382e239739863237aa8eaa2608f02228c0205ac4a26334c17d58333de1143674

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-28_44d6597627a9658385d9b97fbc7ef254_cobalt-strike_glassworm_icedid_njrat_stealc_vidar_win-beast.exe
Size 5.5MB
Sample260928-trhsjayw3q
SHA256 382e239739863237aa8eaa2608f02228c0205ac4a26334c17d58333de1143674
MD5 44d6597627a9658385d9b97fbc7ef254
SHA1 2032fe9df7178a24ea401665e6c53d4fe8c1716a
SHA512 629d0c3c04fcebe694ec90b6be73098c2a0917cd877426a809e7f136ad7171afe77b0071649e1a9718b43adb07f5a1616fd5e39b88522f17c8f224c96601961c
SSDEEP 98304:sZ8FJBuLNP3AxNVu0VLGMb5Cx0taAUgLdpq+Xvna9k7VoiX996Kc2sfb9s7JTHfW:I8FJk13EVu0VLGMb5Cx0taAUgLdpq+Xj
TLSH
T14046CF4A62A800E9D1A7D27CCA965A07E6F23C05937097DF02E07B6A1F377E15E7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1348	elevation_service.exe
2876	elevation_service.exe
4420	maintenanceservice.exe
3076	OSE.EXE
260	PerceptionSimulationService.exe
1088	perfhost.exe
1104	ReFsDedupSvc.exe
852	SensorDataService.exe
2272	ssh-agent.exe
4092	AgentService.exe
5836	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
	\??\F:\	elevation_service.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-28_44d6597627a9658385d9b97fbc7ef254_cobalt-strike_glassworm_icedid_njrat_stealc_vidar_win-beast.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-28_44d6597627a9658385d9b97fbc7ef254_cobalt-strike_glassworm_icedid_njrat_stealc_vidar_win-beast.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-28_44d6597627a9658385d9b97fbc7ef254_cobalt-strike_glassworm_icedid_njrat_stealc_vidar_win-beast.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-28_44d6597627a9658385d9b97fbc7ef254_cobalt-strike_glassworm_icedid_njrat_stealc_vidar_win-beast.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-28_44d6597627a9658385d9b97fbc7ef254_cobalt-strike_glassworm_icedid_njrat_stealc_vidar_win-beast.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-28_44d6597627a9658385d9b97fbc7ef254_cobalt-strike_glassworm_icedid_njrat_stealc_vidar_win-beast.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-28_44d6597627a9658385d9b97fbc7ef254_cobalt-strike_glassworm_icedid_njrat_stealc_vidar_win-beast.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-28_44d6597627a9658385d9b97fbc7ef254_cobalt-strike_glassworm_icedid_njrat_stealc_vidar_win-beast.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\55ce0db6e4fea11e.bin	elevation_service.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5468-0-0x0000000140000000-0x0000000140583000-memory.dmp	upx
behavioral2/memory/5468-74-0x0000000140000000-0x0000000140583000-memory.dmp	upx
behavioral2/files/0x0001000000009329-107.dat	upx
behavioral2/memory/5468-111-0x0000000140000000-0x0000000140583000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-09-28_44d6597627a9658385d9b97fbc7ef254_cobalt-strike_glassworm_icedid_njrat_stealc_vidar_win-beast.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-28_44d6597627a9658385d9b97fbc7ef254_cobalt-strike_glassworm_icedid_njrat_stealc_vidar_win-beast.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d220727654fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005ddeabe4644fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000021e7a3e4644fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c01dcce3644fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000151423e5644fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d2c0ae4644fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1348	elevation_service.exe
1348	elevation_service.exe
1348	elevation_service.exe
1348	elevation_service.exe
1348	elevation_service.exe
1348	elevation_service.exe
1348	elevation_service.exe
2876	elevation_service.exe
2876	elevation_service.exe
2876	elevation_service.exe
2876	elevation_service.exe
2876	elevation_service.exe
2876	elevation_service.exe
2876	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5468	2026-09-28_44d6597627a9658385d9b97fbc7ef254_cobalt-strike_glassworm_icedid_njrat_stealc_vidar_win-beast.exe
Token: SeTakeOwnershipPrivilege	1348	elevation_service.exe
Token: SeBackupPrivilege	1104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1104	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1104	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4092	AgentService.exe
Token: 33	5836	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5836	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5836	SearchIndexer.exe
Token: SeBackupPrivilege	1104	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1104	ReFsDedupSvc.exe
Token: SeDebugPrivilege	1348	elevation_service.exe
Token: SeDebugPrivilege	2876	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5836 wrote to memory of 2640	5836	SearchIndexer.exe	102
PID 5836 wrote to memory of 5592	5836	SearchIndexer.exe	103
PID 5836 wrote to memory of 2364	5836	SearchIndexer.exe	104
PID 5836 wrote to memory of 3304	5836	SearchIndexer.exe	105
PID 5836 wrote to memory of 6044	5836	SearchIndexer.exe	109
PID 5836 wrote to memory of 4960	5836	SearchIndexer.exe	110
PID 5836 wrote to memory of 5332	5836	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-09-28_44d6597627a9658385d9b97fbc7ef254_cobalt-strike_glassworm_icedid_njrat_stealc_vidar_win-beast.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-28_44d6597627a9658385d9b97fbc7ef254_cobalt-strike_glassworm_icedid_njrat_stealc_vidar_win-beast.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5468

