89a11725dfa82fe7ba56952e4593e851343ed2dc12b323d727040bd9ca2ed7ca

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 22:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
Size 828KB
Sample260825-18vxrawyby
SHA256 89a11725dfa82fe7ba56952e4593e851343ed2dc12b323d727040bd9ca2ed7ca
MD5 bbb5f60692e2a24904acc2ce8745937b
SHA1 a0a42cd860d5b05309d9b65954f8faef42f7b7f0
SHA512 4bb4076136fc63a8a64bf317159b4851336d967d35dedca1c62a62af036fbac233123ceb69de5d98dd673bfd839951fc41ec6a84d16526961c2842208d055eae
SSDEEP 24576:2CSMa1yKSHx73c82R7VpWBPnmyjHBldthWFu0W:gPBUx73c1UBfmaHB3Ou0W
TLSH
T13E050117E21B50FED88BC4B58707A422BA61FC4D8760ADDF17949F712A72ED06739B40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence ransomware spyware stealer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
55	6040	msedge.exe

Executes dropped EXE 11 IoCs

pid	Process
2788	elevation_service.exe
2592	elevation_service.exe
4336	maintenanceservice.exe
4420	OSE.EXE
1592	PerceptionSimulationService.exe
4792	perfhost.exe
5648	ReFsDedupSvc.exe
4584	SensorDataService.exe
4424	ssh-agent.exe
5204	AgentService.exe
2996	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe

System Binary Proxy Execution: Verclsid 1 TTPs 1 IoCs

Adversaries may abuse Verclsid to proxy execution of malicious code.

defense_evasion

Verclsid

T1218.012

pid	Process
4932	verclsid.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\617429b9c618523d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1544141429\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\zu\messages.json	msedge.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_561288226\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\offscreendocument.html	msedge.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4348_1543112539\_locales\zh_HK\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6040	msedge.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321700101577130"	msedge.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f9fa27dedf34dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e0958e3df34dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003323c8e3df34dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000093f51a20e034dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{64190AB6-1945-4421-B367-EEB296FF0E9A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2788	elevation_service.exe
2788	elevation_service.exe
2788	elevation_service.exe
2788	elevation_service.exe
2788	elevation_service.exe
2788	elevation_service.exe
2788	elevation_service.exe
4420	OSE.EXE
4420	OSE.EXE
4420	OSE.EXE
4420	OSE.EXE
4420	OSE.EXE
4420	OSE.EXE
4420	OSE.EXE
4184	msedge.exe
4184	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3036	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
Token: SeBackupPrivilege	5648	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5648	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5648	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5648	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5648	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5648	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5648	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5648	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5648	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5648	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5204	AgentService.exe
Token: 33	2996	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2996	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2996	SearchIndexer.exe
Token: SeDebugPrivilege	2788	elevation_service.exe
Token: SeDebugPrivilege	4420	OSE.EXE

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe
4348	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2644	2996	SearchIndexer.exe	100
PID 2996 wrote to memory of 1104	2996	SearchIndexer.exe	101
PID 3036 wrote to memory of 4348	3036	2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe	102
PID 4348 wrote to memory of 4540	4348	msedge.exe	103
PID 4348 wrote to memory of 5604	4348	msedge.exe	104
PID 4348 wrote to memory of 6040	4348	msedge.exe	105
PID 4348 wrote to memory of 5604	4348	msedge.exe	104
PID 4348 wrote to memory of 5604	4348	msedge.exe	104
PID 4348 wrote to memory of 6092	4348	msedge.exe	106
PID 4348 wrote to memory of 6092	4348	msedge.exe	106
PID 4348 wrote to memory of 2092	4348	msedge.exe	107
PID 4348 wrote to memory of 716	4348	msedge.exe	108
PID 4348 wrote to memory of 2092	4348	msedge.exe	107
PID 4348 wrote to memory of 2092	4348	msedge.exe	107
PID 4348 wrote to memory of 716	4348	msedge.exe	108
PID 4348 wrote to memory of 716	4348	msedge.exe	108
PID 4348 wrote to memory of 3192	4348	msedge.exe	109
PID 4348 wrote to memory of 3192	4348	msedge.exe	109
PID 4348 wrote to memory of 3192	4348	msedge.exe	109
PID 4348 wrote to memory of 3480	4348	msedge.exe	110
PID 4348 wrote to memory of 3480	4348	msedge.exe	110
PID 4348 wrote to memory of 3480	4348	msedge.exe	110
PID 2996 wrote to memory of 5460	2996	SearchIndexer.exe	112
PID 2996 wrote to memory of 5860	2996	SearchIndexer.exe	113
PID 4348 wrote to memory of 3528	4348	msedge.exe	115
PID 4348 wrote to memory of 1960	4348	msedge.exe	114
PID 4348 wrote to memory of 3528	4348	msedge.exe	115
PID 4348 wrote to memory of 1960	4348	msedge.exe	114
PID 4348 wrote to memory of 4808	4348	msedge.exe	116
PID 4348 wrote to memory of 4808	4348	msedge.exe	116
PID 4348 wrote to memory of 3648	4348	msedge.exe	119
PID 4348 wrote to memory of 3648	4348	msedge.exe	119
PID 4348 wrote to memory of 2940	4348	msedge.exe	120
PID 4348 wrote to memory of 2940	4348	msedge.exe	120
PID 4348 wrote to memory of 2940	4348	msedge.exe	120
PID 4348 wrote to memory of 4668	4348	msedge.exe	122
PID 4348 wrote to memory of 2980	4348	msedge.exe	124
PID 4348 wrote to memory of 2440	4348	msedge.exe	126
PID 4348 wrote to memory of 2440	4348	msedge.exe	126
PID 4348 wrote to memory of 1076	4348	msedge.exe	127
PID 4348 wrote to memory of 1076	4348	msedge.exe	127
PID 4348 wrote to memory of 4640	4348	msedge.exe	128
PID 4348 wrote to memory of 4640	4348	msedge.exe	128
PID 4348 wrote to memory of 4304	4348	msedge.exe	129
PID 4348 wrote to memory of 4304	4348	msedge.exe	129
PID 4348 wrote to memory of 5188	4348	msedge.exe	131
PID 4348 wrote to memory of 900	4348	msedge.exe	132
PID 4348 wrote to memory of 2492	4348	msedge.exe	133
PID 4348 wrote to memory of 4620	4348	msedge.exe	134
PID 4348 wrote to memory of 4620	4348	msedge.exe	134
PID 4348 wrote to memory of 5148	4348	msedge.exe	139
PID 4348 wrote to memory of 5148	4348	msedge.exe	139
PID 4348 wrote to memory of 468	4348	msedge.exe	140
PID 4348 wrote to memory of 468	4348	msedge.exe	140
PID 4348 wrote to memory of 4184	4348	msedge.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_bbb5f60692e2a24904acc2ce8745937b_akira_cobalt-strike_glassworm_satacom.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/vs/17/release/vc_redist.x64.exe
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x220,0x304,0x7ffa3b70c188,0x7ffa3b70c194,0x7ffa3b70c1a0
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,7823895417335397416,7800512204971651345,262144 --field-trial-handle=2312,i,11624524718392711687,14912799695491021090,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
    3⤵
    PID:5604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,1673410886215998997,11811985935716931771,524288 --field-trial-handle=2312,i,11624524718392711687,14912799695491021090,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:11
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:6040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,17963564100255350531,12478665626426274718,524288 --field-trial-handle=2312,i,11624524718392711687,14912799695491021090,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:13
    3⤵
    PID:6092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,8722885652722692390,3531469283910670271,2097152 --field-trial-handle=2312,i,11624524718392711687,14912799695491021090,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
    3⤵
    PID:2092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3648,i,6174756732337270379,1730287839474417388,2097152 --field-trial-handle=2312,i,11624524718392711687,14912799695491021090,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
    3⤵
    PID:716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,13701097367747285882,14883851037289812638,2097152 --field-trial-handle=2312,i,11624524718392711687,14912799695491021090,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
    3⤵
    PID:3192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,2654902726604730126,17190230924125426256,2097152 --field-trial-handle=2312,i,11624524718392711687,14912799695491021090,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:9
    3⤵
    PID:3480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,14798902031320653119,1079364043561840845,524288 --field-trial-handle=2312,i,11624524718392711687,14912799695491021090,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
    3⤵
    PID:1960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3816,i,11057304247938181967,5323571559253166997,524288 --field-trial-handle=2312,i,11624524718392711687,14912799695491021090,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
    3⤵
    PID:3528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,3795929747402095797,433476753722306877,524288 --field-trial-handle=2312,i,11624524718392711687,14912799695491021090,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
    3⤵
    PID:4808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,13290694427395137203,13575275386563106526,524288 --field-trial-handle=2312,i,11624524718392711687,14912799695491021090,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
    3⤵
    PID:3648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6204,i,5288294033834492493,7681064198419220072,2097152 --field-trial-handle=2312,i,11624524718392711687,14912799695491021090,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:1
    3⤵
    PID:2940
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,15452505176879472098,9628575806677488547,524288 --field-trial-handle=2312,i,11624524718392711687,14912799695491021090,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
    3⤵
    PID:3448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,10370760029274738781,16028014130755490182,524288 --field-trial-handle=2312,i,11624524718392711687,14912799695491021090,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,15452505176879472098,9628575806677488547,524288 --field-trial-handle=2312,i,11624524718392711687,14912799695491021090,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
    3⤵
    PID:2980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,11218614727338566219,6808911363334983614,524288 --field-trial-handle=2312,i,11624524718392711687,14912799695491021090,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
    3⤵
    PID:2440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,3594367207917093900,14445277144865969803,524288 --field-trial-handle=2312,i,11624524718392711687,14912799695491021090,262144 --variations-seed-version --mojo-platform-channel-handle=7184 /prefetch:14
    3⤵
    PID:1076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,1992080485227933449,9017616849912538771,524288 --field-trial-handle=2312,i,11624524718392711687,14912799695491021090,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
    3⤵
    PID:4640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7612,i,13384077319187357566,9749917689819513426,524288 --field-trial-handle=2312,i,11624524718392711687,14912799695491021090,262144 --variations-seed-version --mojo-platform-channel-handle=7620 /prefetch:14
    3⤵
    PID:4304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7124,i,15358919725540695832,8470844897354318179,524288 --field-trial-handle=2312,i,11624524718392711687,14912799695491021090,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:14
    3⤵
    PID:5188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,13073263117609863088,15213634177556809902,524288 --field-trial-handle=2312,i,11624524718392711687,14912799695491021090,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
    3⤵
    PID:900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,10048748859810161707,8397512754584439376,524288 --field-trial-handle=2312,i,11624524718392711687,14912799695491021090,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:14
    3⤵
    PID:2492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,1792599443118828417,1430629994249026317,524288 --field-trial-handle=2312,i,11624524718392711687,14912799695491021090,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,8932694915639589926,16927119909709045456,524288 --field-trial-handle=2312,i,11624524718392711687,14912799695491021090,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
    3⤵
    PID:5148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,9719296597839214862,8808911888057858047,524288 --field-trial-handle=2312,i,11624524718392711687,14912799695491021090,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
    3⤵
    PID:468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6372,i,8189682948590896507,16793010358657946612,262144 --field-trial-handle=2312,i,11624524718392711687,14912799695491021090,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4184

