Analysis
- max time kernel
149s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 14:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
General
- Target 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
- Size 12.7MB
- Sample260820-sa4s1azarc
- SHA256 bbf1e48512eb6e537239628478d7f3ef4734a02e0375c2db9144f72fa5571b66
- MD5 9fe9d0449ac28780f9507c9386ca085a
- SHA1 a797ad37a8e53729d796a9b560d0de4a566e3a28
- SHA512 51ce1059a372d5b1a1fe7277286145a352d1eedcaa5294e5358f54bf693722f668bd5521f21d7601fc56ceeec65c180dc5f328f917b8945896e816912365283e
- SSDEEP 98304:DKMoMLZcpZE/Pn3NGNHoPy3beqBnZlmOj6EGRGNNK/zFEYDELm:DN9p/P3NGNiyaq1ZspEUMoaIEL
- TLSH T17FD65A57EC6545E9D0EAD1308A769253BBB17C494B3023DB6B60F3242F72BE09EB9350
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 11 IoCs
pid Process 4252 elevation_service.exe 4932 elevation_service.exe 2144 maintenanceservice.exe 4628 OSE.EXE 3416 PerceptionSimulationService.exe 4624 perfhost.exe 5052 ReFsDedupSvc.exe 1424 SensorDataService.exe 4536 ssh-agent.exe 5376 AgentService.exe 1676 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe - Drops file in System32 directory 56 IoCs
description ioc Process File opened for modification C:\Windows\system32\AgentService.exe 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe File opened for modification C:\Windows\System32\vds.exe 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe File opened for modification C:\Windows\system32\locator.exe 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\b2c8a6a6d744edbe.bin elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Defender\NisSrv.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7z.exe elevation_service.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7zG.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe elevation_service.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe elevation_service.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe elevation_service.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe elevation_service.exe File opened for modification C:\Program Files\7-Zip\7z.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\java.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe elevation_service.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe elevation_service.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe elevation_service.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad3af721b430dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000033447160b430dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 3936 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe 3936 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe 3936 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe 3936 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe 4252 elevation_service.exe 4252 elevation_service.exe 4252 elevation_service.exe 4252 elevation_service.exe 4252 elevation_service.exe 4252 elevation_service.exe 4252 elevation_service.exe 4932 elevation_service.exe 4932 elevation_service.exe 4932 elevation_service.exe 4932 elevation_service.exe 4932 elevation_service.exe 4932 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 808 Process not Found 808 Process not Found - Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3936 2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe Token: SeBackupPrivilege 5052 ReFsDedupSvc.exe Token: SeRestorePrivilege 5052 ReFsDedupSvc.exe Token: SeBackupPrivilege 5052 ReFsDedupSvc.exe Token: SeRestorePrivilege 5052 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 5376 AgentService.exe Token: SeBackupPrivilege 5052 ReFsDedupSvc.exe Token: SeRestorePrivilege 5052 ReFsDedupSvc.exe Token: SeBackupPrivilege 5052 ReFsDedupSvc.exe Token: SeRestorePrivilege 5052 ReFsDedupSvc.exe Token: SeBackupPrivilege 5052 ReFsDedupSvc.exe Token: SeRestorePrivilege 5052 ReFsDedupSvc.exe Token: 33 1676 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 1676 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 1676 SearchIndexer.exe Token: SeDebugPrivilege 4252 elevation_service.exe Token: SeDebugPrivilege 4932 elevation_service.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1676 wrote to memory of 4712 1676 SearchIndexer.exe 101 PID 1676 wrote to memory of 4888 1676 SearchIndexer.exe 102 PID 1676 wrote to memory of 4880 1676 SearchIndexer.exe 103 PID 1676 wrote to memory of 4416 1676 SearchIndexer.exe 104 PID 1676 wrote to memory of 1640 1676 SearchIndexer.exe 106 PID 1676 wrote to memory of 2552 1676 SearchIndexer.exe 107 PID 1676 wrote to memory of 1644 1676 SearchIndexer.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_9fe9d0449ac28780f9507c9386ca085a_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3936