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1348

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2876

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4420

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3076

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:260

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1088

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1104

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:852

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2272

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4092

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5836
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2640
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2714045687-1127350534-2056456672-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5592
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2364
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3304
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6044
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4960
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 413fd9ae2c1e4a84867fd37531bed5095427dc78455f7a4324c20a5e9aca9eb0
MD5 26b0f3cb67540cec72f6ff92005e951d
SHA1 e9dff43e7b4c44dcd23e4236469d91e599787f9d
SHA512 77cbb50d3f9779273535381e20787789ce0f510d226d7d7a4464d356a15214c4afa80a1d01a9ad5c81988c70d9c56983d5eba87c0f22b30930dde9e27d8260b8
SSDEEP 49152:/b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnnA9n/TDbXNKd:93q6HjBFfb9s
TLSH
T195D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 c70ca84e6a6a8c23d7f76a3f4cf4314edd720389d50277f4323b95c8a3121f08
MD5 284525c2971934637051694593cac1c8
SHA1 cb75f3d5cd5c133598775edfc8ae7c761f6c7bad
SHA512 02e066b8b2dad2082654233a4d12108ade83b97f4e005c638a560c3be0245faa784a7f0456e783ff5ee2bd7d96d40136338a2378881807d4d2e335899430436d
SSDEEP 24576:vXYfDtczASUeA9n/TM4NZYeNm+9MhUwd:atcFA9n/TDbXNKd
TLSH
T1C885012967E408F9DD67827CC8A28505EA73BC454760E7DF03A4992A1F333D85E3EB46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 04f95c2b37cf30d7aa0cf8a82874c34bb1aeb49cec0d9763caed64817faea61a
MD5 be4f9224219b5e619b2b4cde83bea430
SHA1 c26b3569ac5f7355e45dd9ef2a379713ba16dc1a
SHA512 ce29d4cc07dfae4f78b4dfd6765583c460bbc190a2e24ccee9409f85cef320c9776bb3f7fc616e5df5055f9a35c1c93bd99ae8efca97abb3be8c323223578d72
SSDEEP 24576:D0Le5ji0hmxYrMGUeA9n/TM4NZYeNm+9MhUwd:DPji0A2tA9n/TDbXNKd
TLSH
T12D959E16F6748731D073C0B9C5D2A68EED72348657308ACB4286D77C7E27AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 432621e418a6faaac2acfdf5184a9f474cdec218d38b4b94b9f0925516f30313
MD5 edec96760529ce81fb39e31e62af9955
SHA1 448dea6a1f61f306bbddacf26d537d32f03e2667
SHA512 03504a87048767b4b67435bbbac8c5fd15989fc509204affbc56ff7b7d94d0695c8967a69423cd0e26efad92dcc56b0c0d253d1a284fac0ef9b2564489214fcb
SSDEEP 24576:Za7/ezSC6vUyD/aqgrvWE6q8wyuIUeA9n/TM4NZYeNm+9MhUwd:I/ezSC6vUzPvxHjyxA9n/TDbXNKd
TLSH
T1C3755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 bf61c5822fba6a60704a8408b0b8d68f15b4eabcdf7271f8ec2661546edf6029
MD5 1cec1fd7d90d3d4b1abca834408184f9
SHA1 70061f33ee345b34ce799aeaab6a121fd4b97ea5
SHA512 e651da6382020f9cc17895456602d97b545c5d43ae95eda5c9e25f56ac7c3c1ee8c20be10b6df8f31ea8587560879b23dab235d77b08fa65b1ca9102cc634f47
SSDEEP 24576:OVbqPb88hv/l+6HUeA9n/TM4NZYeNm+9MhUwd:OVO88hXl+EA9n/TDbXNKd
TLSH
T14A559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 13a324d0f93b9b118bf46646ec65dc22837041ef3f1a9de108e68b2e0ef7baa5
MD5 407e1037580984ecb4e60491fbda20e9
SHA1 a8926c19bf60c63a9c0e2a4d2dd20b501a1367ed
SHA512 2ff2453b3e8649edbf3d92bd053342de815f5292161f04170a4c5af2069700d5750741db2c912813625e1d34f5ca9f900219617895f7bd3e3d3a2b058feaf76a
SSDEEP 12288:wHCBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dv:wHCUeA9n/TM4NZYeNm+9MhUwd
TLSH
T11C6523824BFC0CF1C78E0A7544AABF0CCDA2BD4DE684879E4719762A5E385C6C95648F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 508b923d09e468385f26bc7869bf7b52235ad0575797741180c31491364fe5a8
MD5 afa0c9c5f9461fc1ff48c724c06c19ed
SHA1 239fece96fd87e7c4e93c886f7dbdb754fcf10d4
SHA512 bf26c9a39acec4b8c3473d8a7220e1a8898d443d1fc7176074eec26744cd9c2ec10dcdd635d2305c09e1fc764a8955b4e01a95d5b3fc90b920161078e76233ae
SSDEEP 12288:EeBNUbTVO86UPBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dO:EJIUPUeA9n/TM4NZYeNm+9MhUwd
TLSH
T14685CF7BAE38ECE2C27E4DB956918700D77278304B6293CBD165830EDE235E15E7AC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 86ecd00064344a84e495fd41fc47744b44d3da8b0f0a1762537b7ef7d7ffd0f9
MD5 5cb6095079e6ddf24e4a5a002231ebd9
SHA1 dbb24de7d82e61a3f332b570d384daa7a0796f4d
SHA512 730925f0fc78c66bcca4ec617bb0f9da17c8cc81c913b3f75350f5744bac5999caa1aa0c9c682bc653e3caf69a0b7b14af483f0185ec6aaea4012759675907fd
SSDEEP 49152:IQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH5:IQvGAdlCEL8c/yRNw5CLfb9s
TLSH
