Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 23:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
General
- Target 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
- Size 3.7MB
- Sample260810-3jdchsbb95
- SHA256 4e5d621922379b984c526b37829a75edec6660fe095c2bf4f5706c4bebaae335
- MD5 c36e6cacd01f977d0f3e1abd10691cea
- SHA1 d68604d13377f8249e1070bd3cdee9070a3e2933
- SHA512 6ff7db64ee0848c00414e378662d7f60923ac508f4921069fb1e04787f0497d7af31fa34f44cf70470a6c816c017aa8ea187d69fe4ecc1f0c83818ebd6fc3088
- SSDEEP 49152:HIbvKPkz+jy//XJllqk8PA0KfEslHyNkJmzQPm6YgA0uG:KLlqCZTJo6YgAn
- TLSH T1FF06AE1277A882A4E2FA9178D416DA59D630BC990334A1C765F43A7B7F3BBD18D3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 4352 elevation_service.exe 3204 elevation_service.exe 5628 maintenanceservice.exe 3828 OSE.EXE 4796 PerceptionSimulationService.exe 1140 perfhost.exe 1404 ReFsDedupSvc.exe 2416 SensorDataService.exe 5264 ssh-agent.exe 4532 AgentService.exe 4300 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe - Drops file in System32 directory 41 IoCs
description ioc Process File opened for modification C:\Windows\system32\AgentService.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\vds.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\locator.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\5cc5c5b8b05c2f27.bin elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\javaws.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7z.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies Control Panel 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Control Panel\Colors 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036b090c82029dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cb0803862029dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000428d43862029dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c37e49852029dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007827e8872029dd01 SearchProtocolHost.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{BC3444D4-9179-4E4D-AA98-E4C0AC13AD07} 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe - Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4352 elevation_service.exe 4352 elevation_service.exe 4352 elevation_service.exe 4352 elevation_service.exe 4352 elevation_service.exe 4352 elevation_service.exe 4352 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 820 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe Token: SeAssignPrimaryTokenPrivilege 4532 AgentService.exe Token: SeBackupPrivilege 1404 ReFsDedupSvc.exe Token: SeRestorePrivilege 1404 ReFsDedupSvc.exe Token: SeBackupPrivilege 1404 ReFsDedupSvc.exe Token: SeRestorePrivilege 1404 ReFsDedupSvc.exe Token: SeBackupPrivilege 1404 ReFsDedupSvc.exe Token: SeRestorePrivilege 1404 ReFsDedupSvc.exe Token: SeBackupPrivilege 1404 ReFsDedupSvc.exe Token: SeRestorePrivilege 1404 ReFsDedupSvc.exe Token: SeBackupPrivilege 1404 ReFsDedupSvc.exe Token: SeRestorePrivilege 1404 ReFsDedupSvc.exe Token: 33 4300 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4300 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4300 SearchIndexer.exe Token: SeDebugPrivilege 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 4352 elevation_service.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5820 2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4300 wrote to memory of 800 4300 SearchIndexer.exe 101 PID 4300 wrote to memory of 5732 4300 SearchIndexer.exe 102 PID 4300 wrote to memory of 4776 4300 SearchIndexer.exe 103 PID 4300 wrote to memory of 2576 4300 SearchIndexer.exe 104 PID 4300 wrote to memory of 5180 4300 SearchIndexer.exe 106 PID 4300 wrote to memory of 1376 4300 SearchIndexer.exe 107 PID 4300 wrote to memory of 200 4300 SearchIndexer.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_c36e6cacd01f977d0f3e1abd10691cea_akira_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5820
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4352
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:3204
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:5628
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:3828
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4796
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:1140
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1404
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2416
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:5264
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4532