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4252
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4932
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2144
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4628
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:3416
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4624
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5052
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1424
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4536
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5376
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:4712
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4888
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:4880
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3024 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:4416
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1640
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3024 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:2552
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:1644
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 e57303aa4cef46e25a54ffcf7ebf4dfc00817f3f0d6ea39c38f81b9412c1697b
- MD5 ba520f06f7dcdfbc5679afe76163c129
- SHA1 8b34c55d3f372be7282e0a6ede38a16ecbcef7e9
- SHA512 9fc3ab7532421012767c43bed259531e39e09728e8877ec8e99f16d2694eb36554d915860716e190d324e7fac270d78caacd2575f6ba4ddd7867fb4ac7a967ef
- SSDEEP 49152:Lb+632BuPkFKRrdE6ohmstBhuXjfS4LWxntQ/lFTjN4:Z3q6HjBdLm
- TLSH T1A1D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.5MB
- SHA256 fdd7a4e24029686a7d92e32ed9e2a65eaed16968afde233912e4e3b298a0fe4d
- MD5 a34df6bcc0924b340d70aee019b141ee
- SHA1 e90065d7b5b46fb13759c8e1ea0744c0df610063
- SHA512 638de3e5281c57e82ec009593deafb53e98dd087e3f1f39b45037eb503b5879cd8b44fa93f97c59f674c2cdb4092a33d5c4852623f4b4bf3594aa0f5a1fcd674
- SSDEEP 12288:J1XLsswWkxy2lRq2czAuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:HXYfDtczAunQ/tbw/2Mkjy6Fr7g0oY
- TLSH T10265F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.8MB
- SHA256 0de623ca7a90925346ec25168d075538a2394c38cc2398edd5cae51439d608df
- MD5 992f915f46d8b7194efb40b342d580ab
- SHA1 4875b8581469420cfc31e48361aff59200fda4ab
- SHA512 3a38d7c7f25e24cafc031744703e80c0e9df09f9b869ad0b899a5afbe7f0adcf646223889b0ba0a061a9bbaa6b623374ee6f249518b2d73a5d5eb43bb7b78ec3
- SSDEEP 24576:A0Le5ji0hmxLrM1nQ/tbw/2Mkjy6Fr7g0o9:APji0Al8Q/lFTjN4
- TLSH T10E859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 303893de148ac3b005ae3c305798f6eee79a51d2b374271fbb578927d403736d
- MD5 80ac7d5b16495a09f977f6e246bcdafe
- SHA1 2dab706f07cac0204c442cb02b1a20be56bbb8ef
- SHA512 d763dceddbc5a433beddcb023ebdda4dd92ec347ca61ee352ec19422db6cf6492bc866ee0cd79a37dfd672ec8266c8bedd7767f338ec93d7d11a01428cbf8157
- SSDEEP 24576:ta7/ezSC6vUyD/aqgrvWE6q8wyuXnQ/tbw/2Mkjy6Fr7g0oE:k/ezSC6vUzPvxHjyIQ/lFTjN4
- TLSH T154755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 90142ff1d23af5748cab372798bee8ecaa93f455799be68bbf46024b726c085d
- MD5 0d7c7d2f6f3757e85730f270aed66550
- SHA1 7b113da6742aa841fb788bf2fef9c654b6eb3c01
- SHA512 390808b7310ef9885bf744c28d209c0ec128a1e652a29994ec6ccc3a4b11a45d3f5b44a284de30aa9f3b112690212f484f542cca1cf590da3c74e1c81f577c32
- SSDEEP 24576:/VbqPb88hv/l+6CnQ/tbw/2Mkjy6Fr7g0om:/VO88hXl+hQ/lFTjN4
- TLSH T1DC559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 7bd7fcafe1d00d244d7cf54777da9b80fddf8fdc2f9b728c87f3babbcdcb4c9b
- MD5 064ef934303157375b4dc8fd71538e22
- SHA1 6011111a4897041dec55cdf717cb5941dd1d4b69
- SHA512 5aa68c35a845473c579a546d69a2177d5cc3d08242e9338e66ecb869afd1a63b7fe08d019653ec2231146892cbb531cd66422c1344f013697c332139ad583b80
- SSDEEP 12288:kzpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:kz5nQ/tbw/2Mkjy6Fr7g0oJ
- TLSH T1915523696A24F897FF2B06F15CC284826B7B0EC1BFD4A74E6B44362D857C39446DB381
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 1.5MB
- SHA256 0a339fdc05e89aa9e5e8de9a7c7bcf759191a6a2ae4b1024924750fd8d72d536