T1EE267D656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 18897544fdee533efab3c1a622139e28098320eb03d737978d9dab739195ef1b
MD5 6a48285049b0c89bdcb3581cecdeda70
SHA1 612b57a6518f6261e7f981a76cc386d6a6398e82
SHA512 3476fe3f734a0421d0f213576dfbaf5464d2f062ccb2722b8b2208cffbad49d52081cfe5c42030f813a7f19f4281614eab7aa8707201d5b9c559718de69a1d6a
SSDEEP 12288:8AwSfxL/2Dc3SDLLmt0LDQewsAjRBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9m:h7ewsAjRUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1A785E031FE74D432C3BF0DB21B36D706586DB9204B511AC3E3A89A9E59302D26776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e80e23c5429aa9c9e913032f05ac6452cbac58b68c30e1cc7917ca7078a63d6a
MD5 688c43ec7ec4fd0db2bd122fa52805eb
SHA1 59fd879c6148085f026931272b6817e6ec686283
SHA512 8e048d937455c5124d4189b32d9580d8c420069c3ceccc0db837368759bd67b628905d07db316a18f8763c7a1a3fb375a4dd14f0b2edb50ee1eaa668aa93d3ef
SSDEEP 196608:yUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHE9:yUEtQevvqc2W1cpV2EI32
TLSH
T190474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 65b525a24b1d7f53c0d4aa4bf6d597d1321bea422a2e25b29ff45859b0d7184c
MD5 a695ca13881bb56e4c1f2b30712313ba
SHA1 79534fcb139313614670081d57be2b67eb100b86
SHA512 addd8cc9bc6884e44102442e0c6c82f067a7eabc31962c01c73581f64508e007d5414fbb009b1e3a909c23179b66a1f0411aa68ef56bea71d10bba76bc91c3c1
SSDEEP 49152:sCbRquA/m2yL5zTfFiV+XenmE3/z9A9n/TDbXNKd:FoquVjnmXfb9s
TLSH
T15DD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9af9f6f6937b9f9028a4250f3243e72f6fa556990d0d0ca5a3df73e6f144b605
MD5 136b9188f4ba3f46d29423967d429df9
SHA1 4e3233fc22b982a36299ee0818e048162cc7a3d2
SHA512 2d181a303a071d1d58b31f9e3e5e95cfc384724f0a16e6ba57125460ba08c4083df9a51acc130f82b3befb9bc12dd221f2381873add9604a56e05ee905006b48
SSDEEP 24576:zAhGLJIFoiwtA5l7S53MUeA9n/TM4NZYeNm+9MhUwd:zAMyFoiq5eA9n/TDbXNKd
TLSH
T1A4359D81EBF945D4F5B3AAB899B69570EA76BCAA5E31C20F1150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 2179c11ed472214072a456fdec9ecc6bffd513792895916f92e74240fff90177
MD5 db5e4ab328f7a36ad9e167279202be28
SHA1 87ae00e686b32b5012b7c76ec192be5a53f569d9
SHA512 65ed4840fea4b8720fa1bc2fa4435c8aadde5cfb582a4fcdbefd92095dd9783ab02e4de6a694820db54aa6a8c81a35d78eba61f846739c420744b5c9c29ee551
SSDEEP 12288:Tmw5HEjsChNzBFgl0WDm+CpBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dR:ywuSOWwUeA9n/TM4NZYeNm+9MhUwd
TLSH
T11885F14637E80CF9DAA746398597D535EBF2BC062A21C71F0760C61B5F37261AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 f4c6392b464077e2db72ac078876c99ade0d856398a83c15360b16d496259df5
MD5 9103df03e389597a6839ca162b014693
SHA1 eff2f0b8025be1d706df37ec3917f84f77758d36
SHA512 346eb589aaadf58ef02576d474c056d7125c01521d9ff3ad905267eeccffa3d7744d1f01ed8eec9cf04cd928b6d1e625d372e09be07d8668060d951e65e53f31
SSDEEP 12288:vjZ1IyBBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dM:bZuOUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1B775128627F814F5C397467DC8E56B08DBB27C5A637543CF0225626A1F32AC28D3A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d66c4aaca373fdb9238b469e53ff6de3b3e50b1e7775d66dea3723273998dd92
MD5 15e9a6808aa795e57f3b1d5ccc682e88
SHA1 2a6e7d59873b84de0947fee4bf0865816eee9f8e
SHA512 2901cea9ec3846291557af9d9a4d4be41cab297cff1533a72d879c7f637d4ad089d353c65fc5b2851a697859ffb5e9f3a3ca1c971dca5b3973e397eeb1c6bd64
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UN:MQRQyi36YOcPQLvw2gAf+PN3Efb9s
TLSH
T17E666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 36bd3eb4e77bead04fe9d6f14fb7d596e0fd3bb22aa51435591769273e93de3c
MD5 e9210a2b443cc27178733d0f3d42c76e
SHA1 d68a9f92c0b94fa475c9b7dca32bef8315ec21a1
SHA512 556cee1ad2dc1a89b4e7cfc7bc05bbc1c81f0547b9b2c210af867c664c511e5ac8d5703f3984eb1f66644ef97f04743fb35cdf043a3c2bc4d75915785bdfe5c5
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UN:8QRQyi36YOcPQLvw2gAf+PN3Efb9s
TLSH
T110666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 485b53fe08c85b35be2f803e30def177e4548bdbc5a02d33c2898ac925a81338
MD5 877465f6211f6c7bb7df88cffb6a38f5
SHA1 31d4ab114b76141f8d54f385ff397f8ad46ae140
SHA512 d6091c7c41765e6cc7e9916652b9f841cdaf41f77644cc02d24ac9a7b3cf87c9287e3db4b7e460e1d072eb3824e4809a24cd0d8a705a91c196ec4cfa470a8452
SSDEEP 24576:xwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0eUeA9n/TM4NZYeq:d68Qg55nhheWu7PNU3/tA9n/TDbXNKd
TLSH
T19DB55A33B2F600A9C44DE1769F4A972196D27C758FE0E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 88280cf556a55d35febb27f9015f3c109c8b080809c34a7cced8b3b4a5ddea14
MD5 38bf41248e53d102ba431d31cacfdefe
SHA1 0b13bdefe9e3918cce3f17e8e849a1d99dfc8c31
SHA512 0349bd3185eab9f7d5a25249af2d836d27a9ffc9174b1d4b7e05dffcc06feb5b4d44d564ae41789ee06022cc4bb5ec82339e66d8fb97fdb76593527a37613797
SSDEEP 49152:E3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99f:Ry5112gYy5azzVvL69nLKnhZpfb9s
TLSH
T17D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 319b21937f3b9f3afee5f9ba32d46056fd57f29cd3a421c9751e7e50bd49a06a
MD5 1ec686df3b5a84c515c80a186ee40630
