76c73d94481eafa2f189fa234a25f0961473e2427334e84b7c735feab9217e5a

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Size 19.0MB
Sample261011-tpryesda49
SHA256 76c73d94481eafa2f189fa234a25f0961473e2427334e84b7c735feab9217e5a
MD5 3f4bb808cb1c0f75bcb2854f494ce5a0
SHA1 e5129f01ab05ad6d8b080d9a2f13a54f49f9f90d
SHA512 c52b4fba6397c36d9b14d7ad8231f52c9b710af4d8c022bf4192b0a3e97847226e55b7fd31731b83d27249b8dfbb22b226c3efb40131cacc284157c389426a8d
SSDEEP 393216:Z5s2HBOMaY77v9GIAIJzB+2ga0Ddx3ED:Z5s2HBOMaY77v9GIAIJzlxD
TLSH
T1C11707257A5B99ACD09BC47483478A724A3130CB0B35B9FF449496382F6EBF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
12	3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
12	3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Executes dropped EXE 11 IoCs

pid	Process
5328	elevation_service.exe
3540	elevation_service.exe
3260	maintenanceservice.exe
4412	OSE.EXE
4068	PerceptionSimulationService.exe
236	perfhost.exe
1136	ReFsDedupSvc.exe
5460	SensorDataService.exe
3504	ssh-agent.exe
716	AgentService.exe
5200	SearchIndexer.exe

Loads dropped DLL 1 IoCs

pid	Process
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e3b1ff863a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2296_292495850\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2296_292495850\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2296_292495850\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2296_292495850\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2296_1591004499\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2296_1591004499\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2296_200335888\manifest.json	msedgewebview2.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2296_292495850\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2296_1591004499\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2296_1591004499\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2296_200335888\manifest.fingerprint	msedgewebview2.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x000b00000001c6ce-557.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004867ccc39b59dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000fade8c09b59dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba96c1c19b59dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008a6ae3019c59dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000044ba50c19b59dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000103a15c29b59dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce2884c49b59dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006e29f0019c59dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002da105029c59dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2296	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Token: SeAssignPrimaryTokenPrivilege	716	AgentService.exe
Token: 33	5200	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5200	SearchIndexer.exe
Token: SeBackupPrivilege	1136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1136	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1136	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1136	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1136	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1136	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Token: SeDebugPrivilege	3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Token: SeDebugPrivilege	3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Token: SeDebugPrivilege	3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
Token: SeDebugPrivilege	5328	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 2296	3300	2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe	90
PID 2296 wrote to memory of 4744	2296	msedgewebview2.exe	91
PID 2296 wrote to memory of 1996	2296	msedgewebview2.exe	94
PID 2296 wrote to memory of 1996	2296	msedgewebview2.exe	94
PID 2296 wrote to memory of 1996	2296	msedgewebview2.exe	94
PID 2296 wrote to memory of 1996	2296	msedgewebview2.exe	94
PID 2296 wrote to memory of 1436	2296	msedgewebview2.exe	95
PID 2296 wrote to memory of 3572	2296	msedgewebview2.exe	96
PID 2296 wrote to memory of 3572	2296	msedgewebview2.exe	96
PID 2296 wrote to memory of 3572	2296	msedgewebview2.exe	96
PID 2296 wrote to memory of 1404	2296	msedgewebview2.exe	97
PID 2296 wrote to memory of 1404	2296	msedgewebview2.exe	97
PID 2296 wrote to memory of 1404	2296	msedgewebview2.exe	97
PID 2296 wrote to memory of 1404	2296	msedgewebview2.exe	97
PID 2296 wrote to memory of 1404	2296	msedgewebview2.exe	97
PID 5200 wrote to memory of 5372	5200	SearchIndexer.exe	106
PID 5200 wrote to memory of 2252	5200	SearchIndexer.exe	107
PID 5200 wrote to memory of 1032	5200	SearchIndexer.exe	108
PID 5200 wrote to memory of 1696	5200	SearchIndexer.exe	109
PID 2296 wrote to memory of 2332	2296	msedgewebview2.exe	115
PID 2296 wrote to memory of 2332	2296	msedgewebview2.exe	115
PID 2296 wrote to memory of 2332	2296	msedgewebview2.exe	115
PID 2296 wrote to memory of 6044	2296	msedgewebview2.exe	116
PID 2296 wrote to memory of 6044	2296	msedgewebview2.exe	116
PID 2296 wrote to memory of 6044	2296	msedgewebview2.exe	116
PID 2296 wrote to memory of 200	2296	msedgewebview2.exe	117
PID 5200 wrote to memory of 2908	5200	SearchIndexer.exe	118
PID 5200 wrote to memory of 3212	5200	SearchIndexer.exe	119
PID 5200 wrote to memory of 3552	5200	SearchIndexer.exe	120
PID 2296 wrote to memory of 2536	2296	msedgewebview2.exe	121
PID 2296 wrote to memory of 2536	2296	msedgewebview2.exe	121
PID 2296 wrote to memory of 2536	2296	msedgewebview2.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe"
1⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3300.5928.1251891126417469864 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView /prefetch:4 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffd9f145fd8,0x7ffd9f145fe4,0x7ffd9f145ff0
    3⤵
    PID:4744
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1744 --field-trial-handle=1748,i,5165786208243597242,4605454308572428559,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:1996
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2164 --field-trial-handle=1748,i,5165786208243597242,4605454308572428559,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:1436
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2272 --field-trial-handle=1748,i,5165786208243597242,4605454308572428559,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:3572
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3420 --field-trial-handle=1748,i,5165786208243597242,4605454308572428559,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98 /prefetch:1
    3⤵
    PID:1404
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4452 --field-trial-handle=1748,i,5165786208243597242,4605454308572428559,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:2332
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4568 --field-trial-handle=1748,i,5165786208243597242,4605454308572428559,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:6044
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4620 --field-trial-handle=1748,i,5165786208243597242,4605454308572428559,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:200
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView" --webview-exe-name=2026-10-10_3f4bb808cb1c0f75bcb2854f494ce5a0_akira_cobalt-strike_glassworm_rusty-stealer_satacom.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4384 --field-trial-handle=1748,i,5165786208243597242,4605454308572428559,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:44a73eecac610e4f54160b0fde5492a4455a6e98
    3⤵
    PID:2536

