Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 17:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe
- Size 1.8MB
- Sample260730-vslfgsshrb
- SHA256 0724f279d24ae2d04c677f9c00916df14c7eea5b59f369c27584b64f4e8f3bfd
- MD5 9fbce097082afdffa88ccaaded92b7e0
- SHA1 702df2433051d1a3a07d76775a00ee2a3f67749d
- SHA512 7dddd165e701be3471d7202fe5e9fd8b136659efd13dcf1261749a0838995e3c9d20c8d61d41558d7f400654196d0c2b9f44976f961418c5aa4997cad63f2e82
- SSDEEP 24576:QRAWYZTjT1AF0oJJNZv9ss82h1e1dhAy3IfnBcZVbX56mctvE/BT76+1NCE:/djTbG19V41dhAJnGVbJ6mGvKVO+n1
- TLSH T1EE95DF46A2B400F9D0B7C1B8C546A31BE671385517608BDB23E89B693F73BE06A7F711
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 4124 elevation_service.exe 5108 elevation_service.exe 1036 maintenanceservice.exe 6084 OSE.EXE 5208 PerceptionSimulationService.exe 3760 perfhost.exe 5892 ReFsDedupSvc.exe 256 SensorDataService.exe 3756 ssh-agent.exe 4416 AgentService.exe 4980 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe - Drops file in System32 directory 56 IoCs
description ioc Process File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\8537787624febf98.bin elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe elevation_service.exe File opened for modification C:\Program Files\dotnet\dotnet.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117953\java.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117953\java.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a215e064720dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f1d069064720dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d98271034720dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f73c55084720dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000831e29494720dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000015af49064720dd01 SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4124 elevation_service.exe 4124 elevation_service.exe 4124 elevation_service.exe 4124 elevation_service.exe 4124 elevation_service.exe 4124 elevation_service.exe 4124 elevation_service.exe 5108 elevation_service.exe 5108 elevation_service.exe 5108 elevation_service.exe 5108 elevation_service.exe 5108 elevation_service.exe 5108 elevation_service.exe 5108 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 816 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5020 2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe Token: SeAssignPrimaryTokenPrivilege 4416 AgentService.exe Token: SeBackupPrivilege 5892 ReFsDedupSvc.exe Token: SeRestorePrivilege 5892 ReFsDedupSvc.exe Token: SeBackupPrivilege 5892 ReFsDedupSvc.exe Token: SeRestorePrivilege 5892 ReFsDedupSvc.exe Token: SeBackupPrivilege 5892 ReFsDedupSvc.exe Token: SeRestorePrivilege 5892 ReFsDedupSvc.exe Token: SeBackupPrivilege 5892 ReFsDedupSvc.exe Token: SeRestorePrivilege 5892 ReFsDedupSvc.exe Token: SeBackupPrivilege 5892 ReFsDedupSvc.exe Token: SeRestorePrivilege 5892 ReFsDedupSvc.exe Token: 33 4980 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4980 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4980 SearchIndexer.exe Token: SeDebugPrivilege 4124 elevation_service.exe Token: SeDebugPrivilege 5108 elevation_service.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4980 wrote to memory of 4732 4980 SearchIndexer.exe 100 PID 4980 wrote to memory of 4472 4980 SearchIndexer.exe 101 PID 4980 wrote to memory of 936 4980 SearchIndexer.exe 102 PID 4980 wrote to memory of 4104 4980 SearchIndexer.exe 103 PID 4980 wrote to memory of 3020 4980 SearchIndexer.exe 105 PID 4980 wrote to memory of 5760 4980 SearchIndexer.exe 106 PID 4980 wrote to memory of 1104 4980 SearchIndexer.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_9fbce097082afdffa88ccaaded92b7e0_glassworm_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5020
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4124
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5108
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:1036
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:6084
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:5208
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3760
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5892
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:256
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3756
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4416
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:4732
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4472
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2704 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:936