SHA1 3810295a7656c8b3ce30eb7c201a444c51a23f43
SHA512 a23c799f14ec57ba9f8bdb684d373ebd0272bc6da60df35ff6900da7ee4fa6e88dbd050834333c945f686ec1eac1503a40f9caa9f129f24280f8a039150e55e5
SSDEEP 49152:0B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl8A9n/TDbXNKd:uu6JmVxd2dpfb9s
TLSH
T1A0D59D13F1D901E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ca465efc6d0fab5b92ccc51bc501be8d8aa8c71720cc93f3ca0424d521a43f2a
MD5 f224614ccf9032bfe34e45742010e1e9
SHA1 f801e8aba43b65187f6ea825e53254b9dfb88ca1
SHA512 8801eb137d20334eaa141b8904f9caace585bcb3994b9972526a15311b000bb41093621ba0b023aa8a11715b4483adc1c303d1de896082cca979b466fc5d5794
SSDEEP 49152:E1hpsNoJpF1A6UU44CwH7R4xjA9n/TDbXNKd:EmifPbRXfb9s
TLSH
T108B5BE13F2D800E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f114f8dcebc73c7857f4ecf85527d775b9724ccb0151434e5e96709cf98ef967
MD5 1069f70d4737c96a7c746792e8ef26c8
SHA1 47a299a97236d146627474aca0134506a1c98e52
SHA512 86b6c20fcb32b586b7c396e6b8e0e2704ca4a7c906a1ea2dc6d31b516841832ce7c1246c22b98751206410987b68271122fafaaeffc6f3af08c00e84cb1d9a02
SSDEEP 49152:LSuZQIY0Be2KRRVtOnks6NMHq4A9n/TDbXNKd:Z5dKTi61Nfb9s
TLSH
T1FAC5BF03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7befbaa8110195827d87534097527841be93e6486b82d40ee811654cf2bef36b
MD5 5ce22a5f84f75db54b2df428cbbda3e0
SHA1 7916f7d14dcc48a73c682a37ae601ebc93f27b9c
SHA512 110b3fefec33a2b36830da24acba41a81ac6ea4c2877ac6d49a3a07196550a4e85237abb4c74dc58e6ec87b87fed1280cab4f98457a52872d0dc075f1d2d3199
SSDEEP 49152:thtSn8EApI0figngiDn0AP5wPA9n/TDbXNKd:8X2iyphTfb9s
TLSH
T14B95BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 3b4db439ab7b9d98043e39e327d4b79153a23011c93703da32264b1ee211cd88
MD5 d74a507cebe386bf6f4b292f22468feb
SHA1 c529010c771b9fd9a04099bf0c132ccdfb98addb
SHA512 858a0d100056a4625a96a932e9ae13668b8acf9c7e331796f6ebd3426de4d0f9aebd527b77597a9c22ab678cf1397d0d9c5bc7b8b8642a52b69e29495f70fc12
SSDEEP 12288:4KBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2da:4KUeA9n/TM4NZYeNm+9MhUwd
TLSH
T15A6523824BFC09F5C7490AB580A6BB0CCD91BE4FF685439E470E722A5F385C6C9564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 93f0612bd11a1fd0ecd97ea3ea7d2e1d43fda06f739f795a0cadef672ad6efdc
MD5 45a0b42ccac9b2ded4c95a112c870441
SHA1 ebdf1b3eff31ad187ee19afe4ca5f7f777a0c8cd
SHA512 6a1ebd4dbfbe0157ca66693cf57fc76eff762276c25bf9571a7dbeea9d113f56ebb65be50b4eb609ef9bd5534bdb6e8b66f94e34dff1b382566a6b867ca0e49b
SSDEEP 12288:htBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d+:htUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1896523824BFC0DF1C7490AB581A6BB0CCD91BE4FF68543AE471D712A5B385D6C9168CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 72dc1b1581f5a5482b4572709b6e3abd8fe879c2a710f385059b68e4c218d67d
MD5 c562c8a49445f37a60462160d17e7b61
SHA1 2b697b25008779f928c36e0813482a3130760b5e
SHA512 d6431c4eb44f554b035a4f96a6585a47ef7f9cc73588a8b3458d05cb10b83826b403f25ee85a73aeac10a15f1a06fcd42cd0147a48cfd0f3ad1b1800f7da6b46
SSDEEP 12288:LXBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d+:LXUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1276523824BFC09F5C7490AB581A67B0CCDA1BE4FF68543AE470E712A5B385C6C9568CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 1379363b2d5f4f2faadfcf43e8b9baaa5630df12299da9e985c50fa079ade884
MD5 721b6c0bf4447892074697471b9f9352
SHA1 f8f3c84d4d941fbec2660c3fd38379e8f3c3c1a3
SHA512 4cf51ef0ca89c4f3b73b786b0c8c23d05a9e2e6e3ddc8f04a073b7bddae193401c97e9faed581e303b3b6667b905725bdb980491d9827bbad6c744b1a3044308
SSDEEP 12288:gVsBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2db:fUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1FC6523821BBC04F1CB4A9675C5A6AB08DAB2BD4EE76183DF4705361A1F302D5CD3598E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 c2c499a41c46055a0d022576bc8b5322e9501bc42ffbeea32e2186663887737c
MD5 4c0d0870874fdbeb535e91d04c8c5902
SHA1 a3df8e08b547b703dc96894fb21d729a71a73287
SHA512 f84bc855dd73591c4e5a8b50067985449068ba7b15ae525541955a7d26d3c3d3ee7d3a36240bee1556af43b193b0b113a0d68c736015392ed17ec7ae472b45a4
SSDEEP 12288:KkBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2do:KkUeA9n/TM4NZYeNm+9MhUwd
TLSH
T16C6523824BFC09F5C7490AB581A6BB0CCD91BE4FF685439E470E722A5F385D6C9168CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 d69adc8f64715a28a67fc5ceebdf7c8f45f53fc1932cd4acb084a5c7d0bb3d41
MD5 e4a71e4ec9162822457565bf210967bd
SHA1 c9204bccc188ddcbe37977fad2c55e33afa90b8e
SHA512 4e49c68ec403d347a6a780f973dc7b1a1f15e04a3651961777362938e9b27c6be1f400852c539c84154a80a2cc6efecaf99971c59a6a65ecd80cbdafe762da42
SSDEEP 12288:E5BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d6:E5UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1976523824BFC0DF5C7490AB581A6BB0CCD91BE4FF68543AE470D722A5B385D6C9168CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 8768a8ead7dd8b320be584333bd2841d0d9846fe04051f3e73c66a602535dade
MD5 93454e2feefb5b08e175f5f6aa978bb3