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:800
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5732
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3056 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:4776
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3016 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:2576
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5180
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3056 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:1376
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3016 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:200
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 2f09c1138e53b66819e5abab506f4e3f3db79d0b8d6923ba19ed37dca2002902
- MD5 0fb802ed148b56596800be0106b6b51c
- SHA1 c4e2f30576ecfd0003167f2de386311315d6e2fc
- SHA512 43aac1b91cab0ea22277b5f24b34a1343dcf1b62567b21c86ca75457caf487b11216eb5824b08664549bea23b1060e560feb068290035584874ab6a3b6a441a6
- SSDEEP 49152:cb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnczQPm6YgA0uG:G3q6sjBz6YgAn
- TLSH T1C4D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.6MB
- SHA256 c72ec365c3c135b24e80fbd4a424df4395819a34a65d35372e4ab93ffc6a6ea0
- MD5 13f147d4833f2d3d5a3cac300ceea782
- SHA1 98943dbd2eb8c6d63e2021cf57cb669c5ddc2a6c
- SHA512 c550796cf9e5e1294ce1d7bf14f1e3de9d586425bcd8f7616160d8d2799a4e7f3003974580f1c32f62a1eeb1c02d42b8077bff24bcbc78a767a3f803baffcde6
- SSDEEP 12288:t1XLsswWkxy2lRq2czA3xRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:DXYfDtczA3nzQPI9hAH8CzQgAqvuG
- TLSH T179750129B3E409F9DD6B827DCCA28911EA73785047A0E79B03B489754F332C85E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.9MB
- SHA256 9443abe26c767869acade6c390f9d44d0051c0718bd9414dabe965b3cc365a2f
- MD5 717fb8bdfd40dc7956ec4755de036286
- SHA1 8c379ccd70b2da1beeec95b3c6ea8ab5c0ab07f5
- SHA512 e1287175f62c353ebb6d281fbec75a6ddec4e4d21118cde14f1c34d90623b6a4c4d48f2ac1e3e87739c1c8109180131a7c9b8966d78196fdab7849b98b079c72
- SSDEEP 24576:r0Le5ji0hmxsrM8nzQPI9hAH8CzQgAqvuG:rPji0AKhzQPm6YgA0uG
- TLSH T18295AE16F6748371D073C0B9C5D2A69AED7230811B308ACB4296D77C7F67AE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 341dc193a7856a447641cd420c767215736001565cfe5845bd962c89c8b410d9
- MD5 46d8d8357e122f18c42d51f4e759ce23
- SHA1 bd80583c0c63dfc5756852af4eebd68065f4a151
- SHA512 066a4229352b6a5972be800a93c89d22806366dc65ed29c8629068f1e9affd5ec91028f4ec2e36773eee2147d8af2a49a766675894a686432c70f3403da43757
- SSDEEP 24576:Ca7/ezSC6vUyD/aqgrvWn6q8wyu2nzQPI9hAH8CzQgAqvuG:l/ezSC6vUzPveHjy1zQPm6YgA0uG
- TLSH T18A756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 df94c8e86bcca52d1f88dd6cfe42442b5ae116264963cd264b106568dd4efd69
- MD5 61ef836425a261e0858da9d29d20166b
- SHA1 c023bf75ea634a33228ec1c3ad4dbad3bdfb6280
- SHA512 715bcdcf9e989a7982f574798a7f98651eaac82391ada2c493b68082e226cfc8830a97962734969e75599dbce6941bbe84d108dbab4c2ce34c5c5db18454e64f
- SSDEEP 24576:yVbqPb88hv/l+Y7nzQPI9hAH8CzQgAqvuG:yVO88hXl+azQPm6YgA0uG
- TLSH T105559E66F5B48331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677D6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.3MB
- SHA256 2552c0aa58355c1fe821eb07806e48b6d2d8e29dc8e7097de00d4bd099ee1f25
- MD5 54825ec35e3123ff86363094e9aa8d76
- SHA1 f462812f3e7173c9e162ed79ef4334593f92b4ea
- SHA512 506b42e85082787a6a0c0c20b4ae0ffd1a16033466758fe7d802f1c31f5393e129b3772305acc3d36b51b8a6cf75eed8166493253a506da2101e2587eb4bf18b
- SSDEEP 12288:VfwxRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:VfwnzQPI9hAH8CzQgAqvuG
- TLSH T174552347F59805E5DF5F0BB2587B5FE2087D8DB43BC0A76702322DA68E7E0C4E946292
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.6MB
- SHA256 556af3c795d6de56023eeb753a559db1ef52a3136d5075ae523b2b47472a854b
- MD5 a4e65de184894dd101a53158e51a236f
- SHA1 ceb42e02d48b58cd233824d746f4ec13554aec8a
- SHA512 554e648c470cf506158f9a02709a89dc9efbd23cf97edd7b729f8e9ff94efa3359bdd6134e206a7738b8b91f2780183d34b25c5ba82e12c424dcd97dc7536ac6
- SSDEEP 12288:teBNUbTVO86UzxRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:tJIUznzQPI9hAH8CzQgAqvuG
- TLSH T1BE75CF3BEE28FCE2C67E4DB95A918740977278704B51A3CBD135820EDE235E05E7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 773edcac9458a824f5f205ce95625c5a454716c75edea203bf59c860499ea2fc
- MD5 84b59844f36f31e1076a27263975406c
- SHA1 665515720496b773578a3d0b0ca01a5fb1fb0f6d
- SHA512 5b4c797b5b21e06aa1843e6d6bd901e4625ea61737252e8fd01f26c93250d88c17c402cc65114719a4b27d8fc28300bdfa5a71bb0ed21d05539a2b93d180befd
