c0d775c048f5162fe2f306114fecbac7522edcba5468999944c1dba7890a8e36

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 15:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_03fd4834ed1da6b826b300290269f4ab_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 20.5MB
Sample260721-ta3flsca56
SHA256 c0d775c048f5162fe2f306114fecbac7522edcba5468999944c1dba7890a8e36
MD5 03fd4834ed1da6b826b300290269f4ab
SHA1 a815756654a4c500ed875cd2c45bce7f07d876b0
SHA512 c0bb40940d0e99cfc8fdfa2b6b0f9f3d453949c07a0847f3ae364c1d5bfad445bdd60deedbad9cd6f6f8c1bac3d4502f41409994b6441eaa1d41f11c18b70433
SSDEEP 196608:bgHweaQgdA+1EscqiZ0MC5ufYuoe0WOBg:bswBQgqsPiWMCEww0d
TLSH
T176275A43E8A500E9C5ADD570C5A29112FB71BC498B3427D72F60F6683F36BD0AEBA750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2516	elevation_service.exe
3528	elevation_service.exe
2016	maintenanceservice.exe
1572	OSE.EXE
2680	PerceptionSimulationService.exe
1896	perfhost.exe
2104	ReFsDedupSvc.exe
5964	SensorDataService.exe
4656	ssh-agent.exe
5132	AgentService.exe
4372	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	2026-07-21_03fd4834ed1da6b826b300290269f4ab_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-21_03fd4834ed1da6b826b300290269f4ab_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-21_03fd4834ed1da6b826b300290269f4ab_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-21_03fd4834ed1da6b826b300290269f4ab_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-21_03fd4834ed1da6b826b300290269f4ab_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-21_03fd4834ed1da6b826b300290269f4ab_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-21_03fd4834ed1da6b826b300290269f4ab_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-21_03fd4834ed1da6b826b300290269f4ab_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-21_03fd4834ed1da6b826b300290269f4ab_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fcdd7be3e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-21_03fd4834ed1da6b826b300290269f4ab_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-21_03fd4834ed1da6b826b300290269f4ab_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-21_03fd4834ed1da6b826b300290269f4ab_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-21_03fd4834ed1da6b826b300290269f4ab_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-21_03fd4834ed1da6b826b300290269f4ab_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-21_03fd4834ed1da6b826b300290269f4ab_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-21_03fd4834ed1da6b826b300290269f4ab_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-21_03fd4834ed1da6b826b300290269f4ab_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-21_03fd4834ed1da6b826b300290269f4ab_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-21_03fd4834ed1da6b826b300290269f4ab_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-21_03fd4834ed1da6b826b300290269f4ab_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-21_03fd4834ed1da6b826b300290269f4ab_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-21_03fd4834ed1da6b826b300290269f4ab_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-21_03fd4834ed1da6b826b300290269f4ab_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c0377a272919dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000362df4252919dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000010f056262919dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000056ffc0672919dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000698bf9672919dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007be87c262919dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f28f9c292919dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
5272	2026-07-21_03fd4834ed1da6b826b300290269f4ab_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
5272	2026-07-21_03fd4834ed1da6b826b300290269f4ab_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
5272	2026-07-21_03fd4834ed1da6b826b300290269f4ab_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
5272	2026-07-21_03fd4834ed1da6b826b300290269f4ab_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
2516	elevation_service.exe
2516	elevation_service.exe
2516	elevation_service.exe
2516	elevation_service.exe
2516	elevation_service.exe
2516	elevation_service.exe
2516	elevation_service.exe
3528	elevation_service.exe
3528	elevation_service.exe
3528	elevation_service.exe
3528	elevation_service.exe
3528	elevation_service.exe
3528	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5272	2026-07-21_03fd4834ed1da6b826b300290269f4ab_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Token: SeBackupPrivilege	2104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2104	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5132	AgentService.exe
Token: 33	4372	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4372	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4372	SearchIndexer.exe
Token: SeDebugPrivilege	2516	elevation_service.exe
Token: SeDebugPrivilege	3528	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 1816	4372	SearchIndexer.exe	100
PID 4372 wrote to memory of 4720	4372	SearchIndexer.exe	101
PID 4372 wrote to memory of 5948	4372	SearchIndexer.exe	102
PID 4372 wrote to memory of 3172	4372	SearchIndexer.exe	103
PID 4372 wrote to memory of 252	4372	SearchIndexer.exe	105
PID 4372 wrote to memory of 5364	4372	SearchIndexer.exe	106
PID 4372 wrote to memory of 5828	4372	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-21_03fd4834ed1da6b826b300290269f4ab_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_03fd4834ed1da6b826b300290269f4ab_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5272