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:5328

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3540

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3260

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4412

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4068

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:236

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1136

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5460

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3504

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:716

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5200
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5372
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2252
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2948 2944 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1032
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3024 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1696
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2908
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3028 3024 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3212
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2948 2944 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e6decb5eb3addefb4d82cc08558ddf5c8197c86b340cf526a3848c5db30424d2
MD5 86d3fac652996190433e4c97fa5de613
SHA1 d0ad5c77b606e6dc475cf481f5516fbdd0a011a0
SHA512 dfbf69869ddab112514ee7b7bf13e613f0cbe3175df969387910b929de8fdff1cd1276e5fe6c509cb37dd73378b610644483833dcb19f6d0ff5ee95699662690
SSDEEP 49152:Ub+632BuPkFKRrdE6ohrstBhuXjfS4LWxniXozsr8zlLwJIh:O3q60jBTwFRKIh
TLSH
T132D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 dc026289e0882ebb020f5340860f3dbc8d2a1a1eca22aea23bf87ce8ef932ec7
MD5 3267bb769e07327ee9caf4c6a5871e5d
SHA1 1458a2dfa327c50d978d8cf9ab082e4617121b48
SHA512 0d70cbaa6a44f4279e16f87eb672f790dcebccb53b363dd564b15a98fe5c95fab4c09ab0cf066055d5191fa71cabb4ff1286114da6c5cd7a43c18f82955c4cd1
SSDEEP 12288:d1XLsswWkxy2lRq2czAfksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:TXYfDtczAt9Xozsr8zbhN6GwXOGIh4
TLSH
T1BC850129B7E008F9ED678239CCA28501EA73BC5547A0E7CB03B485655F336D86E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 87e3acdac2986aab2e374ab63a621b0f5608fa9aec64de28301fd604575044f0
MD5 a4669526015826ac52a54b81b949b657
SHA1 98d79a0a5cb5a7cb542b1ff3a5795a1a042d2440
SHA512 e05e99e7e8d91e7d889449367487b7f30009a7a7c4fd7fe6c200f9cb049558e1774a3c0bc152f7b9dc05e413b8957ea926ce5307be55af7da633573b62be3424
SSDEEP 24576:20Le5ji0hmx3rMg9Xozsr8zbhN6GwXOGIh4:2Pji0Ah1Xozsr8zlLwJIh
TLSH
T14FA5AF26F6748331D073C0B9C5D2A68EED72308657308ACB4296D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3a3605b949318a290b6d500f0de9c11c8838315b293e1883a0e02ba40af90e64
MD5 4741e7fcba042a51af27348d29f5e206
SHA1 d7919a618048fae4eb815fbfc5a91e76381fe8dc
SHA512 e9d3be06393d49eaab57f1793c0316b3e42b8f6b7239e7fccba6da500176779f923a908adc2b61a68e981c9f777a00117bed917c6924047cfc8805ebf8ee7367
SSDEEP 24576:za7/ezSC6vUyD/aqgrvWr6q8wyu+9Xozsr8zbhN6GwXOGIh4:e/ezSC6vUzPviHjyRXozsr8zlLwJIh
TLSH
T16C755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a2b02f59dc2c1fa292e8be10c512bb5da8963a9dd1842cf4cc466ded8e162c08
MD5 2fc482c1e483448a545dd97fc4524051
SHA1 82a7ed81988e31153306c88581c53f0d31045420
SHA512 2a6818c17ffb4be845ce96a9eec0173ca4b1d6edc177516f77b492347efdc23ba9e2ec705a0dfdb43cd73ef0cea93283696885702ff363fe488a73aa334aef8f
SSDEEP 24576:9VbqPb88hv/l+bx9Xozsr8zbhN6GwXOGIh4:9VO88hXl+XXozsr8zlLwJIh
TLSH
T1EB55AE66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 6affb36b2cfe33c97779cc8e190607db2c14e5ab67dc3a57b8a11a8aca7021e0
MD5 a8cf52fff5e626c3ca3406e2f57ee613
SHA1 7364a466df94ba442dd172fb9c6db8ab53edc11c
SHA512 27f4ac2c22f330718c1cbe1ce2a8b11a3a40b485a54080a0a567718b27c903a61fe1c99ceccb6a63cc3d87cd45c71ae3ef07ddc6d4dc19354293b9eae1fe6cb7
SSDEEP 12288:pRIksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:pRk9Xozsr8zbhN6GwXOGIh4
TLSH
T1B46523F7E691A442EF671F3129916AC4DEA7FD9E49811B8112382186CC7E476FE31332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 e977ee9622f577533b084f3c83c43b2a967c916380c89f794331b01843c9d2c2
MD5 5bae4cd27b745c8c8341aac438bcf7e8
SHA1 0f74aac5b66ede88c136a53a7835ff2d9c547438
SHA512 997f9affd4938f4684690dd9ba580fa1e25852529a66ac1495f9f751f7a8df6424277d574fdd51a095a3471b779caab9915e8b5eef8fecce2e6d825e068f9861
SSDEEP 12288:GeBNUbTVO86ULksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:GJIUZ9Xozsr8zbhN6GwXOGIh4
TLSH
T10C85DF7BEE28FCD2C27A8D785A918640D7B278704F52A3CBD174820EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c75668b223b6da95a3cc961a4c648324c4965c2efd71df0b166c9c4a157583c8
MD5 bf9d6486c130f3375a761dee98b75966
SHA1 4b9cd5a905a5fd2f9da560ea80d5c6e1a2e380c6
SHA512 8af4cb7a01a9ff061300e54d4707a72208b47d3d8c04a95ec792f532ec4c4bea221ee96293bde8275020c15260993bd31d34f8c52e9e448592ec7440fd804831
SSDEEP 49152:8QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3TH8:8QvGAdlCEL8c/RRNw5CswFRKIh
TLSH
T158267C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 db3eb9ac4c9a82491e282f6c10663aa6f486b74d9f064e6f59d40c94fbeec0fc
MD5 78d0d5f604ea3f066a6db250d65a0999
SHA1 3e5f9e49fc5753a4b78c32e07ac79fbc32dddaa2
SHA512 213f3362dc5722d2f8cdeba6ff1afc19ab26db31f79a69ff31d7cd93565d1988ddc1d005e65b1e7d44dfff699556441ceaaff1aa306ecbf96eb6d2d218814f45
SSDEEP 12288:UAwSfxL/2Dc3VDLLmt0LDQewsAjBksLmONw/CX7YNmysags3R3DGwv5NjOytLsXJ:p4ewsAjf9Xozsr8zbhN6GwXOGIh4
TLSH
T1FE85E031FE74E032C7BB0DB21B26D716587DB9604B911AC3E3B8498E99341D22776B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 bb23541d7797deabe3c48bab42e62e7eaa10a0f38f348777135fe05ff00e42b6
MD5 133b0dee39fe75c328e7f25cbe5f3956
SHA1 6e614db515e2084d79966e30031b7bb6f5103065
SHA512 f07c60283bb3f9631586b18b0ae1f0ae77f9cbb4bebc6116ff2bc532fa55cc07e3744c1deba7dfcdb41424b262d869628dbffdf014a0603da9aa2dc82aa93ca1
SSDEEP 196608:TUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH6DKI:TUEtQevvqc2W1cpV2RI326D
TLSH
T13C474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f688fc4294533ac0ab7fc426a964e4710bc734a58374625a26dab76355006673
MD5 ca2cd064c99ffbe09bac47f7d5fbabee
SHA1 8e7464f9bab691389ba5f6a843bc59759801be52
SHA512 9bcb17854b7d63c2da0e5f50f0fd38054bd4372f8c41e86465c5a221bc122960c547d65081be04a66e0a4c700a388c350d72f2706a4213301f62760abedb285a
SSDEEP 49152:dCbRquA/m2yL5zLfFiV+XenmE3/zFXozsr8zlLwJIh:aoq2VjnmIwFRKIh
TLSH
T1F7D58D1976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265460E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a7633c6d7ea679a553966a87ea26552073844b9af30492b8fc0ff47b903b9309
MD5 bf005dc6c9464317a36e9672af79a08f
SHA1 7940dfe8ab8bdf5ab84da6901ed90e692f8b571c
SHA512 6c18ffe0c01fbba13037d04719ffe8b78b9117b65b4691c8b77b930e6493bea0faf8dca5273126f455fc36b6afde098301124fc2c8883738bec54debd7a3eda0
SSDEEP 24576:qAhGL2IFoiwtA5l7S53a9Xozsr8zbhN6GwXOGIh4:qAM1Foiq5oXozsr8zlLwJIh
TLSH
T193359D81E7F955D4F5B3AA7899B69570EA76BCAA5E31C20F2160C10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 d3e4fe747afd9c326eec26648158ac39e1009f7ff664316aaa60ac801031ec10
MD5 9e3119f82b99179a977cc6ac8b65b86f
SHA1 3a6742d0df7913a45e635f4f02a46d6caa038a7f
SHA512 37a866504f2fb21a5475a8db96f8a490f29c4b68d37ff8b5e4334899b34067c4935959574e20874640619361ee99a13f00b42f7ee2917dddeba9ada793ea0e5b
SSDEEP 12288:Rmw5HEjsChNkBFgl0WDm+CKksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEi:MwuVOW79Xozsr8zbhN6GwXOGIh4
TLSH
T15B85F14676A41CF9EAA786398597C535E7F3BC062A21CB1F1370C25B9F37221BD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 38c7f354841bac55fd7184ad9b6e0cf7f0607b2368dbde75d2f6b7ac679cb9bb
MD5 4c8cc8fde6aa0d29e76f4c11e95ffa9d
SHA1 35ac6f8b4c3aeb1e3f3d3df7e0d5436ce9445258
SHA512 0815a66b65bd45769de8e1be8c2fe80d8ca078668a1c8755129ce227f117b14f295f959d7d2e7725cdaa7e253cd0a61117139d55cfcdf4ab1c5c873329f4f675
