8131b5b55280feac09a228840a1b6fcef238e0e0078d1ddd6abd2a11a716a170

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
Size 4.0MB
Sample260629-e21c1aes8r
SHA256 8131b5b55280feac09a228840a1b6fcef238e0e0078d1ddd6abd2a11a716a170
MD5 a209a8b2bf194ef1cc654dbc100bf1ef
SHA1 711f563e9e739fa2a44574ebc44942bc52559c8e
SHA512 8f4ee2f47ac9f168f8a9a2a516982ecb5b5fd2d38196575cfdb263c6bb2d9202726b8c973d9949930668597ec1b2d1b900bd2454d76ba92c0297f77f82e46561
SSDEEP 98304:Dl+kYL0Ow2f2ifIB9X+5SSDntdDpbRZy:Dqw2f2igjkSintdDFRo
TLSH
T1D5169D07BDA108F9C09AA23189B746967B75BC480B3533DB2E50B6783F727D45D3AB18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 23 IoCs

description	pid	Process	procid_target
PID 4888 created 5468	4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	104
PID 4888 created 3500	4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	105
PID 4888 created 4400	4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	106
PID 4888 created 3212	4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	107
PID 4888 created 3736	4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	108
PID 4888 created 3180	4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	109
PID 4888 created 2556	4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	110
PID 4888 created 5468	4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	104
PID 4888 created 5468	4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	104
PID 4888 created 3212	4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	107
PID 4888 created 3212	4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	107
PID 4888 created 2456	4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	122
PID 4888 created 4864	4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	123
PID 4888 created 240	4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	125
PID 4888 created 2632	4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	124
PID 4888 created 5068	4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	126
PID 4888 created 4680	4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	127
PID 4888 created 5604	4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	129
PID 4888 created 800	4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	130
PID 4888 created 2456	4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	122
PID 4888 created 2456	4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	122
PID 4888 created 240	4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	125
PID 4888 created 240	4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	125

Executes dropped EXE 11 IoCs

pid	Process
5900	elevation_service.exe
5960	elevation_service.exe
5100	maintenanceservice.exe
2876	OSE.EXE
5504	PerceptionSimulationService.exe
620	perfhost.exe
712	ReFsDedupSvc.exe
5500	SensorDataService.exe
3216	ssh-agent.exe
264	AgentService.exe
5644	SearchIndexer.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 58 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9578acb0a6e14f9.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\msdtc.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\dllhost.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\system32\locator.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\System32\GameInputSvc.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Windows\System32\alg.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	PerceptionSimulationService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	PerceptionSimulationService.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	OSE.EXE
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	OSE.EXE
File opened for modification	C:\Program Files\7-Zip\7zG.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102406\java.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	PerceptionSimulationService.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	PerceptionSimulationService.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	PerceptionSimulationService.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3212	chrome.exe
240	msedge.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000efc60e8f7f07dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000050d3318f7f07dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b51e40907f07dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a3f9c9dc7f07dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009ad24e8e7f07dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d5ae808f7f07dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2894455325-857903158-4263030270-1000\{2CF75C4C-9322-4E45-B1DE-218A64EA9A1E}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
5468	chrome.exe
5468	chrome.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
Token: SeBackupPrivilege	712	ReFsDedupSvc.exe
Token: SeRestorePrivilege	712	ReFsDedupSvc.exe
Token: SeBackupPrivilege	712	ReFsDedupSvc.exe
Token: SeRestorePrivilege	712	ReFsDedupSvc.exe
Token: SeBackupPrivilege	712	ReFsDedupSvc.exe
Token: SeRestorePrivilege	712	ReFsDedupSvc.exe
Token: SeBackupPrivilege	712	ReFsDedupSvc.exe
Token: SeRestorePrivilege	712	ReFsDedupSvc.exe
Token: SeBackupPrivilege	712	ReFsDedupSvc.exe
Token: SeRestorePrivilege	712	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	264	AgentService.exe
Token: 33	5644	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5644	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5644	SearchIndexer.exe
Token: SeDebugPrivilege	4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
Token: SeShutdownPrivilege	5468	chrome.exe
Token: SeCreatePagefilePrivilege	5468	chrome.exe
Token: SeShutdownPrivilege	5468	chrome.exe
Token: SeCreatePagefilePrivilege	5468	chrome.exe
Token: SeDebugPrivilege	4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
Token: SeDebugPrivilege	4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
Token: SeDebugPrivilege	4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
Token: SeDebugPrivilege	4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
Token: SeShutdownPrivilege	5468	chrome.exe
Token: SeCreatePagefilePrivilege	5468	chrome.exe
Token: SeShutdownPrivilege	5468	chrome.exe
Token: SeCreatePagefilePrivilege	5468	chrome.exe
Token: SeShutdownPrivilege	5468	chrome.exe
Token: SeCreatePagefilePrivilege	5468	chrome.exe
Token: SeShutdownPrivilege	5468	chrome.exe
Token: SeCreatePagefilePrivilege	5468	chrome.exe
Token: SeShutdownPrivilege	5468	chrome.exe
Token: SeCreatePagefilePrivilege	5468	chrome.exe
Token: SeShutdownPrivilege	5468	chrome.exe
Token: SeCreatePagefilePrivilege	5468	chrome.exe
Token: SeShutdownPrivilege	5468	chrome.exe
Token: SeCreatePagefilePrivilege	5468	chrome.exe
Token: SeShutdownPrivilege	5468	chrome.exe
Token: SeCreatePagefilePrivilege	5468	chrome.exe
Token: SeDebugPrivilege	2876	OSE.EXE
Token: SeDebugPrivilege	5504	PerceptionSimulationService.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
5468	chrome.exe
2456	msedge.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 5644 wrote to memory of 4356	5644	SearchIndexer.exe	100
PID 5644 wrote to memory of 4700	5644	SearchIndexer.exe	101
PID 5644 wrote to memory of 5388	5644	SearchIndexer.exe	102
PID 5644 wrote to memory of 3052	5644	SearchIndexer.exe	103
PID 4888 wrote to memory of 5468	4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	104
PID 5468 wrote to memory of 3500	5468	chrome.exe	105
PID 5468 wrote to memory of 4400	5468	chrome.exe	106
PID 5468 wrote to memory of 4400	5468	chrome.exe	106
PID 5468 wrote to memory of 3212	5468	chrome.exe	107
PID 5468 wrote to memory of 3736	5468	chrome.exe	108
PID 5468 wrote to memory of 3736	5468	chrome.exe	108
PID 5468 wrote to memory of 3180	5468	chrome.exe	109
PID 5468 wrote to memory of 3180	5468	chrome.exe	109
PID 5468 wrote to memory of 2556	5468	chrome.exe	110
PID 5468 wrote to memory of 2556	5468	chrome.exe	110
PID 5468 wrote to memory of 4684	5468	chrome.exe	111
PID 5468 wrote to memory of 4684	5468	chrome.exe	111
PID 5468 wrote to memory of 4900	5468	chrome.exe	113
PID 5468 wrote to memory of 2084	5468	chrome.exe	115
PID 5468 wrote to memory of 2084	5468	chrome.exe	115
PID 5468 wrote to memory of 4748	5468	chrome.exe	116
PID 5468 wrote to memory of 4748	5468	chrome.exe	116
PID 5468 wrote to memory of 5280	5468	chrome.exe	119
PID 5468 wrote to memory of 5356	5468	chrome.exe	120
PID 5468 wrote to memory of 5860	5468	chrome.exe	121
PID 5468 wrote to memory of 5280	5468	chrome.exe	119
PID 5468 wrote to memory of 5356	5468	chrome.exe	120
PID 5468 wrote to memory of 5860	5468	chrome.exe	121
PID 4888 wrote to memory of 2456	4888	2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe	122
PID 2456 wrote to memory of 4864	2456	msedge.exe	123
PID 2456 wrote to memory of 2632	2456	msedge.exe	124
PID 2456 wrote to memory of 240	2456	msedge.exe	125
PID 2456 wrote to memory of 2632	2456	msedge.exe	124
PID 2456 wrote to memory of 2632	2456	msedge.exe	124
PID 2456 wrote to memory of 5068	2456	msedge.exe	126
PID 2456 wrote to memory of 5068	2456	msedge.exe	126
PID 2456 wrote to memory of 5840	2456	msedge.exe	128
PID 2456 wrote to memory of 5840	2456	msedge.exe	128
PID 2456 wrote to memory of 4680	2456	msedge.exe	127
PID 2456 wrote to memory of 5840	2456	msedge.exe	128
PID 2456 wrote to memory of 4680	2456	msedge.exe	127
PID 2456 wrote to memory of 4680	2456	msedge.exe	127
PID 2456 wrote to memory of 5604	2456	msedge.exe	129
PID 2456 wrote to memory of 5604	2456	msedge.exe	129
PID 2456 wrote to memory of 5604	2456	msedge.exe	129
PID 2456 wrote to memory of 800	2456	msedge.exe	130
PID 2456 wrote to memory of 800	2456	msedge.exe	130
PID 2456 wrote to memory of 800	2456	msedge.exe	130
PID 2456 wrote to memory of 2936	2456	msedge.exe	131
PID 2456 wrote to memory of 2936	2456	msedge.exe	131
PID 2456 wrote to memory of 4132	2456	msedge.exe	132
PID 2456 wrote to memory of 4380	2456	msedge.exe	133
PID 2456 wrote to memory of 4132	2456	msedge.exe	132
PID 2456 wrote to memory of 4380	2456	msedge.exe	133
PID 2456 wrote to memory of 5660	2456	msedge.exe	135
PID 2456 wrote to memory of 1632	2456	msedge.exe	138
PID 2456 wrote to memory of 1632	2456	msedge.exe	138
PID 2456 wrote to memory of 1132	2456	msedge.exe	139
PID 2456 wrote to memory of 1132	2456	msedge.exe	139
PID 5644 wrote to memory of 5980	5644	SearchIndexer.exe	140
PID 5644 wrote to memory of 5240	5644	SearchIndexer.exe	141
PID 5644 wrote to memory of 3832	5644	SearchIndexer.exe	142