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2516

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3528

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2016

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1572

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2680

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1896

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2104

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5964

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4656

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5132

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1816
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4720
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5948
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3028 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3172
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:252
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3028 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5364
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 51ba9d778722bc73e5380746dfa208b0dc25ccf7a28352f96fc962ae979d0577
MD5 fda30bb0b7b8b9109fd8dbcb251921f4
SHA1 32ade5bb7baef94c1c8d9db5026dd52215c6b2e7
SHA512 8205b1da76767efae34ff9a5057d96f132ce73655c5881509c7b66645156ba4960f5ef5723715e1412db754c714d76c69be76f275f77573ecfea5987b4044468
SSDEEP 49152:Lb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn6KnAX1tIc5foj3:Z3q6HjBN0Okc5g
TLSH
T1EFD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 f999926c568c06bca2a736041b40867c47ad82701722b40e718c9afa121fae82
MD5 35f789f5555804d88745a3d8596f9dbf
SHA1 13233c276c72a360b1463063587b329cd241fce9
SHA512 44c61718a77086d57180d9bcb8d7a5e4dbf1c04d1d4e2e34fe5350bb2501a56980ae5f0fbc61ee12b43d14be14c70007e6cbac141d0bd7678aec69de5ee34141
SSDEEP 24576:YXYfDtczAJ3KnAoIBlEq1tIgAWz5foj3Z:PtcIKnAX1tIc5foj3
TLSH
T1C865012477E408FDED67823CC9B28506EA33B8514360E69B03B499266F377D85D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 46f245277b159d57ff80062912cf9daeae0b5fd0acf4f1d1f2619ef5a2a4a855
MD5 519b7197cdf7e424f5034eb55fcc5a22
SHA1 c8cfc8595f874bc7054fbf482e6086b218df9c15
SHA512 432c5c5050db1b4e26984573b1989d5fc4ecb5fc9a207cb384c2dfbc6ed44d685c371c54c164ecd2a62c3d8dc47d766602c7141da06e7b7fdf67598358b37e9b
SSDEEP 24576:80Le5ji0hmxirM83KnAoIBlEq1tIgAWz5foj3Z:8Pji0Ac7KnAX1tIc5foj3
TLSH
T158859E26F6788335D073C0B9C5D2A68EED723082573089CB4296D77C7E67AE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 20f8a9d120b47fa8edd7eb68fa7ac75eed754053a75c2056db5d4dd18deafb09
MD5 86be9f73ac36d8158ef66db63b1427fc
SHA1 54b556b1c829ab01e5ef7cba3cd7748b5cd1e881
SHA512 824e4ef51a494a5a7579897c9640fdf3e5f6df9a0f267b37a5b9a7c845ccf59562c4bf2e50d97e741e7dd48758407b259c8e3a606384a807c51dfd661f45afb3
SSDEEP 24576:6a7/ezSC6vUyD/aqgrvWE6q8wyuq3KnAoIBlEq1tIgAWz5foj3Z:t/ezSC6vUzPvxHjynKnAX1tIc5foj3
TLSH
T158756D25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9bdb72857895048c231c5fb9a3b89c91997d5a8b1415b8bda4837140eeac0a13
MD5 eac38bc35fe69a1a836f1d6d16e64ed6
SHA1 10402551be2b8e1f283ebfdeb5a8d4a20c0f51e1
SHA512 65fe89b6b22e12c153a2d2e2b07b4a4d410a2d739a55628f5d29d0e3d9388108b100002929f03cc0311953d8245bf45297ec59a32b75839eb5d3d84d993e253f
SSDEEP 24576:nVbqPb88hv/l+6N3KnAoIBlEq1tIgAWz5foj3Z:nVO88hXl+uKnAX1tIc5foj3
TLSH
T126559E66F5748331D073C0BAC5D2AA9AEE3234414B318ACB1246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ce9c421d72d1c6b44796e62bcf1ad8cc975ab150ed04fb6e7b453993d562d843
MD5 792ed2174751d7f3c0e6f0188ea63b6b
SHA1 7e5124ab0b428bc250277fcbe7ed608884ff8118
SHA512 7e4e1d7ca878fdc9a8bb89b633842dd292e967000b54253adfb17b8c9599bfb0c84da0d97e60394c3a25136611d583ce4a7883cc10fe446c4d063e425728710f
SSDEEP 12288:PR2Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:PRA3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1CD4523217B5C182EE7A74535A2F6684AFD71DD70443A48272035FD17B63CDA0A83B2BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 9e0548c8f1fb85ab6755a4e2d5562df55f32d26365f07e1ea60883c56460f998
MD5 ab222f54c03809cd512a90230711fcfa
SHA1 f15924d28152ebb99042c6945fc451cce852908a
SHA512 414178f6c51a8e8bb105e94c12f1a305a70af6633623740e82f65c63aeccd5074e74e80b8b586d3d24defc75f66586ca50e08e2bc7426735483b8167016cb63c
SSDEEP 12288:3eBNUbTVO86UrZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:3JIUF3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T16565C037AE28FCE2C27A8D7957918640EB7278304B6293CBD175C20EDE275E05D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b8abcab5e0d649f513ac4b27a616a7ee2b164f2d26e834a1bd8aaa5ee03a92a2
MD5 f627925e1b0fe3267848d3769300f9e9
SHA1 249ca6210236c62712a283968c52e4e3dd1795e0
SHA512 c73228b26716f8eadfe2b767ab59eeedfd1bb3d9aca515cc58471e5ec4ef2cd33293f5523306edd5e5f30b3f2925b937ca1cfb50841bff5ac213018e63b1e9e2
SSDEEP 49152:vQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THI:vQvGAdlCEL8c/yRNw5Co0Okc5g
TLSH