- MD5 0ea03993cd0838ade23b28d46b9e9286
- SHA1 527f4993d5b2db5c8b8883a62a515909f020575f
- SHA512 a49fffd6f72b261e30fcadd6ff3dbb8fe6e540ec9c46b3a1c6cc92d2f74e74b665a1d3966e96dd8ce3a61cf7dbf4e61a0cc98bd3eb465f2d8fd3f93ddf152de7
- SSDEEP 12288:YeBNUbTVO86UqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:YJIUqnQ/tbw/2Mkjy6Fr7g0ow
- TLSH T17975CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 de9d08412fb4b839b184c20ebb70fd1f10097a43fc0acaa5718fa3051babeb09
- MD5 09766c19ca731ac9778e7e71370929fa
- SHA1 d71d483bbf847491afda9e19ccac236a985bca91
- SHA512 6a344ac92a868ec674089bcb5116a4a1224f482438bf8f00612468303af63c1bbb58e565a0e5179a59053733e52426894678543e37180d8160bd2270751f05fe
- SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THQ:XQvGAdlCEL8c/yRNw5CsLm
- TLSH T1AB267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 1.6MB
- SHA256 9f7a41c7f0af5ec6a2f4ef42f3b51d04be601336b509dd4509167c58f8610260
- MD5 c66049062ce5d19c55b9e5784ecbd6e7
- SHA1 6450b7c62d72d839d996fcba5aa927a1432853e0
- SHA512 31906315134a544b2b130a81d0daf162d41f5fa907eacb0dc4eadb37fccd528473582145a20415e8b0bf45da13d5bc790c7a5fc2c90a4d53a3ecad5ff7acec25
- SSDEEP 12288:BAwSfxL/2Dc39DLLmt0LDQewsAjsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0:iQewsAjsnQ/tbw/2Mkjy6Fr7g0oq
- TLSH T1DC75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D59342D22776B17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 4b9a83e4e5ba007930d04907ff06d59a32b82a3e3c80ed838fc25f62089d9764
- MD5 00ba0d0df25a6ab0443f60625839f66f
- SHA1 86d6220ea3a71816a1b67b19335c1bca70850ab7
- SHA512 20a76bee262e4ac55146183bfc788e7f981a78e46b12b24ea74694a60f17267f46a3a331dc9a14e0c6b702a12b2c08e98e2a404b18156451aa721ec1b7b0cfa8
- SSDEEP 196608:qUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH3L:qUEtQevvqc2W1cpV2EI32
- TLSH T1B2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 9b02fbb149de3b4bf8be1847e40d7c8e4780a904df130e8a33764406ec5a60fc
- MD5 77227d6fad3c8dc002fd525033d26cbe
- SHA1 4f7925af9b29bf16a26b41d65332e1f10c60700d
- SHA512 5c0aab1b5a4387f3eb7547e23f2e1738e7d02e2e2f75c03993a12c1692a06f6294b22a4cfe92dee8a78a63a61dbe5e99c509fd440e95cde11cff3719d4274111
- SSDEEP 49152:HCbRquA/m2yL5zQfFiV+XenmE3/zMQ/lFTjN4:QoqtVjnmoLm
- TLSH T184D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 5681aff5d2e21f68ccb73203d9d8107dd4346afa8ef0a5bb1a18893843bcd169
- MD5 aa7f14e13416a33ee3f9c31599cb913a
- SHA1 9d53594b9599be78bd31576345456f007a5e4222
- SHA512 34a6c8ddfec8e1f316cec3c03b0d657883a03af3209ea8dea811425050cf57dc4abfda831875262200fd0f1003f934fc7057242211b6b927b34e66630a142b7b
- SSDEEP 24576:MAhGLJIFoiwtA5l7S53vnQ/tbw/2Mkjy6Fr7g0os:MAMyFoiq5/Q/lFTjN4
- TLSH T1CF35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.5MB
- SHA256 dd2e837c94fdc750c22380a3a87cb548c72292d59a32a687425b1803aaf564e3
- MD5 00d33afa01bbcf491ec0335d5dd8f31c
- SHA1 60ad5793d7905234a1d28451258a7e22b033a9a9
- SHA512 06e0fa1a058399bf212721b6f292ed31fa8b5cdd007c6bdbb23ee4d39dfa111d6cecfa99c350c624279130e76300522a67f1dfc0119195ee07ac9b2fc1e86e84
- SSDEEP 12288:Fmw5HEjsChN2BFgl0WDm+CXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM5:gwuHOWonQ/tbw/2Mkjy6Fr7g0ow
- TLSH T10465F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 1.3MB
- SHA256 746def2bd0551f542d105e30a56ce4395eabb6280e0f18eb92e04ed3a87c430d
- MD5 b78d2f169b3f2fe56ff69ecaa358f00e
- SHA1 3404b59780574673c0a428e2f063eda1b2557579
- SHA512 cbdfe7f7d10fd0cf9b207be5f4d5c98d2025c116b68b92a0ae9ba49ca92cb77a2b1b1190f59c6a84316b782f10c20045cf9d356f3004fdaab9d84851bc6eb614
- SSDEEP 12288:QXZ1IyIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:YZuxnQ/tbw/2Mkjy6Fr7g0oN
- TLSH T12855126A37A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 5ae8e3438cbd51278549254386463b78de3225551fe95039acfea88fc017cb4a
- MD5 bf12303baa70b03a56c04cd90e1ede56
- SHA1 22401a89b226dd3f9dbfc8bc01f093b4829e5819
- SHA512 a64476ef6553d1c4aa3080effb0326bf78c0ece72a9c1de3aca52ea0f4e65310d1894718624cc620dc9a63e0da888b6a9db439568d5843a6fbb0f05695ffb032
- SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U4:/QRQyi36YOcPQLvw2gAf+PN3NLm
- TLSH T1A7667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 a362908597a5930b29cf7b9d9936162bd551bba96754317c438906aa185d00cd
- MD5 fd91e50e388299bdc3af8d0a6152c24a
- SHA1 b51213ef611562391cec254b21b3a01bd510f7a2