SHA1 9dd75939487a34b6de96bbf260194441d1da55a9
SHA512 63b6d9e4549ea91e6260e31fe98ee86848319869b96b1054ef2177cb4a2a213869d3b730142e922dcb6f4ac63f841e68a181df01812a3f3a64bb09b18f40ef3d
SSDEEP 12288:RlBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dD:RlUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1356523824BFC0DF1C74A06B581A5BB0CCD91BE4FF685439E470E722A6B385D6C9168CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 179fbf6daf0f37810c3a72b4299f11cc474f647b7cfb259220b89d32265e746b
MD5 8f00c4ec5c66163d40236aa8611d0f1f
SHA1 2726bb4dcfa7e1c533906ec9066c849a3020c344
SHA512 a9eecf9bb22ab5e03dcaae2e689a1453811125b11f1a473a9276498557c29479f6c2c208d8717355d9607e1722d411ef5f43573acec7bb4ffac134b120710e8c
SSDEEP 24576:HZMEzFVSONUeA9n/TM4NZYeNm+9MhUwd:HZMEzf1A9n/TDbXNKd
TLSH
T160850295B3A00CF4DD67423EC9659A05D6B2BC1A4760C75F03A8362B5F333A14D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 550d020fe79b65e99ba46f55921fb0d114af0282d189276361e5b653a2a27b20
MD5 e2caa2647d1aa8eace67ef77406a54ce
SHA1 2485e7a6e22874ec73c0665466ecd77c2e5a1cc0
SHA512 fd36474fa522ba50ebe71e59705347d1f2f561cb5b94bf357253a318744bfe29a7e09f496452d5ce39b99ef407eabbe793a4822b75dd6932b61b03450face8b7
SSDEEP 12288:m+BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dp:m+UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1136523824BFC09F5C7490AB581A6BB0CCDA1BE4FF685439E470E722A5F385D6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 6b2a9d7128202c932cb45f1ab5c029e284d956fbb1980b48aeae8a4115060d80
MD5 47db291ffa7df41479db5be028e8ac12
SHA1 41fb2a08d2f9991b40edc64e759ce9c02a2cf00d
SHA512 93e10c28e202ac39589aba87d3908dd6f8f4f8d9b162cac3dea0f2afe14fa3c9142f49378826d6c945468fb20a6c029b4093168dce7a515f0a275607e27508bf
SSDEEP 12288:WyBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dp:WyUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1926523824BFC0DF5C7490AB581A6BB0CCD91BE4FF685439E470E722A6B385D6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 0ad85b4b39287e9d0fe83fe3ea4a310e3e6f05b3a624dc1e755109d5f7944d71
MD5 575f2eeb9b8639a3aeaebc0dc6cac70e
SHA1 ba22f81711f182745e810550641cd09f8b41f676
SHA512 2630c3916c76c89084d439b825aa37e3f140760b3e1a5f2cd2229abd12e8d6fbad8f6714ffbc2543534f7ffd029d41b9a06501e1c411f570a9f8dd7cbdaff5c6
SSDEEP 12288:XyPz5L8BBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dZ:azyBUeA9n/TM4NZYeNm+9MhUwd
TLSH
T11075124777B520F9C2664238C8A21B05F772BC3A57608BAF036417362F376D19E3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 08667bb15f948bc63ecff7c56e32b0003798eb70d6ad3c219c8e75d6fc2cff55
MD5 bd069dc92cd101e2d746528ebee92bdd
SHA1 7ebe530d18317aead06f101e51f7b1b2dccd5c3f
SHA512 106f26bc15fd4ace671a736ca962bb6222102e5dae276f84180b46bfe4a1ab8fd242dafb19b3c258000c6504019e7d0c7d1c70e9a9cf2b94b7a62a82b19e2384
SSDEEP 12288:D+BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2de:D+UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1FA6523824BFC09F5C7490AB581A6BB0CCDA1BE4FF68543DE470E722A5B385D6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 cc37f1e6bfbd382f909884e47e2dffdcf7122775b006b3916e1be14a011e55f4
MD5 f137870c5f2895a7c5ce7b240e0d3c1d
SHA1 5dc68f93b57c9bca030ad21e147d51c95c73ea89
SHA512 ea6df563965401947d9f2f7cc38fe7769164d707ec665b5e1a22f4abf8d005ceacb2fc48dc9da752806d6f253e9f4bff6f062b4cbb8f30100cd8c2b59b6a2df5
SSDEEP 12288:9+BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2de:9+UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1D26523824BFC09F5C7490AB581A6BB0CCD91BE4FF685439E470E722A6F385D6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 824622314a212ba42e5d173f349e87134b9512b24eeb7b452f2a3b8a5f6cf100
MD5 15687a08a0babfd54055b09d6efcc1fe
SHA1 b1435ca683c481a52a38a3d0d1ff4dd68eb25ef4
SHA512 5e8492e1eb5fc3d1bbbdf5b1e65d1b34b727df901b11d9b871b4dc22301c408b335c98225d4fbb052dba0331f5b6323764898f6abc84a7a82269ef1ca8f83673
SSDEEP 12288:JyPz5L8BBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d+:ozyBUeA9n/TM4NZYeNm+9MhUwd
TLSH
T15F75024777B520F9C2664238C8A21B05F772BC3A57608BAF036417362F376D19E3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 982441fc6668976ac4e40260d5a974b8c3f5d20ba2cd11f23138dcc20ad049a8
MD5 f36da8bd35a0445d6123b2d28c67f3c1
SHA1 acbe4644146c9f3ca230b295615ffef26bf98ae9
SHA512 e0f9435c057b2ba8cd5cacd7d03334e202f3a87a0558761bfac8a1545a689c44a525fd3d509cf95cecb7342893d62c20415605e79ba6bafa36944ca2af1e7450
SSDEEP 24576:OTdaLl3z0zDnUeA9n/TM4NZYeNm+9MhUwd:OTwLljqA9n/TDbXNKd
TLSH
T1AC850295B3A00CF8DD67423EC8659A05D6B27C5A4760C75F03A8362B5F333A14D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 4b2db2f01792d4481db83a2b6bebcf4f0440406606f444375975c9d3b1b954dc
MD5 a123d98612c3d3396c7b906f6c129b09
SHA1 b8b375271eff56aca79ef6c27d323a590e84a377
SHA512 803f6f928e835c55a89c065750604eda28c8e3fbb2990350f401e8e7c654008e033f574f0a08bd9de008fccaff9f1780c1d46b2f73b6dffcc62d44321606e98a
SSDEEP 24576:T35d9CHKy7GZzUeA9n/TM4NZYeNm+9MhUwd:z5d9CHKya1A9n/TDbXNKd