T1C4267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 f09e8e04157f1413a7872d60afdae5f452d76cce0c10c2c73bf6907f9f290238
MD5 2e13fb705bb84dc84bd2ad78d82e68f8
SHA1 073f8a791a7a04b2d2f1727ae0d81fdc9b808068
SHA512 07349bc79073962198ba05ebd2b4035f1e37774b533e4656db6b3db278372e04480b3b1bb0b998ee533f67a4e59fb8de854c3fa8f814469763a8843c41405eea
SSDEEP 12288:hAwSfxL/2Dc34DLLmt0LDQewsAjJZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+p:CdewsAjr3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T10C75E031FE74E436C27B0DB21B76C706687DB9204B6119C3E3B88D9E59346D22736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 095183ffe8ab0cd2ef7ea63c73af4749c3f407777aa31517f6208da268cec638
MD5 119ef96550df7a3aa7691fb2e7c82618
SHA1 fd8c59d07f23226cdf73c45a59daf8b67d99b281
SHA512 7352dd2000048ee3a1741525770f696f7b091d4988008d60a568bd931fffbde3a7070afb406b2c4f8cda2214db3c6f81f80e1bf0b201b1fb888d23b3da1e50cc
SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH4OBg:5UEtQevvqc2W1cpV2EI32b
TLSH
T1F8474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 fedec7c98b58b2e97a4c41388a74036db25c1ace71fd60a91caf7de1cb84f821
MD5 a4a0dc46c1aa5b5455abcd5640754475
SHA1 78c45f87ebeea9333c15984472ef4b7a5bea81dc
SHA512 9052131856a8f613d8dd39636a6da05553cb472c8f58ada752017b5793072834f31b2fa9de9f46b4d1132850f3b9da241f2c9b7ed88515d525aef99ba9a14bb4
SSDEEP 49152:zCbRquA/m2yL5zTfFiV+XenmE3/zrKnAX1tIc5foj3:MoquVjnm00Okc5g
TLSH
T17BD58D0976B8C1E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 635ae2b5c13799a6c3426af6d3036cfcede019eabe471ad54c741cc05c004576
MD5 4f90da2aeddabac6292bf1704a64547b
SHA1 9fe6f4242ea7023b27b7bd5c1d8e67dfacdd4a35
SHA512 31a8c23ec6432344e1ee8b05728881c0f23ed4713e76d73d560d49a582684ab2f35fb126943e167878739f668e9365c3674806ab9a30e1f2feb919b98364bd99
SSDEEP 24576:jAhGLJIFoiwtA5l7S53+3KnAoIBlEq1tIgAWz5foj3Z:jAMyFoiq5MKnAX1tIc5foj3
TLSH
T19235AD80EBF955D4F5B3AAB899B68171EA76BCA55E31C20F2160D10F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 f9fd3ddba67ded96d6e2d85a84b42c23cc86bc63e1ea453f4a8faa0fc3935981
MD5 af83a80d747438b7e86e7b4a8c69cf3e
SHA1 ff63ec1536c09c410fc66627acecc5bffe5596e6
SHA512 5a86a7d40a1dcf5aa07f31764cf486429741d31fe12a606caf58dfd7aecd30fd66037a1c2d95e7ea67e6fe9b22a24fb0f9b207a56aac3ce04748de5909d77160
SSDEEP 12288:Vmw5HEjsChNVBFgl0WDm+C4Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojp:QwuoOWX3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T11B65F14637A80CF9E9678239C6978536FBB2BC112A25C71F1370C61B6F376616D2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e41755b1fb1f54f54b0a5873b8465b60e48d021bdf3202d4e6931c51964f55b3
MD5 02917d9ea4f25210023e5b676f19fea6
SHA1 c0507d96c0cd55536b71cda3cf64b7cc667482e0
SHA512 f064389e4db503f9daaf70d76e2a8ff97568baabd7ac29b02311e5c5d9ef1350e0d662dd5060455c26dd011e4cb22ec6932b509f2abcfc4936ebbe36df27e9be
SSDEEP 12288:fBZ1IyZZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:pZug3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T13155125237E820BEE2A34239D5F55549EB72B861133643CF213586567F3AED12C3A332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8c13464644981561eed050368d20fc5ade3dca123f298baed65bd5aaa4305f3a
MD5 0e3aadad97052c334626d0d29176e41c
SHA1 28044a73c060d565a685e27fa367e426c5b87a95
SHA512 3d0268121529940b1be98beb32ad2f2ff87adb508a185df3dcbdaef9aa204a8893838acb322c4aa1e646712d43f59413bec2ae36a4c19bf57fadebc43dabb37f
SSDEEP 49152:gj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UI:nQRQyi36YOcPQLvw2gAf+PN3l0Okc5g
TLSH
T194667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ff4e5810ab670238bea81441e7f6be474af97c6b46ff4ee13f94df00a8033d85
MD5 12224604d75fb5efebb4fc31e518ae49
SHA1 89a1af03b4361248b5ca8ebf6aca36bc5e0c2fbb
SHA512 1cad0db94d9ab575210a363703eaf1c28e4e501e8de08734604b5b626f79faf28a4eab9b926eb8e59b31248a0627f12ef8ef477ed20487bde10f280485960373
SSDEEP 49152:1j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UI:sQRQyi36YOcPQLvw2gAf+PN3l0Okc5g
TLSH
T12C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 86b645f2282d0f855d5aecbe8b62ffa4a74a9dad7d301d8017f8fe2c41eb2094
MD5 6ac16d81ac4efa5f97e593a11a822603
SHA1 e525d588d350cbd9e959c9aefb93a99e034a34a3
SHA512 61b5a7f2f3f440226f6b23c54eb578de2c98b1c68d6d141e0d165bd206c099781a0c973a1a0733a7b718ee66ac27f7ec437b61862928dae9cd685d5d990d0792
SSDEEP 49152:f68Qg55nhheWu7PNU3/7KnAX1tIc5foj3:ZthWRc/70Okc5g
TLSH
T1CBB55A33B2F600A9C44DE1769F4A873196E17C758FE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b42ece7d802140c67506ebefd6ef72e7a4b80cdd446e216f193a769a61d88c1c
MD5 b33261486127bd8279a2b63551ec6f0c
SHA1 c4fa6e3e7dd4380f1fa865ce186e0ca4d03e3c6e
SHA512 7c5633aab51ea1b81f41c2cdaaafbec47515027d4a94dac577d28c5194fc5494c35dd5e17df2b5967343861ed8527a8886dd30228863572224c436a3f3957429
SSDEEP 49152:V3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99u:Uy5112gYy5azzVvL69nLKnhZq0Okc5g
TLSH
T199167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 eeeec423cbc0a0e949a6848b24f9b4a06ee8f767cbd39e3ec83fe9d312db3642