- SHA512 2a8f5a1a5e2e59c8fb98b4bae7449598fb8d96e406081aa5f76c0e2ea3441bbe668f35e3c217591615ddde6c2dd8dfb501052d76186acecec1346748e1405d4d
- SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U4:pQRQyi36YOcPQLvw2gAf+PN3NLm
- TLSH T12C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 9fc47a08b606cb3084edda378843ffff2e46777ad83956fbb04561bc4a114103
- MD5 d12ef98286f1be1c211e12bd5b81b6c5
- SHA1 dd5d3a4452dd5c073711a787fc7b316ca9467073
- SHA512 f8301050e4f0802162a6927057e0cf259ad44ca057d7f2f9cb2b97d6e1370f010b9529ca0a7b55ef4c47c08e115829333fbdeda25120af01d91cea22c3d951bf
- SSDEEP 24576:awvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0BnQ/tbw/2Mkjy6e:U68Qg55nhheWu7PNU3/oQ/lFTjN4
- TLSH T18AB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 86195d6a85e8183a551e015dd67923195dd11d5ab13ab44ebd1546f415fe7645
- MD5 2e1d6ed6addc09d50d79797e0349770d
- SHA1 e31078c76448a2342e287caa2fd1e860c6b0399f
- SHA512 14295971adbdf25f450ca84bbb7982dd17c9f59d5f06944b42e9aecf2c95a0f075f890f43f84ca95ecda4f5bf10f9c6c973bfa1bd0431ff010613def812741b1
- SSDEEP 49152:M3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99+:py5112gYy5azzVvL69nLKnhZ6Lm
- TLSH T1D2167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 c3d3a934d320b56b6d4a20d021cc3803b6d60fcbfcdb63e5aab195e974a66206
- MD5 0e7963dcbb44cd6454491e2395c7b4e1
- SHA1 fac710c4a62fdf4ab33f2139ed0bd5d728da42b9
- SHA512 180c2ecf03f86cc6d1f7e2d4ed70c03c6cf0e4df8fa0d5c3518d6784c90b2426204a6c450f7896d0aebbf8ff2e90acf1dfc6977ecf586a463d12db62e0d9704d
- SSDEEP 49152:NB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl+Q/lFTjN4:Tu6JmVxd2dZLm
- TLSH T1C1D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 7867885e2d584c3a0a3396844718a84cd27703fa86302a4099a3724063a37ed2
- MD5 39b54d55c472a72a38ab4b9820dfdfb7
- SHA1 8bac40d1c84dc3203a6bc7debdb4989235586ec7
- SHA512 e4d555de59ecc4c9d996f97beb7d01fa81ae610512d313cefa23eba29d2f5acac260ef435fa1b85e5d47e42c28dd4307756c96cd613412926535cef6b128d9ff
- SSDEEP 49152:q1hpsNoJpF1A6UU44CwH7R4x+Q/lFTjN4:qmifPbRELm
- TLSH T1E1B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 b1f007a306da52291f23c665a50684a30da2c135746832b509bfda16341febb2
- MD5 378897c2a452492bf3e0fc36b9e028a6
- SHA1 bf680d46435a39d68847d6e7ccda596cc8660885
- SHA512 67a8d44a90f11aec2fe75901c561246f759f6dcf1508583bb21172cd3f43018524e1935b74d5bc9157ee5c8a934c5799f4594a5aef8aacaeb36f1162dd8aa72f
- SSDEEP 49152:0SuZQIY0Be2KRRVtOnks6NMHqxQ/lFTjN4:m5dKTi61WLm
- TLSH T1D3C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 04e66463b6fd9c6e42ef3478ac714f419e8e7d9340241eb95e1d493011b93c9e
- MD5 0edf0348b4a8cbc4f59a9308cfab0681
- SHA1 8e2232daaf8b82becb5e19c69b92787110b87357
- SHA512 e4e2735e18976fd076a069ec410c681754f928bc6614cef8c7e88e415b8df5167c2471374fb37c4d1654fbad0186d77cd19f52983ff55a6565e88a2e382826bd
- SSDEEP 49152:bhtSn8EApI0figngiDn0AP5wqQ/lFTjN4:6X2iyphILm
- TLSH T13695BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 1.2MB
- SHA256 0b203f2dcee6d371588edf3a2cfe2b4955d9a41a168ae0fd351a919ec33a792a
- MD5 c244b04718aeb4c7d3233ebf14403f43
- SHA1 5a626e5eec8443e5708bd987f2af0d778704ccc1
- SHA512 2be0eae197cc83de27ed5a3ad55bded19961765215454cbf7e2bf4203d2a316a9b9b293132ecd5e1b90c3b3e532f31a3a8010e733f067f4515b397c71459a39a
- SSDEEP 12288:NtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:NNnQ/tbw/2Mkjy6Fr7g0o8
- TLSH T15F5523697965F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 1.2MB
- SHA256 cbd9421d25f81338a9c38a1823e12a79a676bd82f5eb7243c583e21ced76798b
- MD5 8a87a9814e7b7ca7da96ac8b536490d9
- SHA1 682c0cc88f6fad5ec625f65adadad56597d8103c
- SHA512 78dd9cff0fc5199d4623e888e6764a29da2e822ab11b61050bf2093953c1a47b7147d3da6f67f0e5231a42e749d7344a7ca124a88d2294b1b33600c2d6879762
- SSDEEP 12288:0kGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:0EnQ/tbw/2Mkjy6Fr7g0oq
- TLSH T1615523697965F98BFB1706F14C8281829B3F0EC6BFD1938F7B482129967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.2MB
- SHA256 5e9485c2aaea86a96d3b47106aea5cefdf0c97978051d7e1afd096dfb12f8a3d
- MD5 e85b88e566a5f2500d1d0188f4b96b45
- SHA1 160d32602361545570c6c60887cb1c5caaece70d
- SHA512 e34c5ba9098aabd228412899a1269e23dc93741213ab4642a50591a2241791430482fb7b1012f5022b48305e46a14a4d73c2c427c931fdcb83cdf39253c98c66
- SSDEEP 12288:D2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:DWnQ/tbw/2Mkjy6Fr7g0oG
- TLSH T1495523697965F98BFB1706F1488281829B7F0EC6BFD1938F7B482128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 1.3MB