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2888 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:4104
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3020
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2704 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:5760
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2888 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:1104
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 72a57c9e749f14ae7caadb58e0dac0973f91ccae07364eb02c227e0c3ad9f8e2
- MD5 5592d1faadc6135ed5dfed0fe630a0b2
- SHA1 514f745e7d169d5d8e63bc3da5d10413633170da
- SHA512 c08c36a24379081aa71cb038310d2be4b15907ed1c1fdf6ea33094dba8165bbcb7f96586526213156d324008fd35c7fa8602b5222ff712bb976861ac98042460
- SSDEEP 49152:Db+632BuPkFKRrdE6ohrstBhuXjfS4LWxna6mGvKVO+n1:h3q60jBJXeN+1
- TLSH T1DED59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 f433720e408de2757d3956f2177183d1e8a7fab072a163b76d78b96c999cde89
- MD5 5c047259b688abd483fa7d86ee44d6f8
- SHA1 1f8605edaa551f1b1ea8d5ee984f8ae58887314c
- SHA512 c5c6482ac93207215cc04a35e2b19e5b32e0d068831df1d06094a35fe5c9fc4ae33339a8f0720acfa99fc33d9e22e083bee7a58f724b71779d3a42b0e2a073bc
- SSDEEP 12288:l1XLsswWkxy2lRq2czAttM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:rXYfDtczAt6mctvE/BT76+1NCE
- TLSH T1C4750224779504F9ED6B4278C9A2C112EA737C9547A4E7CB03A4892A1F333D85E3FB52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 1f507015add365b82f04ce4e4d9492edafb492180f20974d971325bd5a8e30cb
- MD5 6478d97d51a7647eff06470399e372f4
- SHA1 f03321e07b710017cebdc143c78cf70a38f64865
- SHA512 2c05104cd8d6aff8363976584f923b08c545cd57c1bcac0d1ebcae95e8a5de051ec561188d78f539912121a5e707bf4c56c0d58233de931e4911cb5f1f24efd4
- SSDEEP 12288:xXZNYVLeyUji0h90ZD0wxpGZIVuDrHsytM6hct28uP18WR/FW2Gb8JTCMMK7LIFq:30Le5ji0hmxkrMy6mctvE/BT76+1NCE
- TLSH T118859E16F6748331D073C0B9C5D2A69EED7130865B308ACB4286D77C7E67AE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 e8337ceba7b5e6843903b5bb85645298bd5255e8c4797fe80c8f048731f09d11
- MD5 75e2381f192a327d25297f2e1493234c
- SHA1 9591af080c05d3b3b51b5d99eb3bcbc017655b34
- SHA512 bd24ed542c2aab1f4288748c5fd7700a792d683f1b804d780a6d85e7f3004816cdc505723057ea2d4c24a552ac7f59361733e69a115e502d6b613857425bfb59
- SSDEEP 24576:wa7/ezSC6vUyD/aqgrvWr6q8wyug6mctvE/BT76+1NCE:n/ezSC6vUzPviHjyr6mGvKVO+n1
- TLSH T11B755D15F5788323D0B2D0BAC5D6BA9AFE723086573089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 fdd5d03b7b9824f29d0bc29ab3836bcf7761e6277417bafff47f22037edc1a7a
- MD5 fb0cb7cce0ab63edbbcc3ea7f51e6fad
- SHA1 29d11fe2b22344cbc464f8fe4e32ab9202b5d332
- SHA512 6c6acf60becf8401e653a12aaa46db2dc28c7d156ae22ef3341f099d5e41156bab98f931e5d21486de0d5c8b37120536a81b18676723c56c2442f883c46cd950
- SSDEEP 12288:RVJjBq33vb5O8M+l1D0hwsEBoW/lx45f0Im985tM6hct28uP18WR/FW2Gb8JTCMx:RVbqPb88hv/l+b56mctvE/BT76+1NCE
- TLSH T1AE55AE66F5748331D073C0BAC5D2A69AEE3234425B318ACB1246D72C3E677E6D63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.3MB
- SHA256 43d6d8a9a15b976656045127f89908fdc836897b57944dfe685b6736c66c41da
- MD5 0aac024589e6fc0e39961946fb141461
- SHA1 96832d16a5f4a670ca51283c0b1027454d178646
- SHA512 e11964b69126feb5feaac945c49a0e32f6860a8124b619a922ca666ed6acd9c62cb3109af3c201c989b5d0a97dca011952bdcc296b1728703c697fb66410f13f
- SSDEEP 12288:uiOtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:uiO6mctvE/BT76+1NCE
- TLSH T164552382C81B11D0EFFF07F06295E296E8516EF934DA1C81D322991F9D30162FD4BAA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 3105d11726399e146353aaec929c1d745da311855aacae74a3d7e3a4942c8996
- MD5 1a3adc1c1a0559a3f97608c3d1322c03
- SHA1 1a916d585b65025a03c8f1106d05121790436a42
- SHA512 4d12c3c416aeebbe591deb397413b428538f28c7a7887d92ebcd3f4aa1876151ea97271a085fef0c05269b10dc752d085b3be2123fcfa789ceb9c17e2b14dc24
- SSDEEP 12288:AeBNUbTVO86URtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:AJIUR6mctvE/BT76+1NCE
- TLSH T16875CF7BEE28FCD2C27E4DB85691C240E77278704B52A3CBD165820EDE235E15E7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 9382f6c1f1d2a2fab166533c5a1e3c9bed921a9e987e41f6bf66999c6549c756
- MD5 7722586ad157aaf0a6899d8ca89739c2
- SHA1 7ab0b2f883efabcb3599d6c526de6874945544d6
- SHA512 fd200579e84278e32a1047a3cb4cab186f031d2af1da8934e7ecb96c8943f49b5d2ef1929319405c3addc31b106947a5778abf7511c66fef47cc2075de59cce3
- SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THb:jQvGAdlCEL8c/RRNw5CQXeN+1
- TLSH T135267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 4cc127e3326d6ac08f94bafe699ab26d7ac54b76ce69fe4bdfb979af2feaf8ce
- MD5 f4430d45cfb24ac9fdf452ca89d46575