MD5 e15457760a9a4f06d8f72e15dfed4aef
SHA1 3477ce79aa074ec2387746f1345293190f57aa3a
SHA512 d9bfd609172839a5c2dc32ce148bb19e90b3f2fcbc13cd4a08d0370cf04006b997b5b698899a68f0fa3a3a134341808f7174901b74b7e4a306d5afc141c46f8f
SSDEEP 49152:nB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glZKnAX1tIc5foj3:pu6JmVxd2dZ0Okc5g
TLSH
T1D8D59D13F1D901E8D06AD478974A9233FA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 adedb28721b0b49b18ed4edd61f591f891f9beca4179484bad6c3bf56f1b1104
MD5 a92a6cce698b1fb11a7132c150bc8e25
SHA1 fec9aae78b0364fedba6f41d3602bd207d265f52
SHA512 29e95d0b1b8ac955931e8dca3e6b069498b8f0721ac9e449d9e3c99868d8f7c092936a05a7ce17d200e5197c27b73a62302be59eb9c2cdea8eb40aa346f7800a
SSDEEP 49152:t1hpsNoJpF1A6UU44CwH7R4xRKnAX1tIc5foj3:tmifPbR80Okc5g
TLSH
T144B5AE13F2D800E8D06ED17887569232EA62BC450B35B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e0bcc0fb3eeaa91da747b8e8073b7fd49dacd72e0de041e6093ad82731082386
MD5 6eff6dc433c11ae639a8482fa9f1dc72
SHA1 29f4776256e8857ab40380aeca3b29e2e06ecfab
SHA512 3d449ac1982d9beab7f3142bc132f641fae20278f0248e715fe339ef6454922a2110681c2eaf6084bdbbda02ba5a56ac9bdba744fc1b16e730b8ceeefb2b6ac9
SSDEEP 49152:vSuZQIY0Be2KRRVtOnks6NMHqWKnAX1tIc5foj3:V5dKTi61W0Okc5g
TLSH
T193C5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5cc49144861831b9af97e1a191c6f70cabc032a4d8bdca67ce861d66473810f5
MD5 b6b2df1c0976719d6802be5ffcaeaaa7
SHA1 1824b25e4c5983ca297cf86c8cc8f151eb9b49c9
SHA512 842c8889912a2838a8451ad54d869015908c95aabd17bbac760f088ba8c86890eec484de619dc2b2af4613840234fed9eca8925494479b6d16a9fd886a64ecea
SSDEEP 49152:chtSn8EApI0figngiDn0AP5w9KnAX1tIc5foj3:dX2iyphw0Okc5g
TLSH
T1BD95BE13F2D900E8D05ED178C7568632E962BC150B39AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 255ee6c55cf74986a0d020687baad62bd21707e45ac4f8d9dd4f0169c7714352
MD5 997e90da5c876b7116759dad5025def6
SHA1 f88fa792f87cb7d3928b9a07a6679e3d8e2b5aee
SHA512 425130c34bc17ba295962f3bef60e8150a5f78af5b8d3156808eee219fcca30156a9ab422a8834d35a3ba3dfc11ab2685f5bffb3dc8cdeebbd22c35e9052f32b
SSDEEP 12288:hKZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:h83KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1D84523217B9C182FE6538271D2F6548AFD75ED74853A442731399903B73DEA0283F2BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 3d6591ca82a4ca5a1cf7321f866e4bb2c5dcebd92c494d529e39c00cbf7f6f82
MD5 1fbe81f6ad70feca56be0d44ba726076
SHA1 c905d14904586a5b34f0a532f37a64b6336aaf5b
SHA512 b0321952366aaa4eabf521c52ed93418f55dbf65b5a69971e0b86da2d28dc58785dfd37123d974c612166673cb90cb7aa74750010ae3132d86fe373b9e9c481e
SSDEEP 12288:OdZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:OH3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1B14523217BAC182FE6538271D2F6548AFD75ED74453A442731399803B73DEA0283F6BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 27280a1794a463dfdaa5c8e54748a89e13f57c901deac7fbcc0aa337b4f9a36f
MD5 481822ffc1ae705f337b51d2a8276ef4
SHA1 fdf5c90aaae8aaf859f35ae7d9851703180426c5
SHA512 ea7868be1e7baab77780c9697a961e0ae1eccd81ab2606648dd0b742b20713cb5a6377f450e829afa73fba3923b3f89118496996d9ee16f73e7a7e21c0b2d6b8
SSDEEP 12288:6HZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:653KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1694523217BAC182FE6538671D2F6548AFD75ED74453A442734399803B73DEA0283F2BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 e3ada2706dff82fef06fb4cd565f5b4b1220945be04649106d6e0f0b3bfd79e6
MD5 b3e32fa908c1e2f3e202c3819aa6f341
SHA1 6428d31186781d633e969f8946fe127cbddcdb1f
SHA512 48218fcba638562d2a72d9334376b8e7bfa158fb5d415144b1b8ead8b549dbf08c921dbcb8d75334a8bbe705695a4a8d78298fbac729f1e0ce95f4185c6e2d91
SSDEEP 12288:qV0Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:X3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1E74522213BAC04AEE5638275C2F2544AFEB5FC708636456B25258D077B39FE0283A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 1b842a2b17e70a65d4ef7f08f08f6da01a2dddd09f22e4b72cb7115e845ad73c
MD5 14fe4e83a8694c5348739c52f1f7b8c1
SHA1 85f70c65a8f528b554343dc26ea6779fe8a38db7
SHA512 75aa23b024bec448adc158f8368663bbb61eefe5777a019223f3a3348d80d706c13bcc2c87cd3c85e781a1dc63ca52820dcd0395c5a5dfe1d328078d8eb89580
SSDEEP 12288:BcZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:B23KnAoIBlEq1tIgAWz5foj3Z
TLSH
T15F4523217BAC182FE6538671D2F6548AFD75ED74453A442730399803B73DEA0283F6BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ea6f77dd04f5e893a20f3d923dd1d4dbdc5bb741a9d20e0fa6a52a4743e19295
MD5 81d3a351540f5f9c5df588e591e6041d
SHA1 3598fea834c5433308103980b451f2a6e303e1f4
SHA512 0d9d6026d870c45df1e19d551d45030afcec5733b1e6af8edc199c3188e2ee40ff0c31175cb1e0d77596434aacbdf9aff6bca9d260d63c44c38ca9ab13d96f97
SSDEEP 12288:NhZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:Nz3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1A74523217BAC182FE6538271D2F6548EFD75ED74453A442731399803B73DEA0283E6BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 9caf4ff51e26953db4d092024383de714aa122e1a680a95dddba8b29db322988