C:\Users\Admin\AppData\Local\Temp\2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_a209a8b2bf194ef1cc654dbc100bf1ef_frostygoop_glassworm_hive_knight_luca-stealer_salatstealer_sliver.exe"
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff8f02c728,0x7fff8f02c734,0x7fff8f02c740
    3⤵
    PID:3500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1676,i,2762658938839918094,10109832223486877505,262144 --field-trial-handle=1896,i,11117227816937026595,15784209824493716839,262144 --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:2
    3⤵
    PID:4400
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2064,i,15652004987812970562,3326690351678269637,524288 --field-trial-handle=1896,i,11117227816937026595,15784209824493716839,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3212
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2216,i,9954512286439874623,10660836852541213962,524288 --field-trial-handle=1896,i,11117227816937026595,15784209824493716839,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:13
    3⤵
    PID:3736
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3036,i,10365282141437648210,4316470684711120961,2097152 --field-trial-handle=1896,i,11117227816937026595,15784209824493716839,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:1
    3⤵
    PID:3180
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2948,i,14886390952091132281,4689862393082372154,2097152 --field-trial-handle=1896,i,11117227816937026595,15784209824493716839,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:1
    3⤵
    PID:2556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4544,i,3239595063947364282,9061689435931593999,524288 --field-trial-handle=1896,i,11117227816937026595,15784209824493716839,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:14
    3⤵
    PID:4684
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,6136295190104406010,11902046207625863771,524288 --field-trial-handle=1896,i,11117227816937026595,15784209824493716839,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
    3⤵
    PID:4900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5432,i,1027444273304490541,3622068557506305035,2097152 --field-trial-handle=1896,i,11117227816937026595,15784209824493716839,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
    3⤵
    PID:2084
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5464,i,17313289184180281459,17637238942539439768,2097152 --field-trial-handle=1896,i,11117227816937026595,15784209824493716839,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
    3⤵
    PID:4748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5724,i,5690634403711342644,7230031348831833022,2097152 --field-trial-handle=1896,i,11117227816937026595,15784209824493716839,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
    3⤵
    PID:5280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5468,i,1348059905775394721,13542342050645965936,524288 --field-trial-handle=1896,i,11117227816937026595,15784209824493716839,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
    3⤵
    PID:5356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5964,i,11445400122372875323,2023532223747254564,2097152 --field-trial-handle=1896,i,11117227816937026595,15784209824493716839,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
    3⤵
    PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7fff8aa0c188,0x7fff8aa0c194,0x7fff8aa0c1a0
    3⤵
    PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1712,i,15592468101156413891,12328653214704229940,262144 --field-trial-handle=2256,i,3129129966989090658,14587666900748501649,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
    3⤵
    PID:2632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,17849723482248818252,16200672686497962405,524288 --field-trial-handle=2256,i,3129129966989090658,14587666900748501649,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:11
    3⤵
    - System Time Discovery
    PID:240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,12493870309337876297,3919770323522633214,524288 --field-trial-handle=2256,i,3129129966989090658,14587666900748501649,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:13
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,9389882132084623063,15979051108494613889,2097152 --field-trial-handle=2256,i,3129129966989090658,14587666900748501649,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
    3⤵
    PID:4680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,4931642676550526690,15465198359894539258,2097152 --field-trial-handle=2256,i,3129129966989090658,14587666900748501649,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:5840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,12809628373036647141,809473896580729109,2097152 --field-trial-handle=2256,i,3129129966989090658,14587666900748501649,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
    3⤵
    PID:5604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,11375420847729706139,17213013997434398328,2097152 --field-trial-handle=2256,i,3129129966989090658,14587666900748501649,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:9
    3⤵
    PID:800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,12291129520194351748,3987120894917110371,524288 --field-trial-handle=2256,i,3129129966989090658,14587666900748501649,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:14
    3⤵
    PID:2936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,1257955534386251233,851951058148460932,524288 --field-trial-handle=2256,i,3129129966989090658,14587666900748501649,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:14
    3⤵
    PID:4132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,5098127191941492322,3912700970293326496,524288 --field-trial-handle=2256,i,3129129966989090658,14587666900748501649,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
    3⤵
    PID:4380
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,6802537233058439427,14860217845123249101,524288 --field-trial-handle=2256,i,3129129966989090658,14587666900748501649,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
    3⤵
    PID:5960
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,6802537233058439427,14860217845123249101,524288 --field-trial-handle=2256,i,3129129966989090658,14587666900748501649,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
    3⤵
    PID:5660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,16414530850967420520,14271761811165373993,524288 --field-trial-handle=2256,i,3129129966989090658,14587666900748501649,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
    3⤵
    PID:1632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,16748473123645225211,13249671126862452134,524288 --field-trial-handle=2256,i,3129129966989090658,14587666900748501649,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
    3⤵
    PID:1132