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2788

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2592

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4336

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4420

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1592

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4792

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5648

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4584

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4424

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5204

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2644
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1104
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2716 2728 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5460
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5276

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {9E175B8B-F52A-11D8-B9A5-505054503030} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:4932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

System Binary Proxy Execution

T1218

Verclsid

T1218.012

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4d7ecce50b1931e0c06feb8f8195ad6d934d13303285b401d941a91e8f65154b
MD5 b503a4e728298b44d39500d677d3cb75
SHA1 37248887fcb81a54f528bf07d641787fa40ceb10
SHA512 fb6422ba5f006a455607702946de226d4af93322a49d7d837bd01bbf239f8fa26f245a1cb4a111b3ff5d8019f4255ca84939b1e51f70e76b2f136af4dec72536
SSDEEP 49152:Yb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnW73c1UBfmaHB3Ou0W:y3q6sjBJ73fVmah3Ou0
TLSH
T112D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 33b87ac2cb35ecb8f4c8186473cad3e68cbb1be226dda09bdf385dec0aabca15
MD5 0dcba758aff18546107d6e91c7c5bc88
SHA1 fde231101e2a4b06ed76dad095cf486b50571c6d
SHA512 0323fe525aee99414f3a11f7cb3566f7d06824e273fc72dc14e937c041b00340a74b5e18ab77bc81bb2e382ea5f407992c7f17f24647a035eccb7480da16785a
SSDEEP 24576:CXYfDtczAN73c82R7VpWBPnmyjHBldthWFu0W:Jtcc73c1UBfmaHB3Ou0W
TLSH
T13F05012873A409F9ED57817CC9628511E632BC964360E7DF03E49A7A1F336D81E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 ad2cf67d30647878d0f7227db1298fbd3269029b3ef58bf63942071dd3a07c78
MD5 23095a9bedd55f7613e3b8445bcc001d
SHA1 3301df70033bbf0a2e8d723c5384e603137a3e45
SHA512 bb784b502e32e16279e1482acd9470e3c2c5f9a85a40355815833987868cb94254762fbf31365427d7efe95936db48a0c6b02498f77661848d0ff1bfbeb0aa3e
SSDEEP 24576:50Le5ji0hmxxrM+73c82R7VpWBPnmyjHBldthWFu0W:5Pji0Aj373c1UBfmaHB3Ou0W
TLSH
T1E0359E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c16242fbbf1e2d23ae2f24a0790cb1aa1d815244178266b7fd82bc28ac978181
MD5 a98b27645924b0569ceaeb6783ad923f
SHA1 859d6c85aa8da17ce334bd3b046154dffa0285d2
SHA512 02b19d88e504a7110c79293d3f2eacd1d2a90ed851eb4c169fc08b21b398db359cc63271cc6c7d0cd0a1579bbccfaa4edcbb7a3224c640a77dc5a64013c0ec46
SSDEEP 24576:za7/ezSC6vUyD/aqgrvWn6q8wyuM73c82R7VpWBPnmyjHBldthWFu0W:e/ezSC6vUzPveHjy773c1UBfmaHB3Oud
TLSH
T155756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 bb4e89e5ca9f42c53a4f4ede640805eb3a80d44df20fef9ee040df65fa7954f3
MD5 1882a79f50e815bc3608053193239171
SHA1 e84e9271efee06588c2db80d1b05757a73517d22
SHA512 0afc05db9857d239ce4564b821da14dfdfbd6346f1eed724ff04112a615f73a09cd416e4a767de780b7890477d6dc811b4e2c2cc359441e4ca8b6fd34bd466c5
SSDEEP 24576:kVbqPb88hv/l+Y573c82R7VpWBPnmyjHBldthWFu0W:kVO88hXl+E73c1UBfmaHB3Ou0W
TLSH
T1AC559E66F5748331D073C0BAC5D2AA9AEE3234424B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 3dcc812a3a677330650ffe4f2c99eda83981dc7360cd7be2df342c2489b78dad
MD5 ec6b3ef7fe8e68dd775085ab696a16a0
SHA1 80196831898d909a60b782e7c336ce567eeb319c
SHA512 a5654739fff41f0afd0ad7267f466ac5d3b516852053449ee1d80de28337777b1b647f0bfa5189b4f97e4de0e521686a07782809c2cacd9aaf5cf989eb0b0e2b
SSDEEP 12288:3Lajvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:3La73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T13EC4231266281231EF0BA0B0DA171611F154ECDF80960F9FE59D7BEE277CC94A9C7E89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 272491ea4e7728de2aceb5dbea9b485e424ced3dbf8e7133b277a2728e89fcc4
MD5 6681f1e08b54d9a34f2165f40eae73d7
SHA1 0b9dde70cc74370dfa6f7279dfb9b3c451531c03
SHA512 293a625a052fa3fccde5b347b0bdfd8ebcd26c16c2829a11a87b93df0a8004472c22307ecb532dfad81ed6042e0062416e91c1c248a3d30b730ac99af63c58c9
SSDEEP 24576:0JIUh73c82R7VpWBPnmyjHBldthWFu0W:0JIUh73c1UBfmaHB3Ou0W
TLSH
T1D805CF3BEE28FCE2C67A9CB85B518700E77278714B5293CBD165830E9E235E05E7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 cbcc4aab92a44b42fdd7842c913332aed5402031afb2fde1cf855e0e0cb47499
MD5 c957db654181874c2deae14176372a49
SHA1 c672a357fa6d865eaca4658cf8fa40c18322bc24
SHA512 0aebef7950d8ffe69105f70ec945335740aab4dc1017125451bb3343bf0b455d9e31a6224c0debcecfe0ce8ec7f24bb2a13739f3d734a60d2f04ca33da33c592
SSDEEP 49152:FQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH1:FQvGAdlCEL8c/DRNw5C873fVmah3Ou0
TLSH
T182266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 09159e8dfdc4fe0cb884da9aeb11ea6a517607c7922719b99418222515062112
MD5 746f9e2193d8e7f7b351a4e91b735779
SHA1 3214b30e3a915d2cb3a0c450c412e0ece4044162
SHA512 dd89c32847dc5b74f0322db07ae3ccc8594d8d408dc0a544c76c3a55936bf0e01c52bd581433f88155d4850d364e1eff718ebb5b0045d1df49e2f5f73d18f086
SSDEEP 24576:A0ewsAjn73c82R7VpWBPnmyjHBldthWFu0W:lljn73c1UBfmaHB3Ou0W
TLSH
T10B15E031FE74E032C77B0CB21B26C716542CB9604B621AC7E3E89E9E5A345D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 bafce20394c0502cf68615d800828e7004950ef1f0f15f68b389d851316ed739
MD5 f3de4827ab1a878215a4ffde066e281d
SHA1 4a3bc10f81c4cf624b9b5b28b1eec3aee3bff770
SHA512 97f4b59827cdbe4401ff5780d31ad8fcee0b1402e65288549630a23e2ba5cf0cde162270013f58735dc72aa1e7f47c92fb8d8ee5b4ed25922b7dccced2e06f0a
SSDEEP 196608:bUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHDfVNh370:bUEtQevvqc2W1cpV2tI327l4
TLSH
T1F5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5b2df44ef37ebf33c9d9ee11dc0e329770a573a3ec1b3e784db28695f7c0afda
MD5 685b737c0eba7f1caf91eee350119d7a
SHA1 c05a76feae0cd70f45efac47c77e24b4ed065a8f