MD5 3d80a1504e6361d95ba3adfb29462a8d
SHA1 e5276bbc168004bdd0eb317a65ab86db4aae3a44
SHA512 083fbcc8fea39794821c4a36d6b77259749f97952a37350dfdc497600ca4d1c70d921db246187e2665b9fb724c67825dd2030b78a1c7413a9e2199d18d3e0d71
SSDEEP 12288:6FZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:6/3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1F24523217BAC182EE6534271D2F6548AFD75ED74853A44273139D803B73DEB0283E6BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 33905e3727d51e8b5c987519680ac327b06fc200fa10f871db44430d4c3dd0da
MD5 db673ddf271849c4c44ff487ff219f01
SHA1 a06cd1f2e4904a6b0b1a141ac46baca55c4e71d4
SHA512 cc140b66a50410ac2029e227280b8b974174eed40804a69eabef9a4d1aa35e90e65a4987f629404d2a8eb920dddade7402d1c873d8e0bbe651c113a9ff23b1d4
SSDEEP 24576:8ZMSzFVSOn3KnAoIBlEq1tIgAWz5foj3Z:8ZMSzfDKnAX1tIc5foj3
TLSH
T191650161739418F9EC63813EC9658906EAB2BC650770C61F13B436276F377A11C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 621b9a4fe420aefe0af53b927838bd59274d2197759ee12a3011955ed2b7a172
MD5 b8a640b4e988e89a7d4b4bd8a820fbc0
SHA1 a69f063204cdb9a0c334dff81e8fc849fa0e936a
SHA512 4f0837ecd4efbce0a2f8666b5d78afae2c4f41a76fa4823861cad98f0fa2317b431d055bf9beb560ae9b0965b5c0a36bf290418f0385de19db4fe0f05c5e04b9
SSDEEP 12288:TmZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:TQ3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1FD4523217BAC182EE6534275D2F6548AFD75ED74853B442734399803B73DEA0283F2BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 6ad26ca61e298b7de85d19b6dc17121bee53b2286c2bbc6cf5ac881045af2e2c
MD5 231600fb484a236a8fcb6af33ea0bb54
SHA1 ac74e7abec0cb9fa6b26565bfd0380574e6f3d65
SHA512 56af57aa4c7777b293428d7198669aff136b42b2f6253443d00a5c5be1bb310c500fcb45865ee396e714e546e438a357acce42974572cc9ac58d2854e2a932a1
SSDEEP 12288:HCZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:HE3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1454523213BAC182EE6534271D3F6548AFD75ED74853B442735399903B73DEA0283E2BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 979aa61e1b3e0cf57da606fbc9b90ba2cfe3596a574f82d0ab80b901f8aa426b
MD5 df3e20a90ecad1e73d2bf0ff27e08025
SHA1 ab6d26e7564d868e870a2407c6d7cfab5ba314f4
SHA512 04ab6b6c35739f9d5de3737a4576f15c24dca7e2a1cb35e8962cc5125a5472411523e27565622af246762cd3a5b39b2f180310af49140eb46882328b39fa02ce
SSDEEP 12288:4yPz5L8ZZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:Zzyb3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1A555021377A430FDD1678235C5A21906FB71B83147358AAF226446376F2BAE06D3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 9352cb1b659ef86818e95ea1aca3e796a8cbeb3c2dae1a8b89f0792769037000
MD5 6ce2577f52b4fa196393ce6bdbd27f73
SHA1 3b4870cc83309b265c54443fb8a6eb4d6dd51bd4
SHA512 c5883c6f8ed321e5b73fedb31c961dd3fd2984e1dba2006a8cbb38a4dfb0b4e4fd44beee27387ed74f3bcd78e12247deaf18ce3bbd118d8a8850874873afc7e1
SSDEEP 12288:gmZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:gQ3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1124523217BAC182EE6534275D2F6548AFD75ED74853B442734399803B73DEA0283F2BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 3249a109af03aa0177a25c784c949386e3782a01f15906ef7f83b379cc26ccc7
MD5 7b05a0f67c954ef25b7d8d1f4db2fbb6
SHA1 04c269982ad9e5d2f04123cb10ca3cd8b772d226
SHA512 019d2b9d4b55d384e43cbfe4f264cf75b0b46a9578574f8a980a7fdbb3f221fed568817dd6b3ac75de51d2bd261c925a2346fdebaa25da7e6c0130ff084b32a8
SSDEEP 12288:bmZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:bQ3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T10A4523217BAC182EE6534275D2F6548EFD75ED74853B442730399803B73DEA0283E2BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 c36b5e20626586fc52ac089ab30c19ecebb647b9839f83af60c3a38f689c3418
MD5 288162f3921c469cc29813e69c4ad3c0
SHA1 d89ac1b065fe89c4aaea4218c90d2cc441798d88
SHA512 d98dbd5ef512baba0269b6cf61bc289866949d15f15333571567e02df2fb65c9f9498e2bf9fb99f386574d8af616efade2569e14b9f3785e5d10f563b8cc9c40
SSDEEP 12288:5yPz5L8ZZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:4zyb3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T13855021377A430FDD1678239C5A21906FB71B83147358AAF226446376F2BAE06D3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 7f6bad54147ebf59be4632abc4d55010ba080764f0321c6ba74bfb8dff22daf0
MD5 a02b1788544498e1717d5bbbc88cd63a
SHA1 91a16028837043a51b5ecfe042289ea9d1201932
SHA512 da494dca60a94e0e31e45ec22c6c67b3981f2352916617b074aadfb8645a45d1d1403a5e0a65760766853affb2cd1cb6e023b7969d8f914c5916c340b6ceb726
SSDEEP 24576:UTHaLl3z0zDJ3KnAoIBlEq1tIgAWz5foj3Z:UT6LljoKnAX1tIc5foj3
TLSH
T10A650160735418F9ED67813EC9658906DAB2BC650770C61F13B836276F377A01C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 3a724d00edcebeea2688be32aed35b783edf06106e7b75f01ba72f0fcb870ca8
MD5 4609ff4f1bdfa1c7d2fd8ad6b237c31a
SHA1 6cba67d54bbcee2dccd70e0c5b24e50b104d6e29
SHA512 7aade80cb65f206814e49280d6505ba7d1f611467fb0953d098385159a0785c53282825a48931afa09d4ebc571844386c735af26c3abccef316fc9c82e460085