- SSDEEP 49152:1QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THe:1QvGAdlCEL8c/DRNw5Ck6YgAn
- TLSH T131267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.7MB
- SHA256 bb321e06026eabb49ae8185acae3f721fed4dab4ab76e70eb08aba23f28df061
- MD5 0393db79ad17db8e70a32ee94eb1b2a3
- SHA1 c992fb9f32438a7f9354bdb2e084ba8c2d6d18df
- SHA512 2e047bbb5bbb3c2135a10f38c785ac54dce05a620e7fb2842f15b5f9f4fc008289eb35eeb25ce7299416795cd58a05dccc01e42c1d7121173b544fc7e8b8ec9e
- SSDEEP 12288:ZAwSfxL/2Dc3FDLLmt0LDQewsAjlxRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKow:KwewsAjlnzQPI9hAH8CzQgAqvuG
- TLSH T1C685E031FA74E436C77F0DB21B36CB16187DA9204B912AC3E3B84D9E59342D22776A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 666de05d5864352882f42664584bd1e4d51b3ae3cd2b864a25f152b244c74356
- MD5 b27d8b3aa199b38a06e92f5abc929b18
- SHA1 30a7f8afef73883f7dd23b9dadd35e25e505f104
- SHA512 c750ced27c7e58494c1664183f160e758f1644346c59d56a984f3eb692987f18a41b5c76a17891d34095971344178252242dad8efb51cf9650748ece3001ce80
- SSDEEP 196608:oUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHkp:oUEtQevvqc2W1cpV2tI32kp
- TLSH T1FB474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 f9dcef28bc5b6abd742e753053fc2b1ba6741de1e796163174f10a2187d0b2d9
- MD5 9644bf967a053f9c42a183df74bff87b
- SHA1 be7648bc3efce74f8ab093172eee626b79749b12
- SHA512 7a00dd10e8a6c3682dbf7b7e14d18dd25326b470b6d8af73389a3c669aeda6fbe4b6aa3b50920f8e9a1e77c9de7278c49db105d075d5f5dc9a34544e7b52a4d7
- SSDEEP 49152:7CbRquA/m2yL5zTfFiV+XenmE3/zRzQPm6YgA0uG:koquVjnmI6YgAn
- TLSH T147D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 52d8be157eacb24c2c510dcace256801a0926557f1a59d4becf84cefc58d62b8
- MD5 36b0983e64d2f84662a6b8acf7e5aa44
- SHA1 602a968ab9c343c8e149921b60a760a40a0891d5
- SHA512 844bd8569e74d6ad62bd462219328bb40fb0ec917c792b91de4d2a49138ff2cb8fc6892d73ce68324b07615d717ff16ecbed343845603732d1ff141f8db25da4
- SSDEEP 24576:0AhGL3IFoiwtA5l7S53SnzQPI9hAH8CzQgAqvuG:0AMUFoiq5WzQPm6YgA0uG
- TLSH T15C359D81E7F945D4F5B3ABB899B68571EA76BCA55E31D20F2120D11F0E33A809D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.6MB
- SHA256 3c51e0f50d5d46480500b92e2ef08cd00fe10bc190199b0bef95b7abda835aa8
- MD5 fe4c3d2f240fef140a5789a4f0110f32
- SHA1 6e7f6cdd3f4f5f133d354077d43053c63aac0172
- SHA512 a4c3646ae6f122b5423b27d1bc0ca52ed452b554dda28bfa3f944c9947848434fbedce6c88ba34292fae209f4b00f1b28b1ce3a2ffcc162cb475c06d4da20279
- SSDEEP 12288:umw5HEjsChN5BFgl0WDm+CWxRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:nwucOWRnzQPI9hAH8CzQgAqvuG
- TLSH T18E75F14A76E80CF9EA6B42398557C632E7F2BC112B61D71F0360C65B5F37261AD2E720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.4MB
- SHA256 851000e4c82085cd1503f171d96ace1e228221947079ad1c1f624ab987f90d9a
- MD5 d9b09abb807d6a7dc2d338450e7beabc
- SHA1 6bcdb4b5160f1d395a86ff14ccee178cfa0168a5
- SHA512 b30bc76cdb463316938c45af83625dc96412bdd28459731a32f15a35ad8576094be1d073254d6a4e58efb3840da4f57ba3fddab81e4d8219e4e3f7623ae03afa
- SSDEEP 12288:V6Z1Iy1xRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:UZuUnzQPI9hAH8CzQgAqvuG
- TLSH T1DB65128A72E821F9D6AB43798CF64B8187767861377193CF023106A65F37AC16D39322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 862f637b571545c1cd33dbffe93ee724166afbac13cdf1ca3e34907da2fce8a8
- MD5 2069e6ab59fe1cdaec8fc31c32568df0
- SHA1 abb9c4be5b0cb5d608469f3381f6f14f19c750eb
- SHA512 37057eb1bf4ed867454f32378ee50fbdd3bcc8feeabe524c3c935f79d291c8b28ecf28ccb862f95c6ea2b6428ae164a8437c032a390302e5d5c9af82e90af0d9
- SSDEEP 49152:+j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UK:NQRQyi36YOcPbLvw2gAf+PN3P6YgAn
- TLSH T13E666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 5b74218212336d58e3691688b48bbb59efa68e5c59e06da2152054f87a7dbf83
- MD5 7b37424c013fce52d46c41360f22d445
- SHA1 9e3ea4bae7ba2ce91d1b5141d7d79f7dca433b86
- SHA512 ff511bdab60717b3a2f3556530ea07daf3c103ac1d1167e1fdbe9a85e009a674c4169052894c42485b11c249d857a182dca448180fd061b3388e9208c904f47f
- SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UK:QQRQyi36YOcPbLvw2gAf+PN3P6YgAn
- TLSH T1CD666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 2ac3a92363b3e3e6e9f4aa8f0126a89e1bb5c4ec62b882633894e816194b2bc9
- MD5 b8fee0125616604a239aacefd86ff846
- SHA1 c1d057f444e7f6eb672abb487ab85ea8cd5f7bae
- SHA512 bcf8bf3dead894db0cd12cc8c352e636094322a5a8322ff9aa3e5a6386af0a6413569e9759ae1e338066c6ec9a3d027446830469ac8717b1edc56ea581ae489e