TLSH
T11F95CF90F3E814E8F1B79A35C9765501DAB67C5A5B31CA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 36cb88a9799e2ded5787fab71af34a656d44605faf672df0800bf5c0470e04c0
MD5 95c25863ca70156609ed3d82095f4ed5
SHA1 2d98e53bd0a8ab8df7068cc6bb66e780e3ab1810
SHA512 779a5970147af7f466e6385239c45b523a468f5e69980d719527402fddd30aa5fa57d595d21159e3332d6f968c2ed403932efa5c0da3efd33d811ce3c92d6e76
SSDEEP 12288:j3BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dA:j3UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1366523824BFC09F5C7490AB581A6BB0CCD91BE4FF68543AE470E712A5F385D6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 cf5098c2903b46581f6b5b7280be9c99c2efb116cdf06fdd9abfbb3cfb030808
MD5 0e31ba58935927925bd479745a57f8fb
SHA1 79f5669fa9908b1777b3b5117e5cfe61d3498617
SHA512 45927ac40f76b3c39b575e070ca185e641ba082a60fd0dd84ec6c203e762d130ad05194fb8d3031f8086331c522941067fc43fedd7c9f349dc9508e1db7a6511
SSDEEP 12288:5hBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dP:5hUeA9n/TM4NZYeNm+9MhUwd
TLSH
T12C6523824FFC0DF5C74A0AB580A6BB0CCD91BE4EF69543AE471E712A5F385C6C91648E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 623c8f1c992ffcfe2e6024592f6868b7c1f297720fe5b7427fdacd0f200d32fb
MD5 6b84a3a74059be709f6e1fb9728a64b5
SHA1 352f57f7af4aa0d315a00015bb566f669fda2e58
SHA512 5fac8c6a9d509ad415c2c7bd57d0c591aa6bf3ec30e432b0ceaab77a764d3e9e44adb56b680f51d358689b0a428d14cca69169279d1381f168ef3db42150449d
SSDEEP 12288:7ABqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dD:7AUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1006523824BFC09F5C7490AB581A6BB0CCDA1BE4FF685439E470E722A5F385D6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 88efaf5e15166b4265fa8cc3f6a464c2763252d69f507270ec36cc887d7522db
MD5 3293f88fbcf6a96d5d71f59a8c087001
SHA1 be2a0450eaa07b070a5bc50fa084312dd9a3f3a9
SHA512 454ba0c8ef23ad81b4408f2ecd99d68dbfc213469cb0f7c3176413a8943945c5b7e184e75618de941ab40a9d63f2000f018d1b8b363ef7278a31297e068d1496
SSDEEP 12288:K+BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dB:K+UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1EE6523824BFC09F5C7490AB581A6BB0CCD91BE4FF685439E470E722A6F385D6C9164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 83236dde561a69fc44f1108279d8ff38b5207babbbe5bbee2d9180552ebae77b
MD5 e35dba2d545bc0fe5ca47f092963a37a
SHA1 1f0c89b44e5291d687095a29cc2f4fcc7200e0d9
SHA512 896341583bf80b975cb6e769139e453db775dcfc963ff8025a9a5258a3459d46e3ee3983be728d7402d42cf9ea137db86df5ab11bd1eaec0897c52148c7321e5
SSDEEP 12288:t3BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dk:t3UeA9n/TM4NZYeNm+9MhUwd
TLSH
T13C6523824BFC09F5C7490AB581A67B0CCDA1BE4FF685439E470E712A5F385D6C9168CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 681f29bb26a7b306b8aab83c4491fafd8a7d1e18d798db63ba5cf92f5dc4aa8d
MD5 8cc25ff96d1bfec45f689243eea0a498
SHA1 da7b5b4561aeb11ab9eed860876552a9ac3ab0a2
SHA512 c37a633b71e18df99565237103c47340e63b3278b4384de00951ddaf82137d25c8269832a30b2c961abb4e4f95da5cc7bfb92a8827591c9562aae18c100e848d
SSDEEP 12288:SWBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d4:SWUeA9n/TM4NZYeNm+9MhUwd
TLSH
T11B6523824FFC0DF5C7490AB585A6BB0CCD91BE4EF686439E470E722A5F385C6C91648E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 64738d24b71cd1a96bf35b7c31e1434ec432ad2eb948b0c97807afca5b523e98
MD5 e4664926b1dffc3c18edc7d0ff4ecdc9
SHA1 f3f2f6127e8b7feab978e957f083fa304b6c793e
SHA512 9118086b0758623c6802349402143a95d0476dc6b7ad00ff3e999fd92970c8ad0d221a5bd66808aad6c2598b4314efb032e13bfd7365d3b5710113b0a52eb678
SSDEEP 24576:Dfwv+k9RX6wkyAIiUeA9n/TM4NZYeNm+9MhUwd:rMnYIcA9n/TDbXNKd
TLSH
T16495CF29EBDC08E5E1B7923C89B7460AF6B178591B31C2CF025A536D0E37ED49E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a38d4541b83626a978ea6f07b5ab687a04f8a226455008b1addf38c6896c17c7
MD5 30d649394c82964c1c6e02b69c183297
SHA1 012c1a1139ccd7cc4749805e12307cf553e2cb8b
SHA512 d7c2196e573869c46a205a96fc71cfc73945932a05116cd125895f7687568e08f2fbff0ed92c8045fdd298decd930f9d835cd0f36eed35ea2ab06c84e28dd74f
SSDEEP 49152:KYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0vA9n/TDbXNKd:kySzPkfb9s
TLSH
T1C7066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 919608e7517dc9978bf91d2d03c3d8940503dd15812fc88a2445e63a1b6604d9
MD5 2830ab6add6dccc998f1bcaaf230159c
SHA1 ad76869864341c7916b88ca0925af08ef98a7f16
SHA512 f8f208d473a9465165f4914cf23f8e72e04ebea6c7cc178cfcdf722a621f4a43f7d73b909b4e9d8850f7328ac89b09bbe51824c90b969a560cc0d70461b210d0
SSDEEP 24576:A47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY9UeA9n/TM4NZYeNm+9MhUwd:A47JUQj1irIhCnDHUPfF/fA9n/TDbXNs
TLSH
T12F65AE1EA3EC01E5D1BA927885154A1AEA71782E5F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 3ab3ce0e517961e056f18b4d7e8cd4342a6cf612cf9594f1f9ed92bebcc39acf
MD5 49fa88ded0b8f9258157ad232dff8776
SHA1 b0a544b0e6759757137f4010a77da6c5cedafe27