SSDEEP 24576:s37d9CHKy7GZ13KnAoIBlEq1tIgAWz5foj3Z:W7d9CHKyaDKnAX1tIc5foj3
TLSH
T10E75CF90F3E814E8F1B78A35C9765511DAB67C691B31CA8F03A8651A1F33AD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 a31f41e44fdcbf06c907fd22454f743b52b12443b579a7698be03966dfa93939
MD5 2c4102a01a9608375b5c84fbb6375170
SHA1 375933cb7049a57304f34bf7f26dba04c58788a2
SHA512 f75d6cc09c155e472eb594916ee3fc219329771008c7205be9cc192049d610797fa6cc8d019d768ffa3b30521ef9e04ebfb2add6702d3934eba087fa40baddb3
SSDEEP 12288:+nZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:+Z3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1904523217BAC182EE6534671D2F6548AFD75ED74853B442730399803B73DEA0283F6BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 864c93e3c9dbb0f62b6f275994a4d50a69cb510e7a36abbe035d3efbd1f12559
MD5 56d4df2897b176ab65aa1e5ce2b435ed
SHA1 462e9a1050b8a819146e2a0a2cdc973212eb4c89
SHA512 9cf53a9c3a0c2870ef113f9ef45a474f86b1d873ec366380b8225c8c29fe22fcf5f622c31301aba31f0b4ced8363d80cf32ef98fadd5cd56cc4d0e71717521f5
SSDEEP 12288:p5Z3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:p73KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1F84523213BAC182FE6534271D2F6548AFD75ED74853B442735399C03B77DEA0283A2BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 8317733e76d939e6398f7a776a124633eeaa0a17a703e1002cd3b7f3cbba5d2f
MD5 2d9c63465d453339ac5ca44d15dbab9c
SHA1 f0035540dc92e6bf0f1f660fa0038e4ea22807f4
SHA512 6d7644ecd120f7bd8526967fe61ddef48f7eddd60d3b5374a58f5cb04409d998935a7da28bbcc72eb03c7caaffdedd30655b96a097afe315757587ddba91793e
SSDEEP 12288:1wZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:1y3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T13C4523213BAC182EE6534275D3F6548AFD75ED75453B4427303A9903B73DEA0283E2BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 0daccf6ba542fa50042e4692772cdc0d515a7220a601e87d3257fb94ed603da1
MD5 4b4dad255330620ccfb44d1fca3f7fbf
SHA1 81bd54f8bda42b9f1998702a11a15519af7e4406
SHA512 ba51217e233e344bb7ddd308950853b7cdede494abce9cd31f832ef7cf01fb249f20656128273c61d1fc1057909a1cc57759875d7625dad9ece672de4f3e23f3
SSDEEP 12288:hmZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:hQ3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1AA4523217BAC182EE6534275D2F6548AFD75ED74853B442730399803B73DEA0283F2BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 0f994bf30eebe47ca3749be91d22afc2a8ad9e980bc8cd466e8e3237b1a0c0bf
MD5 84eacb04252da21d4b668ef58854ea27
SHA1 dfd3072c973a0c5eeac50bed7328829f950bfb68
SHA512 b3e9f79fa49c704c11a9b2bbe67bbb295ee607be49755062fc41d3c8fc0a7b9c84844255054bf0149e06afd048896b3a551b8ab8928807fc94f2db225885aadf
SSDEEP 12288:KnZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:KZ3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1624523217BAC182FE6534671D2F6548AFD75ED75853A442730399803B73DEA0283F2BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 573428ab4d160d4da3c180a7e52ecb5f9393c259a6a4e2013e09f87e6c5e6621
MD5 b843fb6d849b4476edc5b23cf65aeda4
SHA1 ba6e5acdf59ee28b6eac273bf2da30b1f5865d45
SHA512 156a5aaec49badfddb62a814be4f9782d26ddfb95355664b7de12905adc772da5e7f0d03ceb5f6bd761cfe83ba3847a659611249d44f54e3104221ccb9d868cf
SSDEEP 12288:muZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:mo3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1014523213BAC182EE6538271D3F6548AFD75ED74453B442735399903B73DEA0282E2BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 34b4d86e3de8f710df0c688b528e10a953e7b0a5d6fe9802e0978945f46ac1ec
MD5 fd70ab4b4d4047f9ad5ab21dda6b56c9
SHA1 50a4df6fdfe17b0ce91ebaa53296100adc82cc89
SHA512 7c9d8ac379c40b1f87437116e1abf362c7f79e1a2bf2848b1109484be3b6fc550d3d5a6a7b88823e565f23656d8be995edf3c09227f8a0fde52d29952810fb99
SSDEEP 12288:6cZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:623KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1324523217BAC182FE6538671D2F6548AFD75ED75453A442730399803B73DEA0283F2BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 e2b80dc40df4486b743e31ca0f41a863f2f54e09c4e75597bdfd698ea3956267
MD5 1d8877e526f7ccc024469a7aa9e877ee
SHA1 4ac244ae5eb10db11e2f6a8c2b53aaac07840f67
SHA512 746e3618d078353c6f28c5aec3c7d70101e2cc4e4fb16c43cce1acc8319e58aceed94e71e07600fe58c27335601d88e8c1a2e0459cd10e4d1bd4700150525d56
SSDEEP 24576:Bfwvok9RX6wkyAIg3KnAoIBlEq1tIgAWz5foj3Z:nMnYIWKnAX1tIc5foj3
TLSH
T1AE85D029EBDC04E5E177923C99B7460AF6B178680B31C2CF126A536E1E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 dfbb5ba7339969e5a01c813a07f66ab581902e25e0a2348a8383ca92e231b80d
MD5 592cba2997431144566c1ae058bb4677
SHA1 d54c876e8ad0208ddd4d474bafb04245e7eaa3d1
SHA512 72a7c84d42dd8dd87f89beffa0a9854714f8b4eef0160642c2c2c0df3942451f13f09dd63a870772ba2e62a5f9218d9bf778e9e18482bc5a3b1b29d088c465f6
SSDEEP 49152:qYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0JKnAX1tIc5fob:EySzPB0Okc5g
TLSH
T1DD066C56A16801D9C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 757357785f441ef717e8bc661f934c24b34138496d89b5a1ac49d4be1ac3805d