- SSDEEP 24576:9wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0EnzQPI9hAH8CzQ+:568Qg55nhceWu7PNU3/hzQPm6YgA0uG
- TLSH T15EB54933B2F600A9C44DE1769F4A873196D27C758FE0E3DB851172161BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 b8bd4d20addd3a8ce1d92abf16bb34438335721336270713c9d12be5193d9f22
- MD5 7bdbd8f69e1ca2746a827995761e24f8
- SHA1 e6383c72966a08bf39a680b09778341963b2639f
- SHA512 73b07494c63905da3ffd6d6ebb09f2f2703411c7af6a447b4b4a9e9bbf471ae1353527f2fc7dab4e65f43f5a3228810d935f4d4401d7ed9d4ca2383bf45be5a2
- SSDEEP 49152:y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99o:Ty5112gYy5azzVvt69nLKnhZa6YgAn
- TLSH T13C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 0dbf53150f883c8b7b8b0e43e61e17ba3db03bd3c66c4ee0f403471ac8987391
- MD5 8c0097642ec81dc6b9303674421da3c4
- SHA1 b02aeeca8749225d3777fdca9e0b0cb49598a5dc
- SHA512 9708d8198a84e9fca4908f97cc134f7248dea79271eb340fcdcca96572048105be9b5315ad834864426a0c2879fba0c4122eaeb88db2cc6a7f611feb23aa49eb
- SSDEEP 49152:CB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glnzQPm6YgA0uG:wu6Jmdxd2d36YgAn
- TLSH T196D59D13F1D901E8D06ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 1ed4891c3eee1db28b0b5a2dede812c18f41265b2023cc9ee31f81b801e9d356
- MD5 2752315c50af15c5127d96a5fb57a4f8
- SHA1 f5a6be7ed55438c1856fdbab096b4244ae8c6b65
- SHA512 8f430c77978fca60ebd002563e1545e67c21fee9e764f749f27ff15a888019edd77a760d0bea2081764af49ef3a35a0b45afeffedc461c347244e6e726dcabfd
- SSDEEP 49152:41hpsNoJpF1A63U44CwH7R4x7zQPm6YgA0uG:4mifPWRI6YgAn
- TLSH T179B5BE13F2D801E8D06ED17887569632EA72BC450B34B6DF0A90B7961F7BAE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 c4c8e92e1fc65906c92f39df6fb01d29b980fc72e3ceee6cfe39bff414440965
- MD5 7c5bb85b2419e4ae40ee24ef77fdbcea
- SHA1 4c8c9daeb1bddec2a624fb08f2130eab2a3e73ef
- SHA512 f4bb01dbf09a6b153e138dac394858e16758f26f4537797bc4cb82cd372bd800b0e05a2e05d136093b9a7792dd4159f836ce85eeb2d1a5d7f5921b47a31b5c5f
- SSDEEP 49152:eSuZQIY0Be2KcRVtOnks6NMHqszQPm6YgA0uG:w5dKii61G6YgAn
- TLSH T13AC5BE03F2E901E8E0BED6748B669632EA72BC464B34A6DF064072551E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 d6c96e3a3ee88f031a8fa889ca0577344d186991151dac7861f083aa4dc0eb67
- MD5 30bcf65763c3b08a2f2e7b11fe2ae71b
- SHA1 e8b00b23bdee191a7f9648bff24af92fae0bf196
- SHA512 b472df869baaafb53cc01e4f1579054d773e20a9afa4b5dfd4afc70470138d029258ccb6f65fff7535f794f5f6f2e57e572ab9c9794ed4270e3b4b43c53fdb8f
- SSDEEP 49152:RhtSn8EApI0fig3giDn0AP5w3zQPm6YgA0uG:AX2imphc6YgAn
- TLSH T1C795BE13F2D901E8D05ED178C7568632E962BC150B38BAEF0A50B6561F7BBE46B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.3MB
- SHA256 a5f187587a9f4f780e8a1d070fc79316328780a10a6a52683f6b5617c79c07fe
- MD5 5c73fb915ad27d30eac4884ad2f00d59
- SHA1 eafdf1efce9a7c06f2d980a2d3bb1dbac432c520
- SHA512 148ada6b38b235cfd8167a715293e73b4244c050c32d7fc4e8828f213b9ee6b5b3535c592100f51fa5a5d9814a9b071b2a8af17428ff795def56274112744df3
- SSDEEP 12288:0oxRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:0onzQPI9hAH8CzQgAqvuG
- TLSH T19C55234AF5E80AE5DF4F0BB248675FD1086D5DB47BC1A36B123318628F7F5C8690A2D1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.3MB
- SHA256 5ce92bad6727f7bb3c44b3cebdd6a8da4c7fb3240ad88275031e14f99dbc4882
- MD5 93a3322a1090e619ef734cc92d59a10c
- SHA1 ccf7aec45927aa5af4d21f2f70ddc8e729c09913
- SHA512 a77ff1e6660f48e4bc63b6c55ff10150023dbc57d18c36173f11ab348693be8a9f5a3d1316fb0575a5319f148b1c9df1d20f8fe75195eafb141aa3f0cd52057c
- SSDEEP 12288:l5xRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:l5nzQPI9hAH8CzQgAqvuG
- TLSH T1FC55234AF4A80AE5DF4F0BB248675FD1086D9DB47BC1A37B133258628F7F5C8690A2D1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.3MB
- SHA256 ad911206e3c4850864bb235597248a0a9d7a9b7c7e517fa0e8deba82d10336c9
- MD5 c3c904b13f1876ff954a7a73845c297e
- SHA1 e7dbd657d7fa66851358856fccbfd45099eebdf1
- SHA512 e4ac7cb14179083ad9c9a963556851f4d2bbaae0d0ee831487df7e716b618f6026747dbc888dc058a473454f15e5ca227f02c87ac5e1727ebee0d777926a84e8
- SSDEEP 12288:lrxRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:lrnzQPI9hAH8CzQgAqvuG
- TLSH T1FF55234AF4A80AE5DF4F0BB648675FD1086D5DB47BC1A3AB123318628F7F5C8690A2D1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 c80d280c006547f5ef6029795ed9c8c0bac581d2a0dbc439b196ae6f45979f08
- MD5 7ea3ad45559dec11a29ae222173f2023
- SHA1 665149db4277dc15590b42c6d4369f66335ef8bc
- SHA512 04c705a4a7a09c2c2b2826d293fc4e9310c5dd0a6c2e95ba90c10cacf7ebf7567f113aa95900db007ea2dc924502158e777a83011e15c2b64e575439db9e46c5