SHA512 ad19ba7bedca19c179b288e00a2d7f8255cb1a5e56754018b2e47ac4c1d2c186016f05d2b7db4ae75593a8cb8c5ede231b43376c7662a5258686f3c359a9ddb8
SSDEEP 49152:wCbRquA/m2yL5zifFiV+XenmE3/zH73c1UBfmaHB3Ou0W:ZoqHVjnmg73fVmah3Ou0
TLSH
T167D58D0976B8C2E4D1F6C37886A2C647F37178154B3597EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 aea51f7c73107473a28ed4330c0d5e3b09c3b9943030f6e2ab696b5965815f91
MD5 470bb2b3a5e2c9d30a26ee920e627187
SHA1 1bd1c2c28958c8e321bc46e29f47dca1d197f888
SHA512 d0c669e10993eb68ff7d5d28a50d5e8dfc168a23f98682761c0dc85c5b27f633cb9973ef18d2503615ef75195a20b6948df33a4d9992f336ccca2fe96095409b
SSDEEP 24576:KAhGL3IFoiwtA5l7S53A73c82R7VpWBPnmyjHBldthWFu0W:KAMUFoiq5Q73c1UBfmaHB3Ou0W
TLSH
T14135AE81E7F955D4F5B3AAB899768171EA76BCAA5E31C20F2150D21F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 90ddbac759853422975ab7ef7d97ea932a867c38821f075a987e320dcbb8686e
MD5 552bc95175fa454a3e14729acaf41c51
SHA1 1231909f53530f174021acec905f0e0baf0c3f1c
SHA512 7e4705801f44e4e4997ee8c35ab9a3eb1c7c25bd02610ab7e66a11605351aa79b0c6d98b4aedddf5b277d57455a42628b57e454bc5e2af07ae5b58a7122b10e8
SSDEEP 24576:Hwu4OWb73c82R7VpWBPnmyjHBldthWFu0W:HwvOU73c1UBfmaHB3Ou0W
TLSH
T1A305F14672A40CF9E9679138C6578132F3F2BC462A25CB1F1760C75B6F37661AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 cb8aff3c89a2974b10a3253d0506605329e4d1a2e326b1e57de1da74923544c1
MD5 02379bbeab533061d5481b760ecc9769
SHA1 b3f24fd7bb05ed3fc8796599f598c2632ab1f53f
SHA512 d04a900bbe2f9c2b23cee0670837263b82b099a8d3f8f3b2bb7eda43eac6f61c2b0f38f09c59ac68aa0fede83fce07f0d7057afe47b748adc54845f2350f0aab
SSDEEP 12288:seZ1IyXjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:1ZuG73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T118E4120A33A421F5E9439178CDA24601E371FCAB537643CF126957AA2F37EC12D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 3d952228a4b93dd77805a28df2825a9c0006140b2d51a546d04e84503cfa6d3a
MD5 1cfed9b85cd028b2379727e7c348287d
SHA1 2858899c798dab7d20acdbb3293cc0fb15d35529
SHA512 e5c436a3991cd606ab0772d9a5f8657b76450625d26b5de311e5ef0871b2a2800512343c0d1ed435f3905c5a7d87e6beee1ab77cff086c3cc6a7f637974a9084
SSDEEP 98304:AQRQyi36YOcPbLvw2gAf+PN3V73fVmah3Ou0:XQyiKa/X+PNxfVNh370
TLSH
T152667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5d6db09934ec0a2d2316e48b64f880b6444bb0002f22edcffa9127d250aa608a
MD5 910b7d1869dd877e60fadde83a419956
SHA1 98c2e7da3308a263373dfc47700e17d1f84b32bf
SHA512 6a07a16fc34701da70cc653a4ecb2bda8762b762c56e4f2894cd2b5f9e1b3740f9f4ec895e663d236da43918fabd1ece254d502038ec6a8320223321fe6d15e1
SSDEEP 98304:uQRQyi36YOcPbLvw2gAf+PN3V73fVmah3Ou0:1QyiKa/X+PNxfVNh370
TLSH
T1BA667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 0944c2634e3c209de2617b64b1dc756cfc0176ec5dba77c18792ed1714e6a9d5
MD5 63fdaf8a774ad2db1a56e3cb65169978
SHA1 e9d3234392c23cf5773981cecf5a9ee38e17ff45
SHA512 441e7397d6e3177a1206eb063371ead445f0d61ded2dc54fcaf58a5a883f0798501b6e2c600f8f3c06660022ed03b1e6b31c68349e29603171e87e7f78705fec
SSDEEP 49152:M68Qg55nhceWu7PNU3/373c1UBfmaHB3Ou0W:GthLRc/373fVmah3Ou0
TLSH
T169B55933B2F200A9C44DE1769F4A873196D17C758FE1E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8b9286262ab4ba0b119b342e53b6800ed3f513ef8fb8628edea96f40f6cfb1d8
MD5 53eafb4cd200232c41021a4b7d191b01
SHA1 21673dd992aba5f0050e0559cdef4d020ed5bad9
SHA512 70af93b08be0d88510164762eb0d8afc84cb0eb4c7c0e04fe430c23ab57e8bedab26f0e25c21f3c1417d310efb30c4bea4bdea254d74a272a86dc26fbde65f2a
SSDEEP 98304:yy5112gYy5azzVvt69nLKnhZa73fVmah3Ou0:7LIHEWhSfVNh370
TLSH
T1F4168B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c8b3d545aa9230598fc8a57676ecddf988bb57e5b52985e1291b55fd0002f4c9
MD5 a96f2422a6b53725684f944032d9c866
SHA1 d32bdaecf6f75b333a0753182415af7e4bc85686
SHA512 2967208419cf191f432ea3f6aaba4720077463fed9f3c6d11dc9b0f0bf96c7575d20bd635e39ec81ade6999e526317e7522ae8659fac830b027098ffd208b9c1
SSDEEP 49152:eB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gld73c1UBfmaHB3Ou0W:Mu6Jmdxd2dd73fVmah3Ou0
TLSH
T112D59D13F1DA01E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5385d5f9c89270ffdebcdb0a09960bdb3abed19f75d4896885136ff4c9ab3bc1
MD5 dce37d89eea18f2ff12421d3e860ec35
SHA1 7ff502a2d27f1295345edd2835c4533583cb5806
SHA512 3668bcd524bb10493df2b86a80059d2a792e158834b87f31c2d96087d3a3a32f52bee64dbf044d84dc5e6e9961490fc746d7807e658c58c4d15687bbcfc3bf54
SSDEEP 49152:V1hpsNoJpF1A63U44CwH7R4xB73c1UBfmaHB3Ou0W:VmifPWRg73fVmah3Ou0
TLSH
T130B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 18b535bfa1be96bc80ae861345111c1b1a456e6dd5b49dab326dbe133d4904f2
MD5 8c6bc843c19dd0a0f0567dbe3460d42c
SHA1 bd3fa37d8b55414991ad3cd4716c9a11a74343a9
SHA512 7da80f687d440424f0740fb7776addb8c7c5106123300f2a9ed2989cf9e42f0d9cb6569649e5e4b3c85497c83da6c60660557034ef99503a09e0a05df56fdb89
SSDEEP 49152:MSuZQIY0Be2KcRVtOnks6NMHqG73c1UBfmaHB3Ou0W:u5dKii61G73fVmah3Ou0
TLSH
T195C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 46c9cbe461700c1025c367bd7fad2dc2b5840e9f13c08b0fa3d5919d635652d7
MD5 ff5a89ac33e88cf821168af73b32f3cd
SHA1 7b757602f6b2c4d61045d5775e9331265256c70e
SHA512 deb5844628cf65518e990afb3ceeedd1e91e4f8580b8f98ad2fac85d23fea9bfa634b81311c79856a8b1f0064f5e8fc838f0cd32b7ebf31fafc818a011a6c948
SSDEEP 49152:ZhtSn8EApI0fig3giDn0AP5wN73c1UBfmaHB3Ou0W:oX2imph073fVmah3Ou0
TLSH
T11695BE13F2D900E8D05ED078C7468632E962BC160B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 4b53bf2570c9ae40e09972da1b72ca25674633d1d765ddcb6b836dd93bb4ffa3
MD5 a65db8219b87b7945a1665dd2051ec37
SHA1 70016d72d0fd73a817a028b98cdc5a990839513e
SHA512 a88a2683d77e8c45a6189ada3fef1763f52a0c42ea7ee6b10b579d050b444925e861831f8f1b3ac197a55a40365b500c974f279bbc48b8fb530f51e583b91b6e
SSDEEP 12288:PCjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:PC73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T19CC4230675290332ED06A0B1CA171301E154ECDFD19707EFB68E77AA27B9C9529CBEC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 52fa25a13ac604e593235194e63513a790b5575a17fba3ba306c845f3e3957d7
MD5 c11b8b7ac40600b63462da6d0a2d72b8
SHA1 72e0378b219c7e8c95438d90759f35857c534625
SHA512 c307f938a71ab46b74e81b00a74802b27bf940fa7166654ab60c62947dd3d21a79ad3f8ee404f952595b2b22f416f6c2a015f1a233afeb1f59ecfd1656d1aa9e