- SHA1 506f3ee31f268aa1b7dddefc8a7b202eb81cdce3
- SHA512 0b89391597520af96ed12aa41e2f77f8df9688c53f3f2cb0af4b2eccac1b45239780037ee446cb4cd7f27b3866064201a646e80316ae54951393720d6fed85c0
- SSDEEP 12288:hAwSfxL/2Dc3ADLLmt0LDQewsAj3tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WG:CBewsAj36mctvE/BT76+1NCE
- TLSH T1F575E031FE75E036C7BF0DB21B26D316546C7A604B9219C3E3A88E9E59302D22776E17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 57615060ca6540b2b6ca0afa8e39402e847a1500ed948e2931ae4b30b7405670
- MD5 b9e3abf4986f6fa58e7cd9287b2d5244
- SHA1 ecd58aeeb3a1d5263089062d6c17f406aebce46b
- SHA512 44a593947cff0ecdca5e368725c045807bb6a7a1f4b3748f5b2c9d36633fe394c8ccb54e1e037237b4454eb2c1a03bb4ff70bf9e3b4be96fca282e49ebc894fd
- SSDEEP 196608:/UEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH/XeN:/UEtQevvqc2W1cpV2RI32ve
- TLSH T1F6474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 daabecdde64a02c6df53bb363d435611e4b1c704fb98563516a1adf9c104bf99
- MD5 006ce9dab541e137a62b86e5f0592c7b
- SHA1 d3ba9347eda98b86164f470a0b3ce6c2e2558701
- SHA512 5a52d81d6c2b9b7af18492d3fac4e7bbebce0a91c3bec9f3b3fbe9f6645da9299972050d400d59c4614e5c3b5b1a8c2e1e73779f0364adfaeb5728917037dc6d
- SSDEEP 49152:vCbRquA/m2yL5zQfFiV+XenmE3/zX6mGvKVO+n1:ooqtVjnmUXeN+1
- TLSH T117D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 3ea190308e6c0339c9ad524d3ff993ccf0cdb16e213051fdda19bae80c2c0726
- MD5 f646d8a22ab0b72c2b3ba021beb3ae52
- SHA1 1071cfdb22fbcdee7a3516fd210f6d6fdebfd5ab
- SHA512 ba55ecc9b027743f354b1349acf51210768f4c5314a54b7f85ab9ebdb8e3c0ed3f7e0173b07582d7a586045a03f92297475c6db249d330dfdda9867d91b7f21d
- SSDEEP 24576:+AhGL2IFoiwtA5l7S5306mctvE/BT76+1NCE:+AM1Foiq5E6mGvKVO+n1
- TLSH T15F359D81E7F951D4F5F3AAB899B69171EA76BCAA5E31C20F2150C11F0E33A509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 0ba0d715eab584c379839453c140763d0a346210ceef5e7b09aea63783af3225
- MD5 2cb55b05bc76e63e6e0072e79c5072ff
- SHA1 4d482b229bfa5db07e80087aa1dd14e1de6ca8d2
- SHA512 6c089e8e6ed463199c18a849406948baf40d55917d261488dc6beb83be33c22985235802596bc6f669257332fb491cfb4099cb6d277a74e53a197dbdc3358b0e
- SSDEEP 12288:Tmw5HEjsChNNBFgl0WDm+CAtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwL:ywuUOWL6mctvE/BT76+1NCE
- TLSH T10865F14676A508F9E9A742788697C136F7F2BC513A25CB1F1360C61B5F33261BD2EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 e90bb89f36db6678bbd0240cf320fe1375e9d5bde398690b04478666a0cc6f38
- MD5 ffe3cab0d4a7f93b3356f59c528045de
- SHA1 fca4b62ac4f3df94bcb0ff54163c7efb50e78b15
- SHA512 51424a83e7bb77ac35de3366f5b5b3730368c28b8dc22622ca093f1d192507fbe56ed8663c4209f317fb7c23d3c6a89cabf6dc2b8d4b758a27ba775bf5c17746
- SSDEEP 12288:U+Z1IyntM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:dZuK6mctvE/BT76+1NCE
- TLSH T1DE551286326520F5E5E702B8C9E19246E77138E6377603CF5221466F5F32AD26D3AB33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 985d393d0f9b4fa5199a3525043358d5f1d8a020b67dc20b1cde430ca44b0ded
- MD5 7d5d62822b640fdd1de7bd94b9db6b8d
- SHA1 16268f5d3bcbd868bddfe2e108a9a41578bfc591
- SHA512 64fc5cafb5b75e3590447c03960f6548a22743dd9afaa58d014659979da3195a4923c0f3a8e61eb7023df50eed50baf72bba30ab272c88bbf4d8172b85a54600
- SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UX:/QRQyi36YOcPhLvw2gAf+PN3FXeN+1
- TLSH T194667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 0f7eb81854dbf4dc2cde424cc9c294702d92b91353e5efc4d69bbe13af2002aa
- MD5 fdd96a9b9724c3464b9cec61eadb4aa3
- SHA1 8f8193142e71c9083bf95b17891e9b85b9522b90
- SHA512 e010dc44cd130800c1738b10d6124de9f56b2d2bc18338c75f876ba4a2c2b868c0b580c60a3b13559b09fd7726ae4f35b8f5bd742760cd7e8f040200f4ff0aa3
- SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGexAaLSF259ruMHwpXMi4FqJLd23UX:+QRQyi36YOcPhLvw2gAf+PN3FXeN+1
- TLSH T141667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 8c9e67e4ae9baf1c8df8ef127a84cc4820b0d69fdda2293bd509516e234b3835
- MD5 77d79860b49d7f3d2e9054e016334394
- SHA1 00db6bd53eee82f56a362377759f2ff37368520f
- SHA512 ac39b8f4eaa8fe0acc6f520574d85910f374a2f943c046ae7b7123b023035eff5c3390bf16d65c89223a239ca9dd866e2f83d9afd7f546cf63894ac18f2367f9
- SSDEEP 24576:3wvLof6SRQ+rn/fDboqxN1nnh6D7DaHGTNHu7PNU3/5W/ohL0a6mctvE/BT76+13:/68Qg55nhceWu7PNU3/H6mGvKVO+n1
- TLSH T1C3B54933B2F600A9C44DE1769F4A872196D17C758FE1E3DB8511720A1BB2AD07B3A71B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 9916fe7cfdc04d4af46d7f8a20ddadfd59cd91e2964f69f279f7aca1501a2c77
- MD5 c3f7cc5925684c8d6b040f77dfcd6ac6
- SHA1 07f91272329d37cf1f9b24e3f5ef5f1a9c118e0e
- SHA512 3ec5d6fb76d9dc8b1dd33bd806a185ba3fe7773ad2c1f7f7c7e3160b13365cff88ab767317fa4aa6a8cb2d4548b62a286e94a75ddb34e23c5889589cba41ca8b