- SSDEEP 12288:mVyxRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:9nzQPI9hAH8CzQgAqvuG
- TLSH T13F652346B6A802E1DE5F87B688374FD144BDBCB47791A3AF032208A64F7B2C4BD15791
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.3MB
- SHA256 f092f4bf339fc15aae77a19befe20785b9311488afc7ae56e8027b7221297c32
- MD5 130d5eb9060ab7796565a499bdcd06cc
- SHA1 1ddd8a66e5afd3b6da833cbd4289f63fe117ba7f
- SHA512 8324e805011162da7d9dde61d992b8f5cfab7a494f90108ad17779943f66b15648cf0c0013569ce37bc02b7c238deddbbcddde8994ac944b31c6adef7d6fa6dd
- SSDEEP 12288:IaxRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:IanzQPI9hAH8CzQgAqvuG
- TLSH T19355234AF4A806E5DF4F0BB748675FE1086D5DB47BC1A3AB123318628F7F5C8690A1E1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.3MB
- SHA256 3ca8ee7246e3902fee6a06834532e49a1332957f6f1362a61bca16e9ad61ec9d
- MD5 9e1d6f2b10fa8134bdb563a490f60da1
- SHA1 e62261e65722f7c470bf63db21a10f4f316060a0
- SHA512 b7fd91a1ecfe1fbbfc4ee1a3634d131cfec5af17a254a432eeeb9b1fdfe63b5cad7335e0d1a63b8511376af3b2fc6c33063f62686b3a8bfd59a0e112508790c2
- SSDEEP 12288:z9xRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:z9nzQPI9hAH8CzQgAqvuG
- TLSH T1CC55234AF4A80AE5DF5F0BB248675FD1086D5DB43BC1A37B123318628F7F5D8690A1E1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.3MB
- SHA256 9a425f7edfb7b94760ec4965ce06d7b85924f5f9f8860727b1272b12f0b8b6e3
- MD5 24e6a89709b9837d69378f228547ab3d
- SHA1 73f092e586b68d3b49f74806230da045108fd6db
- SHA512 16b609777083f3946f05a0fcda5919716b57aa97340fdb5ebd337b1e8092c858a2d9b5b61021dee030849bea1689e34a1a52a2e154cfcb52ee01d0cae7748ec0
- SSDEEP 12288:ZBxRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:ZBnzQPI9hAH8CzQgAqvuG
- TLSH T11055234AF4A80AE5DF1F07B248675FE1086D5DB47BC1A37B133358628F7F498690A1E1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.6MB
- SHA256 ede630380949aeda67bd281dcb852600c9691d774720bc7a44b4520a84672d4b
- MD5 95a2678cf0cd6133d3902089dd795f71
- SHA1 258429a12736a21a9416567411b3e35c248252fb
- SHA512 c2d82e29a00d62c07956907688023458bf689fd742ced0965efd08dc62b193ae8b96e4c18e79dca31c1591a3b49056bbb7a682be9c3926402875da8fcb59e608
- SSDEEP 12288:ciZwbJzzFEoS2cPvyZxRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:/ZMNzFVSOZnzQPI9hAH8CzQgAqvuG
- TLSH T17E750195B39008F8DD67823ECC268E52D5B27C691BA0C61F03B436675F373911D2EBA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.3MB
- SHA256 956ce78a13733944bb98fa641f38832b13cccfa128bdcda78f37fed5a4f9a1fd
- MD5 c90ab77eb1dcf448c4e38a51a1edaad5
- SHA1 55a82f68e8c4d1d84cbdcdabc1e1bbad8d9e718d
- SHA512 04dd747e93bab4dfd8668f97f38ce536d835edda6dab03577c009ef32a23487afac0f55907446986f58ecf00149c1a2a3d06fd26af68a5457cdbeba4842fe309
- SSDEEP 12288:1kxRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:1knzQPI9hAH8CzQgAqvuG
- TLSH T11855234BF4A80AE5DF4F0BB648675FD1086D9DB43BC1A3AB123718628F7F5C8690A1D1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.3MB
- SHA256 7047f4dbf7a36a0ad01d178393da13117281679fb1e52ad001b08eafc28e8131
- MD5 2f51a949c4d6971854a8a51d7d1faede
- SHA1 4809be6f30554e0f9864de14622103e44fa010db
- SHA512 bb6c79e9c26e8f2ee2f05f0b192c58c9b9b15bb012f7e53492bbcca08f4429a421cc5c6289f2b95e2ee2b48ff883a47abd95f77f0287c74cceeda7a926f4832c
- SSDEEP 12288:9AxRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:9AnzQPI9hAH8CzQgAqvuG
- TLSH T16755234BF4A80AE5DF1F07B648675FD1086D9DB47BC1A36B123318628F7F5C8690A1E1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.5MB
- SHA256 c96f1f2b109f073d802483ea8952c15b934de3d8dbcbb3363318119f24a1f79e
- MD5 d4d546e0ac4e4f0111e6d8187c602c46
- SHA1 dcc6387304f47a098698830c10bd7e459134174e
- SHA512 90d5aa217f5bf734f4afae9c298aec91c12f155d0aefdca290deff1a87f8befac85b3bbb829efd4cc4fb94ee830b1184557703b3dfc21116d1784941a89a34d3
- SSDEEP 12288:0yPz5L81xRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:tzy1nzQPI9hAH8CzQgAqvuG
- TLSH T1B3650247B2A421F9D56B8339C8631F82E776B87117609BAF136006765F372D0AE3E760
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.3MB
- SHA256 79efbe2e7768d3271e32926c822ec5eb4ae60d918d8dc046834946b68377b793
- MD5 df22b9c35f9794b23ee347188cbd5a15
- SHA1 c351422406da514d6f66e1a2899f26de0ebc3e7a
- SHA512 fbaf2888ce29a1cefc48caf89c369ee8bbefd964e3c1e64df2dcb770166786967098456c0c975efdfe379a823449aef3514d62d885f5433fc27ebd36798c8404
- SSDEEP 12288:akxRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:aknzQPI9hAH8CzQgAqvuG
- TLSH T19855234BF4A80AE5DF5F0BB648675FD1086D9DB43BC1A3AB123318628F7F5C8690A1D1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.3MB