SSDEEP 12288:XTjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:XT73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T1D7C4231675290332ED06E0B0CA171201E154EDDFD19707EFB69E77AA27B9C9429CBEC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 9cee3a09e742df2bce29cf64afa423c64cdc4414ca29293d7cec8bfda4b2a5e7
MD5 5b1a3180d8ae11eb23b362e3f5d0f1e7
SHA1 b095583f780a80c211dc391ae381b608d33a59b4
SHA512 d15dc444743738de3f51ecfeb18463d66b0d87ee0ef29acebd65e33bf1d200c183cc4128c11c7bb5701cba25126864052559e4983328e2bf4aacf041b2127c00
SSDEEP 12288:MJjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:MJ73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T14DC4231675290332ED06A0B1CA171301E154ECDFD19707EFB68E77AA27B9C9529CBDC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 7bf487825fe90a4f81ece51febb2223b291f8031b906c88ad0077a8da7f74a79
MD5 d3af3e19d94efa092b4e8dc0405859bf
SHA1 97c8d401912594a28d4834b1dcb033694c8be945
SHA512 15a0d9fde9da46282e88b167630ed9ac9161ad426f872a2a7ecd2f50d68866fae8a66882d5a17039c7c19965de3a1fabeb86d871d9e69f4564170c890003f282
SSDEEP 12288:iVgjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:r73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T13DD42306363902A1EC06D1B4CA134211F2B4FCDFD27347EFA64927AA1F75E942D96F98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 aba3a9307d5c03efe6bef7ce234cce04edb9742867254cdc6e8efe074cdbc350
MD5 102fa7bb3e19656c354b48947299743a
SHA1 11fb1a5175e820cebf6f5ccb73a830e222a4d711
SHA512 089963403e7f17546057f1b60b4be2f00b47d1eef604c1007092955af044a626bb5221d4f1af2308477055cfb1c80a0135dfc05660ddefc81800ca506aa09993
SSDEEP 12288:rYjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:rY73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T1F8C4231675290332ED06A0B1CA171351E154ECDFD09707EFB68E77AA27B9C9429CBDC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 6604b8e9e037273433c0e8ceac8cabf9df381881adf496be999b9f820e81dbf3
MD5 cd0c88ee18f3b5d92aadc08bbeb72ebc
SHA1 61f0e693c4482a0eb1619c74f7b4fdda1db95a93
SHA512 d99fa5568e47f38ca396d6caa7900499185cd3a17f0b6e275b6c24a04ac84952a0c9e78f5ddd7b0954144b79b09937aa27607870a17bf517d089f64874bf780d
SSDEEP 12288:Uvjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:Uv73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T14CC4231675290332ED06E0B0CA171201E154EDDFD09707EFB68E77AA27B9CA529CBDD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 7d1cce63fe775200303771c690e542c9b745f6b2e53116f34b15b9c0abf2cc60
MD5 f4151f21ba130a10c29003065f40fca7
SHA1 2cf2de73852704ab397599f532cf5b173a2d8adb
SHA512 4eceb0a2ef4ddb4b52412d47f77b5624e50d268d6536a03566fe156a1fbfe582b3b4ed9843635b1cb26f164a6e1ced2cc96f059a39e8ef81b920a7abe1eac34d
SSDEEP 12288:Irjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:Ir73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T139C4231675290332ED06A0B0CA071211E154EDDFD09707EFB69E77AA37B9CA429CBDD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 ea27b4cb7007c559990b6ab03255c6486d705c3a448f2b896dc2c7d023ae79c3
MD5 db918ead2a557d6ff8f81224a64cb989
SHA1 855de970bef4c1b3aeeeb04427efeb12ae400957
SHA512 a4de17449bd0658b2a7017bcec5f0a05b0a2f09c00e5dbc33ccec759d3ef0612bb27b5464cb4ce4fc473082af862cc2bc0dfd2c87f189226a6250fae046bdd59
SSDEEP 24576:SZMRzFVSOz73c82R7VpWBPnmyjHBldthWFu0W:SZMRzff73c1UBfmaHB3Ou0W
TLSH
T1A7050195B36018F4EC67813ECD168906E2B2BC5A4770C65F13A8366B1F337A11D2EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 e3154e41b2037e8de5decdbe4d5cd220ede135a99410a42541cca8319cbd4d07
MD5 086b8d61c8aec2ae5a9f6d4c44dd846f
SHA1 67ef36d48a65e94e44a6f83e3f1075f492a940ee
SHA512 d46b25363052999bc85c002ca8847e539c97f02edc45d3bef0f676fed9f41a25924350ecce255bdbffe804a4eb405b662d0e30767dadc89bdc9acf8548472d6c
SSDEEP 12288:S2jvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:S273c82R7VpWBPnmyjHBldthWFu0W
TLSH
T1DFC4231675290232ED06A0B0CA071701E154EDDFD09707EFB69E77AA27B9C9529CBDC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 621060c97c949834904caf701c7777fe0c9bce3d7b9d70eda106b9b231eab979
MD5 e81cca40c1342e71291c341d00c03798
SHA1 27dedcff2f401e934380c8e0aefaf300920f1938
SHA512 d3c235ecb89a38b62399b351c30f7f0e719cd0ac37caebcb3659487cf3fe58bf295906068358931660f8674ba7b2a9a9c4509dbc5f2b3cea3212f9ba26787ceb
SSDEEP 12288:dKjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:dK73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T1DAC4231675290332ED06A0B0CA071201E154EDDFD09707EFB68E77AA37B9C9429CBDD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 24f4c5a0daaac78c852d789f021686939470ebb0ba545145c0166c654c5b1307
MD5 f7e46b69b6786bf98ea6fa4dfc16744e
SHA1 9cc159d00953a7718a3695b021c40d2a8cd3f8f9
SHA512 40617d55ecf16fc01f159398a61f4b8953777bbb96ac3f1110abc3aef76e5a43bf0ba6f67a0c5df276607236ab989fecd46d4194c971595ccf4c991cb70927e9
SSDEEP 12288:uyPz5L8Xjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:zzyX73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T19EF4120773A521F9D5269134C9520A02F371FC7B47218BAF53A8177A2F37AD06E6BB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 9a6a1d091699b6c98fb1c5a0286c2c88b4a688fbe10799843fe4743c1eee6457
MD5 8573e8d71eea3e49ef5f3517766552fc
SHA1 ca10874bbb9ed7f2e8f0cfe009d8d4b618b20222
SHA512 8f9b88a50a1a7532800a78439c7294320b252a512f496f13c8a205d78bf1d2eefaf937a0b270a085978bf429595ab2c1461de8f98801521e08df64d0e5fd9ee9
SSDEEP 12288:22jvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:2273c82R7VpWBPnmyjHBldthWFu0W
TLSH
T1A9C4231675290232ED06A0B0CA071711E158EDDFD09707EFB68E77AA27B9C9529CBDC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 f3f485e38fbcabb3253f627004668b76b33fb09bcc533e04d97032bb8ac5fb89
MD5 f4ac2753f9b4cddf7c79273ecf3f5241
SHA1 c5a5150ea04d1bf8419906667cf83d40329b6c88
SHA512 7c5a59143d2325cddc479acf57901164fc52f26dd5e485a281dbe38c6550c0a5a163ecbb21a29f3cb99b6e5e3002d622fb412c88cc226358c1804f0b2adaf2ba
SSDEEP 12288:e2jvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:e273c82R7VpWBPnmyjHBldthWFu0W
TLSH
T15AC4231675290232ED06A0B1CA071711E154ECDFD09707EFF68E77AA27B9C9529CBDC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 eef0627f6d296fd3cbe722408d5b660b326104bc5eeed333f80b0377e406a12e