SHA512 fa7ce872226ae121e1770dfc78f9f224375e0633c71215d37cfc7780c41d03808ff84dad360d9c0667f0337b5a7059f204f01bd30727f36b2a9e5c430150eb29
SSDEEP 12288:qzsfOBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dL:VOUeA9n/TM4NZYeNm+9MhUwd
TLSH
T10D75F04AD2A802E8C15E6279C7565A04F7737C2A93E1D3CB43C0F53E1F366909DEAA47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 6023f1862c5d8d97d1fcdb7ab61e7ea54055e1540f8ff0edf5fad3f538ed38b7
MD5 4a6f1977bec81fca7be73082bc8747d6
SHA1 eb46f73e062dff0c8ff4eb379e8722dcd727c2a3
SHA512 4d34e201c2a19e137008893f734804b1da6dfdafeb06ba172eaafaaaa52a2a7aea257f02ecf69e2f13f7e9b48923d0abf8af7eee08b17f367e2087ffa5775db5
SSDEEP 24576:aG3OeUP/J5VlhPr4HBpeidJEoYhZ+doEkf:POeUHJjIHBpeSxYH+do
TLSH
T160553900762ADB8FC66940325E36D6CCA7707D06FE446F0773C9873F9476A58BAB2291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 d836502eb85c6a56c133aaaa176b4b862885402ef8ce8265202e50ef31f012e7
MD5 941860d2b45cf77100201d598d591731
SHA1 906f70bf3770fb56ddd1cc743dccb02c56af00d4
SHA512 daf285e28e92db365416c03ea82ab0f36b85ddef3b4be06fd5e32546c8f4a0f02d94e56785101d1f88cf4f3a34438b1859043c27b73ab39cc408a3a8bf01d7c8
SSDEEP 12288:xGd/QbVy+BJJVYJ/xROmSOV9Q4Y8sjJz89BWLUpioNsEsnjsRAs1hsgWCHKezoU:gd/GVxJwSOb/jE5v1gzzoU
TLSH
T1C145190065A7EB4FC97A9037173286CDBB786C06B7892F057341893C986796EB5F23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 ded114715069537ae3075fbfbdab41d7a8ad5dfd8c11086de53ee432790fc4ec
MD5 2e5c3686f35dd01e4f01bd56af1f306d
SHA1 3e9851c16960836f58473506c8121a18a56b6b17
SHA512 72cc441a5907d5d6dcf73342037d87b1559225fd0fe7366e8071b2856eb36d8fa9c6cf534c2ac637e81aa354cc7488a8202e810d53b792e0ca92d588361337a8
SSDEEP 12288:EO7LBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dR:/LUeA9n/TM4NZYeNm+9MhUwd
TLSH
T13D6523824BFC0CF1C75E1A7440AAA7089E56FE4DEB4483DF8609722A6E345C6CD7694F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e678b084e52bd7db0028e92a7850c4dbff1de36dbc4c5a7522cfc230bc52f59d
MD5 305af0c040576d4b32a81b28149d3218
SHA1 37125ce390b9daee9534ae7c12e556eecca5b0eb
SHA512 4c7d1b17cb726a106672fe1a9cc1e810d78ab6c2bf07f50d93ad1288112d8dc3a7dee19ea9d76addea79d46624f456286d76820f27c441ef8ef465089af01883
SSDEEP 24576:Wgb6bmBIi49WNNFpg1rSvFv7bYIUeA9n/TM4NZYeNm+9MhUwd:Wgb4mBIBhGF5A9n/TDbXNKd
TLSH
T1A565AE1E22EC02F5E1F9D2B8CDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 44ce9e30d8d2a76f31ed4f484dc9b6ab521a823927c45d6c09f518d029345058
MD5 811c72c3e646ceba2af5386948208acf
SHA1 947bc20bfa6b8b67d99f6b28a16545ebcdedf757
SHA512 49561504ffd7e59cdb264e58845c27088e69c0083df9656ee2fb9a0e6b4d2b27a1de58e6f21f0eaf0799382a80c499ddd0d8bc0b81f72e9288492efa485fccb0
SSDEEP 24576:TG88u8FpJqH1hzria7/mNUeA9n/TM4NZYeNm+9MhUwd:i7ZFPqVoa7/iA9n/TDbXNKd
TLSH
T11B95016567E401F0C47BD13889824667FAB2B8251364EBDF07AC8B551F23AE54B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 0828e579403fc1629ff834cd95e198e5f89da534b28be1f700bacb411518b1ed
MD5 eb35b7b4eb816f36f85f93e9abd1db23
SHA1 ddbd76b49eadbe916a5895ca78e4c90d63e1611a
SHA512 6c432f352a1006d0e9e3c1dd465467725b9922fff37e81e5ba48a53f63579dbe780d0efadd046137a2db2ee69b5f04747e508b6ceacfc75a40ef4d281c91f727
SSDEEP 12288:3HvUrBFrEjwaQcBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dP:3PUr+NQcUeA9n/TM4NZYeNm+9MhUwd
TLSH
T10E85E15F26EC0CE5E67AA17D8582870DE772B856131292CF0290817E4F37ED8AD3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 302fc272f3e1c90fe0f5cb7199ef69b05ecba3fced825975ff051f5b1a7da307
MD5 508673655e350708de0233f715716067
SHA1 09a9aa3f012bec6c48c98cc1cfdee5466bbccc77
SHA512 581557a64f208150507872947e9d5964695652ea838c5d46f3e9c32570fd7b77774984325b18da6bdb54520449e8696eb26ae27a3be7ff7613e6d9598c53fe7c
SSDEEP 49152:IBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjFA9n/TDbXNKd:jG05lO43bRfb9s
TLSH
T1DFD5C06A62EC01F9D1BBD17CD9C6460BEBB23815033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 78c308086154b58b850fcde486dba7de3ed04937074b9c02439471c9f4b460d3
MD5 bdf966a8c4f9e886da7e0cd97de95415
SHA1 ef7f6b42f28798df2704ab8a243e8bd870cba828
SHA512 b1d25b278f84a6bac23b14c46871b0a8b68af8eb90cde913e46873459eb73b5cdce6aaaf632ff0331ada1e34ce4868493e07140bc05128ac9387ed24bec1bbf4
SSDEEP 24576:8fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnrUeA9n/TM4NZYeNm+9MhUwd:ka5POZ3+Jt2pasx2+mtA9n/TDbXNKd
TLSH
T1F365AF5EA7FC01D5D5B9D17DC583860AE5B1342653319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 fd9563eaf33dbe2bb3774fcaa10515e8e6a0069b578c79e27a4058047ebead85
MD5 7f64c18165ca90b49ad3712d88e01ad3
SHA1 245d5fc7a7bcda442b0d5c7ff543d08ea7514d63
SHA512 69e81a06d449d7aba68cf68ddca3ce8c6cd20daea0b94ad1acdd6e8106bc49ca6bf13972ea104102aa22542741fa93d38a50a967f9b7552772acf35bf56d9a46
SSDEEP 24576:INcwHdjbyQ4nLC18lb/EOjowL7Fk1UeA9n/TM4NZYeNm+9MhUwd:INc/zEOVHFCA9n/TDbXNKd
TLSH
T18E858C1623E901E4E5BBE1BE89779646FA717869533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 10de58c700a752698568a90808e3537566fbd99ad5ed81e109734e00e980cc2f
MD5 fc73e4e9043f84bae8a63faa2500a079