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5960

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5100

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2876

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5504

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:620

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:712

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5500

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3216

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:264

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5644
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4356
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2894455325-857903158-4263030270-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2894455325-857903158-4263030270-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4700
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2976 2980 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5388
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3052
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5980
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5240
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2976 2980 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c59bcd7ec79a9520d25dcd47b13540c5032d296e303501c02060e63cb36c1d22
MD5 e358247226c52a24f2b4149db81a125b
SHA1 ce1767c0215fd78928be16fb3d0de4a2272ff516
SHA512 1a03c65483fdf504b22dfcbc8a0c5b94442d14059e5b8ffe17bf38479a5a90ebcaa5691355efab541b8ada42e6faf9b3f34dc1c95d745f0d0efd7485b039b6ee
SSDEEP 49152:eb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn55SW6H8DS52tdDpbRZy:g3q6HjBA5SSDntdDpbRZy
TLSH
T100D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 bc38f4f8aef0d4fa0970f27ddd576771439299717125422af5044f15ca22248a
MD5 427b9d950e125783e3b1ce886dfdab31
SHA1 c5a1f20a22e97efe7f274da9eb4fec4aeccd63d4
SHA512 3d74f6ae26d6a744e1cf369456812d58324d608719f668f3b2681ac0a109eb444415e053ac74335e487d9e763756c034d1645c296b67169a38145d37cf6316f7
SSDEEP 24576:0XYfDtczAU5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:ztcD5SW6H8DS52tdDpbRZy
TLSH
T10E05022873D008FAED6B8279C8B28511EA33B8954760E79B03F495664F337C95E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 d5cf6b256d93c7b869e3b2c61278ca8485677dae096a4f83801064bc49853acc
MD5 2f1137d63f3af545307971d2ae742a13
SHA1 2032bc86314e2599a07aa91e0026d7f598752db1
SHA512 69c4bc8d58c5864ea46f1406006ff5a33087821cef4b62e2870aaec77198c73b5320d9c36aca410fd063813e59192e3ba79fe089b7d3c3a17c8cc0c43dd1314b
SSDEEP 24576:D0Le5ji0hmxirMR5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:DPji0Ac65SW6H8DS52tdDpbRZy
TLSH
T108359E55F6748332D073C0B9C5D2A69EED7130865B308ACB4286D77C6F27AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6cc750d6f871773e94e6ca76e09a2bfe34f50c8c491c7d80b88e35442ef17d90
MD5 4329b4a293404443cda77daa6e1b79c0
SHA1 6d2b5ee17240781c1950dd28d31910ac0cf87176
SHA512 ab552d1ed5b36a6abc0495b83b20ecccca05fd7b8552e64026337dedbb652b185568e0f8ce20dfdfebd01153e00ae41fb6822a39ffbce21db12ea0dc39d27668
SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWE6q8wyuT5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:D/ezSC6vUzPvxHjye5SW6H8DS52tdDpO
TLSH
T196755C15F5788323D0B2D0BAC5D6AA9AFE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2b37f6eb69acdda0122117587287192bd6d9ccff38cf0f1497e0833af662ae89
MD5 7d34eee3a97de2fae255dd8ed19d3cb1
SHA1 2021852bc81bdd7578c7366f0ba3f09e19eb840c
SHA512 f432762d2654a264c641ec3b8e8ce02ff0ad4905891a936ea27695440a47f5ecaebc8484e0b73cda3a7d63f00b9996edb2c9e0064095f895e863f38dc81dd0ef
SSDEEP 24576:IVbqPb88hv/l+6Q5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:IVO88hXl+F5SW6H8DS52tdDpbRZy
TLSH
T10B559E65F6748331D073C0BAC5D3AA9AEE3234425B318ACB1246D76C2E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 0c3f48dbcc42da089feb43f90f389b6604e6634841e7cf0d94a14f6b329c79c9
MD5 9250339ef5d6bdd82da897bf30344959
SHA1 544c46c6f5593f513cb1d9934734825e886152c0
SHA512 03c9ec3dc3ee242273aa63ce4240e3ec853595ffc73cc1d49e19537145514f8974b7427ae8fb740d6746923b69cdd50b5789426ed50e1ef66aad4ad6bc841cb6
SSDEEP 12288:BRt5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6F:BRt5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1FAC423C4479030A7E31F0AB3F1FA96D4DA18EDED8408663B4E717687CA3998FC576426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 f43e7ed073d042fccbf8e30b5d2046e3dfa099814dec509b6ce5838acf96d13c
MD5 13fea6f8c7d4192b4cbed72fb8890def
SHA1 1e860272bf1d84c31e9d0a1ef36244193af322db
SHA512 db3bc90bb2cfa786bbd892076e12d1b1265095c0ef4d169db7cac9f53d5c3f653f342a724833b80b1193d4312c8eac90fe0aea86275471bfc1f81f1ebbf52278
SSDEEP 24576:lJIUo5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:lJIUo5SW6H8DS52tdDpbRZy
TLSH