- SHA256 b1f4232fd114df863d4364d50f7faef9ba2b5ac89f3aa8236f9256b698597a51
- MD5 2faa98026f455ad0c86e8db758fc3301
- SHA1 7949dd49b8fe0f8a4347eabb4e9e638b13202ac4
- SHA512 530d99667ae46d618033e705f959a36cb64158d8d40677f9bf01f70600a5b94e310e6ea86e991ad09f0964f2b4b1dc55d96070dac0774474d6a1b04aab4f23b0
- SSDEEP 12288:HVvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:9nQ/tbw/2Mkjy6Fr7g0oh
- TLSH T1CA5523693A69F4C7F92742B4CC928142E77B3DC5BBB1A3CF6B04111D4E793D419AAB80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 1.2MB
- SHA256 2ffe0662cc41263c7d6f9b5bfd578258a74671177165763a91ecd446cf53f775
- MD5 63c71afbddef39bbd3108621c393b53e
- SHA1 b4febf717a84551542a1f8d39f928be1371fda4b
- SHA512 212a8c8c3036aa113e176b1d34db542b502ccc81a17554f03e2288bf42e118daca4e90d502e4981abaf301fe3ebea9d2829a84ea6f35ff76a4acb07a10e57c21
- SSDEEP 12288:c3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:cXnQ/tbw/2Mkjy6Fr7g0ol
- TLSH T1085523697925F98BFA1706F1488381829B7B0EC6BFD1938F7B4C2128967D39406DA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 1.2MB
- SHA256 313c9ab9754e345890efe906439cf086dda7507679dc9ec8f086546aa3691965
- MD5 3dfdf8f48ce03a46f6bb03d23fcbf644
- SHA1 b2cfaaf5d92cad52643ead08968402baab2880b5
- SHA512 3b4ea004105c550d06db08423c1d3bde6c7ba3ed7d0789b01af6c5eb101a08b71ef8a5fda4d592c39a2cfd70ffee439b08322a8a7231ac075d37b517122d53b6
- SSDEEP 12288:3wGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:3QnQ/tbw/2Mkjy6Fr7g0om
- TLSH T1A55523697964F98BFB1706F14C828182A73F0EC6BFD1938F7B482129967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.2MB
- SHA256 2135e0e1c83592f3e2c4558f3a6430f88fcea41814a1c74eae26d5b282062119
- MD5 ecd63789bb977c4c59c4852c4aacc00f
- SHA1 982009bfb68f5e9e0eb55a69c45972ef97dde091
- SHA512 401ec02e552de91c087144de4c3f2212d9d4357959d253e1a5641b49972c32a5ed592b1e7f67ee042100d7a6699181ece0ed8ab84923a795bd788436ed834967
- SSDEEP 12288:pMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:pMnQ/tbw/2Mkjy6Fr7g0ou
- TLSH T1E75523697925F98BFB2706F14C8281829B3F0EC6BFD1938F7B481129967D39416CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 1.5MB
- SHA256 ded9b2018b9486c703d92e3914604b5ea562cabc780403aa68769c360dcdbcc6
- MD5 68665e34a167a701fc12ecb2c1fdc6f2
- SHA1 bbc797ed98419b9c994a46698708156ba8ad90c6
- SHA512 d8e5bb8ace9a392a85ba81bbd2219511df9d2aaf8e077c4f7eb8f12d9160b3894c7085338fb1bc86089c6bd5a3661a9c3f4d259644804f64906d94f0a49a6a23
- SSDEEP 12288:EiZwbDzzFEoS2cPvyEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:nZM3zFVSOknQ/tbw/2Mkjy6Fr7g0om
- TLSH T1117501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 1.2MB
- SHA256 0ec8b394a3dd37b00c840b66cdab260911cf9e00f410950c0491bfddc3abf716
- MD5 5e0295f476b48a68c671386a234f058f
- SHA1 e81c1ebd52853756945d780f7621c6b8913c79c0
- SHA512 c7bb8770367546c881cd8d4f6b2035c6521a378b2e699244bf76ee4821779374cfdfa6aa611e472e496493b2f3c60b040c1f5e25741be7ed4a848bc161efa1e7
- SSDEEP 12288:zRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:zhnQ/tbw/2Mkjy6Fr7g0ol
- TLSH T1BB5523697925F98BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.2MB
- SHA256 580645776d413dd54d4004e2b9b0a589b861e1b7a4475f9e74c59f0dfca5f812
- MD5 6a83216f9187618e14ae167b22d55efd
- SHA1 7e4863e2a78931c725330afdde5a295507f731bb
- SHA512 6219ebeab231956fed6197bc568b33db6cc0eaa9c918bc096bdb2af3a9663c6e2eb03c8e341939de8157bdeb9bb058cfe95add6d0119bca7079fd4e93eaf08c6
- SSDEEP 12288:IlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:IFnQ/tbw/2Mkjy6Fr7g0oU
- TLSH T1AD5523697964F98BFB1706F1488281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 1.4MB
- SHA256 e45590a6db5642a60b47f4dbd225a079baa0449a161a9b5913982e78da891434
- MD5 b7645f1fdddabd4dbcb963f22a482aa4
- SHA1 c33d6bab0440b514cfcf6337ae909f7528a9f8fc
- SHA512 7a27d31f48b82370219e617da1fc0c2f8f28aeab5b379533d6436216a04887b8ddc534923b03dec1ef205675564a2db123b272918c4b3be7aedad3afaad04308
- SSDEEP 12288:qyPz5L8IGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:3zyInQ/tbw/2Mkjy6Fr7g0om
- TLSH T18565021777A170FAE537427888920A02F77678725B609BAF2754037A1F3B3D05E7AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.2MB
- SHA256 f1f137b49adebfd03c9fca62922dbbcae3e237281f05040bc10c49b872acd6fa
- MD5 e1194246a346b4c9d17f935cf5131e1b
- SHA1 2c2b8da09ba0e13f68723260b3226c9dffeb5e0d