- SSDEEP 49152:Y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbpN3Oh6tznm2FQ/nho2qkrk99h:Vy5112gYy5azzVva69nLKnhZOXeN+1
- TLSH T184167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 7482b1ca7ba87f61c888631ae6d345dc2be3f71b140d3b599088a1b7ebd886fa
- MD5 a3df5ea4bebeee07226a63ff22b485e0
- SHA1 bb92af3d0f3305e4834139c61a9c118d6c4451f1
- SHA512 a3129bb97b59ba5da53e7e6a1ca728b134c6b9b1130ae233b37b87829a824ddf3b298a35fc01468270ec9c9d7409ad5656a55c3661a1c91356479eefc181e7d6
- SSDEEP 49152:7B+taZ3usBWOBr4tEG20bqx0z+n217aau1gl96mGvKVO+n1:tu6JmUxd2d9XeN+1
- TLSH T1EED59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 dafa41ef2f1322f08e90dbfb585850a99251a871660146677ba1c600e81bf9d3
- MD5 bd5559efb4c6f6d9b328cc6cc11fbfa5
- SHA1 0af77e6599a1915b8cb042d9d158ecb5d00fdd46
- SHA512 7ba06ac797c902d6b65a5842e9769c042201f149f81d914a9b904e63f01309715ad97623756ea51e460ce5f7042603fc0fde0c756b5d692f616d13f3aaf40c2c
- SSDEEP 49152:T1hpsNoJpF1A6BU44CwH7R4xx6mGvKVO+n1:TmifPkRUXeN+1
- TLSH T1B4B5BE13F29900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46F3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 f1516822962ceeaa952e5edd3604a4f44ea73b0d05a96fa927ac0219e9c84629
- MD5 05ce536d20ef2efc9110650e0c1e8e79
- SHA1 9e823954026d1599744613a9488bb1fe38109311
- SHA512 4e1fc7c0fc62ea772bbc9af1c2ccd91f18bd7c0b5e886a7d5caf5a22bf4dc56cc12320d4741ac3482a3438bda90900a4c84ac0b7b035031fb2f3037f4c08e2c9
- SSDEEP 49152:YSuZQIY0Be2KNRVtOnks6NMHqK6mGvKVO+n1:C5dKvi61KXeN+1
- TLSH T17CC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 9d621fa307755f5b7831d1281011730b198775c273efb1048c8453c0dfc57e01
- MD5 9993dbc444d72e9ab4b9494b6b6dee6b
- SHA1 568a7e315916f18169c523c2234c601f35c6c296
- SHA512 e1ff6d97f5e723a5eb52cb7d9e13a21e00a17eabb8d34bb741cef2a03f826a79eb8b2c8d3d11614804b3ccff78c753abdbf3b5bfae4e5422257e1c07edac2807
- SSDEEP 49152:3htSn8EApI0figXgiDn0AP5wt6mGvKVO+n1:mX2iyph4XeN+1
- TLSH T10595BE13F2D900E8D05ED174C7468632E962BC160B39AAEF0A90B7561F7BBE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.3MB
- SHA256 0c89dfe5a22d29662cba3ab759bf8e36a82eafd534090dc820363a1351238c54
- MD5 1be477fb5382044bf17f357b545fe490
- SHA1 472c527dfab72a3e7c498486d51c097f9a7d7af1
- SHA512 ec22e547de23f7f6b54f7d225be712038cc0daf0d33fb784f006cb7f9bfb3b1c10256162e5f39cfe99e3117eb9b113bd5e09aff53b02f112b15461a1f045424b
- SSDEEP 12288:AGtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:AG6mctvE/BT76+1NCE
- TLSH T169552381981B01C5E9DF07F19395E29AE8502EFE74DB1881F326841FAE305A17D0BDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.3MB
- SHA256 3240036bcdcb0d50eef84123c4c9c8af49bd94832bd488ab5cd1f4ce01883b85
- MD5 fdf8c53f31b12be4bdf2eb17c3170a8b
- SHA1 a5d76a83ecc477046ad23536b94e6965ade3440a
- SHA512 fa611f4fe9029e0cd33132a83da4efaed4a8e77c9ab051f60265c72a6c5819cec9c16aebdaee08a60324901601bf259443a2f297909298edeefa6fa290276fc8
- SSDEEP 12288:dztM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:dz6mctvE/BT76+1NCE
- TLSH T1FB552381981B01C5E99F07F19395E29AE8502FFE74DB1881F326841FAE705A17D0BDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.3MB
- SHA256 4f80e6879062e8d21845ec9ad81917d3b253755bed57b69470a7f2752cb0848a
- MD5 b72a3bcd786b456888b25a1597fa72a5
- SHA1 eec2de1815efea6eff84357b77e746fd80eff798
- SHA512 e0206221f1a83235017840e0cad0aa2866263262d6d4bf608c0075a30db58107f6e050cbe9afb2c9400ab1340d8f8185a7e521c6ef4f3d81eff3017dbea5e21f
- SSDEEP 12288:iJtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:iJ6mctvE/BT76+1NCE
- TLSH T1F6552381981B01C5E9DF07F19395E29AE8502EFE74DB1881F326841FAE705A17D0BDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 8688ac582b167b93260fc8e93bde593db3dc8bf75182412099dc6b6d62a44f59
- MD5 06f7e876f6cc31bb8edd4c674c31be87
- SHA1 e24fca7da51085c25d0c758b9f9a65492370e2d3
- SHA512 4e39cff010ae3ee1e1ea94498d168007edb9bbfd118572049ae321d2a4e9740443ba11c6ec3361632862bf93feebb3d5c89bcbd355b4227ca33175c128c6479f
- SSDEEP 12288:vVUtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:+6mctvE/BT76+1NCE
- TLSH T1D7552382692B01C0D8EB43F0C6A2D256E5B07DE975A719CBE311491F5E303A17D2BFA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.3MB
- SHA256 c3693c689325d54ba18a801748175366f8e5354e3b82c55e33b3670f71bb7318
- MD5 39fa481ce3455d43c207d0d29b10a0b0
- SHA1 e84d5b50ac8a3b392afa316186f86bf2542221e0
- SHA512 2aeba3d0a65d7c97f1553b17c0eb65713739d1994bcd73df23404e5e762e5eafa10ad59b4a1d207fe0007eb141b2938a7d2ae9418f7f1124dcda48cd1c99260b
- SSDEEP 12288:SctM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Sc6mctvE/BT76+1NCE
- TLSH T1C2552381981B01C5E9DF07F19395E29AE8502EFE74DB1881F326841FAE705A17D0BDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.3MB