SSDEEP 12288:GZZ1IyxksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:4Zuo9Xozsr8zbhN6GwXOGIh4
TLSH
T1397512AB73E030F6E6A3473998E15A44D7B3B856577203CF1238025A5E37AD66E35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a968e0fdeec45ece9521a134505b09311d582c03beb81409b98867613a070f86
MD5 ca7f120f99763154121916220bbc4e6e
SHA1 cc3b1f6581eb0ba09297e012bde77117486d905e
SHA512 28821de7f1bdfd441db95d12c590ef3a8d655d8b3ddc752997fc5db105c9fe5944c5a826e2d5fbfe81df0dc8852261012ae6da45fd8c7bb03e187933602491cc
SSDEEP 49152:Uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uw:LQRQyi36YOcPhLvw2gAf+PN33wFRKIh
TLSH
T162667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4d1387793174ef5f560217476040273640ea3065ef1154f7dd709142bfdf58a3
MD5 89d33ed640b258ae03239292bc7d837c
SHA1 86b7900c557a322549521dbfe4ef8aff45a4d757
SHA512 3cc5fe5b6dbf67a0bba70e9475d41f7e1648a1cf344087e675291ad25466f1c1dc8557529b4db0f684770c6df91160366d9199f500c530be817546ad69dee906
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23Uw:8QRQyi36YOcPhLvw2gAf+PN33wFRKIh
TLSH
T1F4667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f6be3c03147b917f0d328c5eb5293b98290ee8b2423cfdffd790dca22e036a42
MD5 b3e6090127d0ac9c2d5bb2f276179b04
SHA1 041274c5ca546448eecca92b75e8ddf54b919ac9
SHA512 c6b8e2d41c536353556ec93339604643eb732576db76c01e81af8c0c1a80974f680e2445147465b20a58e599c7b46096ac7846b3f92883cd03578c8207e63fb0
SSDEEP 49152:n68Qg55nhceWu7PNU3/1Xozsr8zlLwJIh:RthLRc/JwFRKIh
TLSH
T1D4B55933B2F200A9C44DE1769F4A872196D27C758FE1E3DB851572061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2e919d19e993f215981579cdd6170411426eab0872542c2a2a8317b3d4aea516
MD5 62b4f7e968c27732337a8c2f61d0cc89
SHA1 9956e00d95fbafa3bdbcfb8edf0dfb58fef47f9e
SHA512 3018d627ff8f72cf9b81b66a79fbd5dd361d95f2c6423f3e393e0d0da43feec6f497f387bf547cde45d7a836a2af2ddd8dbdc4cd14d7c348c56ce22dff4fd9ee
SSDEEP 49152:Z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99C:Iy5112gYy5azzVva69nLKnhZ6wFRKIh
TLSH
T1DC167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6a174f0e8991f44e9f63477982fdcc63ef2291c0aefc0406dcf2e014a675c029
MD5 d2b622cfc05dc50f34389a02071b106a
SHA1 16697f93c6362eec5f6bad5fe545cb299aa9ce34
SHA512 dd6b5c3f590a2785cf7a32db8a42185726adc7265f5cbebd0093bf31339fb066d988bd509c71a64b70ea25e3a4a4ccf3e11edce9b542de1770e8d653e299c771
SSDEEP 49152:kB+taZ3usBWOBr4tEG20bqx0z+n217aau1glfXozsr8zlLwJIh:+u6JmUxd2dfwFRKIh
TLSH
T113D59D13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e7b14e1d8cf07201a8af8042b38c7e627edda86a760dd21e0a8e822f4218f51c
MD5 a5d1943f1943c6d93cabc1af8e681372
SHA1 acdeee82fbd3a9e55cb1d527756c3f7e9a298f27
SHA512 6c93187a4cb274ac8dd43ca61ca882fb283d6fdf4051bfb9a32ac84b7e22d783942bec788148a854d893c396f50a709ef8b365c54dd45082c19a5538fdf465e9
SSDEEP 49152:y1hpsNoJpF1A6BU44CwH7R4xbXozsr8zlLwJIh:ymifPkRIwFRKIh
TLSH
T150B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 49275b5d6e30f854c378f978c0601fc76d2544912edea59285344f5105c7166d
MD5 06dee27072f2308c616f7c4f11649626
SHA1 7e4824bbe00c969b70f3ba65f090c7f932c99fc2
SHA512 f425a97f9b6eee1556655594ecee5d09cbee76ee6c1a1de34bf5d8238b11ea8d7a9e659d3cb3a558afac69b29c6ec786fa475d020501e2f796e0e0f637bb6b0f
SSDEEP 49152:tSuZQIY0Be2KNRVtOnks6NMHqSXozsr8zlLwJIh:j5dKvi61ewFRKIh
TLSH
T165C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 4514a45af73dceaf07438cba87e707118c5f8796f798971d3c80490a3983a5c9
MD5 68fcf512cb78250a40cdc1c663f19250
SHA1 d00153f6fc7168936ba6fed9fc8d0d622690e794
SHA512 6f4562c4d3f8c331db67af5fcb1f5e37a013522658ee67cb1e9c8cb7d11a28d14d1652fbe21314a0bd825151e6b9bc49de2cb980ebcf294aadfab03088831a1c
SSDEEP 49152:lhtSn8EApI0figXgiDn0AP5wPXozsr8zlLwJIh:UX2iyphkwFRKIh
TLSH
T1F495BE13F2D900E8D05ED175C7468632EA62BC160B35AAEF0A50B7561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 daac28b9c2a9027d37445f33cd5ad76d51aa7967b4e204ccb4258beaccc50677
MD5 6887c0567d448c68fe4a36d69cc76f2c
SHA1 e24ac39331a1444ad84b2adbc939a814970cccb0
SHA512 bfc22cc26c9c204a7f92320b2a6bcdbc490e2da7e6176f99fc9424766dc279bc442c4d925ddf93b0883a9dba1459a78d6fe23567d0233eca18ae2aa2a24b591d
SSDEEP 12288:SAksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Ss9Xozsr8zbhN6GwXOGIh4
TLSH
T1046523B7F992A442FB575B3129811AC4CAA7BD9FA9C20791333D1042DD7A87A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 1c7c307d2dbde118a0b9af8ac949b4ce80dd22ea2977ed76f29bd698f6c4bc09
MD5 86fae3bfad1f6e1dd4c385bb3ff5a67b
SHA1 89ef1cdb9ef4980c42dafe54594658fc318d6a18
SHA512 ff43f902fe0a153de4bc8a65f7de289f83dd5b647dde235e9207f100a94293064f6e2b0b240792786d1ae6fb7c6007a73f020b024c31b8703e24d66b1e371dfa
SSDEEP 12288:iVksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:iz9Xozsr8zbhN6GwXOGIh4
TLSH
T12C6523B7F992A442EB575B3129815AC4CEA7BD9FA9820791333C1042DD7A87A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 c45b3d7c5af1da2008dec506971b1a67ec8ca118fc9cb76e22879a758759a09d
MD5 542e34191e184a14c66abcba44a733d3
SHA1 03f4f72377fb93927e9e1343658f4a81887d53b5
SHA512 5df3c74de79b8a065c28919fc35b32d6e0d526c7cc0f981f48b0426df40c08c71fe75c885401620b252ed58a4d3a1e2888894f376217ce1703b7171d890c7966
SSDEEP 12288:bDksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:bB9Xozsr8zbhN6GwXOGIh4
TLSH
T1C36523B7F992A442EB575B3129811AC4CEA7BD9FA9C20791333D1042DD7A87A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 f9dcdd95a21f9dcff539c942b67fb2d5ba23b9961a726dc24f5456b5f9b51912
MD5 0794a163054dc26f76fe773fab85a646
SHA1 c09a9d6fe85ab8a3db06e2e12e32e65e9ca4398e
SHA512 52eebebdeb6e578678c3e2300a6cd83be5e41608abe18fdecb80d538d16b518ae5a1e7d378e9542e7be645c7674e1bfdf7768533fbd1825df4365d293f2fd419
SSDEEP 12288:JVWksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:m9Xozsr8zbhN6GwXOGIh4
TLSH
T1836523A7F7A550C2EE679B3198915680DAF3FC9F9B5207DB232800468D76679BE30331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 df00c7a657b8bda98caf134627d1fd259dd2cccbcabdbb922a9295d9e75f7fa4
MD5 756116e304e6580496e914ada028a926
SHA1 7c12b226161110aa5cfe5724e21159700b2e16c5
SHA512 9f4c29dee2f9a7bfb1df39adfd242c85e1891ebea3bd6e7c7d4aa82bf66ed77387807d8b626dc40d37fb19f8562c3bc9cb307dfb6b242e07467a070e8321e377
SSDEEP 12288:m+ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:my9Xozsr8zbhN6GwXOGIh4
TLSH
T1F56523B7F992A442EB575B3129811AC4CEA7BD9FA9C20791333D1042DD7A83A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 6cf90fed19c5bed8c5ff55df859f5d2f4bd2db4fd1eb5a38cfbe13ec65276c40
MD5 55308a223d2c7b783b9432a8bebf8371
SHA1 5049cb8517c0cee01d839562a98764b6b7049738
SHA512 cd4f7c5f325b485a643aa9a1d6c91e5fc93c6677b05aad19e521961a01512f21219bc6e0b0f293c451f80ed1738ea097e2a848fa631727301049600cfb7ba3e5
SSDEEP 12288:mZksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:mn9Xozsr8zbhN6GwXOGIh4
TLSH
T19D6523F7F992A442EB575B3129811AC4CEA7BD9FA9820791333D1042DD7A87A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 610171be3d9018a98445eed4afe961a8a1d03026ef57daa0488d2abea1829099
MD5 4717b19fc899aa5bb4e4c2b92f3fa6a9
SHA1 35cbe2f29ce943b5af59ec41e75fd83f24236bbf
SHA512 e560eb21487699f233de39ce70ab710045ea1194d4fd866d751309183bc11f6274805cd9a372738977ce0a7944d81716f7e42703faf8328ec8b182c9de2aec4c
SSDEEP 12288:rdksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:rL9Xozsr8zbhN6GwXOGIh4
TLSH
T1BC6523F7F992A442EB575B3129815AC4CEA7BD9FA9C20791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 08cb93c171d07f9540b1f1881bc779b86b0c54858fdff0aff10966dc9ea4316e
MD5 a132c2226286feb0cf1ddd498b08d683
SHA1 d5c3ba93ce7b0c5de726c644efeff4efebb1411f
SHA512 4427acc1e40328de7885df30a62a273bedcb8c395842552f91a58a9308fd0885ede38b9b5e730548b2e689224c20ffe255de4b76e9bc8dcb3085fac8d44572f6
SSDEEP 12288:QiZwbWzzFEoS2cPvy1ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:TZMWzFVSOT9Xozsr8zbhN6GwXOGIh4
TLSH
T1698501A6B39018F4ED67823EC9518905D6B2BC5A0BA0C75F13B832675F333A11D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 6ddc5c3e2bfb1be298379ea88d5bd8199930adc469415da09bea5640c23d2344