T1D605DF7BEE28FCE2C27E4DB956918640D77278704B21A3CBD175820ECE235E54E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f3606b2a248bc6528a9b295781bb9d5ac1bf43a917dc491e22b58b35dfdd1128
MD5 8f848521e2c73d1975c008a5ac73973c
SHA1 58124ea35a83e3e4985064720a77e51765717413
SHA512 1cec7a8f2f832ed088f169dc2c9f813064d6a1bcc61f19b12980c7ef9ccbb1ba3ac8fd147e02700a30e596c03cc06157872a5585f0cb85a77a4c572b8a40538f
SSDEEP 98304:UQvGAdlCEL8c/yRNw5Cj5SSDntdDpbRZy:pvyEYc/y3w81SintdDFRo
TLSH
T167267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 6aeebf6409c423abb236ad94755fcbe8f9755eea1121411f8ac0ed5bf15f9aec
MD5 2c7b232ca455427ea53c29e3a71eb115
SHA1 0071a849fd1ece55e03fdf831bc8ee45cc2759fe
SHA512 291b11f3e0c4bd7e4c666246c92886a72fa5a876894b868fa610bc463faeea441ee60204bc73c82a2afcd59d831277968f13d626776ccff271221a46811c0176
SSDEEP 24576:AdewsAjK5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:wljK5SW6H8DS52tdDpbRZy
TLSH
T16915E030FB74E037C37F0DB21B76C716582CB9604B511AC3E3A89A9E99342D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 02eee24ed3988a4875fff6084f1dfa000180e2841670da878606379c61aba063
MD5 9fce3db6d4a22540fd6950ff8a703140
SHA1 0858467ecd9478e915352dc825d097b68a27bd55
SHA512 40b31d865cee9822ff4450f75eea1faf23dd99cc793122041dc0bc4db253d9ff626e7130a20083e7bde3c78bf8f9e7a2a8b1ad7b8d3612a736cdd536c5881872
SSDEEP 196608:+UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHYSintdDFRo:+UEtQevvqc2W1cpV2EI32dedDFRo
TLSH
T1F2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 083060dfdbeee5b53583f076444a79bc1158ed199537cb928f735b81bba42554
MD5 b06775a8ba45b6d23720be875ddcd0a2
SHA1 2ab0c6ae620695a100e5c704094e165daa99fbe4
SHA512 a99acae79bc8b4f06523b22b2b039bbb0bf4d1f8451ef67316b1d0b678e9e0e74816e69749652ec3079fcafdab6e797e515061b8e018e66442c3b434615ea5d7
SSDEEP 49152:YCbRquA/m2yL5zLfFiV+XenmE3/zq5SW6H8DS52tdDpbRZy:Roq2VjnmH5SSDntdDpbRZy
TLSH
T1C1D58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c9ec06b148931ce783e593970e98f9d9338ce4c353c112b594a5a1700e267aaf
MD5 896ef60acfd06e791582e8e2fb11baec
SHA1 18c5e20a87bc01814e54967f16ef243e06c63c89
SHA512 21b2c36b845be3b08dec66f5a7ba8389fcfc76ae03cd6560bb817bfe5d58272890483d9569017eebbebc06144833d649046debc02db33317ea1aeb8df8ad1dcf
SSDEEP 24576:ZAhGLJIFoiwtA5l7S53n5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:ZAMyFoiq5X5SW6H8DS52tdDpbRZy
TLSH
T1F035AE80E7F955D4F5B7AAB899B68171EA76BCAA5E30C21F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 e7640bde03bcca2fe8c871c1d6d02c4b03e411d13d76a6005ebdf67b4e6de1ee
MD5 c8552e76315788af15c18bf1a1d419f3
SHA1 124c9d6303c4cca2c14d8a9c35d6ca9024f49d99
SHA512 b6d0b18e8b0f0705c199e2c37a81f7a8a9c04fba2c0e930801a1313f67c1911285f78c6ef020682528c42d9ee3e8d995c0b705a1b96326ad35ccfde4e96857ea
SSDEEP 24576:0wuoOW+5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:0wDOr5SW6H8DS52tdDpbRZy
TLSH
T13A05F14533A41CFAE96B4239C597C136F7B2B8162A24D72F0760C65B5F37252AD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 3dc9c690e37316bf1486c55cabb421b92c19b08fa35078a4ebffe1172e9a2f69
MD5 4573d1616a066c12af20c87a506ea5a3
SHA1 8f817865747ab0ebba03cf9915d988e83a3a3773
SHA512 fade9739b99089708fd2a2bdb873f6561f70ffe8505d9079b78d1cc646c95b22c67ea63d55947c41b356ab71615057b7bf52c78c9c4577bd7e3af17243e4e9c5
SSDEEP 12288:5BZ1Iya5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6p:XZuJ5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T1A2E4128923E430FBE25B42BAD9F54685D771B4A6533443DF0A60429B5F33AC64E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 977f360b389bf644eda0d810e4598b648ab8dc2183d8b6fa7efd5e257881f46f
MD5 7c2b7ba7a414d229c0843a6ce618a9ac
SHA1 b26ab4b2aeb7f7d3b4dac1ca0168ca7168c04da1
SHA512 5806ec25f7dfdcb5d75b4b912ac3711bc692a22fbe123048e0ba92eb8c089225b19a2a95b8b8eabea9e945223f13f67d7863f1a4d413eb8959a57dd3660eef4f
SSDEEP 49152:E68Qg55nhheWu7PNU3/65SW6H8DS52tdDpbRZy:uthWRc/65SSDntdDpbRZy
TLSH
T104B54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1def4c3f988d70d540babe7b99f7f3ab8ea568550eb229f7c17ce9253aad8f01
MD5 9e81a85febabf940b7a0adb2bfc1a8ea
SHA1 58160826a9a6b73c7c9ea25d7a88f92b830cbfd2
SHA512 ff5eaa2883aa2dae2927fc5fc2133b0619ee29c44d85f63df489bcf974c96603fd610d17db51e54d87f0151022ec93df15cabbf8a669d4386f5662d832622d8e
SSDEEP 98304:ny5112gYy5azzVvL69nLKnhZt5SSDntdDpbRZy:6LIHmWhhSintdDFRo
TLSH
T15F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9f20f279c655f5fb9cde12ac46af56e523eff77c950cc199f414fba5079596a7
MD5 b9bf62fdf52267772def6ba19472de84
SHA1 e504337f88de173094afe63d6e30a9bd83651cc5
SHA512 5d7afc78c6fadd76eb8ec1de4e3831be25677b9d052f1ab179fae5e6c0ac405630c517bd8b875042aeb3a1ab20625995c933d3112c2ead65c64b18c44f284edd
SSDEEP 49152:4B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glE5SW6H8DS52tdDpbRZy:Su6JmVxd2dE5SSDntdDpbRZy
TLSH