- SHA256 6e92328695d31366f3ff629557b98866bf78e0cf7dd2a00fa6a7f019904c3e10
- MD5 233ce4dccd9a843a225c41404daa4a3f
- SHA1 124c740cb287280dbb77cf562200cb9a78fc4e86
- SHA512 cb38f69ad7bacc0e91ce3f45c90513fadf12ea8127a0eabc3cd965931e46fc02aa091313872f46dada9168881169540ebd130967a5660b02c8cd2ce33acb1cac
- SSDEEP 12288:kvtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:kv6mctvE/BT76+1NCE
- TLSH T1F4552381981B01D5E9AF07F19395E29AE8502EFE74DB1881F326841FAE305617D0BDBB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.3MB
- SHA256 d8fee5f2927cc17faa22aa96328a663ec527a3bf904a65bd3690b5cfb25f2dcf
- MD5 f219d0554aa18f7170f258def355b5b6
- SHA1 ede8a82de76cb27674330971f3eebc02b266ac2d
- SHA512 ad81176fd38fb46d31048ca4ac2a6f721a80df04fcf5fc6d346f6fa4f55db37cd7f27bc87d74ac769f5f42ce13b2cf7360ca0a687bb5f37fc8a6842e016d03f1
- SSDEEP 12288:YbtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Yb6mctvE/BT76+1NCE
- TLSH T1A6552381981B01C5E9EF06F19395E29AE8502EFE74DB1881F326841FAE705617D0BDFB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 fc0fc245805ecb4873baa01d98047e5e89958b46c51218151161fed99f5712e0
- MD5 513c77c144c8362b64eec108ee575c58
- SHA1 a49c3139e47558ae014e858f4c437773fdd7b6a6
- SHA512 97c532535464047a935f7f72d988dee28d6dff5554cc241a6e4af71be64b94a235dbf4a02e85ba07c788d90fa693073dd40f85c0b8a54bb3059f000d0ce4900d
- SSDEEP 12288:5iZwbNzzFEoS2cPvyTtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:8ZMJzFVSOT6mctvE/BT76+1NCE
- TLSH T1D3750295B35108F4ECA7427EC9558506D6B27CAA16B0C64F13B4362B5F333A11C3EFAA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.3MB
- SHA256 8a9c700339cd0335b1b4287bb68662e1cda36c90eecf223607470492b2bf001d
- MD5 0da54c7d27045aef522d955abad2efef
- SHA1 07180c4ab48983c3cfe17d20b8fe37e5c8711fc4
- SHA512 1157a3892d07195df7cd0063920d12e763fcb9cff8293991b50be00bc566ba5b97b512ee3ca1c3a59cf8829e48533f6af5c0645b1a7e2657c8a6915be4a33a0f
- SSDEEP 12288:o6tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:o66mctvE/BT76+1NCE
- TLSH T178552381981B01C4E9DF07F19395E29AE8502EFE74DB1881F326851FAE305627D0FDAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.3MB
- SHA256 6b9edef60e655133b93129990ddbdbf83d20acfba777a0428780ea9a433c2e96
- MD5 cb90398a79b5c6cbc8619cb787e075b3
- SHA1 0dd1d7ebff08972adf79e9952f0e9202f0f0734b
- SHA512 c0460f8576848c0bac436c860c74bc5c275ff8504dca8edaa1c8ecd329eefd4fa93adb3ab445b8ae1dcddc101916a5ebc4f27b03d1ce6ca84a57f144b69b312f
- SSDEEP 12288:a+tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:a+6mctvE/BT76+1NCE
- TLSH T1D5552382981B01C5E99F06F15395E29AE8502FFE74DB1881F326851FAE305627D0BDBB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 9fe15e8ed548a248825c1e02a4301d01507cd15f857cd4c4d013313957741014
- MD5 ce88c13f5c7edf05c4066d903d365e1b
- SHA1 8ddad3ea4ca0df53ccd5f13d3966b943e1a1007f
- SHA512 6f5ab827ea8bdbfea9522ff7b2fcab527b2ec7576f007cd2a0b78a5655a2e6a6bceaa5763bf5bf5eb3c8eefe1b88304dce856c77e668f25e22844f59f5c3c8b2
- SSDEEP 12288:FyPz5L8ntM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Mzyn6mctvE/BT76+1NCE
- TLSH T14E651143726630F8D17B4274C9A25202F77178B627658A9F5360463B2F332A1AE3FB71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.3MB
- SHA256 d84dc414d80677a495384bbe40eb0c9cf02dd2bc9198dd6b678ee43053bca4cb
- MD5 be7c5ad93ca5c4e2140bdfdfc3a6145e
- SHA1 aa98de2714fca7cf5a3519ef703c9def5725381d
- SHA512 98ab9e322c64cb616207ca7dcb67b1e5006136040b985ae2b07fca8ce94eaddd8ec3a3191a0d29a54dceb32c2a1785f25b1fb776f13287bd8523ae923492895a
- SSDEEP 12288:46tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:466mctvE/BT76+1NCE
- TLSH T1A4552381981B01C4E9EF07F19355E29AE8502EFE74DB1881F316851FAE305627D0FDAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.3MB
- SHA256 05c19b57721fb04c18802c02124d4a0411879335042542ba632e533b7996d5ea
- MD5 87a1c756716332700bf26cb242b50a0c
- SHA1 ad73282c9c7e0681158681b03b4d82d482c7df7f
- SHA512 3c600958bfdbb5d759fcee6edca6d7f9d8bdc9626abb0ce96be0cbf4d233fbd16824386d7658c4d64b961d859ffb83d6abcfc097089d978ddf1b0013f6b58559
- SSDEEP 12288:56tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:566mctvE/BT76+1NCE
- TLSH T11E552381981B01C4E9EF06F19355E29AE8502EFE74DB1881F326851FAE305627D0FDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.4MB
- SHA256 c5154ffec11cd4fe302dbd13bc0db76de4e7fed40eeed4f9ecb807204388ec69
- MD5 6564d95fc95801c9fab7a7cac08a244c
- SHA1 7be909280775172610f74bebd3f34fabf7c94132
- SHA512 3909073558a1d0e0f6d1b42d5803ca6f09395e2f72178de5f08a5bff3afc37173b51e22adbc988be450c00ed37f8d7fe8d2b8ff32ca7982bcd9e5eb317287465