MD5 ad0811212c8193b85d16853f06db68d9
SHA1 752fd9be95782c4efcd6c2e13efdedf7610a5017
SHA512 21300bfb2afe2778856efe526c8dd767eabdd1aff1dff85a2f6b169560f8a8e198ed0eea32f02d6ec87bd8d04d8ed176e995b31df07afe72c05c29c96809af07
SSDEEP 12288:HcksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:HY9Xozsr8zbhN6GwXOGIh4
TLSH
T12E6523F7F992A442EB571B3129811AC4CEA7BD9FA9C217D1323D1046DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 99aa0f18ba5ac6bcec7b7ea5ab15b6a0898134fab735799d1df8277f950b8b75
MD5 4f5c3f2eabe78687426f6b35fdc5cd82
SHA1 e45e007eba1910779fc82ee033c4e8e0d06d9a4d
SHA512 208c0ab8c8ae8538ebc5e05a825be9ad24bfe279aae1ec4f267b0c14b86606f3dc2c2c062821c581ea541b284fe7acd7171b2705a3291e24d8cc95bb44c939f4
SSDEEP 12288:q4ksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:qU9Xozsr8zbhN6GwXOGIh4
TLSH
T1D46523B7F992A442EB575B3129811AC4CEA7FD9FA9C21791333D1042DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 c74aba481c9a2dc4cf1b9620c90aa9157def66c9d930c5190dcf68e0024a7bf4
MD5 89ecab371e5fd6fda995316c9b3f1137
SHA1 52b5c9e39b12a7432228067aa4a96f8b2f5bc395
SHA512 f52c5d937bcee5f02fe96bd8dabfa2d890fda5423dbef801948bca237b40e3c26b4b89cff220f454e70cbededbdceee7387dc88d3cea0a36c9084e33e262885d
SSDEEP 12288:6yPz5L8xksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:nzyP9Xozsr8zbhN6GwXOGIh4
TLSH
T1DD751257B3A130F9D677833588921A41F7B2BC764B604BAF137402765E376A1AE3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 5263654808fe9ba3b67f81f8bf011b26179627edbda3d7dfe60685ce6bc05600
MD5 b62d73a80827312b54b1c184e12bdaa5
SHA1 c740574dd61e467baf3542b252ee48ea76abd396
SHA512 8c3530162c0fc347bb46764a77efd62922c28b41d8ff0c18ae9bac0c7cd20ced09109b9837eba79dffaf3a657ab2f5d632e44820abd4c21c2b58c5b63098439c
SSDEEP 12288:GcksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:GY9Xozsr8zbhN6GwXOGIh4
TLSH
T1C66523B7F992A442EB571B3129811AC4CEA7BD9FA9C21781323D1046DD7A83A7E20335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 ea8e76b8e30e4679523fd4d753f3e7ceaff0b95dbd6e7f422cdfc9d59504486d
MD5 10dc0c195d9ce777bf3880f94ca08a41
SHA1 aa458c67d625d885fb36438123d8deabf3b05b5b
SHA512 de9714565716b26ec402313e9820761074fa74fa1940cf9db58ececdae25d32da0e2fc17055403800f02067138dd4792c901a790ca10f364e9d1afd12990d049
SSDEEP 12288:ucksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:uY9Xozsr8zbhN6GwXOGIh4
TLSH
T18C6523F7F992A442EB571B3129811AC4CEA7BD9FA9C21791323D1046DD7A83A7E30335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 bbe6fe9d164f651dc6ff1d50667f9745869bbc3ff1b14c075eef3b603b5d6607
MD5 8675eab94fe856faed88f3882878f722
SHA1 1aec7e30a006cf02699f367f84006ac131414694
SHA512 6aa1b8972d88710f366e6df8ebf1c2e2af4d670b6f6a5ea3db69e0d5f081629d6dee7cf0742e270f1e39d5e66b0d187199541a35f06d02d8d40e84213ec6fbb8
SSDEEP 12288:1yPz5L8xksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:czyP9Xozsr8zbhN6GwXOGIh4
TLSH
T1E1751257B3A130F9D677833588921A41F7B2BC764B604BAF137402765E376A1AE3A730
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 144ba89951a0b6eef8996083060034036e8e333277ca022c7fc47fec3e9e6890
MD5 3051cd31789baf8b86ab7a1bb809142e
SHA1 9ba84056141e7bb9a8d96bbe6e96a2be1477d7a4
SHA512 2366459b5856dd66658f268aa5c204e4e6de4df56b05ce081c2eede37eaf9ebbada5c428500f14852a64a8d7f19473d5d4af9e8fb33f24099840a0d65f3ae70c
SSDEEP 24576:7THaLl3z0zDR9Xozsr8zbhN6GwXOGIh4:7T6LljcXozsr8zlLwJIh
TLSH
T19D8501A5B39018F4ED67823EC8518945D6B2BC5A0BA0C75F13B832675F333A12D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 e895ae56347160efe642aa7af843374623586e6265cfd1055c6e7e435d69c670
MD5 71360f4b70bcb4c67cfef55076608064
SHA1 8a30d4ebfc1dd326ed6275a7c040c246cf638968
SHA512 d968b3f03ec42edd629d8950981a3f63bfcc99f6834c502b2c26a43e1a6ddde2b95d895e6c51e4098710bb643e2cc7b800139cdc86a68cc62cce4e53ff08c2a0
SSDEEP 24576:u3Ld9CHKy7GZV9Xozsr8zbhN6GwXOGIh4:wLd9CHKyatXozsr8zlLwJIh
TLSH
T1E595CF91F3E410E4F1B79A358D725511DAB67C9A1B61CE8F03A8251A1F33AE19D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 1b416b84ca7068aea4f0d07b84f437baa4a599e7d2e237b76a93dac96e14f650
MD5 0b4cef774c54559063d50cad5483fa25
SHA1 c538044af6eee18ceda3e929168d5420f8eae0fd
SHA512 612c8dcfce8d5885b1bec00041f95cb535e2ef63a01a0428e1ff157fd71eaadb13b07e1c2b16d9c0db8be4decff13decc8e7d4492eac20911c6d9446fcc4aac2
SSDEEP 24576:xfwv7k9RX6wkyAIE9Xozsr8zbhN6GwXOGIh4:MMnYI+Xozsr8zlLwJIh
TLSH
T1D795D02AEBD844E1E1B7923C99B3460AF6B178591B31C3CF125A536D0E37ED46E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 0aade90b5a2de6fbe87f73ffcb6cbf12617470c7a7a04ce6dea793b4ba78b176
MD5 efcd99908f4a4690e1c9c7821c5382ab
SHA1 ebe11bdb0786e84c63a1c33ccad17722c28132c3
SHA512 588b9e4454d19148a8dd00260bdbab5ad5d859de069d98f32a2e46591334e8a3f870419e9bc642cec28b060ae8126b28b47e039574e8af85c4e682e94a3fe2e5
SSDEEP 49152:fYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0vXozsr8zlLwJs:ZySzPXwFRKIh
TLSH
T165066C97A16801D5C1B9C1B98B1BCC1BFA7134490335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b8d2da75b72ca743a7b857e86ca84fb4c78219094549180d84b336ac3dde9858
MD5 f3c3efbbf08b1d1a37e3ee6262e3b943
SHA1 8af356489aee1c5ffdda9e645a95d482cb7bedab
SHA512 4aa6fd62d9070d056dbf11e68bfdbe8174e50b889b0e850cb197acf7eee556e3d7e4af980dc20d707aa1eb7a5df543ecdad0cf79abcaa7bdcf1650748f6f2e33
SSDEEP 24576:547Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYD9Xozsr8zbhN6GwXOGIh4:547JUQj4irIhCnDHUPfF/fXozsr8zlLT
TLSH
T1AC65AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270437D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 6ba51091329b7925fccd04af02567703881386d6c345bc81a952d7fd7e0ee35d
MD5 7b423fac86a08a093b4305abb5074523
SHA1 9839e060bb36e9f4ad4a4c85e698e09a879a2288
SHA512 1a21876a5c350a92cd6cefb860fb002970a53866b0d5b9794e8772c6ef8b9c4cbfd6ab9a0471e4b28428545470da0b5aa1ff43fb0e8bb440439ddee789481691
SSDEEP 12288:0QsfsksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:Oo9Xozsr8zbhN6GwXOGIh4
TLSH
T1BE75F15AE29411D5D16F6235CB414A80F7737C6A87E193CB22E0F03E0F7A5A4AEE9713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 ffed2621b701e19f22e5d451482607f54317e61c03184b9021e521ea5433ce3a
MD5 db5bd44ff5a20678fc46cb314d457118
SHA1 39e68fd64fb5fc16247cef002387c1c8bafaf750
SHA512 176ef42293d2555c7c745ebc7baf153caa72307d6662dbf060176922720881c2c9846c4ed352592c017ba6ba88011b270837abe026e47631104047536092d74f
SSDEEP 12288:ycjS4Bql2++P2vIO9GWUA7WlrvaJqrHv57UqaRBveK:yx4h+uEyCJiHvKqaRBve
TLSH
T163451710762ACB4FC6A980325E36D5CCAB707D11EE056F0373C9873F9576A59BAF2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 8KB
SHA256 73abf11b1ff6f12c67cc3966192ecc942f1526b92001a5b30c24f0144c368f53
MD5 b850afdb32d32c18272fba5a22ef874f
SHA1 de1ee0e6cac080553b4fa4988cd6b16b6aa43bd7
SHA512 34c6c478f019f60f8fbf1ff48f2225f310a5af1926da8448333c001b86f5e5f20b9680431f1345d9a811c10b278900e1a6a8bec8ad65f1a0ab6fc734d1b64743
SSDEEP 48:p7tqdZnUj33D3Xlle3Xll83BUREK0kENRu+UKnA:pJQZUT3zXllGXllUy+LRTX
TLSH
T1D40260B1B754F732C45F4236CCA0A7DA5B78F0292E100357F18920EECCC89C20DAAB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 7a18995690c3363566093c115a6df41cfdccb42be6aa204bc80538d5bbcd18f8
MD5 a0d58468b265ee4f9934ea9dd6268aa7
SHA1 028b6b79fc8bc515123c32af1877c218dcb3b061
SHA512 6efed3ac5d27953ea9940b7ec187f7a19659bfea6e979e429b5e4c3b2786984194993bb37252a0584a8daffa504a66751b09b5967459079b37eac732055f7cb0
SSDEEP 6144:+Q6G4M3/I1HI107WH+ZA1VR7KDeoHW7KDeoHgBjQ9MR+kPjXzYdd8NDjpVrwrucE:344k7WH+ZkRD7B06RtYv8NDlCScE
TLSH
T19465F9805137E78FD1B75032032A5B8CA764EC06B7466F26B3C9457AD86AB56B0FD3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\DEBUG.txt
Size 206B
SHA256 00b615566127338155a51f70b6b8621203014b8d4d8ac5751b5264a2cdde294f
MD5 c41bef83158f56094ff5ea3936dc3071
SHA1 955a91996c3c507cafca106d79903e6eac8f6673
SHA512 fe926bd3ea6026f171bd6670e54721ce580cde4d443bee29577a12af370790ef78a93064bb394dd92708f52d3c45ec7cd55618548e25d05cf9925e281cbacc3b
TLSH
T10BD0E910625CE0AB51D663831A786ED05691A9F386668CFC374BC74674BB9311E9FC82
MD5 SHA1 SHA512 TLSH