T142D59D13F1DA01E8D05ED479974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 2931bbdcc495f415f82cdf20c2d2cfe497982648e5c7eaacf07a1c4e5a2e4fa8
MD5 19729c4e5fb2ad0875f75c399f987709
SHA1 c0a2c1d5124e09aab0d2e58bc32ef86916e79f97
SHA512 0712a022f306a96b410d8ade0b59bb5be21df64e359ae59ec9163d1ce4833374fa5e51ebfb35f0bc8b6f2c680cfeed58aac32a8f921bedbdc4eb9eddc58a91b5
SSDEEP 24576:tfwvok9RX6wkyAIN5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:rMnYIN5SW6H8DS52tdDpbRZy
TLSH
T12135D029EBD804E6E177923C99F7460AF6B178691B31C2CF025A536E0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 cab1b7ff42eb36d16a33e1d05e45a936f44e32bcc7522b2a6dcb845c6ed327cc
MD5 dcedab1b89ff1b9c32f7521f9627a235
SHA1 31c6c1fa2070c9c97d87033683c93df96e2c60f0
SHA512 49ca6347ffd201f3c36090fca272a48241453b3853c3b447eb6ad4b5e60291c7eccd6e6bbc02f7af451173a114b1ebd7481dcc9107f126ba5497ab5b9525de7e
SSDEEP 49152:9YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK005SW6H8DS52tK:9ySzPs5SSDntdDpbRZy
TLSH
T155066C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4d2ebb0d1841aba2e72022587569e92d62f0050f9e98c90cce7d6412b204727f
MD5 434f84dde33ef261febe291008faab2c
SHA1 e7a632f916cfb4683702ef0fbecf85558bdeee26
SHA512 5baf51379961f7389cd27fa1c89b8d713e412218afb5d18954a02a5003f892d3a830ed7840f3e180264698037793dc01d855832bcc19fcf5f6c2f4efd6b8c072
SSDEEP 24576:N47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYW5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:N47JUQj1irIhCnDHUPfF/E5SW6H8DS5X
TLSH
T19C65AE1DA3EC01E6E1BA927885554A5AEA71742E1F31CACF1270837D6F23ED48F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 84f0f64a26ff682d7f85c60acb687d4802c7d9ad990d02c7c6ccca327d670688
MD5 961977ce3a16942d19ef102c844c043f
SHA1 977c8e87277db2ebc4cf0e6e961ee39abdac651d
SHA512 1d41bd8144b1b28f4aeedd199715abb6eaf48754d1e43da0b8e74ad6f756eaca5ebac6e98becf91cc1c0b07472ebf0a31d17ad8e6d82b43cd7a492d1d0c127f5
SSDEEP 12288:8NsfJ5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6q:tJ5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T182E4F149D39412EAC02E5276C7A64680F3277C6983E0D3DB5AD0F53E0F366859DFAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 11544baeaed014abcd83004ff6863060259a22af541b3ef6e5343fae9b35c041
MD5 00c82181d0c510762c27ef202c6905e9
SHA1 656cc8ce9b467beb1959f6d536167d187e890bf1
SHA512 e55023554df9eaf700f0e8f3961a931ebee81c3f1b99fb08bedabfb852749276f829a7307cfb53975a065720a20240e619871501efed301555f1f2d053774de4
SSDEEP 24576:naalvRUPEdNvaPC96EZMWq+yldRMKX3sQnzMXa7:ZVRUMOJfjrRMKXcQzN
TLSH
T15C5527007626D78FC6A940725E36D6CCAB707D41EE446F0373C8973F9476658BAFA282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 185cd130a060c760214d7d3b46603ffd233548568460ff1ea8246293c395e398
MD5 71f3a2e6416b6bdd7e168310cc38dd10
SHA1 1ad3d717e53c55fa33350e013ccb6fb58a8f5a4f
SHA512 071374e6ced1ecc3d3cc5c12bb61e50f0d9a1c3dace0ef9f02b5b3d53cee6401e462fac25ad1801384d311725634828d75d2fa502a2fc40598adbdfdacfaeb05
SSDEEP 24576:QUadn0BHdsWusj1IxgJnYNMpdXO0ssgWIk3UbaHSfk2iSRgem/ASP9ZbqFgAx2wd:QUadn0BHWW7jqxgJnYNMpdXO0ssgWIkC
TLSH
T1DC552A01A5B3E34FC97E50774236868D7B746C07BB453F017344893C9866AAEB6EA3D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 426dd35649fc399f9a606f54263b4dfb1b23df76ecd3a67ebc4c2e5afd398e38
MD5 fdbbf33d4f13377661b1e59bb1f27eea
SHA1 e073ea77b433f8fb350f5c4a482153acd9203a67
SHA512 09d049a607bb3d070e3e3c83cbd9f8f282b6dd09daea275639b462588a5362d84193194f00ec0bcd13a3d8efbf92d240a83560ea468ac67be0370e6885352ecd
SSDEEP 192:QrR1P3eoc6kGv7DvAPRp2A9NHsb+WNn8VPt/PHdkwEUVyIsnAUgR:QrR1PO4dH6XfrwGP/kQR
TLSH
T1FD32972EA954653B9CDED22AF9227B53E3F5203275D42E84E6FC8A2C25D79CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 8c31e10e96245aeba171810abb981c770c665bf25bcf3bef3c4c87dee31cddce
MD5 2b16a71632bfd9ba4d31a481a0511ac0
SHA1 0cea752dd9ba09f57381195e44c49c3bfc536893
SHA512 3114c0fe177f10c77b1ac7bc260c002885fce64c4cf8fd0a83d76796cd8a0040a512ea4df285fda9c2c8316bd4e1f7e855ec2599dd46cb31164edf57b4d7d34d
SSDEEP 192:em54K6+g7KxkXqK4I40pUZNCgVLHrKHfFKslEJOYXzKD/L2+ErUkKN9847vAJsyr:35jRg7KxkXqKf/pUZNCgVLH2HfgslRYV
TLSH
T19832D827A48D9A7F4FD8E81CDC126F4F6DB4019672680D24A6FF5D0803A57CA125E1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
Size 138KB
SHA256 4dcc245567b34bbe5f97bea6709bf790a36a180cf8c2f74c5dd51eb59edbfd1a
MD5 0d700f592d8e977e0a9f1700b17470c6
SHA1 d237546f4a0565fded7b082a1933528d7d88e00e
SHA512 97b26328b2f90c5f67b214f2462bd90e9cd35cac299abe431789777c248ad37893bb0bda20f2aeb56da38c4f720982468a841584270b78417a98a46a7d5e68a8
SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OxaVumkZnyR:1nbZeMrv/hGtxVZnyR
TLSH
T172D3A74B3A743002EDE59A721CE051BB5E3CB16D4F51A5D538B620688EF2963B23D0BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 671c67f7021422d16b79587e030fe232349519c0f40a5de57dcc1df40e8b9baf
MD5 7298955d0e0e95a783a1261ad0541195
SHA1 13722a325b4ce10fd86fd62db2bbbc12426788a6
