06fc7f8d1a3d91c2d16f2f8668cb2418e282c19610dc4f3e5759f77c52ca999b

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 07:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_bf63fd2cee257b647cea0c46ea3f5a1b_glassworm_icedid_njrat_ryuk.exe
Size 1.9MB
Sample261017-jqv2csby8n
SHA256 06fc7f8d1a3d91c2d16f2f8668cb2418e282c19610dc4f3e5759f77c52ca999b
MD5 bf63fd2cee257b647cea0c46ea3f5a1b
SHA1 85f3a82931b4230a54b23ab8c4f8a31f979ed972
SHA512 9dcc0ef42878b908c5c567d94c65361ad9671c035946be48c69a5186073eeb2884a239af956d5a96b830e4629f2803e792773c01fdab073c7f1a7ae1aba1c72d
SSDEEP 49152:XrObh9MpkGJr9OV1XHsZelmOvJvt/PExdCKsbbp:2ipYyimOBV/NP
TLSH
T19695F213A39100F8D06EC276CB269112FAB2F4950A34BA9F13A557662F37F945F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1184	elevation_service.exe
5960	elevation_service.exe
1544	maintenanceservice.exe
5372	OSE.EXE
4924	PerceptionSimulationService.exe
3204	perfhost.exe
4136	ReFsDedupSvc.exe
2672	SensorDataService.exe
5512	ssh-agent.exe
1104	AgentService.exe
2576	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\cb8799209600bb.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-16_bf63fd2cee257b647cea0c46ea3f5a1b_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-16_bf63fd2cee257b647cea0c46ea3f5a1b_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-16_bf63fd2cee257b647cea0c46ea3f5a1b_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-16_bf63fd2cee257b647cea0c46ea3f5a1b_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4544-0-0x0000000140000000-0x000000014065E000-memory.dmp	upx
behavioral2/memory/4544-23-0x0000000140000000-0x000000014065E000-memory.dmp	upx
behavioral2/memory/4544-42-0x0000000140000000-0x000000014065E000-memory.dmp	upx
behavioral2/files/0x0001000000009326-45.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_108687\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_108687\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_108687\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-16_bf63fd2cee257b647cea0c46ea3f5a1b_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e85f5920c5edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000402d91940c5edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1184	elevation_service.exe
1184	elevation_service.exe
1184	elevation_service.exe
1184	elevation_service.exe
1184	elevation_service.exe
1184	elevation_service.exe
1184	elevation_service.exe
5960	elevation_service.exe
5960	elevation_service.exe
5960	elevation_service.exe
5960	elevation_service.exe
5960	elevation_service.exe
5960	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4544	2026-10-16_bf63fd2cee257b647cea0c46ea3f5a1b_glassworm_icedid_njrat_ryuk.exe
Token: SeTakeOwnershipPrivilege	1184	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	1104	AgentService.exe
Token: 33	2576	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2576	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2576	SearchIndexer.exe
Token: SeBackupPrivilege	4136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4136	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4136	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4136	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4136	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4136	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4136	ReFsDedupSvc.exe
Token: SeDebugPrivilege	1184	elevation_service.exe
Token: SeDebugPrivilege	5960	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 3168	2576	SearchIndexer.exe	101
PID 2576 wrote to memory of 6000	2576	SearchIndexer.exe	102
PID 2576 wrote to memory of 4588	2576	SearchIndexer.exe	103
PID 2576 wrote to memory of 4848	2576	SearchIndexer.exe	104
PID 2576 wrote to memory of 3556	2576	SearchIndexer.exe	106
PID 2576 wrote to memory of 2268	2576	SearchIndexer.exe	107
PID 2576 wrote to memory of 5936	2576	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-16_bf63fd2cee257b647cea0c46ea3f5a1b_glassworm_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_bf63fd2cee257b647cea0c46ea3f5a1b_glassworm_icedid_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4544