Submit Download

DLCTBL_FRTS

Path C:\Users\Admin\AppData\Local\Temp\bin\DLCTBL_FRTS
Size 131KB
SHA256 004a5377f839a11d8805a7b9d7ac121e67d187dd92c0977b1a6fe0e299c436fe
MD5 35b5a2d2133e2686d94f96a1792b1c51
SHA1 373927d554b32b297de55cdcffe0cceb3d8ff2bb
SHA512 360fd9aae96c9142d24ee118c64e1c2dc38485ec41ea34a3f7ae1a05e691f406e96a100e81102eca3405811ad4f54887eeead721d5cae9f0c71cbcd5490796f6
SSDEEP 3072:9zzVen1/h7HxCiBQht4vshCClTh827ISiVmBxNtFt9DtrNt:xR41Z7RFuhrzg4BftFt9DtrNt
TLSH
T1AAD31218CBA4A7E9C77FE05CB4E32DB6A0D645184B5ADE22B78744AF00D1BC8CF17661
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
Size 854B
SHA256 dbf41a9c3f3114bf6a883b9218394eead12786e45d26a6c25c030126f650ead7
MD5 97c9c95f819ddfe6691c330566d29315
SHA1 8349497847d1563fb3a1f545622de6e3553321b4
SHA512 f979355c28554390862dbb5856063c127cf67fb9278a43b7e138118e534e771df6c67505a02873b217e586812c4238f828d4e50d5ebba1d4406f8b5d42a23bbd
TLSH
T11A012B8A095DC1670AF16643433A9DD2806223B25673DEE83303E3C4345EE2A7F1BD64
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
Size 2KB
SHA256 e81267c8f5087b23d71c5e93a15f6843577d674fad2d6dc376e76526e61213a7
MD5 82d9843d9b74f7ab792abb267abddc03
SHA1 4016b491ad3640ca5696154a9c7e4b026a0f1d80
SHA512 4b7b8e8021b5ca40e88739968afcc36fd9c9096974c81f7a13cc09ca4e89da21f17b46377d08a5d10f336276503bfd9fe9e1d39b238d57c4912923f5f1990dd3
TLSH
T1E8418B46194DD22744E0B34746398ED2847632BB2273C9E97B53C3C8752BE247E2BCB9
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
Size 2KB
SHA256 ddaf64101f69377861e52ad3f0fd87a7f74585a052237b7d4ddf1dc22cb6d00c
MD5 7581c87b83532c5827b882ee64ac9e4e
SHA1 feafc77624e98dc80e661b51eaf8633ac1e8d731
SHA512 d95bac6ad855bb9b82fa91fef1ce5a71359663da76d2b359236dbf6c7585d2cc6347331b188e9cfb7bc3e2ec571c42bbf5dd1ae6336102faab9cbb477379d798
TLSH
T105518D4A494EC12384E0624346398ED244753B7B2773C9E87B63C3C8701BA287E37CB5
MD5 SHA1 SHA512 TLSH