- SHA256 1e1609737c3a283d39bc0d2aabfb5e52ea870707d306418945851dd2f2f3b454
- MD5 2f92fb115debeee99a5b30754252ecc3
- SHA1 68f8afcf2d34cb0e247213d82fa3d6faca758ab5
- SHA512 3ed87fe330bd20bf79ef1d9dd129d24d61465446b7469a64d5a041c34e0428d03860dfcb4e88704504367161b7e769e4dad18360e5ffd7a0d90ef3bf8a341d8b
- SSDEEP 12288:nkxRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:nknzQPI9hAH8CzQgAqvuG
- TLSH T14055234BF4A80AE5DF5F0BB648675FD1086D5DB43BC1A3AB123718628F7F4C8690A1D1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.5MB
- SHA256 900c0885498f30125be3891bf2598f9940df76ee3158b630cee2d7f23f977254
- MD5 bf10528d3a04c3c28d30773e2d2dd81a
- SHA1 a72265d9993eea09a433b43a8e55034469b4013f
- SHA512 b3678d99e5d5cc5beee18a46eabaa6e09db0dea75b21c10fbb071480374a09664fe7b7f6c536fe62901440c3dafef55b0e1f2b004ad9a534dc8029ea382cc649
- SSDEEP 12288:LyPz5L81xRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:mzy1nzQPI9hAH8CzQgAqvuG
- TLSH T135650247B2A421F9D56B8339C8631F82E776B87117609BAF136006765F372D0AE3E760
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.6MB
- SHA256 f3063f92057d087ec0cec933b8f74d987fd9c4ee2f7e0ed356b5b9e0041f0e77
- MD5 20092df6a310c31b78030492d26cbe69
- SHA1 9da8ba002c50170f30a5b4e5f6c11538770ea930
- SHA512 657b633e8087cc4018b33024f377dc563eff875b8e3b4d006550e24e25a00da7c9589548dc8d4c2441c501954b739ad4c078bc0c6311ffddfcecb3646a1d0e5c
- SSDEEP 12288:UCd9mWYoaLHF3z0z04PDvhbxRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:tTvaLl3z0zDbnzQPI9hAH8CzQgAqvuG
- TLSH T107750195B39018F8DD6B823ECC268A56D5B27C6917A0C71F03B436675F373A01C2EB96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.8MB
- SHA256 cd5180212e5242503b9ace9de19a9d1859f61c75e92e7eb77fd71539c2603e80
- MD5 898b7ae674a8681763d159806aefdd4d
- SHA1 bb7593002f1fe15fd87404e72f26cf03aee05ed7
- SHA512 6f51f0ecec5c66a0dfb8ecb23d44541c3f78dcb038f88e970b04ea4101ac4fa8889783190631bd6f2adceabcee0d56a2155b6aaf5e92878cda602127594b85d7
- SSDEEP 24576:/3bd9CHKy7GZvnzQPI9hAH8CzQgAqvuG:Pbd9CHKyapzQPm6YgA0uG
- TLSH T10185CF90F3E414E8F1B78A358C764612DAB67CA91B71DE8F03A4255A1F336D18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.3MB
- SHA256 f3f1eaae5b1e566813e5ff49400a2af2644f5e067a64509bbc551daf579b20c6
- MD5 bc341570f84242ea98fcb3f88afa2ab7
- SHA1 42b9f876f0f9360f7e8eeffe05f47a44d6b8fbeb
- SHA512 6b8a23252b8d9a9f8e699144e9f2b1248ad48b67e9243e598bd4c9e8bb1bd599f8d4410e700c0f4085ff977e2a04765dfcb84845bb0fbde14961d70d968729e4
- SSDEEP 12288:2LxRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:2LnzQPI9hAH8CzQgAqvuG
- TLSH T14B55234AF4A80AE5DF4F0BB6486B5FD1086D5DB47BC1A37B123318628F7F5C8690A2D1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.3MB
- SHA256 6093385900117138f4db580ff2037bf30ce735b1ae72f50b4fa1c2eea27bb7fb
- MD5 416b76c560ec619d14da30821fde63bb
- SHA1 eb9e80a8d80c57ba68ef98fd8a76e14b5d363448
- SHA512 c4dc0e700f48244e56978d400965d9cfe6ef176556838ddf3c64cfdca6ad86a6deecde6ad8752b1cb2460ceae5520f0d1912b436b1b65c0cd8c408b7a01ce63e
- SSDEEP 12288:lVxRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:lVnzQPI9hAH8CzQgAqvuG
- TLSH T18955234AF5A80AF5DF5F0BB3486B5FD1086D5DB47BC1A36B133318628F7F48869062A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.3MB
- SHA256 bd6e04fa42161898a77db063f2876d945b38098d4aad3ce3fc70d7fb721c2353
- MD5 2a992384a7a860669933deb1d11b27ec
- SHA1 c8a72fa20a6068aa6ee75706352d76979cfba7e5
- SHA512 79d5232cdfebad3d4d90f5513db809a2cdd39696aa18afdf62ec400923b9dcea26e71aa8a31d042db55693cdecb03ae9bc014e97f9068c50283662d62a4188eb
- SSDEEP 12288:gexRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:genzQPI9hAH8CzQgAqvuG
- TLSH T11355234BF4A80AE5DF5F0BB6486B5FE1086D5DB43BC1A36B123318628F7F5C8690A1D1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.3MB
- SHA256 6cb2523d3b4337505935ea98eb1fb0c19f73f83ca31130a8fadb8269edd07c46
- MD5 32a7b68c448128fe088dcc2b38b3a69e
- SHA1 275083b346f08281a2b9356dd71066fd59be9db6
- SHA512 1337129f8b86636d3746f52b242320bda09190b8715006c490444a45da75a274151e56dfef49787476e6f1c2067880be055e75cab5dcff8c596d3522172a3759
- SSDEEP 12288:xkxRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:xknzQPI9hAH8CzQgAqvuG
- TLSH T11A55234BF4A80AE5DF5F0BB648675FD1086D9DB43BC1A3AB123718628F7F4C8690A1D1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.3MB
- SHA256 66d713bb23604d1764de4a3168b30d81a699ddfd9a54102412b7b072c55843ba
- MD5 c921edb3d5f5e795c68a1163b02bd2e9
- SHA1 496a9bb2c5d4ae7f5e4e2120fcf3384e4458a173
- SHA512 fd43a668f875b27c1a1be4b8c83a7e82c4f93612fed6789981b8c20d1b54e19c5ce14d41c93bd699c5555b3f2ac9baa65c5ef0a8b80f65f16b6d145344534ceb