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1184

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5960

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1544

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5372

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4924

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3204

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4136

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2672

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5512

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1104

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3168
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6000
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4588
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 2732 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4848
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3556
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 2732 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2268
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 772887eabaa1ad2e288549236714ddc2d5d7e55eb92bdd5a242179d227825fe8
MD5 57d5d1c9e6a90d3c42b4ab334afc0372
SHA1 645268f0b9fac662d05ca2095b4933a74604a603
SHA512 e69ac7fee34f98ddd88827e46d1dc5cfbf6312662de1811dde5e6fe7494849e2fb42644c8ea19f8002a36970eafb648adcc4ba889b1ef21d66c8a93478d5eb6a
SSDEEP 49152:nb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnsHsZelmOvJvt/:V3q6tjBUimOBV/
TLSH
T13DD58D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 b81beb731c9c0845a9b5309109c002a9a44e9ddee57009d45dd74da66b6e3328
MD5 d2cf9ff5ba984095f5784bdcc3e843cf
SHA1 f41ac9c9f335e6b76164cee090f0dd0fec79cf5d
SHA512 8048c40c91a34031d10fc071d40f45e8254e30c9e52a96bc8353e1ecccb4d6e21e14d1c000ac9bedbf2595c2f2ed915c4974049c77eeaebefd7bc620e43a9737
SSDEEP 24576:wXYfDtczATGssZel8Ad6OOnNO5JG7e/t/:Htc2HsZelmOvJvt/
TLSH
T10805012963E008F9ED67827DC9A18511EA33B8554760E7CB03F49A691F337E46E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 7686f914d7480b4580005a2c05a7acc307f0266c0eb013674ec70309d608dd07
MD5 8e31c6b78bb7f8e45fc1ef3452e599fe
SHA1 0ff8bc250a77518661697b86be9972e931049075
SHA512 da1bac1e69d373b04c2b1935aaac482acc8e9c0441a7199c1e1b1b4998ed1c9eb5ede8aa9cf014de6cbd4760de1783a4570b52760ae7dead2c476beac4260b45
SSDEEP 24576:e0Le5ji0hmxnrMEGssZel8Ad6OOnNO5JG7e/t/:ePji0Ax5HsZelmOvJvt/
TLSH
T13135AE16F6748335D073C0B9C5D2A69AE97230861B3089CB4296D77C3E67BE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 20f2c9c3fa4f5acb0f6eac2ee187998c02c5d44a95c69b7ad4c5b0a2e521e454
MD5 d7406602cfc01860cfa9a144fcc36d8b
SHA1 ad03ef3c7fa47c38627d5ee999c42f9682799e31
SHA512 f5776b5fbfaa25931627ec95ecd616349cbe7aa1a7bf1edc1e3ca3666c639863c1c894d139a3a372ffc2c0192635ac7ec0bb6add2f314befaf422c481814f813
SSDEEP 24576:Ka7/ezSC6vUyDZaqgrvWx6q8wyuGGssZel8Ad6OOnNO5JG7e/t/:9/ezSC6vURPvMHjydHsZelmOvJvt/
TLSH
T1D0755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7617e581068cdb41c70ad4686b078382d0d784497a42c71d23ebcdac18547117
MD5 b9ed384d9da14ad301a6b14d266b5dbc
SHA1 0f51a86a4fde184589491b7bfada42ec7d1ac66a
SHA512 984a4e4c87acb692f43145538014200e2c402562c79b284e3fe65b3b0ee46521bba305c42e7e8e957541ef8b9b6c62793905cdaa7bbc3b41a09901b5e04c1936
SSDEEP 24576:iVbqPb88hv/lV7fGssZel8Ad6OOnNO5JG7e/t/:iVO88hXlV7HsZelmOvJvt/
TLSH
T124559E66F5748331D073C0BAC5D2AA9AEE3234424B31CACB1246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 5730e6b1cb23845b42374cce5350a410aaba81a7685c0e58c00b686b82ccfe17
MD5 be78aaadc4d6be444b987cdfb26f0e34
SHA1 b3fd5374d2e784ca38f018b0e1fa8c186da1e049
SHA512 464e2a0d6bd78ac5adeda7ddcddfd5eddb6ca11551997d1bf1d62bbb3b428b185edad8b5393f71d2ef6cc174a9f4a7883ab56eb250d953ef56b516d1b7717ba5
SSDEEP 12288:6G5ywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:6GAGssZel8Ad6OOnNO5JG7e/t/
TLSH