SHA512 5cefab2728526609995d624f4ae2355be069d4495f87798fea4b639f93b820741be622081e6c0ac389dbe9443ddde0e9d4466d11a76570b5cc68ef9daa0b8f29
SSDEEP 96:UC0d+CW1CHw1yfFtS8OERDotok5FdDpwB6lGyvQ7C0sVbEnv4a:UC0RW1YdSUDUDnp0h7C08by
TLSH
T199A10932A4688DF78472DA89F8472F43DEB82157A620BFC4A9ED1F0D15E70DC0782927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 bdd6de6ca0bc9ea4ff82b0a3fa017e3f7a4b93a3e5c43fd4a21cc4c9f6c6a76d
MD5 8d51ccb2ffeb93ec92fff248e6f3d9fc
SHA1 8fff94c730b7dd2e43b3372fabe1105a66746476
SHA512 531c91db5bcd3ead967830111c209dbd177c3d32422b613e772b0a45a79e62e16893a0134f0936311248a9ba780a151da190b65d5c09a5d7b64994e3b8fff21c
SSDEEP 96:GC6Bd+CW1CHw1yfFtSqxORSl8h4otop5FGDpwB6EGyvQ7KTlOAy7z0saU0j9Iy+z:GCORW1YdSqQiU2+p0U7KT07z0DUUA
TLSH
T1F2C11B71AC6C5CB385B3DA56F4032A53CEB861A79610BF849AEE0F0D06D74DE1743527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0f06119439d622a1a5078cf90d2c84d55bc25c179cc319a31bc271a3e62dc8b5
MD5 39897ff436f6a2795449c696417893df
SHA1 b1e15f7b2c6f5ca94bea9d8a160cc9e6864c1d06
SHA512 75fae24fb44003376ccf64d6c3715357ca6f73fb6cca4422a2574a4960dc75c830ef617f5476e7fc21942b321e9fe764ebf9ae64abfc2b05a73fdd7fb96ad95e
TLSH
T1F2D08030FB45B745C78605F2D514A720637A864534C2C60DB2A2D50D98681D0B7E79E7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4921dac989a582c68ea2ce6e44eb3bfcd7f8bf3d87dd155763734d09e46d6684
MD5 6fe58dba083868c4939df3729856b544
SHA1 2946fc6a531247a5afe5d20c0abec1329e76da1f
SHA512 435b892e3c3ced9c341bcad7627e98220f381783f6c0d232345dd92e9cb28357bd93211262aa046fe541f6bd0686d5084ac7e92c687fc72829288aa7d9c823de
TLSH
T1B7D08034FB45B745C78605F2D514A720637A864534C2C60DB1A2D50D98681D0B7E79F7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9684215fe01071c6ac48563cf68423e115db638f170bb3bc86ca9c1afad2c5b8
MD5 ba97b366968b3b1bae4dacfb3e2fba26
SHA1 f25f68e035fd25e804ec013c245d7c0776752e6e
SHA512 34a519631e45cb8fd7ea690af39ddb0a3ae8b047f26f59108e04d8ea72326042fb2eaf6aa26750c730e7f1f1d94be83e95d121427a5d54a4ef43d29328a27675
SSDEEP 192:sxRM/yM/jK1Ml8wcm/fvsktqzZwQaDzoA8pi/g6+WNIYPPUPGzrIgVIJ:sxRM5Cm/fvskU9wsi/5IL+jm
TLSH
T16052D915AA285937CCDBD30DFA557F53D6F81573A1901E44AAFC8A0C05E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 5bbc8eceb5539581d9c61e1083c9b95352d9cc507e870aa119b7468d8619e803
MD5 8514f520247fcf77dde463e100a953a1
SHA1 30557b757a0bf1764d25851123d8e535f583f930
SHA512 22b83a9f6dcd348aa28659f45a2390e9d41837310b6deed722d1b48316d6e790b6e4f514c8be830f0707be0b6ecf4993a19206c09a66c6031797455545a93406
SSDEEP 768:LKKgv47pLuL78xWgdVf7k8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0G33nYtrouFvGC:LKKgvkE78xWgdVf7ku1jaXG33YGuFvGC
TLSH
T10AE2FC7B280CCB7F4F844E9CED29B99E6DA801CB9698CD9447EA840C03D67EB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4211ecd48029d4a0e64bf1cfd42dc0d5b032e0f80fd052428ccd44038ea6e701
MD5 fafb465e77f10a1c36c83bb7cdad0e2e
SHA1 67bf3d0c1d10b1b1acade2d4de6a2af533ce65d3
SHA512 d2ed44c350daf2c5182798b0ab494704340c61952ab4cc405a94ffd9939c2d50ec23583a7b58a53e23daeccc64fc5343e1cec3285bfc772f7eafc867605880cb
SSDEEP 96:KMYQKBy8yicK/6M6LU46Ekh9Yd8DwhKLID6h3yK1wEoilmBF7Th:iB3b6LU46EknYd0weID6lyK1wEoilmBL
TLSH
T19B91F0667A7A3740287E660DC2D4957FAA4230737056A42B7FB850E25B37E411EFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 256KB
SHA256 c3c10e03e35a2b5f9c7de6ebd5f9335b4582c2c12bd4123d1673b7710434c2c2
MD5 2efe33adcd662894c84cef9ff84f50d0
SHA1 7f611bbad09b9538b1207f09dba2e59f6fd1cb1a
SHA512 e1febac99a40bff187a436ed9949154e4eaba098fe925ce215fe3bf5b7bf843320a466be5b8c3a324cb108e5ecdb33208431616670087391b507d83d2e97c982
SSDEEP 384:DNrRZyCSDnxTIC/U5MEhIKyll7svbFKfk7:xFZJSDnil+yI1l7svbF9
TLSH
T17C44750A7B747001EDE6D9725CB080771E3C716E8F22A6916DA254698DB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 868649e78678bd49dfe95c8f1392045d3f64084872a744e3d33d9328d5c88468
MD5 d5a85194a3a362415b57206dfb529c49
SHA1 34d928fbbc15b8be3a18820850c8c7fc8bca6817
SHA512 0696bd96c1b80152eff17170af10f4a0d60e6c87457d291c29ed2fe35d74ec9625514ff0dddbca3e12625fc2e704eebdc0ff31efd5391cce164aefd62766f3f9
SSDEEP 768:oqjaeqD4MlshiLdMmJ3+f/cOxflSAUp75riXYUsZUgb9eHcT+ApXTcsTJ:oqqcjhIdMG3+ZtMiIUsZUgb9s6+KXP
TLSH
T1D313C0B59EB89C63CCF2DAC5B35B76836FB901A385C4199CDDC95B0D02936DE130782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 aaaf12b00f8897e3d680c11eb6a6480ef841b6226049bd4d5df4c0bb49e87c19
MD5 c790851e119e13814ec2630435712fe2
SHA1 4c934f4dc776c8373e0cff764c0b397871406676
SHA512 b6c596d3123e81de96ee3a692a7528a3b42417d766480972701bf0e0c8a8b3ef06bf73599feea236d86bb381f0541d481ab995758ee7f797100768efac58db16
SSDEEP 768:ZkjaeqD4MlshiLdMmJ3HUIcOxflJ75riXYUsZUgb9eHUP+ApXTcHT+:ZkqcjhIdMG3HBViIUsZUgb9sq+KXP
TLSH
T10A03C07999B49C678CF2D6C4B36766472FB941A386C52ADC9CCC6B0D02E35CE530782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