- SSDEEP 12288:TLxRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:TLnzQPI9hAH8CzQgAqvuG
- TLSH T1EA55234AF4A80AE5DF4F0BB648675FD108AD5DB43BC1A37B123318628F7F5D8690A2D1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.3MB
- SHA256 ca3a57f02f57197375cab73ee94ae4b7e67ece7052d2547d0871bf996b32c337
- MD5 8513b00a6b3f852940191930605f9a96
- SHA1 6bdc4abeda7128e6185c6b0c8e4999ff1994a0de
- SHA512 c0a90b77d552885e99d05e19ea048093ea85984a5e53d76bdaff0c910a29d3a49ac329e2a4ebc3df839a2eedfab5bdf8769aa375b73baa2ed95a64f6b0dcd0c3
- SSDEEP 12288:asxRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:asnzQPI9hAH8CzQgAqvuG
- TLSH T1CE55234AF4A80AE5DF4F0BB748675FE1086D5DB47BC1A36B133318628F7F5C8690A191
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 1.3MB
- SHA256 f65de3b06c2004d2da8132412ef3941cba629d8ffb808eceabbd2864595670dd
- MD5 1f392a88f545e7e05861e083fd5d6caa
- SHA1 a0271740396e5dfc80cdaac3c93e4fa3b78a911e
- SHA512 2d2d134479c6964bfed8181f5976a3cb36949f808f0cd8d6070517fe220d7367321c8ab59ee23171c45e2bde2e704825a1e36206525f25af4e13f9f2259f5745
- SSDEEP 12288:0axRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:0anzQPI9hAH8CzQgAqvuG
- TLSH T18355234AF4A806E5DF4F0BB248675FE1086D5DB47BC1A3BB123318628F7F5D8690A2D1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.8MB
- SHA256 127fab3a0ef3e2bffbb028db40cd4f1d2096a8a59907cc71db172c891da86a87
- MD5 c8cd786b39bf1f360cd1dd5d11f6c636
- SHA1 01a9a154e6236d6203709413574c51cf86a8bd72
- SHA512 48695dd124bdf377d42872ecf7caec7b3b080547b11c85b463170d8faca0cba20c62e475660543ca41810c73e4e5fa978aab70b0e5ab92169bfba6edd4a89401
- SSDEEP 24576:Cfwvhk9RX6wkyAIQnzQPI9hAH8CzQgAqvuG:3MnYIgzQPm6YgA0uG
- TLSH T13185CF29EBDC04E5E177923C89B7464AF6B178691B31C2CF025A53AD0E37ED46D3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 293e1c7cff4c95dcf65e6998e509c7a3e8a848734b6839e2d6fad6582ed8f4be
- MD5 94654e8ade8113685d6ae881f8401421
- SHA1 b621808aaa4fefcda9fb2ad0a5f11c45c72a4582
- SHA512 47334d34f12cef3753218ba5f24b05dc5f72d4ae9a8b60d1b7a197c5adf8e3b4ab4dc4784ef5808f49f1085a1d3f5c685503fe4dd6c475d54cd147f7a69f4f66
- SSDEEP 49152:1YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0XzQPm6YgA0uG:4ySzPv6YgAn
- TLSH T1B7066C56A1A801D5C1B9C1B98F1BCC17FAB134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 ba118c99dd9aa08eb25555e68457580e8f82b6e1b4550f9f7348f6b32f87b15c
- MD5 d07a5df36836b86cc49d582a927c1e62
- SHA1 cc452b1faea94dc69116b48408ddfe914ffa2c36
- SHA512 cbbb2ba6288d98f63dc831b02420d1eeb65d17fbab0b5aec7c72611fb47defbb69a7cba72d1237c1632aad1f8a0e354c91293fff6a0a96f54cdcf8c584586bcf
- SSDEEP 24576:w47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYpnzQPI9hAH8CzQgAqvuG:w47JUQjTirIhCnDHUPfF/nzQPm6YgA0V
- TLSH T13A65AE1EA3EC01E5E1BA927885154A5AEA71782D2F31CACF1270837D6F23ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 11e8b6de0dd4ad8d33eb2df8d8d374cd1d0a7965e4052d085b14694e2aeda5e8
- MD5 c4bb82bdc017d8c5e4717a49d1881d3f
- SHA1 3e9a0f2ac8b9f2f6b0f05e4306f6129967113870
- SHA512 abae61c342afe300944cabd7eeceb3247126efbfbb2f1f8fdb7a513dca369a3f20a486f06ba3371fb5ac49daf06176f3059b89e9f79c80ca9aa4df83348e84e5
- SSDEEP 12288:nPsfUxRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:2UnzQPI9hAH8CzQgAqvuG
- TLSH T11D65F10AE29802E8C56E5276CB564A81B3377C6457E1E3CB13D0F47E0F7A590ADEA743
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 d18b8a46af08daa4ad34e3f37491a6a1783ce73847d332b228b3e07eb1d0f4bd
- MD5 f662682d54b2e9ade8857ad17bbe335d
- SHA1 2f5ddf0eb8704876ed9cf981f7431e1b0c011e4b
- SHA512 0be224bca323a8a393e9b3c533f627954a988e8ab6d16798f8d6529984f3a407a8e3780ba6a085f2d5296e77357a449171b7732c2323cbfb2a0ff1e6d517d448
- SSDEEP 12288:1fuRUKDU3faSUFup+mOST56+3nCW2m+Qo0X7FRRr4:1fuUMUPalFuBOST93C7m+jw7vC
- TLSH T1A9351801766ADB5FC6AD40321E32D1CCA7707D11EE05AB0772C88B3FD576669BAF1282
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.4MB
- SHA256 f06e56bcda0fcbc1dbf5f7b605c07748875601bd0d0545e9e20b10502700d43a
- MD5 550000388a11f7246d3c9e6a6389024a
- SHA1 20b2421b97fea056bbaac6c0b4b2c8a50399457f
- SHA512 5f759e84df0a6e13402fb8f355127a68db086d099a5e48f41dd07643667e059bf741056306697061fd5e12f692080d0d1c3afa4b6d3c04180e67117fe176e29b
- SSDEEP 6144:K78n6oxAScGU86ElwffPeC3tMxvVC3tMxI9/xq8vYUJybd:K78n6OQE4fPCRhR
- TLSH T19365C6809537B3CFD1F76031071A5B4CABA4EC07B7456F26A3C9443AD82AB65A4BD3C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.3MB
- SHA256 7284d79e68db825a244ec54aa6636f6d02bccaa0a72430d52ff913a16e3493a4