- SHA512 ee8a42297c59e375d2b4faf9ad73a4e5ea04af25532cb0633e733a597d227db51afb46aa020c39e3687b5979e18bebaaf8d6f90e3b73207cdad76d3c77eca12a
- SSDEEP 12288:TRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:ThnQ/tbw/2Mkjy6Fr7g0o0
- TLSH T1545523697925F98BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 1.2MB
- SHA256 fde9a38a53c41799574ea1b4c7becee179f881d457973c83c3b5dc08baf4ee67
- MD5 56cf8938d2ef61874935f3e0ce2cb7d3
- SHA1 10b61f2c6c7f70d222f3b324dda8e339c6f9fdf2
- SHA512 52bc60e95ae6b2343ad43162df60299add0c108c72f7aec3ffae54225e619c02730cae577d10a5e252f5381780a0bb785a6a8489df6db1d43e2086bc3d02e5cb
- SSDEEP 12288:BRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:BhnQ/tbw/2Mkjy6Fr7g0oA
- TLSH T1705523697924F98BFB1706F5488281869B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 1.4MB
- SHA256 1aec25895d925bdb4fa2ccba75c4746a46568cdea01f5025c8c5dacab2d3f0a0
- MD5 6458ebf08749f0efe5ba51ac26d36be2
- SHA1 1e89fa8602c7b36cc83fa74fbfecc0defd4e4724
- SHA512 82ef2581c00028af00a8c8a5e0dd2166e22fdb9cd335dda865baae0029edb18b0df10a3dd84264c8441cbf9dff06ecb579ae8e97cd5445c62ce8653c29760ce0
- SSDEEP 12288:tyPz5L8IGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:EzyInQ/tbw/2Mkjy6Fr7g0o1
- TLSH T19265021777A170FAE537427888920A02F77678725B609BAF2754037A1F3B3D05E7AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 1.5MB
- SHA256 0430c131d6d3d3bb62fa46f54754eb06f92efdf9a1ae894ebbbc6e02c3147dab
- MD5 5745b8c69caf41954f05ba0dbced995e
- SHA1 5d0cfd1e575127a701055805cf219805adadd08c
- SHA512 a274bd20247452b541f837e0a4834019c3c307d605de2c537100e1029bfd55c2cbdc8e3c94e4acd40cec894bd54e5ed934b3ffba1229fa1a36e8b6fbb314675d
- SSDEEP 24576:4T0aLl3z0zDmnQ/tbw/2Mkjy6Fr7g0ow:4TDLljrQ/lFTjN4
- TLSH T1457501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1.7MB
- SHA256 0966c3116725fa006e817dc22713ef48e7a9d2b3d35eafe9d607bc3e7327916a
- MD5 d58e52751518d07a438db42299bb977e
- SHA1 a8e4976184bb61702dd0cceda41cb26dfeb20d48
- SHA512 1ee8d68933c891a14099212b44843b4b8b2d9b7c69b4b7cc8348b6e5919a6199e08f4ce6db58a40e7fc44d373900d4e9feac6b5655cee57a837904086f8ceb14
- SSDEEP 24576:x31d9CHKy7GZinQ/tbw/2Mkjy6Fr7g0oR:h1d9CHKyaAQ/lFTjN4
- TLSH T14985CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.2MB
- SHA256 2ef279886a1b7d57b2c9a4e1409e10368a9df87d58492b1199f8e48c1a410af8
- MD5 4780d8bc5a6e8d142b645a6f47ed05ba
- SHA1 3c0f6270d8e6102b5ab3b891dd44b1acee6ee8d7
- SHA512 507a7b841b1213d21ef8d5120688070c363c168a0729794c83c2f031e9eb6dd696c3d4a51751bc5927b3c79bd3a729a6386343df1b7cb39f3f6123c1921215b6
- SSDEEP 12288:xWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:x2nQ/tbw/2Mkjy6Fr7g0oF
- TLSH T11D5523697925F98BFB1706F1488281829B7F0EC6BFD1938F7B482128967D39406DB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.2MB
- SHA256 855a9e075cb6145599290c3d2d3e6c9a19fca8cbcd0f0e0be823f9be273071f2
- MD5 08052f3497b8dbab8bcfa87ef8360515
- SHA1 a12bd17ec90a951c856d14e8d9e16d3d3356f5b4
- SHA512 7202b04fcc0269f34aef24832b8124f780cd7db48d519bf17c91312c00b718338f82eeb2581945415a0a49a5e9edf7227e7aaf93a095302486cbcd5d0d65cf71
- SSDEEP 12288:woGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:wonQ/tbw/2Mkjy6Fr7g0o9
- TLSH T1105523797964F99BFA2B06F1488381429B7F0EC6BFD1938F7B481129967D39406CA3C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 1.2MB
- SHA256 29140a61aa4950ac4b3261bfc485df9c57157e6c4ec84438399c5ceab7af1930
- MD5 d77fcb211248b42b7dc230d722e37bba
- SHA1 795190804bdae83f2bec292480102d8827d464fd
- SHA512 b32f7081928f623db1f739f1de4cf5a84ac0f87ecacdccac09ea155509765a404356ef6ab59eb38070f878217701d45b4211086fb5be2a051ae830d19de76aa2
- SSDEEP 12288:ajGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:aTnQ/tbw/2Mkjy6Fr7g0ot
- TLSH T1C15523697924F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 1.2MB
- SHA256 228e03e3b309f9da590749b256f8fed9baf8bcb7977340114b920c85d4d2ae5e
- MD5 2cb936708b0c7a1e14f22d111a2cffb6
- SHA1 cd47ad4745c816a50a17624bceaf7976ba33248b
- SHA512 08f308e34886125aeb9111b429d43ce67f94ec03bef2f6afa0cd3cb83e58a447e34d6eba7d91c60b021c097988a8348dd4035e7ffcfbe786d9c2c8f01f3c937c
- SSDEEP 12288:RRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:RhnQ/tbw/2Mkjy6Fr7g0ot
- TLSH T1225523697925F98BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.2MB
- SHA256 a8265298c9a850b0ef2f689e057a2048e3d5112e30c4675edc1b8d4e31e6803b
- MD5 e127500d3fa7e15b40d7ee1e36f41cda
- SHA1 e75e787d160e06f1d2d3e3e73a19aa687cfbc32c