Submit Download

UIDEBUG.txt

Path C:\Users\Admin\AppData\Local\Temp\bin\UIDEBUG.txt
Size 4KB
SHA256 9ed5651ac17fc34954d1eda51a994c7efd27e7ad2acbd43e423d8aa1e9cec6f0
MD5 5cc0c77f6892e5eec147a1253ce4efac
SHA1 cf4284e9f9ba41840ea79322afa369e3ffebdca8
SHA512 767a8aa6ba6c9ede42d7b80656a1833bc800e9938a9cf2b7508b354b7ee1f39214acabc67c118383070297f29ccf39db116c4ef6071c0d5aa2e8ea5d4379b726
SSDEEP 96:oVk+6YvI+mAcjqb0VW2b6JBjuRJdFfdjF1uJiEl3LXGizaXz:6kYmAcc0VWXSjfvmL5Mz
TLSH
T11E919746554ED52385D0230341398EE248312BBB6773CDE8BB66C3D8701FA25BE37CA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SolaraV3.dll

Path C:\Users\Admin\AppData\Local\Temp\bin\dll\SolaraV3.dll
Size 14.5MB
SHA256 7914f75204b90262b7e1a4d6aa938b6b452590939a7680a85145854f64a8cbd7
MD5 0c0084f7462071be1ca30749baf33cb0
SHA1 9afa34607044980e6ed276bf54a88c09f5084b79
SHA512 69c471484e2defb87b026c332c598dc4f8019abccc4576b5406c27b4efeaacfc2232df88e9b0815f317f5e58a581c15d7eb3d25cdda83e4bc70a2c20a35441d4
SSDEEP 393216:qZcVNgB95+aYAHglyDWWE6kEsl5SWlWO3QQwT4wlwvEgrkvO:qZOh6gwDTMWwvTD
TLSH
T191E69ED668D6109CC436C5BA8353EA3BCA6F787A4334DAD7026096752E23FD1363AF05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

08368866-b507-4609-9c48-6193d45d0aa8.tmp

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\08368866-b507-4609-9c48-6193d45d0aa8.tmp
Size 3KB
SHA256 6907003326ba287844d5ec77e2b289552d596580a03f1ae5b9f966bc49def71b
MD5 f546b57e3148f6001a1c0b237bde8bd6
SHA1 e6321ad5b70ed2419b05e24d1aec8af8017432f5
SHA512 2fc35730f47880a0302c40c1f4d7ed3f50249925486011fc484cd5ea4a933fc4feb0cc7b3f18e218bbd0129448eeafea57216d91931c58b1e2d2cf0ce4304d82
TLSH
T116818422A9B4AF378DF2E504B8863B17ABA55067F5917FA5C6EC0F0D01D72CD1392827
MD5 SHA1 SHA512 TLSH

Submit Download

13e85306-6773-4db9-b3ac-e95d4d7d2ae0.tmp

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\13e85306-6773-4db9-b3ac-e95d4d7d2ae0.tmp
Size 2KB
SHA256 3282fe8aefb23363204594efbcdff106fdfafc6444dedcd4ca2f3aecfeb7b4bf
MD5 553f88735f31eb66676ab3d08c87d958
SHA1 9b7e063435b7978049953f4591bbd39f9559da50
SHA512 c517775f445748e85a2f686ebdc0c43430b2ff6ba153e7709d4020351c9745b0d7bd8093dcfa0c40096512a65906402ece3cb19dd63adea12a3649f96cfd352f
TLSH
T114516333B9946B73DEE2A644B94B2F238E799192BA922F5095DD0B0D01872DC1392C37
MD5 SHA1 SHA512 TLSH

Submit Download

8085c2bb-bcbb-4588-a8bd-875accb56234.tmp

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\8085c2bb-bcbb-4588-a8bd-875accb56234.tmp
Size 15KB
SHA256 7d8771e5ec446886ab4c2e70542d192c9d756eaa40263f0a2248636deacbe126
MD5 b0ebe9e775e4f27fc0987166bff128a8
SHA1 73e9e1061b0de7e811611880e69cdc3882a30aee
SHA512 d018cf19d3ad7bbd3deac6d663d3db583a5443cb3f4d281609c63f903301f4fd16048c4aac0fbaf7bd11f5a1378ed214fb24170ca693499172dd0772083f8667
SSDEEP 384:l+aQikB+z/xvxjg/qhEwNBStGc432yaMU5/Wv29zO:w/UxvxjgC+14Dlzv2FO
TLSH
T16C729E2765A97F33A6F3F601BA59175BCAB894A2A4C27EB449ED1F0906C72C80346C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 51b9771ef5e90611bc2eab920adce9f6526d66d39284dc7721e79d5228e9437d
MD5 08c28d26e22831284ffc39228dec2625
SHA1 6bc6221943edc84e5452a29a67547cf7476e7847
SHA512 2d315ae6f24c2f61732c881df6a46009b9bd7ee4205cf316e37d4fe502b95d420f332efe43dfe7967678e3eacc9f83f02a832c1c9c9454a40a2a3616bf05da1e
TLSH
T183D00430F1147010C00C547D047141C50145CC14440107444450C14505700151501414
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d6ade26f67e2048427a3479376d7feab66f595d956298d99efd9bcddb6bdccb0
MD5 74aed6bc14498fd46bc39690ad56e628
SHA1 835cce71b7270fd12b599837e2e11201355c53b8
SHA512 e0aad4694a2bf471b7c322f2b7343b39269753499964f6bc68389ad15e48893a28144f583dc9f6f4b96e410cd87f03c9e8d56080fd9c7eb2d6a7f2b3518bfe58
TLSH
T11DD0123272116134C0142477046361CD0441CD1F800541449828C65E1B240641E02851
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 240B
SHA256 1ad90143f6046e4ccd901c7560908975f0571953510f9b6328527c62e28bbfb5
MD5 5bbe598fa3c8a647dbf3788d3a55e274
SHA1 f93f64a17570941fe270b9f89ff4431d049e8308
SHA512 3184ba93e466067ea2b43edda747f9d31f64f3884b6815525173c68e69abfb9390824c1f086736c7e97828b4868e57b31f4ab69a770829021c63961da2351c83
TLSH
T16FD0126F40B12441FB9235B356C15A84307DC633A6430E47019A7070D30738F4165139
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 36d8daae693245505355e6fd477b9d7a0f150378ff0fb31d845f50478a4e6143
MD5 d47f6b8a1dc0f7ec47a0014227cef914
SHA1 559d2e3a7f669135c2a68238c31eeb90bf30e3e5
SHA512 c1ae03fb0fd21716286c8bb8ac81df558aa89c082dc459180e22ed737539686bcc696a08ac3332a700580ef0b6ebfc88b8935207f0839a4908198446800e91d2
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\TransportSecurity
Size 523B
SHA256 7e648ad71d7d513f8a050ffac740575e4e0a2d4f05c1dd6204699bba5b155c90
MD5 6008b0aee305c34958e37fe9182d5f04
SHA1 53f588818a8121a3e1b3c1d0d1b7046dfc9ab9c7
SHA512 8c4f2a6c60081dccf37786a2084e142376482112f5b6bad8e1a3a2a247a2cb5c937be768ad97dfe84ac56e4fde4c378d9b565c7516349436ce2cb004545e2f8c
TLSH
T1ECF02B9280BEF53620690D662D85FC453E69F43021D190EECB63C26DA0905FB5622477
MD5 SHA1 SHA512 TLSH