300ac04b

Path C:\Users\Admin\AppData\Local\Temp\aabf7417\300ac04b
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2456_2131074145\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 9d60bb517aefbd4be140d363d939ecb93eac9feb2d029cf8e38024f9b06ca361
MD5 9c11744ffb13da63f84876425da35ff7
SHA1 61aadb1ea4e6b83add6b804ab4aa3a1a590f5a5c
SHA512 365aed9ac795288ba28e6b4703670313454e890981f7f6d3f5018590e0a6d467336b2bd7a2d5eaf7d4af56a4478519af3f4f2b5061e41cc2e738f6da9855b135
SSDEEP 12288:tF7x5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6U:bx5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T133D4238053942597F22E06F3A1FA82B4D60CF5FE8B0491FB9D206287D735DCB8D7651A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9bd7921657b3fa0a30c518436396dab23ff5f96ab0f6629658f1d1584eb65a51
MD5 814c411948302e28ff1a9745d797a248
SHA1 2dcee2230afa3968c2bf498a37958f3bede1e4ed
SHA512 3a7e616f77730d0da57014a3d3d64db6850f1d59a8f90c9c33d136b6b821246fa2760224ff24a53696bd7fcee1dd5942d6011dab5aba58b0a5df4a4877749b56
SSDEEP 24576:Rgb6bmBIi49WNNFpg1rSvFv7bYT5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:Rgb4mBIBhGFW5SW6H8DS52tdDpbRZy
TLSH
T1C465AF1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 0d64209ffe692f27bde5ca3c29946acae830678c30c1caa154d1eb81f15c5893
MD5 757fb86762815490af5e3be20c6f73ae
SHA1 ee7416873f7cc1752649c9248145e9eabf569322
SHA512 1543319941d43feb9c41cf787498f83e6915ad475c1e962f1ce2d73d3039c9cb2e19709c366bc157294da5ac5e3fa9deb4bca8de0c7fb01cadb2a62fcab3a6ad
SSDEEP 24576:MG88u8FpJqH1bzria7/mG5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:v7ZFPqVea7/75SW6H8DS52tdDpbRZy
TLSH
T18535F16577E101F1D47BD138898646A3F6B1B4250324EBEF0BA88B521F23AD54B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 aa040b5c7f66919316ea3e7d4297a20292d9ba52b759cf952b54d7cd1d60b2c7
MD5 563e586d4c1eab4a6e1d22c9205f38d5
SHA1 66a97e0765a70128a59efd3178f8b9cdbf874178
SHA512 dcf8c5797b2c472b59d4bc21634f230cf8b2a7abe1bf74eb1628d7a88a1e476ecd90fc2967eabac889dadce1d5ae4b0893606ec68fafce3c56f4c55361ca3a67
SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAji5SW6H8DS52tdDpbK:SG05lO43bV5SSDntdDpbRZy
TLSH
T1C9D5CF6A62EC11F9D1BBD17CDAC64A0BEBB23425033456CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 84c6ff506649dcd03009c90404e6729b5a494332c78384087ec32b9f16fbef77
MD5 1754d9f9e8f76bfa63b436e38f2bddc0
SHA1 fd7e5f8ff99e723353b6880ff96f27f883408a3d
SHA512 c0853e68759d03ea0b2c387c26265846766ac6f171e3755c7e984908f74cabfcbf31eab288c0c405ecfeb4a8a4ed15110b5cc56b7799e3361100ce82bea4c62d
SSDEEP 24576:3fa5POZ3dpFWVM50JicR2hG0lasx2+47eidn05SSiVw6uAX8DS52tpz9ZRzbPmS1:Pa5POZ3+Jt2pasx2+m65SW6H8DS52td
TLSH
T1E865AF5EA7F801D5E179D17DC583861AE5B1342653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4c35f5cdcaa839242156fdde4f51bb6b079c7d89d8fc8efbbc1c0735d55a7f88
MD5 a76550b42d4317ab2ae95c2032ea5aff
SHA1 8823d888e6a7de2ca9f781ac9422cb31b0c38586
SHA512 d25981bad4cf556ee8a4aa1e0b4e1bf8cd6b4f04090239476eb46db39990e3ed5a97989080d8720500ea38985c4df429f3043a438836c00187a57332cebf1860
SSDEEP 24576:eNcwHdjbyQ4nLC18lb/EOjowL7Fke5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:eNc/zEOVHFb5SW6H8DS52tdDpbRZy
TLSH
T14C857B5623E901E4F1BBE1BE89779546FA71786953308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 080a5e9b1d0555bc1210bf7e86ad4d50ddcd16174471d94bd289e871115687cf
MD5 624ba43beb37ebc6539b069a40c99d27
SHA1 23c607be359edefe41f71ab4ef6ecbf0d854aee3
SHA512 ec9646b9fd64c2328d2727467380c314ae5569b3f83da92136fc87ba3f4b5c401ce9ccb3d0942384a304d2e9feac558ed8b62d1785a34fffa92ce0ff2c2ca74a
SSDEEP 24576:58kNvNnaFeYhJNtmZBm45SSiVw6uAX8DS52tpz9ZRzbPmSZyo:58MwBtOm45SW6H8DS52tdDpbRZy
TLSH
T1A055AF6EB6B806E4D1FEC6B5CD238512EA727461073293CB5290C13F4E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 58b9340eb6fd2cabee72c8815b0f8ba3b9932de3e1e31cd9db88b5b91f97a100
MD5 3d9b86dc7d38ce2e54018d99ef9c219d
SHA1 b1ec39745e8445c579f55cd299e9f0374fa76985
SHA512 c1ed30dcb4b7d339b2c1b2ce7ea1e8dbfc8359523e23d9d303ffeba006e08957557d57d77f99f1091c7c3ec103ef785aeb5dbbd459925779a72abdd3c592d488
SSDEEP 24576:WPUr+NQy5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:WJQy5SW6H8DS52tdDpbRZy
TLSH
T18C05F15E22E818E6E67AA17DC5828719F771B4660311D2DF06E0817F4F27ED8AD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 2355453f905f4187ef7cf7acffd228f05ef6b0e20b25b0e3be8a9722b416415c
MD5 a5f0546fbb8f642ffae5b590b9f2cb67
SHA1 b201bfbafcbd499c7649b4ea95fe6bd8bf03ce75
SHA512 97ae276eb519dee48022715df12f28bec450a99d504eb5bec449dca57d789b7419fbea9f83bef22ac14488018a647ed191c771035b9bf00e95671c7ba2c83776
SSDEEP 24576:aD3FHshBIYQgAl5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:aDVHeBIAAl5SW6H8DS52tdDpbRZy
TLSH
T1C725E17DE79800E5E57BC1BCD6A38A06E77138AD032166DB06D081B65F2BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9578acb0a6e14f9.bin