- SHA512 18b365506213b02d595c40b1ef447a5dca4abf30ea5af2c0bd793b2abd1012c994b98d0bad6106c7110801fb96588970ad6f2374dff364df6fab8cf65a0ee3a2
- SSDEEP 12288:IWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:I2nQ/tbw/2Mkjy6Fr7g0oB
- TLSH T19C5523697925F98BFB1706F1488281829B7F0EC6BFD1938F7B482128967D39406DB7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.2MB
- SHA256 13bb302eecf0c6077b970cd8f451fb4d1518fa7d72b8fb29d2fd291b9dfbaa30
- MD5 9e665ca2f399a5eadb8dce50b3cb600d
- SHA1 b4590e7dfe0dbbeeadf45cdc2e99588efb7c1606
- SHA512 bd7d1f4beb348e3a4b75e615c486a5f019764b493ee50ffc4ec4e1b774a55f5cd25cec2446da26ffda05343c3015c06661ab789ed8df7f6cdc30cb090612e129
- SSDEEP 12288:l5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:lJnQ/tbw/2Mkjy6Fr7g0oF
- TLSH T1745523797925F98BFB1706F14C8281829B7F0EC6BFD2938F7B481129967D39406CA784
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 1.2MB
- SHA256 5e366e464dfce1f5a2328801cf08c6ef25548fffb06a767fa686d4df1a2a5482
- MD5 ad9b6b133dc5dd30ea076451dce652db
- SHA1 9a9adabc607b0fe66222d99767f6cda9fba17479
- SHA512 2c6aad28b3d04c8aaad4bfc7ade0395d383f4301fe0906f81b5a5614ffde8eb2f90c6765535dd79ef4bb8186f75e61db56077cd0d80f9132a999021b0df9a945
- SSDEEP 12288:o3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:oXnQ/tbw/2Mkjy6Fr7g0op
- TLSH T1B35523697925F98BFB1706F148838182AB7F0EC6BFD1938F7B481128967D39406DA7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.7MB
- SHA256 4e1aeafdf591562c9f1d94b235252f9dc317127d9a07f07d0085d6221babb4d2
- MD5 3ec8600756f9a83535d10272391db13a
- SHA1 f32f8cae7e2bba9bbabfbf1c809f70fb07be226d
- SHA512 6efeaef776dad5d2c585280a2204f27234b97020282d882e649d95e544c68debae92b5a4b82a5d4e4e2d231157b1e54a24d8e0ed783452dd83ace6e435dcb906
- SSDEEP 24576:Zfwv/k9RX6wkyAIZnQ/tbw/2Mkjy6Fr7g0oH:IMnYIZQ/lFTjN4
- TLSH T15885DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 a4e204548cb0908422ebbef16ca4a38b5071fdf26ffe8678062a9812bee04fbc
- MD5 b7358870c411c064f39b83ad87ae2acb
- SHA1 a347f003e32d572e97b4b16809b1c95eadedf2b3
- SHA512 1ee8fb8022349efdddc9a732f608f6f8332b919c47434a6856577338ec2ef05ca61619128b89a8e1688dc1af167ef99ac25325fd0d9f6998d3e61f22a63f7e1b
- SSDEEP 49152:1YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0OQ/lFTjN4:1ySzPBLm
- TLSH T1A6066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 aace5254b4e4333dc6885bfe8ae5c83e4607b19ed5bbb6f9c83527202b9940e0
- MD5 4e1fbab8d7586aa53b2a128ad4bd490e
- SHA1 7fae0bb827fe67185af9524182bdf3f0fa7a4db9
- SHA512 a4b291de4a50cfd27febb2a8a5dae2234b61178672a2238352cb87276c7baf18a505d57c23996d512f0bd70bc28bc3e10efd9daf183a40460cad563f0c021a5e
- SSDEEP 24576:047Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYQnQ/tbw/2Mkjy6Fr7g0oS:047JUQj1irIhCnDHUPfF/+Q/lFTjN4
- TLSH T1EE65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.4MB
- SHA256 1c111ebb14f109e2b05ef526a51eca79da00baef2d3a03ac941156a36e2e714b
- MD5 bb1d9337510c24e7dd9375e8d0639dc5
- SHA1 ce6ee6b38c4cb9da90733f080e7b95a5754a204b
- SHA512 bb7719ea909c19c5073465b8523afaa0953ab2b10b0e34410bcf3b352162a7d72d8b1547e1b8d57942c2b2f35773a1475a61214f6a0732fd6a848439479c7097
- SSDEEP 12288:MssfhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:CxnQ/tbw/2Mkjy6Fr7g0o3
- TLSH T10D65F119E29852E9D02E5275CB828A41B3373C9597E1D3CB67C0F53E0F7A2905EEA743
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 60ba69e64f86aeb925c5fc9902bed9d7eb6bf358b08945ac622ac264a24a974c
- MD5 014fdbe66cb332bb640ad11b22e5a812
- SHA1 41eb1335430138c405c3a374eaed1bfccc98b483
- SHA512 a639ae0fa4937b72ef50dfa3b87b7289f6ee40f6fedaf261be27be58b0f93f80796f0b391aa673eb324de2e9e8d75f94c567671ba671a9ce7a3ec82501d70daf
- SSDEEP 12288:IJ2ZUvc5U3fJQlZgXgtdhyjktAZt385DsqwkK0yX:IkSv8UPqWeVtAZl8RsHk1
- TLSH T14F350841766AC75FC6AD40321E32D2CCAB707C45EE456F03B3C8873F9576669BAA2381
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.6MB
- SHA256 b35147dc45325c0c94bdc95f391cd7c0fbde08aa2b8292cf1665c325c89492c5
- MD5 12b5c28341bf093dab5c804b1cdf455b
- SHA1 0f01f5a873e0b44c0f00c2d0fcbea8eeae680f50
- SHA512 73948d162e9d7dbb36ab3fab233508e9310e0e8470af3a9129ad1853c24b82a237dd0380880d2a698987c97ef925162ace89bf6b4c34347441760ebf7b36478e
- SSDEEP 12288:PpHmt7yRjp3KV7v4njjKmgxY5TQBXep4KO7hDbMwqmxXeDDa0WRcsiar:PpHmAjBnjqxmAoKi1O
- TLSH T1C9750A815137E38FD1FB603203265B4DA7A4EC077B496F22B3C8453AD46AB65B4B93C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.2MB