Submit Download

e5bbfaf5-6e05-4213-a8a7-bde66da6f0bf.tmp

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\e5bbfaf5-6e05-4213-a8a7-bde66da6f0bf.tmp
Size 1KB
SHA256 f521a7b748ba847007e66cdee6c2cf4d3c468d20c25fffa949cae90d9fa8b67f
MD5 95524a71207ccfb51d787a1d2e078bb9
SHA1 e0d0bb68d31d999736c29921586671750864d430
SHA512 7142ee23db7c850b262ce82117141faef5efe660f06c7ab13d99f24dd90d28bcd4447992ad5794881dc77e39ff9ee9674a4947ad7c302e834400a6e74fbd5d00
TLSH
T19D415DA2C6E4C76D89112AF477347817C92D091DA2287E2BCDEBEB9A67D10B1D22110E
MD5 SHA1 SHA512 TLSH

Submit Download

f95ad493-a094-486b-ab34-46d657e92914.tmp

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Network\f95ad493-a094-486b-ab34-46d657e92914.tmp
Size 523B
SHA256 1648cfea8272b2a3ce699e0ea3505e9e74ec34ebac05f003d204a60fe0000fa8
MD5 6b7fc4d20841d4bbb1a358a266f7aa53
SHA1 bfa7d73e4816ca7d7a4c47057fdc8bbea5073e75
SHA512 ef9a835791da23aeee4ad5eca089a30d4e7306f8aebfed4fc0ec6e39f779f795505bddbf696d5778c08cd12c74b22a64eb3e82f53717dfdd0455933d2928ed07
TLSH
T188F0509240BFB57A207D0D772D45FC452A79F830319294EECB63C26D60905B75723076
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Preferences
Size 5KB
SHA256 d4a15195d7628a293fa695d1c11902a4812a5e6b6c24308c33a12b1a5ce2bdc6
MD5 741b773f4b06a4264575e116d70cdbd3
SHA1 646ba5f5093af9381e633ebec2be936a5a9b9e2c
SHA512 3d3b8f1499e0c4810195db2a0e27823b09b29ca30220bf3794ce1bcaabff1a90c8559da22d63a2979c991cdc3791a280584b58a0cefaef8a8bd66405fd432987
SSDEEP 96:r0/dvsUXFb93khdo5h16ZZs7/x+6MhmuecmjecK+gzN28XM1C7K:r4p93So+sV+FijIrG6K
TLSH
T130C1A5025E68797B4CCAF509BA35BA03D2F9606230D52E58EBF8462C08EB5CD630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a591ea21-4efc-4f80-8ffc-930b7e39f58e.tmp

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\a591ea21-4efc-4f80-8ffc-930b7e39f58e.tmp
Size 6KB
SHA256 045248924d9c5bf39deefea309c40a71be370113a0090dfc92d5fb313ada09d4
MD5 539a8788028523574e5be63adbcdbc57
SHA1 7a7f15060a51cc1afec64232f4264dec92bcd16b
SHA512 8f358af10ad4b97a5f684a8f06cd58797601a4c2f89b46c91546690b86bef332f703c1880bdf32b3dccf41068b745c07de3cafbd6265ac7215cd521311e2fa23
SSDEEP 96:st0/dvsbGXFb93k+uo5h16Z0Ls7/x+6MhmuecJS51ejecK+gz728XM1C7K:st4p/3qonLsV+FdS5QjIpG6K
TLSH
T175D1A4025E687E7B4CC7F109BA75BA13E2F5606275D52E58EBF8492C04EB6DC630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c0b685b4-3e3d-4603-84cd-aad02fcb0484.tmp

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Default\c0b685b4-3e3d-4603-84cd-aad02fcb0484.tmp
Size 6KB
SHA256 c77cf28395ded43cde16f54988ae37b4ecb29671bbe7b2e0d3407da0a6d9b51b
MD5 074450fb42c92b092ed1a2f8316f7be5
SHA1 8ce502367c673700c0bef06d8a9792ebedea00bb
SHA512 5c7f37ecff24e9ac4cb1af268dfc1eeace18ab574cf5d66c5deef260531ff83fc80192faad7dc75f0f1d9e3d0b5f96639f056a4385461a81b2a112eda1e15c35
SSDEEP 96:st0/dvsUXFb93k+uo5h16Z0Ls7/x+6MhmuecJS51ejecK+gzl28XM1C7K:st4p93qonLsV+FdS5QjI7G6K
TLSH
T106D1A5025E68BE7B4CC7F109BA75BA13E2F5606275D52E58EBF8452C04E76CD630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\Local State
Size 1KB
SHA256 b0415b6d9db4adc69d95a46ff0a20ea01fbc5f7136bcf400b583af2b80711991
MD5 d3f80262601f23c3aa161328f18792d4
SHA1 58067c3592cb05db316c18d557cea5bb3636115e
SHA512 9deb456945e5abf1e46c6a3176f73ac88cfe9f8dc7500016bb6ed1b25869c528296341606f04a6a849f24eedb25d68f1edde763f39a535d435b60a7065419956
TLSH
T1F42142B3F6E42F32EC92724531536A2B5E314097E2518F0051CD4B1D02932CD677AC33
MD5 SHA1 SHA512 TLSH