MD5 6288c9b1392be794f41841b688ce79bc
SHA1 5c8fa1b35ff3c711d614a1e3b48bfad476c54055
SHA512 f92720d09b1f2ad5e472e7c495bff571db0459474cca8444e356891fefb334d42e319cccac8d8e3c8cbdac7629ddf2250ab54c8767aa87a5ae06d4fae1640df1
SSDEEP 12288:uyPz5L8Xjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:zzyX73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T165F4120773A521F9D5269134C9520A02F371FC7B47218BAF53A8177A2F37AD06E6BB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 60454089f744f6776e007ae1b54a50ac11399c9cb6f2fcca26bfc07522109eaf
MD5 f9e554664c3bd952ba8e43ba5f53f61b
SHA1 e57b14b371868caeb28aa91e4b4f8b611b439249
SHA512 66accb3f6a669c97f88fd920f97a3910ed14290c9b5e9dc56ea8cc8b9244d096766a8446781a78feab4f99ac7ee34619b7eb603c56865c25db76ace7ba7b85fa
SSDEEP 24576:KTDaLl3z0zDZ73c82R7VpWBPnmyjHBldthWFu0W:KTuLljM73c1UBfmaHB3Ou0W
TLSH
T1B0050195B36018F4EC67813ECD168906D2B2BC5A4770CA5F13A8366B5F337A11C2EF99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 7c9d2f8b1a723f41d401aa03be4f01e4d4d1a5d8858639177201c6985d5ef078
MD5 c4f1af0bc263ec713f7c554d073efdaa
SHA1 e84a41a5b0563b31d3cef30f4f3ba70cb962343b
SHA512 2c74aeabaca6b9934bd0c8c899bc9746c272c96c65e54db352268fe18ea0ab45faa1909189a8fbee2ce51d20600c138f077cd1ef6a7906137a13d1b0247a7b0e
SSDEEP 24576:W3vd9CHKy7GZ173c82R7VpWBPnmyjHBldthWFu0W:4vd9CHKyaf73c1UBfmaHB3Ou0W
TLSH
T1A025CF90F3E410E4F0B79A35C9764511DA76BC9A5B71CE8F03A8265A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 7a2a2a0cf5e7161d2f28eed2312a9e05a6c615cdec5c662564511a844a5ae8e8
MD5 29c41871652f404c271a2f0605c59705
SHA1 db556449f7bba0b9baa847aaa8d7c728d42042e7
SHA512 8fdff692f2e1ff158a5c8e157ee2469d945e72de0623bd6407a4941c2bf045bf0d2700c5c9e4d45613f3f16a5d4f7f3be30b81f0499c02288f8da5e25f9bba31
SSDEEP 12288:ypjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:yp73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T117C42316B5290332ED06A0B1CA171311E154ECDFD09707EFB68E77AA27B9C9429CBDC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 747e76149787cdf8038072bbb2fdf6e45474c23396bfdbfdaa591408e1fb88db
MD5 941bc5133a1344610ce74614456b2436
SHA1 5e9ba572d922ec67b2d4493e7f3a7ccc6e1e7447
SHA512 15de814efe7e04f9fbf78141e0f749e32ce5c07b2100e651900ce0394d3a4d53f5c2bd71705f1d4911efdea91433554f78501916df749c5ccc0d6d1a9bb77a61
SSDEEP 12288:23jvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:2373c82R7VpWBPnmyjHBldthWFu0W
TLSH
T166C4231575290332ED0AA0B1CA170701E154EDDFD0970BEFB68E776A27B9C9429CBEC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 2b1fcfa21f38d8181e17677786a8c803f4817b0b955d655094f7f1864aba8b0c
MD5 79dc4d143e2d9b3d0ee28c30a8d03194
SHA1 16d147a3fbe11d2ed789b5a3ec0ebb352c0b5d49
SHA512 6266ff2307e866ef06c5a916231fa836dac0ae766ebaaa96a5b4759bcf98677f967ba72033b418c0e2dff86f56a39dc35fcc782da90f2774a00b5c3fa6038c82
SSDEEP 12288:Lkjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:Lk73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T18AC4231675290332ED06A0B0CA071711E154EDDFD09707EFB68E77AA2BB9C9429CBDC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 9a8fa1a174db38c2916dccf5f5bcad94f7800cbf6d13ceef0dbe1f70deb849aa
MD5 573e122d2e8a88985ad29f329ceee049
SHA1 b16fc8fd9a422e6f345c075363cc59a4318311ce
SHA512 660f9a1995cafd1de7b8371c4f8629c1c19c28ffb8a9e8ea457a55b14c79b9552c600110bcf93935c7995194c6f91c26eb00646d704b8a7cd5fa6f86d9dcad9b
SSDEEP 24576:bfwvUk9RX6wkyAI673c82R7VpWBPnmyjHBldthWFu0W:xMnYI673c1UBfmaHB3Ou0W
TLSH
T10635D029EBDC04E5E177913C89B7460AF2B1B8691B31C6CF129A53AD0E37ED46D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 418d6be8884472b4ff4cd0a1f1dd0137e51a4cf9b4d5818c82c9b9a7b4ee1ecc
MD5 9ad110c79c2326410b815a218523fe75
SHA1 7bee38468cdc81e39dd08a936200d87edf5bfd7b
SHA512 c1865f25ebc167d1307276580933973729cde6b6cb6069cf63e55d8f172c0d2e63340d8f298ceae059d9c73b2d5dc152a811d36e206e2df52d3c63632f1f7127
SSDEEP 49152:3YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0t73c1UBfmaHBZ:yySzP173fVmah3Ou0
TLSH
T1BA066C56A16801D5C1B9C1B98B0BCC1BFBB134490335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 415c269fd75da9d4422a9580c42de2dff7c56c5ee454d9c5dc3ecc8cda15125a
MD5 080517e568e8d0289556a449b5b03486
SHA1 0eadb3b9e2342aa9b656eee98c7c50aed889b650
SHA512 b630757b458551ed4c1c4beec432d525e87d3d51e41244d2902c1e85a0995c1b3e93c49ba1cf03c1ed64201deff91c10a2893a9a260375ca03132b1442c3c188
SSDEEP 24576:+47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYj73c82R7VpWBPnmyjHBldthWFu0W:+47JUQjTirIhCnDHUPfF/d73c1UBfmaj
TLSH
T17065AE1EA3EC01E5E1BA927885154A1AEA71782E5B31CACF1270437D6F23ED45F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 e7a546b242fcfcb8dc493a95dca5c82dd79dd9614bc333cb9701bc3bb1f57d2d
MD5 26b8ac147c55c6e61ab0c2b770747a24
SHA1 4fd67ec6f18fd02d4ea35d3edbc1b29280c1525d
SHA512 5abf26da96b77d873606ce54a6573b05db195348c2f2dd0e32992d2c2e800e242bf5f3fe8d552e7dd4f3ebe6a00aadbbce0aa4f5d4e52c1c748d0e55b60bc085
SSDEEP 12288:PbsfGjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:iG73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T154E4F11AD26802E4D45EA175C7164601F333BC6A83E283CF62D4F67E1F769906DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 977e8213e57930dbdfd4a03dca5d9b3fddf64e771fa05d298c3c507c42502525
MD5 6177b682270edc1230dbcb3ef7875a1a
SHA1 af04c83c992d1eb5cb25a780ac417c05df39a5e8
SHA512 e7b5a54d79a4a0bb32532ef8aa1da63dc6442dd8f02568669d1429821edf4d9831fc856c67c968d4dc8f41265a155dc012793add4801ea6ddc0bce29499d150e
SSDEEP 12288:11uyzMU3f00leiv2zZ1PyAs43lTizcyrEBXFu6V:11uyQUPPev/lOzcaEdV
TLSH
T1C9254950762AD75FC6AD40325E37C2CCAB707D01FE059B0772C8972FD576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 350KB
SHA256 2badc61e18ab34de93db042c74f4f6eea5b308bb550a9dd682a2b6cb14439826
MD5 0475411aa1e7992dfb6b3f00ce9c2539
SHA1 0aad67d96de69526e77d1b88ddddfa1311babe41
SHA512 264e5a3dd7a573e922955ffbd5f7559db32b3b7d7f30fcaf74db0a60b38882af8df7304ae863654e225175953dab75b79facbb8052eb7a24bd789e05063a79df
SSDEEP 1536:GT2M1m2VLqauq8XgRb/AeS+iLRCyywvI5hf:u2Mo2VLqaX8wREeaNfyw2
TLSH
T18374C611B714F22AC4B58073D830A6ABEB3DB522CF524B063FD519A9CCF315A3676B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000033