MD5 12da534a94e1de3b159263a92eb41058
SHA1 75da9360215a8e0fc11b0f364e0925566219325e
SHA512 e0a8dbd063b175b6252432d88b7e2120ec476965c7d65f123bfe49fadaabf9f9bb336b7e51fa80ad669a7dd95e23f6e50774d573a752cf5b368467c0e5e6d5a0
SSDEEP 24576:o47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYP3KnAoIBlEq1tIgAWz5foj3Z:o47JUQj1irIhCnDHUPfF/ZKnAX1tIc5g
TLSH
T1D365AE1DA3EC01E5E1BA827885554A5AEA71782D1F31CACF2270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 4a53f284a99e87a8f780139bc466b6edc26241f0a5edf0e1159e21c6005b6264
MD5 5c0dbcc5f610fbcf62efd67ee0733ee1
SHA1 7e7f5faec0366b6052151f0e57d481535db58231
SHA512 efde23fa39dd4b07cfdedb4bb5b6a3084723b8de6a2e3fbbe6765765ebef552df3e342c69f243ad67ea64770e3103468772b2638717c7b8e0e912217dfacb47c
SSDEEP 12288:tNsfWZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:Cg3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T12655F115E29801E9D16E5135C7A64A45FB337C2583F1C2CB22E0F93E2F3AA905CEA753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 263c0132129b35ffef184ad51baf5732a004b5e54e2c312d8ef4617e80651e4d
MD5 ff058df371193034a85c7273d9f24489
SHA1 c3587fa1b2c48b51e5b06dc5e93ca1bfa6b653d7
SHA512 f7d690342b2fddd8d10c0c1f2ff4bc8869b5470be3b171112f1a3627c7492ce11d49538e7a9e59b00995c53b203f8e8cd6a95c51935b625e036786c0897c8521
SSDEEP 12288:pqPdhU3fDO2Za5hJppH4fIGm+qrA60BEz19BsARMC2Wv:pqPHUPOIfXm7rA6YEh9SARM
TLSH
T1FC552841762BC79FC6A980325E32D6CCAB707D01FE056F1773C8873E8476669B6B5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 4acdba6b1ded60cf31ba0036bb0ae5830fd0273ce3ea1b6a520fcc8688c6e78a
MD5 4b127ae5f908956c33712eab7612431a
SHA1 a56700ecfc657db172b00ca56ff2713aab29ff46
SHA512 da382f846198c5547235b9de195c1d31961e072ceb5a47a57f6c0925c9cb08ff92072e0a4bbae9576e6b8d8eed396d4199a85501d6edcda3eb59916dd0690459
SSDEEP 12288:kJ1w2s4MPkSKg33VVF4/sSFblNuqRmYgAzCO:kJ1FjIdRcsSFbP78wzCO
TLSH
T1D1451941A5A7E35FC9FE90370732C6CDAB745C02BB452B0573408A3C9867A7EB5E62D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c720e1fcea3a66088725abbf2500297b9551bcd02412fe89c461f5aea6911581
MD5 6d64b2d1ac7bf60e4dafb04db0771433
SHA1 dd2c2e3c4369dbc67f7658de7b6596454f6fad1b
SHA512 2b3f95d7838a845bdedaa81842ea19c82ed3ec5d7b8c883ace31240d16ce8e1ecdcdbe23f4dbae10a8a82db9928d051a742b03e22f6eeecff851cc81604677f2
SSDEEP 12288:507qZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:qc3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1FA4523217B9C1C2EF676467092FA5419FD39F9704B3584A730299903B63CEE06C3A77A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 51510a10ac4780fc83c07bc8fe6b575e9b37be8918ed820aa5e8fca37bb9bc8b
MD5 617afd6602e20ee2d873e305c27e895b
SHA1 d6f5ff393b3786be1782bfbbd3f2ff7b32562742
SHA512 7fc1677e7d467ef67c429d8e7148ec91ca971154a98d8d341c1f4a75ea72788be8c4a03ef784099ebb794049f8c9d3d0984d67c880fe1fe6b33cb980fbdea2cd
SSDEEP 24576:tgb6bmBIi49WNNFpg1rSvFv7bYq3KnAoIBlEq1tIgAWz5foj3Z:tgb4mBIBhGFfKnAX1tIc5foj3
TLSH
T1CC659E1E22EC02F5E1F6D2B8DDAA4417D6B278160732D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 3e9dae020781054a353c9e16752b0bb5f7a6cb68897120f9a6672f3c9e0c73ab
MD5 c873a9494a1658697c468b8514bcce29
SHA1 1d02f624f9edc7bd943779aab4eb3f220ea08360
SHA512 2a97361506165a1d5ec90bacf68a63e710ffb6c77a75e9c1fa5d33e17b5db6dfb7e6e24d2d394e626639ff593c869deb8bc28a2ecbf36aee748f3e3043628f58
SSDEEP 24576:JG88u8FpJqH1bzria7/mf3KnAoIBlEq1tIgAWz5foj3Z:c7ZFPqVea7/gKnAX1tIc5foj3
TLSH
T1F085F16177E401F5D477D1388A964667FAB1B4250374EBDF06AC8A522F23AE40B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 e7932ecbdd1ed231843efeefaa1aa14d88ea4497b10e3117f091672c57396c0a
MD5 6ff81192c82475efb51899b180224fe9
SHA1 65ff4aba6cb2bbfc705939484c33366d3505feac
SHA512 0d4d7af4ede2b59e07d368870a9aceff423376cd43b6981c85c98936bb0267ae7579fb458f9119acbd2f7491109e3853b3fac7377fea7d7e1a7912288f9088ca
SSDEEP 12288:+HvUrBFrEjwaQBZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+P4F5Y:+PUr+NQT3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T1F165E12B36AC18E9E676E17D8592460DF771B461031292DF02A0817F5F67EE87C3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 22185bc14836c0e800405d578507c613457224ff30604e43dba7cfa864b883bd
MD5 33b0b683f33a14ec4f616a17a3665898
SHA1 6724021e7f9989f556c98c916ff7392a106ebec6
SHA512 e98becb804055668a102e87aaeff888844986a0f43dfb2f6ec3d9e669bcae11718d57d9e6cc0512f3422c88442b66fa248f62f1b2dd7da8eb780c889819e17fe
SSDEEP 49152:nBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjDKnAX1tIc5foj3:YG05lO43b+0Okc5g
TLSH
T10FD5C06A62EC11F9D1BBC17CDAC6460BEBB23825033556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c78419573981c8128eeee48ca60588b14c94aedcaa4a82845951f52758a53b3b
MD5 4ae095582a895030620f975fe84760d2
SHA1 2cba5528a26ae2c255dcbcf98c3d55cfa8ec43b5
SHA512 c8107650119214009863a3bf1219585eebe8039ed8d314a142f929da18de42b73babf6db86a7b60d60bf448da45720549affb120993d506b215fb6c761f927ee