Submit Download

f9d236e6-e5e7-4a70-9cf9-777f5a5f1a22.tmp

Path C:\Users\Admin\AppData\Local\com.solara.v3\EBWebView\f9d236e6-e5e7-4a70-9cf9-777f5a5f1a22.tmp
Size 3KB
SHA256 faa5b33b18a5fb5a47a87aab36706b31d85199832e6ccf0d95b3ced7d302ae9a
MD5 fdf1990fc138ec2386d95a25b715175d
SHA1 f2fcb4ed4d459e4b7ca372ea9b5f81e64c6d8dac
SHA512 9adaa3dbf99ff41eccce2e8a84f1ab0ab4f738c6046431312013d4472a99d6c9dab8fa928767bf913f8bb14968db790e150de4174eb09c6fe3ea6b185e1a69f8
TLSH
T12861752769A4AA378EF2AA04B8862B17ABA55063F5913F55C5EC0F0D01C73CC1391C17
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 2c7ba997493cf4d180b395d0b40ef2404f39839da22a8f982ead4cd2ff6249bb
MD5 7e634af5a6c781b645c66cc59de23482
SHA1 59bff16569ff9ba14a54c844490e1b7df352a723
SHA512 6f0ad7504e0e649debb4304108feec675ca41bb58d6e934342fe57d061e82de233f807700cf0132ba8c45981c2edffddfb4f3045db71d16067a1901b997648b3
SSDEEP 12288:I77UksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:6A9Xozsr8zbhN6GwXOGIh4
TLSH
T1576523B7E795A802FB7B1B30289556549A5BFD9E4F8107C332281186DC7A8E5BE30336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 77faa2e563744d3938487a136c388a70d137a675938b1859a69a508e49d3f7ae
MD5 9dcd9764259ff330fb9ac31be174bf97
SHA1 8206786f2e8e388e6b62b4a0cf2d0bc4793bd0ba
SHA512 e1099db77134cdfd7e12e443d8d384191c006c54abe5b23c3c074f8afc8144e7ca06e7e8f2d98f50f814844e2d02153c27dad41da6c9569b4406e9e19fb7156b
SSDEEP 24576:wgb6bmBIi49WNNFpg1rSvFv7bY+9Xozsr8zbhN6GwXOGIh4:wgb4mBIBhGFpXozsr8zlLwJIh
TLSH
T18E65AE1E22EC02F5E1FAD2B89DA64417D6B378160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 3a4e7814739b80402841f10bc6cb894066b72557dc19a807ea45e0d7ff522f4f
MD5 8164174566fcaa8c04358025cdbb7e2f
SHA1 56259c95180e7c973c3c217a245b69469e13dbda
SHA512 3b67745a231577c9f2e5cd060331c0ac27942ae50278113e50bd8475e1a88395face2883ca877acad94e8ec9f71deea990ac9924447d3d387cc5a3649ee4818c
SSDEEP 24576:YG88u8FpJqH1czria7/mT9Xozsr8zbhN6GwXOGIh4:b7ZFPqV7a7/kXozsr8zlLwJIh
TLSH
T199A5F166B7E101F1D477D13889824663F6B2B8250364EFDF07AC8A511F23AE55B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 898d5508c140ece1dea7fd94de913f0ba9beb3980556afd86062666f30502b70
MD5 4a250ccc2cbeef840e85adf2185b04a2
SHA1 16af81583baead1f9301ac7ab6baae3935ba1d2b
SHA512 36068f8e9acecbfdf3027dbb3dd17f9e006d96d070102572dfdfe61799857bc2cc5994990206b54193f3d03770a5d1fba79aaa2a45d9b404827d3520785b4558
SSDEEP 12288:JHvUrBFrEjwaQJksLmONw/CX7YNmysags3R3DGwv5NjOytLsX1UGjEhlr6:JPUr+NQX9Xozsr8zbhN6GwXOGIh4
TLSH
T1C785F26F72E918E5E677A13D89824709E772B866071293CF02A0417E4E77DE8BD3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4cd1e0ed54730e716f3b7cd9f63e0648f0ff1503978d229b87addcd9c7b86885
MD5 0d7f9c2acb410fa603875f7228aebd3c
SHA1 4d4016d67e4da1e63777e35205d199696ba78dba
SHA512 fd1d096d8b4a93c904e8b2844e8879c4b681db2963aaa526478e1d74513b95bf440e51db8239df2160f150c5ea56b2123dff53b590f198914d65981954ff6c98
SSDEEP 49152:mBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj9Xozsr8zlLwJIh:JG05lO43bSwFRKIh
TLSH
T166D5CF6E62EC11F9D1BBC17CD9C64A0BEBB23815032556CF02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 af81f3c87e6871f723e566bed82c0eb114bd9190aa6efb8e5df12480106f1d58
MD5 b5940428f0a77a2b36a11ba39bab91e2
SHA1 eb12186201d5c1d771978602489383f779c4ebd1
SHA512 c972576350798148e096c961587d8d54bcff028aedaa01d4463ccd450a850047966451845d4af7bc2a466a9c78c79cbd2d5c90c7d1dab8616ef1b27f2664127c
SSDEEP 24576:hfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnN9Xozsr8zbhN6GwXOGIh4:ha5POZ39Jt2pasx2+m1Xozsr8zlLwJIh
TLSH
T1D365BF5EA6FC00D5D57AD17DC583461AE5B1342653329BCB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 42a0e01d9076ec71cc92dc6944eba1fc28712812adc90b3d4e98b60a1d608e6c
MD5 d443a9b89f552d8a521e7e2f87c830b7
SHA1 e52eb31a9b24abbde8a2f74c43b20c730909b76e
SHA512 ee01dd57f4e45c207699ca0e88631a5806e092699e109c9ee4ad0de01f3aba848d5523b435b661f771369c77b0f8ca55be004620501d6029dad90691c4615b63
SSDEEP 24576:UNcwHdjbyQ4nLC18lb/EOjowL7Fkb9Xozsr8zbhN6GwXOGIh4:UNc/zEOVHFEXozsr8zlLwJIh
TLSH
T1F5858C6623E901E4F5BBE1BE89779546FA717865133086CF0291811B1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2296_1591004499\manifest.json
Size 108B
SHA256 8d58f4f4ef20dff6cd1c27243ddbe12d50713f2cf8bb22ba73696bbb04b36f4c
MD5 8e9357dbfee2ec0378af047a76d0b453
SHA1 794f8cce8fbea87b2b62162769bee35c319ebfa0
SHA512 85b5f52013803198e6af0ba37c9c3c66ce4bed4df5a7ee86ca1fc7c3658e2c973e92eed88fd36864d4743db44ad81fda7b24e70ef7530212e85b12c13d5db29d
TLSH
T1E2B012A13C007DBB1DCD03760060E3D783B63E0A1659190006DB6D422A4C9FB137253F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2296_200335888\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2296_292495850\manifest.json
Size 102B
SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
MD5 19322c8a94f1ac01a70f8c58cdbbc720
SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
TLSH
T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
MD5 SHA1 SHA512 TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2bd12360102b0f20d8e813b8bae2376b7b3f25b63ca10cb2bef6086fc32ba3aa
MD5 e8ea2165e352e322c76f9f7594a3d763
SHA1 aac97e6f755139693fc6417d34722e0586dc1d41
SHA512 6f100e47d2dee031fa1a8b21d0e9ba1a7699839b15f00168b004a41a0913874f89d884f436b53ea8f098e2311d273b3cd41a27bbeab49a9754892e8ffa1b0d04
SSDEEP 24576:0tkNvNnaFeYhJNtmZBmJ9Xozsr8zbhN6GwXOGIh4:0tMwBtOmrXozsr8zlLwJIh
TLSH
T1CE55AF6EBAB845E4D1FEC6B48D238512EA727861073253CB5390C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 87e6d041640740768b4ad0dd69c1b1a8015d2bc6a1710189a05b8edcd06d7a20
MD5 de56c02c68ec1e497d26a2252e9cabf3
SHA1 7638cf84f182882b65a1d9861a4a18bc16062229
SHA512 7b2f53143025c6957b148e9b817335280ee056d3fc9fbcf05da6540844641aea3a7631bb4923be6fc5d38edfd3e5d3832e6e46a8f23800fbfe28b50c55e811a1
SSDEEP 24576:KD3FHshBIYQgAM9Xozsr8zbhN6GwXOGIh4:KDVHeBIAA2Xozsr8zlLwJIh
TLSH
T1BF95E17EE69C04E4E57BC27CDA534A06E77238AD032256CB029481B65F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/200-851-0x0000020D84600000-0x0000020D84601000-memory.dmp

Download

memory/200-853-0x0000020D84600000-0x0000020D84601000-memory.dmp

Download

memory/200-860-0x0000020D84600000-0x0000020D84601000-memory.dmp

Download

memory/200-862-0x0000020D84600000-0x0000020D84601000-memory.dmp

Download

memory/200-861-0x0000020D84600000-0x0000020D84601000-memory.dmp

Download

memory/200-858-0x0000020D84600000-0x0000020D84601000-memory.dmp

Download

memory/200-857-0x0000020D84600000-0x0000020D84601000-memory.dmp

Download

memory/200-859-0x0000020D84600000-0x0000020D84601000-memory.dmp

Download

memory/236-575-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/236-244-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/236-254-0x00000000007B0000-0x0000000000817000-memory.dmp

Download

memory/236-249-0x00000000007B0000-0x0000000000817000-memory.dmp

Download

memory/716-317-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/716-330-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/716-328-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/716-323-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/716-316-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1136-280-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1136-286-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1136-577-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1136-714-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/1136-267-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1136-715-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1404-153-0x00007FFDB8570000-0x00007FFDB8571000-memory.dmp

Download

memory/1996-89-0x00007FFDB8570000-0x00007FFDB8571000-memory.dmp

Download

memory/2332-752-0x00007FFDB93E0000-0x00007FFDB93E1000-memory.dmp

Download

memory/2332-751-0x00007FFDB8820000-0x00007FFDB8821000-memory.dmp

Download

memory/3260-161-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3260-155-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3260-189-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3260-52-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/3260-230-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/3300-576-0x00007FFD950E0000-0x00007FFD95F71000-memory.dmp

Download

memory/3300-6-0x0000000002140000-0x00000000021A0000-memory.dmp

Download

memory/3300-0-0x0000000002140000-0x00000000021A0000-memory.dmp

Download

memory/3300-14-0x0000000140000000-0x0000000141303000-memory.dmp

Download

memory/3300-823-0x00007FFD950E0000-0x00007FFD95F71000-memory.dmp

Download

memory/3300-266-0x0000000140000000-0x0000000141303000-memory.dmp

Download

memory/3504-311-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/3504-650-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3504-305-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/3504-303-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/3540-433-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3540-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3540-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3540-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4068-232-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4068-240-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4068-234-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4068-521-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4412-181-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/4412-177-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4412-171-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/4412-499-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/5200-666-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5200-339-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5200-332-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5200-333-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5328-315-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5328-16-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5328-17-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5328-28-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5460-291-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5460-298-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5460-616-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5460-614-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5460-292-0x0000000000720000-0x0000000000780000-memory.dmp

Download