- MD5 6a0fde86cccafe4ec91446209c66e6e7
- SHA1 1c7e91049f7bc2192db3d86d5638d567edd28336
- SHA512 7df8e8b5373d628de882890f6a5e50883362d3f01b033cd512cb311f7e5a54097c2798cd063746c34e8daa99b64b547f10203fc71e61c32ce428a51c96db768c
- SSDEEP 12288:co7cxRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:lcnzQPI9hAH8CzQgAqvuG
- TLSH T169552347F69C09E5DE6F07B1486B8FF1142DAD743F80A3E7222219A18E7F5C4AD25252
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 76f570cb3d12f6d7d69c41fc7e30a290bba35b17b6068c0129544e4868d42468
- MD5 73a89ef8551ddfe9f74deade8e8c2e03
- SHA1 7c500dfed3bfc572ccea8cb4e084b7c3639435c6
- SHA512 2514b17ec237c2cfc4294f00212e7a28ef70f7640bbe7fe59aba6397e234ac0928bbca3c1cb9985b704d6e6ad0b1b5daa750e8b1afbe1f8d669a6ad5d1bd744c
- SSDEEP 24576:4gb6bmBIi49WNNFpg1rSvFv7bY2nzQPI9hAH8CzQgAqvuG:4gb4mBIBhGF9zQPm6YgA0uG
- TLSH T13365AE1E22EC02F5E0FAD2B88DAA4417D6B278161731D2DF1151427D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.9MB
- SHA256 181b2893c2b6d1cd1b55171b21c26b99a35f1de70ce6eec1b1ea3e5b2399c76e
- MD5 4137f5ad461e891d5a5fa223b829c56a
- SHA1 cd10ab1e218034d0cc0e7b7fbcc4836cca1698ef
- SHA512 abc5a146ffcb561a4cf46ffd4da24e6c55b5195d6380fc54b3957c1a400f53ffd144cd4547333c423de77f0ecef0e077c8a387034b6939e301240fea080572e9
- SSDEEP 24576:uG88u8FpJqH1Hzria7/mZnzQPI9hAH8CzQgAqvuG:l7ZFPqVaa7/azQPm6YgA0uG
- TLSH T1D995F165B6E001F0D47BD13889474BA3F6B2B8251364FBDF07A88A511F23AD54B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 496b43a3850b11399015ba8594b2bbf0988c69da1394f6cf1660975ff15a2a53
- MD5 c9cfdbb5260ebccbecb68325041ad2cd
- SHA1 ba919c29340aa5cb31e1c51f2409510f784581b3
- SHA512 7bc46f72f71f3483dbd26c8f3fcb2262ab1e54d692d16c186d1134d5c44d9f9ff6db5fca605a4d50fe0fcae010fd33eb13a49ea11700bcd5f2f40874c26bbfac
- SSDEEP 49152:nBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjZzQPm6YgA0uG:YG05lO43by6YgAn
- TLSH T145D5CF6E62EC11F9D1BBC17CD9C64A0BEBB23825032556CF02A486A91F27FF4597E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 04a5c623a8084f5c19363816f15e57ee202de9a24089fc7cf7b4ed8ee5a54d57
- MD5 d9c12075b7c2b83c1ea740d1f6cbad0e
- SHA1 ca32e2fb23046732a6f16cf247ad6c6f5b3af005
- SHA512 a724340fe49f428a3571dd4704e43a6bbe6b09c9e2ca0a6e380a040021c87820355630110875d1916636df3fdee6fa87b1e41e629199c0cbffd9bde72355fd25
- SSDEEP 24576:Ifa5POZ3dpuWVM50JicR2hG0lasx2+47eidnXnzQPI9hAH8CzQgAqvuG:wa5POZ3BJt2pasx2+mhzQPm6YgA0uG
- TLSH T13965BF5EA6FC01D5D5B9D17DC5838A1AE5B1342153319BCF022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 de98b95cbefe3f64e4fa9b63e8beb0da2d80b406cfe15f40e3e499db4d869fde
- MD5 3ae64eaf30cb98ad49e6d253484951fc
- SHA1 1ef00b8a21fe45b55a6f80a2406cdb12c9349e6c
- SHA512 c2631253ab84a4fe7a298b7a8c1c554ff5f1fac8d571b6f108878179a3fab7f96e0e7403f5ce7ebc76bc8cbe697ad7851aabb60f996c9418147bad1363606393
- SSDEEP 24576:BNcwHdjbyQ4nLC18lb/EOjowL7FkxnzQPI9hAH8CzQgAqvuG:BNc/zEOVHF6zQPm6YgA0uG
- TLSH T13D858C1623E901E4F5BBE1BE89779A46FA717865133086CF0291851B1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 6b3740a30ba0bd05f2908ade2f32dc24c9c50007d5a202ce2dca0723f2e5e48b
- MD5 46f6d13ca23c55f653915452acbe14b3
- SHA1 93534c4519b61aabac802adc93db4891d1ee8961
- SHA512 4f5177d22b9e0cfab777a0d1b05e358d76de05aa43c2cdfe1cc71270d071aa1bc20ae977f8a7f9b9b9034463a3c66f8c4e37a95adf033aa63d2139d32d84c6bb
- SSDEEP 24576:NTkNvNnaFeYhJNtmZBmDnzQPI9hAH8CzQgAqvuG:NTMwBtOmrzQPm6YgA0uG
- TLSH T10555AF6EB6F806E4D1FEC6B58D238512EA727461173293CB5290C13F0E679D89D3AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 67348234b7da1edf11be1d66853edc3f3d9da5ccf9618a01f5f70eaca38ef984
- MD5 ce7fd89552aa198623780679342fc1a1
- SHA1 18e7608772debd782c29433243e014225dfa9701
- SHA512 5385d3a94fa4f38acef4b5af0a5c36deda3905fc882f28cbb4a76771a76629dd0430e80760849db87fb485b66c5c0cd980116c610b674efd7ace91c66d73e9cc
- SSDEEP 12288:4HvUrBFrEjwaQNxRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:4PUr+NQNnzQPI9hAH8CzQgAqvuG
- TLSH T1B975F11F62EC18E5E67AA17D89828759E771B8621311E2CF02A1817E4F77DD8BC3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.7MB
- SHA256 8ce9d57d5236708a87ddff9bb655b64bc0a4aea7f49ca9d48a2df4f8079b5001
- MD5 15165ade0c5f4c14f7d325357ee7c65f
- SHA1 7c48ddc0acbb699666ff636a5f9312ea5ece1cf5
- SHA512 67449145992ea3bc71a6be705e912fc012c8f9b0160ada35828c048d224f405e5819219ab35e72b6b3616c7a17ac0f3ce6d724eee22dc2348d02daf07ce4426d
- SSDEEP 24576:8D3FHshBIYQgAInzQPI9hAH8CzQgAqvuG:8DVHeBIAAozQPm6YgA0uG
- TLSH T1C185E27EE69C04E4D57BC2BCC9638A06E67138B8032166DB029481B65F6BEE47D3DF50
- MD5 SHA1 SHA512 SSDEEP TLSH