SHA1 c1f3e958f09758ce594255c1aa6844c34850453d
SHA512 2ff60395aa06549c6d314f94db8b0ecf91b99375865cf0918bdcea93718c4e5c2941b6e543925b54cd4e6127d99c3cb3df62ae550f88e0e5a96667d0087fdde4
SSDEEP 24576:G6DIkxaKngL2jdshRTdG1YxITqvfPkbIcbjLm:G6DIqarSj8RoTCCW
TLSH
T1BB25126D63AA01F4D06BE13D96934506E5B2B1B487074ACF4AE4C5BD4EA3FD8B93CE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4fc4d143c473df1bd6a20eb02628fc1c69a771ac6a184d7fd7847cd271cab9f5
MD5 18734d4b239b3f6dbe55768ed93003c7
SHA1 ea1434fc86df83f0f2d020ccd639822072bd4761
SHA512 b412443b0dd070300bc903e9a5a7f75674ea0e74bd237de463f050bc1d14864d3e0c4a478b93511b0d23e259d464c3263a61121d7a92801309eeb25d69474942
SSDEEP 24576:B8kNvNnaFeYhJNtmZBmeUeA9n/TM4NZYeNm+9MhUwd:B8MwBtOmIA9n/TDbXNKd
TLSH
T11555AF6EAAF805E4D1FEC6B58D238516EA727851173293CB4390C13F0E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 0169dcd2b29ad25fea672ab4bfe36e0e9cfa3bb12e089ce7757dd7f1705d3b1e
MD5 56940b91ee80b2779365584eb3bd2925
SHA1 2534058587b4af4716448acaa7799cc72614946e
SHA512 0f95a38a43db3a166b88003b25c0856a96d06ca44dc7bf2d4e59835c53fdef15a50974ace06ff461dac8f88b216d90c3aeddcd8b77e4233a61ad19d8ea0af15c
SSDEEP 24576:ND3FHshBIYQgAqUeA9n/TM4NZYeNm+9MhUwd:NDVHeBIAAkA9n/TDbXNKd
TLSH
T10A95E17EE7AC04E4D57BD1BCC6638A06E77138AD032156DB029491BA1F2BEE46D39F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/260-331-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/260-86-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/260-77-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/260-75-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/852-340-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/852-336-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/852-133-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/852-338-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/852-126-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1088-334-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1088-91-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1104-113-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1104-335-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1104-355-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1104-353-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1104-114-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1104-120-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1348-23-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1348-31-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1348-125-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1348-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2272-337-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/2272-146-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2272-148-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/2272-140-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2876-44-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2876-138-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2876-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2876-43-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3076-70-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3076-59-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/3076-64-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/3076-305-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4092-152-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4092-161-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4092-163-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4092-159-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4092-153-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4420-63-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4420-56-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/4420-48-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/4420-61-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/4420-47-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5468-92-0x00000000034E0000-0x0000000003540000-memory.dmp

Download

memory/5468-98-0x00000000034E0000-0x0000000003540000-memory.dmp

Download

memory/5468-0-0x0000000140000000-0x0000000140583000-memory.dmp

Download

memory/5468-111-0x0000000140000000-0x0000000140583000-memory.dmp

Download

memory/5468-74-0x0000000140000000-0x0000000140583000-memory.dmp

Download

memory/5468-1-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/5468-7-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/5468-16-0x0000000002940000-0x00000000029C3000-memory.dmp

Download

memory/5468-9-0x0000000002940000-0x00000000029C3000-memory.dmp

Download

memory/5836-169-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5836-175-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5836-168-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5836-341-0x0000000140000000-0x0000000140172000-memory.dmp

Download