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000033
Size 24.4MB
SHA256 cc0ff0eb1dc3f5188ae6300faef32bf5beeba4bdd6e8e445a9184072096b713b
MD5 486f81facf798678c3244c7cf35a557f
SHA1 21ce0ee54bff57f69fafa741025bf2f15b356405
SHA512 e131b93acde5ffc76c19eb0784183a1e94dfa9fe06111a7830eae3ad8583895575dd4dca66aa70efddb243c95735a0105efcd3042b4b5ca445d3d8e8c39d957e
SSDEEP 786432:mjjpx5hYBug51eEdO41UnAyijgtUHFt9q4YYOQdV:kpx56Bu61eGv1pjg6pb
TLSH
T10A473332E0448026EBE61037A168F5206F7CF624A3649ABBD6CCED0D37B649717FB615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f5fc21a9f182b41b1dd4d3ac2df2023e576a3217754bfd637be6a754b52d94b9
MD5 fff2d00edd2e2778d6630a8f528b3a21
SHA1 30aa700801938277bf0224aefc9ce151d6381779
SHA512 8177b5eeedfb35f9393c2b7c5f1c9377397781ca97cd0ac2b00bce01a742c8fe291f9665f1609daedc10e7ece14f6092ccf44d801f7850c85770964eb358536d
TLSH
T193412DDB4FEDBAF9C33186B235E1055FF3FA82AA410B6F1440432DB0A906F1810D1027
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ebe4477e03a3df5c89e1518321ee59df556468a26ba1d7dcd3d06d709c24c8a5
MD5 19c653070106f686416f01bf0d528d8f
SHA1 02c15ba0d78e3c4b79d8e6d4a02c9d8a01c5ddc0
SHA512 a5a9c3a93df4449b0fdf2c78fcb1fe0fb398f172b531812cb8ee1141c79c2f05e3ef3063b549647edbc925068d777aba170100dbe431f2182b9d9ca599224c29
TLSH
T189319EF783F8853D9A0195F4EA186E1FCE2D0915432C7D96C4E09E2B93E34B1E18099F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f399149d4322391747f4afcf6a9473f9d7c74ba2f28e1e89baca9d14196e8769
MD5 62ca6d3c1fda8d367099de6f0b06ef62
SHA1 fa67a8966803b4c5baa668c387bf5053a35f50e4
SHA512 b2161e8565c0df3a3ee199e327e30ee11d9c952c9bc69be411e6fa42b39261165714105bbf6522b2d4b024a403b7e038bd9f4b8c9b9a61f86b2dac17dd17a392
SSDEEP 192:sxRYrTZ/fisxWsKrjDhzoA8pi/g6+WNIYELiKKGoIgVsJ:sxRY/Z/fisxWs5i/5I6Nu
TLSH
T16F32B7166D28A93B9CC7D21DFB65BF53D6F95033A1D05E48A6FC8A1C04EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7e53f1331df7e1d996fa2451d882a1fbff11b1160da06d25a41c13e554985afb
MD5 051e8f43c1d34947d127b457f81c0912
SHA1 5bf1badd7ba4f3d1aa723a7690c63db9ee88c4f0
SHA512 c8eccc455799c1aca7ff64cde2f57814c62e45bf49e82aaef9616904812ff8a682b4b362a2f086dc036f8e1c7b342ef785f51d7c2a35d7b4e7b265ee097ee391
SSDEEP 192:sxRzrTZ/fisoAssZDczoA8pi/g6+WNIYEeJCKKGoIgDzGu5J:sxRz/Z/fisoAsSDNi/5I3Nz
TLSH
T1A842B916AD28A93B9CC7E21DFB557F53D2F95033A1D11E48A6FC8A1C04EB6DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 43c82d2c097f002c4d70bbe2a39fd78cf61f55562f81822d8fa7dfa73fe89847
MD5 48755838fcdf15aba7a6e8810a696aaa
SHA1 c245c7219612ecde638176adaed30c08873f002b
SHA512 86b5300b389aff1b08bf1b7e48fb4cdc5d0f56e929ffca27eaea297dd173050b6d8bd29e5c7d9d49a00e9db23508ac471c606907d668973bfbeef5cabb5ed191
SSDEEP 192:sxRzrTZ/fisoWssZDczoA8pi/g6+WNIYEpBCKKGoIgDZGu5J:sxRz/Z/fisoWsSDNi/5IONF
TLSH
T12942C915AD28A93B8CC7D21DFB697F53D2FD5032A1D05E48A6FC8A1C04EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 67932cbe14ff3afc23e7cc4e9f80680c0504f35ca712c88b5574c59bec757457
MD5 29b80864adab673e40419c415efa83cc
SHA1 8bc0be76431546dce065d45d7d1f31bc82297c78
SHA512 4b6276fb883c427040a35fa3f3ae986bd3d2fe65f7cdb07cd8b9273586cfad7fa9503ffbcd90199ab2cf151c14e53107b3c61f20441828076eea4a66acbcf914
SSDEEP 768:0UQiKW7pLuL7PaWgH7feQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/OVqEroH6h:0UQiK2E7PaWgH7feQu1jawIqPE
TLSH
T164C2EA7B640C8B7F4F804ADDEC297E9B6DA802CB9698CD8047FE851C03C7BEA51154DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9ef6e244875d48b8a9b76c0fb1e9ba4ccef05fc9e6960d8744fe850656b6b84d
MD5 8a99aaaf723559e12857d403a4cb24c4
SHA1 c258efec760ef5ecc91b184eca264105fde1e5f0
SHA512 fa90b674e3704382ea1636cdf8ac783741a4b60a481c5ff2725c21b8feb55b09fc146df8e9d130c7486edd9c97897a5411216f213540816403028aaf0a9ccff2
SSDEEP 96:KRxOf7JrvbWf8qgjbK4igtbcx50HPoH0VAE+imkWivPgMkK4BgGkckEP+Ugp0wCH:CxOf7Jrv6f8bjhigtIx50HPoH0VAE+iU
TLSH