- SSDEEP 12288:3yPz5L8ntM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:6zyn6mctvE/BT76+1NCE
- TLSH T1A3650143726630F8D57B4274C9A25202F77178B627658A9F5360463B2F332A1AE3FB71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.5MB
- SHA256 628e8ba95698e49775633147fe7b038b46ba46aec472255c1b80697c767c5215
- MD5 11a2b8c309ecfb4022a2c403d6e56197
- SHA1 e8d571f28938aa80d3a8aa10dcd4a98176cd74f8
- SHA512 a75d4f21f4b463cbbd169305b9c705dd2f7520e7fcd430fe763ede211fcea7e44ed8c578db65878992bc6cd825352c5346497295c7dbab79dfa627e8f6bed6fc
- SSDEEP 12288:JCd9PWYoaLHF3z0z04PDvhZtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwL:UTmaLl3z0zDZ6mctvE/BT76+1NCE
- TLSH T192750295B35118F8EC67427EC9558506D6B27CAA17B0C64F03B4362B5F333A11C2EFAA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.7MB
- SHA256 880ca14a04c498020d246c4b89450c36a1e6bc73a8ee9ede92cfacfc46ec243a
- MD5 defe3bb7c1d62e975d66151d056b53af
- SHA1 3d6bc336d40e8271b1bcb200c4e5692b6b230fed
- SHA512 a538cbb93f4d948d02d19cfc139f8296c9f8caf6b3f3d8409951791a1ff2e54b65c40cf413468d4a8208aa331c15a84453abfb0d19447900018dfb2bb4af4fd8
- SSDEEP 12288:yi4e75RdTfgwCHKy7GLbbdIvotM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCm:y3md9CHKy7GZl6mctvE/BT76+1NCE
- TLSH T12F85CF90F3E410E8F0B78A7589769112DAB67C9A1B71CE8F03A4651A1F337D19D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.3MB
- SHA256 c2263fe43ada235ca4825f27f2efca0d2f3fedcef82fe1955200e4d5352ef2cb
- MD5 f07f9fadf569e11ed3a8777cad943547
- SHA1 7f6bbaf28e604ba97ef8bf02d9988a46f92af299
- SHA512 2ec48b57c28446e796655ce8c12d0d07020a0c12379825015854a824fc0aac6bec409d62558ced6636ea251067006d7272e64aa33e79f5c498cd3bea44c0d029
- SSDEEP 12288:iptM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:ip6mctvE/BT76+1NCE
- TLSH T11B552381981B01C5E9DF07F19395E29AE8502EFE74DB1881F326841FAE705A17D0BDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.3MB
- SHA256 04299af4d3ea4c2dd23181d53e4118f8f83daefa5b5e6c6e4c7c02bf8a1b9cee
- MD5 02cd6e5c852cb2ee423040695da2806f
- SHA1 4af52be08f542a215453ef9097d1b4e3f28c560d
- SHA512 253b8523340a2a11b43911149937c88419c1c3b8a33d57485c6696d3d49a822ce6b964a955554a809f47f4d30a4ec895ec7db18e4a88262830feac83db8f27f5
- SSDEEP 12288:JHtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:JH6mctvE/BT76+1NCE
- TLSH T195552381981B01D5E9EF07F15295E29AE8502FFE74DB1881F326841FAE305627D0BDBB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.3MB
- SHA256 555ef2d12225d61140769d994a3157ef1e5ffa244d438092862cfdaa9cba411b
- MD5 cb6bf63e60d058dbecae8c8f5bbb3b37
- SHA1 7414b64743c27b2cb6594e0e855a43c9ae185623
- SHA512 6a80f8339bcd99afb121feb789d713e9d2f5d65f3bfca57c0052f0f49097c611c21662b533310702a33e2f48139e60ceedf2abc0061ee702128f926edbff12f1
- SSDEEP 12288:UotM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Uo6mctvE/BT76+1NCE
- TLSH T122552381981B01C4E9EF06F19395E29AE8502EFE74DB1881F326851FAE705617D0FDAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.3MB
- SHA256 d1580fe69ef1e7e6229d081c0300c91382f68f9a45cbd73c7e4f4b3378f2bde4
- MD5 0bda29d729a67b6e117d1145a9eb7977
- SHA1 b10e5df171c74240942d20d5aa4edad15d0c7592
- SHA512 0f37ae3d9a549c578ca594ea8ee593f860487cba6fe419c918b481432c6ae45f65641b35fe0ae2c5635d7c08d2cba23c0547546f4702a023e9785f3e357e4bb4
- SSDEEP 12288:c6tM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:c66mctvE/BT76+1NCE
- TLSH T124552381981B01D4E9EF07F19395E29AE8502EFE74DB1881F326851FAE305617D0BDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.3MB
- SHA256 dd29bedd8e7bb64f23d9aefff23d1ac2d2e70b8ab935dca37e8312c7a74a4904
- MD5 60d79b3132bf47e9d1712640ec55f15b
- SHA1 0720207c8afa90749c73a855d018a61c0af86b6b
- SHA512 d8f0f6d75a654ab4968e3175ecd2e82d95b7ce48924d9eabb4236f485dab862c7c5a7d84d49e7b6d014ad264075384fb169055a23e091b79216a8debb01ebe20
- SSDEEP 12288:vptM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:vp6mctvE/BT76+1NCE
- TLSH T19A552381981B01C5E9DF07F19395E29AE8502EFE74DB1881F326841FAE705A17D0BDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.3MB
- SHA256 20368f430630cedd85e9019243383078d21912dbb9121200c0294121203c71cd
- MD5 a73d117f0c40918cb7ab48a5a2597a2a
- SHA1 c30783e33ae009c9334ce290aa83e14476aae79c
- SHA512 147af39263178e1edac9ef7d7e622adf5fcd042b6e3ee87389aee375e9eafb30288602b500c7368d7b30e8b63ccf4b31c942176a881c647c5224f330a9b9507d
- SSDEEP 12288:jCtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:jC6mctvE/BT76+1NCE
- TLSH T1E6552381981B01C5E9EF07F19395E296E8502FFE74DB1881F326851FAE305627D0BDAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 1.3MB
- SHA256 443af846e2809df07db69500f0ce43503aac73b40789ef2c79cac62c8e37040a
- MD5 3b6329ed922ec5698ff9df3db0a96181