- SHA256 6110fcc5c83ce3e3ee40f4d4f52f9d61800e45a5262a95d665b3dda9057fd275
- MD5 c2167458df692ac36b40c9d609334eef
- SHA1 6163e8e5dfe157f502c73f442c80a5003ff43ff7
- SHA512 f95207f2ce8ae323b7c12c3319644d3527971b4144577f4ef8c426f47cd7b83cc03540e6e586fd99b8f6c31e5615d45a5a15de3a7e6c5c8f71af9335632c826d
- SSDEEP 12288:X671GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:+VnQ/tbw/2Mkjy6Fr7g0oT
- TLSH T1865523656668F94BFA3B06F058828111673F0EC5AF90D3CFBB082269957D3D40EFA785
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.8MB
- SHA256 fa00e8eeca64f9b82e443273103c942ffc5403bd788aac34b80ff1dcde705945
- MD5 68208009cc55ac64ceda0ca51b52c785
- SHA1 77911f6eb1887f69eecd56a3a2b2ba99117f9a5c
- SHA512 344506d54f1924f32435eb6bddc630658627adf50821d32dfc339b7ee247f9e01dec350f47d8b627c6a4f3d7db5e9be11b42c41edb4097adaa1fe30c2472203e
- SSDEEP 24576:pG88u8FpJqH1Qzria7/mgnQ/tbw/2Mkjy6Fr7g0oe:87ZFPqVva7/vQ/lFTjN4
- TLSH T19785F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.5MB
- SHA256 4aa39019b25b685ee439ed03a2ca64918b1c9925b151adb19c02a6bdaa38ed8c
- MD5 e48f915b7fd295ee0e8b32a5edde4f9a
- SHA1 1fb0e00d124de989b6f9dc6230114f408e5958c4
- SHA512 9c4ad5e7b0203fb2c80e885af931f5a85b2f5f78819bbbf2c000888f6efec541fbe052695ba23d00f44422ba830f9d8c311877f1f696a6cbb74fe10cdbdfaf8c
- SSDEEP 12288:8HvUrBFrEjwaQEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:8PUr+NQknQ/tbw/2Mkjy6Fr7g0oK
- TLSH T1A665E12F26AC18E5F676A17D89828609F77278521752D3CF02D0817E4F77AE86D3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 e3c96c0d7acae57c88f0c77ef504397b3c72807199a83c81d0a085c572dd94c1
- MD5 8fc7a101caaf2bb96f0a9de8e03541eb
- SHA1 b5475c25960b441d9ff7e0ad53cc604af7ee0854
- SHA512 5dd70fd1aacac2c06b6ee6a2125f90fe90278ce1130762409c9e7f028a477d84de1b8119252c79f4a3552ef1c82a5b0652180cc5049c820e9f61b0ed41fa398f
- SSDEEP 49152:LBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj0Q/lFTjN4:UG05lO43b2Lm
- TLSH T15FD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 6692ab11574a4235e620674e70b742eba709dd4fe69016f9856c04769f1e89d1
- MD5 173d18f59175a3b9e8f40962651000a5
- SHA1 d47895fafaeadb40990be6e8ce46e5660e4d529c
- SHA512 43a994a2b9df25e0e0d4609183d8f58810d5dacd0c7259eec1f7cb96dc5b2880ea1065cee241c582fab0f6ef8057dcfe2dd3ba5e4df7c8181bad02876a627c24
- SSDEEP 24576:7fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnOnQ/tbw/2Mkjy6Fr7g0oH:ja5POZ3+Jt2pasx2+m8Q/lFTjN4
- TLSH T10F65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 90d54bde71734b483a7433b960110d2ece66ef193ed427c762d0de1cbcff67de
- MD5 adb45acc00d9be37b960d6855afd63c5
- SHA1 1b32ceb732adcfb9abf365c9d99af29f28c723d3
- SHA512 242830eab32584d8124145a1301b977cec6f2074c9011510435a9d4389c7a4090cb097451bbd0d0306a78acb2e20efafef64e345124f215dfbd64ad668e41ec9
- SSDEEP 24576:3NcwHdjbyQ4nLC18lb/EOjowL7FkInQ/tbw/2Mkjy6Fr7g0oh:3Nc/zEOVHFPQ/lFTjN4
- TLSH T1A1858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AgentService.exe
- Size 1.4MB
- SHA256 4326e788653369b73aa498702e39976725fec82c122eb3fa2f7eec229168a8c5
- MD5 a3891d43f4d446e22cbfbc85add4f316
- SHA1 24d5251816e0f3efe27e40d23e077d03a37a147c
- SHA512 3c5fc58893e7e3ada7b0af555f9c83c2419fabff7d961888e76ca884621f0a768d61d24a13679dccdfb0f0f0a2e9a20d9d8f032ff1df84eb1b36b6133856d1ae
- SSDEEP 24576:Ngb6bmBIi49WNNFpg1rSvFv7bYXnQ/tbw/2Mkjy6Fr7g0oC:Ngb4mBIBhGFQQ/lFTjN4
- TLSH T16265AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 c6011546eadb78a8a972e9a5f3c43bd24c46241329c3e23395a160588dcaccf5
- MD5 97c97412a4468b59527aa3b67f9b4130
- SHA1 ff8581fbba807b169373f0ada8f5eecb6d510481
- SHA512 3814704394f49428862b9648b8711a035d57071fae276a9dfa6d029571ff1599c1bfbcd68757056c663561feffe9eddf9b0e5a62a097bb7f5529427a1c43f99b
- SSDEEP 24576:J8kNvNnaFeYhJNtmZBmanQ/tbw/2Mkjy6Fr7g0o1:J8MwBtOmaQ/lFTjN4
- TLSH T1D655AF2EBAB846E4D1BEC6B4CD238512E6727451173293CF5390C13E0E679D89E7AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 1.6MB
- SHA256 90f360ba99f330ae29d0d79dd08eb36c6e66f48f4b00064dc575250157d27a24
- MD5 c05f01d71108c20829580a5d5f8b3b2b
- SHA1 7c12b7d226042711d681b45fb2997f766661f8ec
- SHA512 53d52b6d7f1558abe9971c4880cbaee0361d5ad2d56a7f30caba41a87132bc94185a4924086945a07a299a33263057e9f8dcc9803f0f23abf334faafb26365cc
- SSDEEP 24576:jD3FHshBIYQgABnQ/tbw/2Mkjy6Fr7g0oA:jDVHeBIAABQ/lFTjN4
- TLSH T1A875E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
- MD5 SHA1 SHA512 SSDEEP TLSH