T144914400717B07417C7EBB0C95B69C1BE681B5627014E42F7BEA4DA10F6AE064EFC9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2b8af4bf-f337-4c79-ad1d-65d488d5979f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2b8af4bf-f337-4c79-ad1d-65d488d5979f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 72844c257be381ce6f0df5146ce7a4fb1edfc0ec83c356accbc392c296168369
MD5 5237166a9514785022130cd460913f0c
SHA1 4f4e83b01ff979e9c928aa3571c97d9b219d19d3
SHA512 4909e03164e36e7294c13e045b26defe7b2edabb1b24835699a352a09cba9b9c5c79f66399c09cda6041258d79f4195eb4ef5bdf6ff994dd4b4171200917ef13
SSDEEP 768:8FQF3MwglBqGwsDPtJK48dHeByERRFzjK3Yr5R5Ys:vF3uEGLPG48dHSyw/t5rYs
TLSH
T1FD038DB1D854DEB7ACE7978ABB427657EEF0016385DCA9D4D6C89E0E00831DE070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4cd9572f93287a6bf613ec572d5089eae1f7272533bfdf09af936d0dceba9051
MD5 daa71999fe1824968e417f4a157a6d59
SHA1 f393025ab6660a4506be045ee3e7ae9159333e10
SHA512 96ae73210f63d17ab3212a99d6fa91f51550e630c55ab11df23097b74ae1745db5aed79ef203f451de17d63970cf2ab383f2863a533656b9dbe947d4445f9956
SSDEEP 768:Qrv+4UNbdf3wqGSGD5PsK48dHeByERRFzjK3Y8eVH1SCj:QbsbJ3RGT5P548dHSyw/uEH1Z
TLSH
T1F403BE31A8A85E734CE7928D76837617BFF4411382D41BA4C5DD6F0E868B4DD130BE2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 62ade4fc9914757087df89c9792752ef7a5c3908daa7ea9b0363ee0514bc7b44
MD5 f204a9588ee2d534d224d31c4fdd337a
SHA1 009f89006de99ed3c347a3a3ce3af5a2a561c335
SHA512 b3c982d9fad1d7ef6de78351401f7ac3c7a527bfb5f4c00dc27355d2e2af9d47aa62a80cc7ac2907b1d247028656169b2f4b00e961dd319fac96a6483fef3233
SSDEEP 768:Wa3wBqGwQD5PtzK48dHeByERRFzjK3Yr5R5Ys:Wa3wEGn5PQ48dHSyw/t5rYs
TLSH
T1AAF2BFB05C599EB35CEBD24A7B433797AEF0412385D86A64C5DCAB0E44835DE170BC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 64c7fab5b12a97a2602203483d994583222535274501c64971f9f800c165e2bf
MD5 f82b33a1fdbf49c54d4d1b6bb27be2f6
SHA1 1bf5785f51c4b4586dac999164ecc536c7e55f64
SHA512 ed864efa6a4ff0b7752b42b3d6745ed84173a8e74badddd7cc96012b38f0056ab82839c4ffed6ede3df8a2192cf989ae7d1b479b3c90c881659480865aa6e69f
SSDEEP 768:Va3LBqGwQD5PtzK48dHeByERRFzjK3Yr5R5Ys:Va3LEGn5PQ48dHSyw/t5rYs
TLSH
T183F2BFB05C599EB35CEBD24A7B433797AEF0412385D86A64C5DCAB0E44835DE170BC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5ade538de4d70524a0cb9553a7120f37c3426fd7217f23a24478e51d89421a6e
MD5 bb3cf44230b6db6ad1c38764a904c0c2
SHA1 51eaa98f93c26e30b88c66764fa2eb451c2d74db
SHA512 ffe44022031e5c86f6996bd74580586b41c2ad28f1fa46eb2cdf11d3b6dd62df5eb92349741fe874bcf43777828a1d8277bd9de73dc2813e00c5fad680fbe65f
SSDEEP 768:brv+4UNbdf3dBqGQQD5PtzK48dHeByERRFzjK3Yr5R3h:bbsbJ3dEGH5PQ48dHSyw/t5b
TLSH
T16503BE70A9699EB39CFB9249B5437697BFF0002384C45B64C5C9AE0E85871DE170BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 cf0ef5664710070ab137637a96f7fe342b677f0921fd568222ac47b1d96c7ac2
MD5 3f328bb0835853b3cf5f2d6839f7296f
SHA1 62151278d43dab3e94a2f9ea08ac2b7e16e3eb46
SHA512 feb93828ed97e811ceb3eb773f6675721b1e3cfe59b26802f1c1800394ffbb73c52b09692908eb305e26d9818155c918499db419a92243d4ba7b85e43d62bc10
SSDEEP 768:urv+4UNbdf3kqGU6D5PtgK48dHeByERRFzjK3Jr5eVH1SCj:ubsbJ3tGB5Pr48dHSyw/y5EH1Z
TLSH
T1E003CF70A8A89E735CE7A2497683765BBFF4412384D40BA4C5D9AF0E85874CD170FD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c11d7348-2a50-44e2-b1f0-fac311be88b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c11d7348-2a50-44e2-b1f0-fac311be88b2.tmp
Size 38KB
SHA256 51e61fd594c14910d37de21f92bc4ca15e869fa6381bf3984782e23b0f28f5b7
MD5 82574cdb83a8ce647a10123c2474932f
SHA1 6070538a27ca34332ce73c0eb03db302eef1856f
SHA512 e61f554cd743ab109c78bb757dff051ecd9f1671104c37ef204fbfc923ef845d20b80c5749f71b2ff7ec6550d1b5f66184b0d12d01c18514209b6efdf085f74d
SSDEEP 768:/rv+4UNbdZ3dBqGQQD5PtzK48dHeByERRFzjK3Yr5R3h:/bsbn3dEGH5PQ48dHSyw/t5b
TLSH
T10403BE70A8699EB39CFBD249B6437697BFF0002384C44B64C5C9AE0E85871DE170BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