SSDEEP 24576:2fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnp3KnAoIBlEq1tIgAWz5foj3Z:ua5POZ3+Jt2pasx2+m7KnAX1tIc5foj3
TLSH
T1AD65BF5EA7FC00D5E5B9D17DC583861AF5B1342153329ACB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5b3dc59018902d664d7b86ee77351a21f0080a041dff48b7c1dde3c9ca6e81b8
MD5 a276ef41aa587d299bc810073443b44f
SHA1 aa3ef87fc4cb1e6598896e0ce2ef9f5d7352a752
SHA512 1dd323064c9515ce7a42c8b5f647d75138743d31a7a665d74ae484518720ba460b24e9c610e7ec45a0d9676c9f0b8a0f3ccfe7680e8762059d0265d8474d1151
SSDEEP 24576:TNcwHdjbyQ4nLC18lb/EOjowL7Fk33KnAoIBlEq1tIgAWz5foj3Z:TNc/zEOVHFAKnAX1tIc5foj3
TLSH
T120858C2623E901E4F1BBE1BE89779546FA71786513348ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3fd1fc49a155e56f2d67f57d99c2b00de5a15387bedf38fc16bab8af122286e0
MD5 a371434a46ad2ae5f4b573cbe2f6aefa
SHA1 f38de97c113bb6e4e368c160d19fe9bac7511895
SHA512 03d08e0bd51f5d57cc4572092a61d9b55de19df6137502d3681512005582c1792969c630c79143e3d65199e7c7c006c5345ae4fd16ff264c733813e57ed14577
SSDEEP 24576:68kNvNnaFeYhJNtmZBm13KnAoIBlEq1tIgAWz5foj3Z:68MwBtOmFKnAX1tIc5foj3
TLSH
T13B55AF2EBBB805E4D1FAC6B5CD238512FA727461073292CB5290C13F5E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 de3bdb3b887e6bbdf055a15929d2d6227f1c2dc6c3b9bedfd131acf2c3c181e9
MD5 5ba8549ef97912d228bda0dae07f2d0f
SHA1 9dff904c693dc773cf0bbea93b7b377af56f194f
SHA512 65931f399a97ecf391284378e6c0de6f367699dc1a0dbfa5edcdaf178440d4c182050056269c46f3d31f15e5b8d06f43f3527d63c27074e89d77d3373bd9476a
SSDEEP 24576:8D3FHshBIYQgA43KnAoIBlEq1tIgAWz5foj3Z:8DVHeBIAAOKnAX1tIc5foj3
TLSH
T1AC75E03DEB9C04E4E57BC1BCD6A38906E77178A8033255DB119481B66F6BEE42D3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1572-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1572-61-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1572-55-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/1572-312-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1896-102-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2016-46-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/2016-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2016-40-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/2016-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2016-49-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/2104-337-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2104-320-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2104-100-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2104-84-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2104-78-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2104-339-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2516-23-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/2516-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2516-15-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/2516-118-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2680-99-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2680-66-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/2680-72-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3528-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3528-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3528-174-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3528-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3528-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4372-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4372-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4372-136-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4372-325-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4656-114-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/4656-324-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4656-108-0x0000000000E00000-0x0000000000E60000-memory.dmp

Download

memory/4656-107-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5132-120-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5132-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5132-126-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5132-128-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5132-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5272-103-0x0000000140000000-0x00000001414D5000-memory.dmp

Download

memory/5272-167-0x0000000140000000-0x00000001414D5000-memory.dmp

Download

memory/5272-0-0x0000000140000000-0x00000001414D5000-memory.dmp

Download

memory/5272-7-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5272-8-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5272-1-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5948-328-0x00007FFC14260000-0x00007FFC14406000-memory.dmp

Download

memory/5964-321-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5964-323-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5964-95-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5964-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5964-89-0x00000000007F0000-0x0000000000850000-memory.dmp

Download