- SHA1 866b19bff7f47998556fc495a0d97005e49dec58
- SHA512 91796057f451c4b75ebe2c2856f8f91f73c1f140b3156fc6e31d00cf4cac6915c4f36f6155d1b869eec5a226acf1900c6c5ae3461b764e4b58c053ee7ca555c7
- SSDEEP 12288:pctM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:pc6mctvE/BT76+1NCE
- TLSH T10C552381981B01C5E9DF07F19395E29AE8502EFE74DB1881F326841FAE705A17D0BDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 1.3MB
- SHA256 c736647039a4f529784a33ea70f8f6c663f43f11b441898dc216e1012a694652
- MD5 57b8e6f7492df51f43687ce7ea9d5632
- SHA1 d8093d0c0b06b09e8540e6afdb1a58a92d2b3afe
- SHA512 e205d1f0ce329017074d37ef17b470e6467df3805f4a596fa2d01ef33b632f48f908ff56769374eb7e0c14af8735b5f5d93c10bcb64fd113907cc7da5c46a71e
- SSDEEP 12288:wBtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:wB6mctvE/BT76+1NCE
- TLSH T1B5552381981B01C5D9EF07F19395E296E8502FFE74DB1881F326851FAE305A27D0BDAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 1.3MB
- SHA256 22fa2bbff8dc9a27dcfb3688be17721eea27c638546b479d98503aa845358cc5
- MD5 23adc9f2fe1a7f55cbfd0133b7735ece
- SHA1 f577f7a4c7b1c60354f5693b8418bc2c815298be
- SHA512 494e280db40d58f920e1f3e39339a4de8b594cf87f88c30790949c4b23d93acb3f9ddbd2c7073fe0493d4d0956da93df02379d5fa079c43b8ec7992399fcfbda
- SSDEEP 12288:MctM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:Mc6mctvE/BT76+1NCE
- TLSH T1DE552381981B01C5E9DF07F19395E29AE8502EFE74DB1881F326841FAE705A17D0BDEB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.7MB
- SHA256 af7c3465a389a0adc9ea824738533f560fe6a1515b1e9d02736e65cf14452bf4
- MD5 6ac619c91ebcc9dc7af112e028ea49de
- SHA1 9fb404c5e29a6d2cccd43a739416d7c4fbb201ed
- SHA512 252349445a606a8da8b70ef6c07d190e3d961abd1a7fd2a538a1c2f46773c1c2ef12fc06e7492769c60b925da5a4f4afe0dbe0f7c0ebeb955c4922bdf59e7022
- SSDEEP 24576:nfwvfk9RX6wkyAIu6mctvE/BT76+1NCE:+MnYIu6mGvKVO+n1
- TLSH T11085D129EBDC04E5E1B7927C89B3460AF6B178691B31C6CF125A536E0E33ED05D3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 526e6cef1c31f310537ee1ebb1ee7c26a1fc127b45e09027c720675c452de825
- MD5 14d68563ea0cd7f25aa6558f334f8247
- SHA1 9ab38358a859eec4694cf82bc8fe9e8878b7a737
- SHA512 fe6e11f19a7be913c1feabe3ddaa8ff6a0fa66b08bbd6f42eb8094a16658113fdb3dbc4e79efb1bb9deb486284923075006ecba334f485128ee5244041a9e8a8
- SSDEEP 49152:YYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0N6mGvKVO+n1:AySzPlXeN+1
- TLSH T153067C96A16801D5C1B9C1B98B0BCC1BFB7134490335ABEB03E556935F6BAF0AE3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 545095112e7b92b5bdfa2500db7f1c9df9b145525f7241aecf21e0369314b0fc
- MD5 4e99d5e82869eb0dfc844c9d101052e2
- SHA1 625b9a53c3a2b4d0d52682e2e42bc1c1cdaf631b
- SHA512 a1893a7abb7f91fba93baddf1d189f8c7539ecb52a0541852a08393477dba6fcdc2ffe4fa6b757e01ececda02f0dc93b60d2ce39a7287da9f2774869d08325dc
- SSDEEP 24576:d47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYD6mctvE/BT76+1NCE:d47JUQj4irIhCnDHUPfF/96mGvKVO+n1
- TLSH T18765AE1EA3EC01E5E1BA92788515865AEA71782E1F31CACF1270837D6F23ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 fe2d40c09e334938eee93c5b46bbd184b5d5b1a931190aedb497963eeb339083
- MD5 1516210f2e4c015501fe0d6def66bb2c
- SHA1 683afcd3a29054ced60cd5ea8be9c60055faa0ce
- SHA512 c9ca563a5f9629669b71f1bbc9448833bbae11933776e3fdd005684bb3157c6c7c7a301ff059942a91c172d3e7d5def248b1677b1c26cc5547ba8742f0fa45fd
- SSDEEP 12288:5XsfKtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:YK6mctvE/BT76+1NCE
- TLSH T10265F14AD25902D8C0AE12B5C7569241F7333CA5A7E293CB63D0F53E1F31690ADEAB53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.3MB
- SHA256 22908f6d62d1abda5297850df3f1e1e7cbd3c84d57c4ffbd56c4ff2fcfdc6fc7
- MD5 ecde661e3a9bedef87745880660e496e
- SHA1 4e16e42ed955bf6443e8ac0b79c47a1c844ccced
- SHA512 ae2c1d4a8dc7ecae650a64520e7045f047ed9a8064a693553298123596dd8ddf991a46bbf01cfc32ada46136f2be97694343b26beabe6af1a22c430d21786b3e
- SSDEEP 24576:UoScwmUPmjKiZbMoZs5HJtO/s9ZQ5HZ/r:jwmUliMoe5fas9q5HZ/r
- TLSH T176553841722AC78FC6A950325E36D6CCA7707D01EE04AF0773C9873F9476669BAF6281
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.1MB
- SHA256 c2de4314d0ae7316503891922d1c94cb64044f4ebf5624cd0008cf5e2eeed22f
- MD5 02c9584decac7f4ac4bd7fce987638f0
- SHA1 6ffa5f5c125e7270bf0d1753d578b8a91ed93109
- SHA512 9ef0e5c8481353986fb02843d9075a50a8445c88f5c0b77d20bbdc369dbf6af43e5bac1147958977a05a0bb08e77af967e465e41ed533537c0f9d32480493f85
- SSDEEP 12288:3q3vfwPMF75sfAnwGabSTq/srpzWPrSRJ3oKZImlNWVPAN92nP07puz3X4sSeccF:63v7MYtCeksrpsrSRJpZIeAN/TQy
- TLSH T156451941A5B7E75FC9BAA0330331868DBB74AC06B7493F047344893C886797EB5E6392
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.3MB