69a374b6-d172-41f3-9515-be49ea3f0e12.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\69a374b6-d172-41f3-9515-be49ea3f0e12.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

9df2c8b9-0212-44d4-a069-9aedd62028ba.tmp

Path C:\Users\Admin\AppData\Local\Temp\9df2c8b9-0212-44d4-a069-9aedd62028ba.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4348_1907972646\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 a48e30989c71d40aec15b1414a252483313589d71a01264c18413dfcb0da1d50
MD5 3205ba7a10302a33c5d85a0e073d1b9a
SHA1 1f06654d8d4e28deaf58666a6732154713bda176
SHA512 936ff43eee6bb0b49d622c0b8a18ae1812277218dcd525f183496c9b8596a3791bec53f0e0c7658dc8789dda60a6669a6714ef806441bb539df99b7c92e9e78c
SSDEEP 12288:tz7ejvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:Ve73c82R7VpWBPnmyjHBldthWFu0W
TLSH
T197D42312A3280622FD1AA0B0C51B4221B118FDEF875646DFF54D37AA2775CD42DD7E8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 36344342d17f08c0584a06218c2c6e8f1305fa4bdf88982c01ad764ad3ff1704
MD5 c87b0bca684ad3a05c6f38a20a7f5651
SHA1 0583be5b6918d952929281efcc962fb411028bb2
SHA512 a7de1310dcf309d63b118e6f0141a5ff2591d88fc14f822ab68fee8b1c80a8b37c70800f4c8e2da092f182b03a427f7589f784056ecf62e009f47f836250fd04
SSDEEP 24576:jgb6bmBIi49WNNFpg1rSvFv7bYM73c82R7VpWBPnmyjHBldthWFu0W:jgb4mBIBhGFj73c1UBfmaHB3Ou0W
TLSH
T109659E1E22EC02F5E0FAD2B8DDAA4417D6B278160732D2DF1151426D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 7b122ade4269ddaec721d722764ae73ae816d3a5dea2a1bfdb18fa3dbfd4b0fd
MD5 b5ad4388e25212d6929bd57ee576bdc2
SHA1 9b3b2163c12b6c64cbe9eda6190ffb71be1151db
SHA512 119e8cce7680e3ef7133066bc8dd8e3cca9eccb9fde8419dd0c35816b28ba30038a328c3771aa004a17704af086ff3fa8e63d658499ebf2cbdcc5b8521eb5f1e
SSDEEP 24576:DG88u8FpJqH1bzria7/mz73c82R7VpWBPnmyjHBldthWFu0W:y7ZFPqVea7/E73c1UBfmaHB3Ou0W
TLSH
T15935F16576E102F1D47BD1388A464663F2B1B8260364EBDF06AC8B551F23AE50B7FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 a87d53b562c2e4e2b08289229440b6ddd4e3788e7ffa347d6c91e5f1607d41b7
MD5 3430b1abf9a75d87c2530ba92416ec0b
SHA1 2902b6ce43723e194338c1d4c8091d5ae3479297
SHA512 d29ce4a794eb0e12eb0d0b8d93899fa716ebd3f230afba7c6e4c217605f52c75fe67fd476829e0a7c1d4dc9b8afe58f0d0e1c92ab5a3f12b58cdaa220872acc3
SSDEEP 24576:8PUr+NQf73c82R7VpWBPnmyjHBldthWFu0W:8JQf73c1UBfmaHB3Ou0W
TLSH
T11905E12F22A818E5E676E17D89424719F371B866031292CF02E1817E5F77DE8BD3EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 d5309f2d513494d3d70f2b03d3b219b26f2a74748bf6cee8b9764df79d5d04d8
MD5 3569d0f270bd125fc7f2460de98a2572
SHA1 66261446d869e46c318ee5e65b94f8472ae668ca
SHA512 acc770c61c9651af3912b613e8cbf5122def90490664962da5b4d0ade67cb13e46baf62a32630909cad05fc8e85d8771e756c3ddb4cb6abb228d0938ec2090fa
SSDEEP 49152:CBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjv73c1UBfmaHB3Ou0W:NG05lO43by73fVmah3Ou0
TLSH
T10FD5CF6A62EC11F9D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 66dce6a6d961acc6f438da586d43f0d6ed985df91741980c2567021153f91828
MD5 8370cfb1035d35c6a0f3d90154843478
SHA1 3308075eb85dbe69e29027a8fccd2fe51fd7a8b8
SHA512 8ff5d4c5082b3e3a947aa83c3b1114e4434921b6b3fda6ee22e4a442925b53ab0cb67baeaeaed5dfd26e75a74671687557633f85c3cea0dd6d7ba53d296ddcd0
SSDEEP 24576:+fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnt73c82R7VpWBPnmyjHBldthWFu0W:ma5POZ3BJt2pasx2+m373c1UBfmaHB3p
TLSH
T1AE65AE5EA6F801D5E579D17CC583461AF5B1342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4848d779660cfbab9600d4534532d839f78976b513c33a33ad9e330b2ba2b546
MD5 5d5c42443e1d11f5bfe935d620a74580
SHA1 0dd76544edf57ffe8da947716b78b40fa30cde02
SHA512 9c45b1e4d3d2fe7e9fc35ac0fb4763ee1db2fd58c9a86194c2ff152ac174098a6ce6f6a19c89d586e984ad6da733afa1e35f45cba5c6ea53cc4fa7ceabb3b560
SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7Fk773c82R7VpWBPnmyjHBldthWFu0W:PNc/zEOVHFk73c1UBfmaHB3Ou0W
TLSH
T10C858B1623E901E4F5BBE1BE89679546FA71786953308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 72b423255982a9f81497015dab9de28997dda10ba1213dbd0cef6427dd5ab9ac
MD5 eb63e2ce11b242f825ccbd504b88bddb
SHA1 eeae8a1ac0238903db0fe1097c4e1e52788f0941
SHA512 01284b621e8e918158b483061929b1c9a10a0c7c00753289473793275e1c28ca46270e3c27c6235c57841a618203a99d237b83be311cca1fbe6db7accb89088d
SSDEEP 24576:RTkNvNnaFeYhJNtmZBmR73c82R7VpWBPnmyjHBldthWFu0W:RTMwBtOmR73c1UBfmaHB3Ou0W
TLSH
T1D955AF2EB6B806E4D1FAC6B5CD238512E6727861073293CF5290C13F1E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 9933cb4a6e4ceb266cb28abd822061cefb85d54a2beab0f4bf9632a3f4262842
MD5 61de8f4970fabe232f12dd7a367db678
SHA1 59876c217fc08515fd12c166688bb10694f9e3f4
SHA512 9ed7f4e5ff0a0041b0384ad00c0ee7bb29cc160aeb1463f2a621b28cb536ef07fac63dae60fe3144d86c17028bbd3478de9e10cc1b935473cf8277c4f5fd4e1c
SSDEEP 24576:tD3FHshBIYQgAi73c82R7VpWBPnmyjHBldthWFu0W:tDVHeBIAAi73c1UBfmaHB3Ou0W
TLSH
T1DC25E13EE65C00E4E57BD1BCDA538606E37178AD032256DB129481BA1F6BEE43D3AF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1592-73-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1592-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1592-67-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1592-308-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2592-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2592-351-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2592-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2592-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2592-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2592-355-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2788-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2788-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2788-23-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2788-15-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2996-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2996-485-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2996-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2996-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3036-0-0x0000000140000000-0x00000001400D6000-memory.dmp

Download

memory/3036-87-0x0000000140000000-0x00000001400D6000-memory.dmp

Download

memory/3036-9-0x00000000009D0000-0x0000000000A30000-memory.dmp

Download

memory/3036-1-0x00000000009D0000-0x0000000000A30000-memory.dmp

Download

memory/4336-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4336-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4336-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4336-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4336-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4420-61-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4420-55-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4420-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4420-307-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4424-424-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4424-121-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4424-113-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4584-415-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4584-420-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4584-416-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4584-107-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4584-108-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4584-101-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4792-77-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4792-310-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4792-78-0x0000000000900000-0x0000000000966000-memory.dmp

Download

memory/4792-83-0x0000000000900000-0x0000000000966000-memory.dmp

Download

memory/5204-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5204-127-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5204-133-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5204-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5204-138-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5648-845-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5648-843-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5648-94-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5648-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5648-88-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5648-353-0x0000000140000000-0x00000001402C9000-memory.dmp

Download