Path C:\Windows\system32\config\systemprofile\AppData\Roaming\9578acb0a6e14f9.bin
Size 12KB
SHA256 b26d6e621b0375b3dc03c9042dab40a0dcefeb80b934520a697876bf5b73f22a
MD5 6da8879dc0ec9585006cb87c52954a38
SHA1 72191ff9f6b33560c18f019fe1dbc58a0967d725
SHA512 2db46de0a32ce32e2de6f3651a5a16f8f9eaa9fef63fd9f8f76277bbb90af88548d60d28026b9152f0e791da87461e27f40f933d2c637d78aa9bc460d83b6861
SSDEEP 192:JfW+qVHNRpalfC0y5zVF2cismQgmjqbZpg7ApfJYCqB9lpumvVbiJ8Mv9fRIMNhf:JfW+qXRYxcTNmuyZpgcP8HqJvlfWMLf
TLSH
T1E842A02941583BE262725AB1C9CAA2B07E791F1FA7CAF9CEC109DE16523353CC026653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/264-136-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/264-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/264-130-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/264-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/264-138-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/620-85-0x00000000008E0000-0x0000000000947000-memory.dmp

Download

memory/620-80-0x00000000008E0000-0x0000000000947000-memory.dmp

Download

memory/620-79-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/620-313-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/712-97-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/712-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/712-98-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/712-91-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/712-1338-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2876-57-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2876-63-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2876-56-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2876-296-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3216-318-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3216-123-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3216-115-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4888-335-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-410-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-330-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-331-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-332-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-333-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-334-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-319-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-320-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-328-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-312-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-6-0x0000000140000000-0x000000014044F000-memory.dmp

Download

memory/4888-10-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-2646-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-369-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-372-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-370-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-375-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-379-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-385-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-392-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-395-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-399-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-401-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-394-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-393-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-388-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-384-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-398-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-407-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-411-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-329-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-421-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-423-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-422-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-327-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-2645-0x0000000140000000-0x000000014044F000-memory.dmp

Download

memory/4888-7-0x0000000000170000-0x00000000001D0000-memory.dmp

Download

memory/4888-322-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-325-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-0-0x0000000000170000-0x00000000001D0000-memory.dmp

Download

memory/4888-55-0x0000000140000000-0x000000014044F000-memory.dmp

Download

memory/4888-326-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-324-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-323-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/4888-89-0x0000000490000000-0x000000049021B000-memory.dmp

Download

memory/5100-50-0x0000000001BC0000-0x0000000001C20000-memory.dmp

Download

memory/5100-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5100-47-0x0000000001BC0000-0x0000000001C20000-memory.dmp

Download

memory/5100-40-0x0000000001BC0000-0x0000000001C20000-memory.dmp

Download

memory/5100-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5100-46-0x0000000001BC0000-0x0000000001C20000-memory.dmp

Download

memory/5500-104-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5500-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5500-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5500-315-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5500-110-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5504-69-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5504-75-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5504-311-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5504-67-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5644-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5644-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5644-321-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5644-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5900-14-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5900-90-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5900-348-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5900-351-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5900-21-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5900-22-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5900-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5960-1382-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5960-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5960-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5960-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5960-1383-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5960-128-0x0000000140000000-0x00000001402D4000-memory.dmp

Download