- SHA256 835b10f3e6153e3168ea1d90572bb653521d00cac13cf1a5dc806804e76346ff
- MD5 bd3fa7ddde96411aea272bbc1611e9d6
- SHA1 e6ed5e7748e7cfa9d7d7cd7d32a44d94c8af85b7
- SHA512 ab3f92377019be34e9117b8d1a22c977f713aeb532833552dbf1238562ca0d28f5d510aba20584c31885b6ca7f4850c870d243cf8c4350a8a15fb8ebf839aea4
- SSDEEP 12288:Ip7StM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:0S6mctvE/BT76+1NCE
- TLSH T17A552382991F1184E9FF07F0529AD265E8157EF93B8608C3F211851FA9305D1BD3BE6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 0795a3358e5661c8b9da9933085a525515c1296404ca5b39c83d4d584cf2a55e
- MD5 6353a0cec906c373e38d1006a823d867
- SHA1 5d2cd9311265ac95347af235603df79ce2acd380
- SHA512 2c790159ebd0c3d3c8c32630f13e39545c45ebf70868a02b74357a5acb5b11a1d1f7e4a907c3f2f9b38daab0dfafebfbadafe4d7d898e245f7258a282cc5a71d
- SSDEEP 24576:Pgb6bmBIi49WNNFpg1rSvFv7bYg6mctvE/BT76+1NCE:Pgb4mBIBhGFD6mGvKVO+n1
- TLSH T1BE659E1E22EC02F5E0FAD2B8DDA64417D6B278161732D2DF1251422D2F37EE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.8MB
- SHA256 231f9d04baa0d1262b4a3e6ea3f0baf04de4988c77f72fe06ff93f86d882a539
- MD5 c268ad9c512022b0c0f6baf6bae28d75
- SHA1 a23649c8437c8c7224a35abf1707f61f86ad94fa
- SHA512 0f35184eab5bb536a7eb0b24d0267aee3003de52b1a8c39524877ca05f37fdbccbf8db19f3c1cefbfb014a2a17e749c816d60868b0c17188f56333996533b3bb
- SSDEEP 24576:NG88u8FpJqH1hzria7/mT6mctvE/BT76+1NCE:A7ZFPqVoa7/I6mGvKVO+n1
- TLSH T1DB85F16576E101F0D47BD1388A864263F6B1B8251364EFDF07A88A561F23AE54B3FF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 6fea55fb94d84ab0cf1e19ef0d2c68a10035ac8c4370e8dd79c75277c06f6179
- MD5 67878cb9fbff34b59174ec485abce3a6
- SHA1 4352a3a3da1277ac127db9d62797d6a87e6f97e0
- SHA512 837a4a9d57bbaa1f69dba881523e6eab98a098b0177c8d2d5d88c278979d1f658c19d984086177218f21fd5f69a5f04caa690861228ed73ddf1e83cd681ddbee
- SSDEEP 12288:oHvUrBFrEjwaQftM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1WroCrwah4:oPUr+NQf6mctvE/BT76+1NCE
- TLSH T13E65F21F65AD18E5E67AA17C85828319F77178A2131292CF02A1813F5F33DE8BD3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 31fa8d52334cc236a98b4782e98c03ec0d263ccbd51a460a7b723a27a105793f
- MD5 49d552db8726c9065fb1ac2d7157a732
- SHA1 e5fdf4cb851486ce9e44da78b0471b912335214f
- SHA512 63508e6b9babc40c9da5a163c23ad072048f423cbd9df629d8d2b83bcbdc3920818525239860ad4021af19c0100370754af9ad3d5e1c494aa44c5afb0370f8a1
- SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjv6mGvKVO+n1:eG05lO43b2XeN+1
- TLSH T185D5C06A62EC11F9D1BBC17CDAC6460BEBB23815033556CF02A486A91F27FF4597E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 4d62b764b8277023759ca058c434489755a70ab6feb7bbf1d4186e1a93df53ed
- MD5 20814d973055c87eae7a33410672251e
- SHA1 a15417b26d3ac138f7a944f219bf1ba9a5d7e425
- SHA512 0915555f4c41493755bc998bfea3a608a6f882dedad07fb0f2d3dec5d4aa1530a1a39c87d968079995f3407a9dffd7d87b5d84165b0943f1b86ce1639e306247
- SSDEEP 24576:mfa5POZ3dpqWVM50JicR2hG0lasx2+47eidnN6mctvE/BT76+1NCE:+a5POZ39Jt2pasx2+mH6mGvKVO+n1
- TLSH T12265BF5EA6FC01D5D5B9D17CC583861AF5B1346513329BCB022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 9e848c1759be99e7400ee46ffd1447de52f72072b82449083d5f799befabd367
- MD5 b7a42f29bae00507e007a4ad5f498609
- SHA1 81eb001130629077c1c8c83917bf89adc7088935
- SHA512 3d04c3c5a54d5c33559471191e3049ad67a9b9dbf32f5ae9289746fdb69f858df02caf0f3b675a7942806f22600344acaf73b311b0a1c88023ec2bf003906996
- SSDEEP 24576:vNcwHdjbyQ4nLC18lb/EOjowL7Fkr6mctvE/BT76+1NCE:vNc/zEOVHFo6mGvKVO+n1
- TLSH T145858C1622E901E4F5BBE1BE89779546FA71786513308ACF0291851F1E73BF46C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 f32c4e06c2ddf4d224aa513cb628a217287e9ae4fc5eb91157fd6800969ab9c6
- MD5 f1743649e20b6bad3193f449a99100ae
- SHA1 40478fc8e499a6f6cdb4ac32523efe82a6828e23
- SHA512 a5728b0401b0fa8fcb964d73e3804fad4f1f3493829764a49595c81ba7faf35b9686a39043ea62938669fba78de804dc677423e83bafb91124b1ce1ae8b85315
- SSDEEP 24576:4tkNvNnaFeYhJNtmZBmB6mctvE/BT76+1NCE:4tMwBtOmB6mGvKVO+n1
- TLSH T18255AF6EBAB806E4D1FEC6B4CD238112EA727461173252CB5390C13F4E679D89D7AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.6MB
- SHA256 c84db335de6a3de9c21a88d3258c27146297f4d5518bc0bf5b76ea59f5daa0fb
- MD5 73e62c36cce883e1c54ca87935f02547
- SHA1 bbdc20b9d410d9a781739412f45be35fa20d937e
- SHA512 6a6dc2f6e374c703532749164ec022851e907751a8cf511604671ba3f6ea4d5737bcbae0ecd67ec9e615357893ccfc36c5e25650f3c44164a491eb4c2361db99
- SSDEEP 12288:DQcMxWDXN1Dp/fshBItT1IQgAmtM6hct28uP18WR/FW2Gb8JTCMMK7LIFYJ1Wrox:TD3FHshBIYQgAm6mctvE/BT76+1NCE
- TLSH T18E85E17EEA5D00E4E57BC2BCD6638606E67138E9032255CB0294C1BA5F67EE47D3AF10
- MD5 SHA1 SHA512 SSDEEP TLSH