T1F9C42397425500FBE3CA2B7226B01B213572FDA95E45C44BA1F7BB9D2530BB2F97A043
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 fe95b0d0e340b4acb005761b9cec2ccadd4869156a5d4315fb418d4a60e06f2b
MD5 8e5446ed34f792196e4b87d5bbc38a43
SHA1 63c2ec800574d998ac7e36abb6ae206f87c3e2a7
SHA512 98160a94f850b26dea15fa9cfd197f702271eeeb97625aa3a8042bf55c3b7a6a39795e9b54da1f9cc95b3f1f37a804ef7e832d4b9f22954fa9ff8ac676bdcad9
SSDEEP 12288:XeBNUbTVO86UOywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:XJIUXGssZel8Ad6OOnNO5JG7e/t/
TLSH
T1BD05CF3BAE28FCE2C27A5DB95B918700A77278304F5293CBD175830E9E235E15E7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 50414f19b093a50098d822b2277466228730e615033cb668550476a23ddfcab2
MD5 4cff864d4dff699315d43c2b8f0c1917
SHA1 6a321c475f862798b902c6354d050d50a8eb2dcf
SHA512 71f42554d84469b50d710f2e4bb9acab9bc0dd3551836ea078087ccb7effbfde64738d13671e967886cb20ae1ea99836fa95cfd00416ba9c33d7aa2270421405
SSDEEP 49152:6QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3TH5:6QvGAdlCEL8c/pRNw5CLimOBV/
TLSH
T144267D656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 2ac6dc1d9e7382c859a132b77abd9421b3437c666ff1fa903a2053a75ae8fd4b
MD5 1cbb78ea431902a0d9292781fdf6637f
SHA1 ccf37ff3b81a1b7ca5c3f3315f73e763969ed4eb
SHA512 cca9ed466c9c10c8a3203183ddfb42f8059eedf475ccae87b5e9d1daa328ed2f9643ed480910e8ba1cd6f70306a9dd8f48233787e84fd3e1e96242cac7889809
SSDEEP 12288:BAwSfxL/2Dc3xDLLmt0LDQewsAjMywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd89:iwewsAjJGssZel8Ad6OOnNO5JG7e/t/
TLSH
T10615D031EA75E036C3BB0DB21B35C716243DBA604F5119C3E3E89E9E59302E26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a84e1398d8e62152bee8f9359784ecea11207310627ed1f12cc8e7c3ebdc9004
MD5 1ffd25458857606a1bf9078423927fe4
SHA1 28933ec93c29ab38e20f94ae4cd006dfcecc251e
SHA512 e5f0c0f00b6b9e330340c7ce4f0e74341754814bd179b352dc5db31a9be512d49e3d4b3e9208a14a1e35bed75cb5b3287c6add072de6c054402d3d92b6a89b39
SSDEEP 196608:OUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHrLBl:OUEtQevvqc2W1cpV29I32rLB
TLSH
T13B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 006276c349a10bc8ad47c223d7afd1c9eb19dc2e8f24d6b764dd905b39123850
MD5 f58990230eb8aeac105f6b04aa364897
SHA1 167626eed06efdc05d35e95c7709fdc2cc3c7d5c
SHA512 086dc0a07f844595a913d88ab9b7453e6e2a8b86a16031f8a8e505bb4b084d6b15f7924cd13b14a741b5b817059299e4021a6a30b9087abf49f9513dd2039eeb
SSDEEP 49152:uCbRquA/m2yL5zifFiV+XenmE3/zpHsZelmOvJvt/:DoqHVjnmPimOBV/
TLSH
T1E8D58D0976B881E4D1F6C77886A2C647F37178154B319BEF4266461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0bdeace81ed713665433ad5d26b51f81e782da4c398b874cc9f82fe3e77fa4b8
MD5 c22ace8187a0622c4ea8b1edba631b9c
SHA1 62957c54b04de18c7175188f80d9497197859d2e
SHA512 75fb89c5ff10d540da7ac3419c9778c175f48a5f79996bf18e63cd1c5b8b65bee512c978fbb5aabb01faca033a73a72607b475093cf61876536bf90daf0d79d2
SSDEEP 24576:9AhGLmIFoiwtA5l7S536GssZel8Ad6OOnNO5JG7e/t/:9AM1Foiq5qHsZelmOvJvt/
TLSH
T143359D81E7F945D4F5B3AAB899B68170EA76BCA65E31C20F2160D11F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 2494e8ad1dc76d5f8370832955d2d493d76dfa9d197b33ae6b1c23a3034bbfe3
MD5 fe2559999a77682fd6a933b2ca8fc1ec
SHA1 5ea35e77688c448cef9c115546b1c400908e50cc
SHA512 481cc559628c90d671b93db976169942edfa77e8e8b734988fd56bc43f8f5413cd46c4cca7c14d07e8f99c7de29852138b0f6f585bce393c0904ae93b07658c6
SSDEEP 12288:dmw5HEjsChNOBFgl0WDm+C7ywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy08:YwuXOW9GssZel8Ad6OOnNO5JG7e/t/
TLSH
T19505F14662A50CF9E6A7563986978536F7B2B8122A21C70F13B0C75B6F33361BD3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 b95cd8f7af1d0677430baf5fe775d1de16afb1fcfa5558e710e7f52e385f168c
MD5 768bdcd3aed1586ca67c41660956e3ab
SHA1 a4f80543efdd3771005ab9ce43d9b7cf5b5ddb52
SHA512 d6a960266988df523c559943d32da9873a8007130c0bcc3472d5ba53d36414659eeec3c848a08c5be265d7af4b62af4359210a6acfd5cdc8d8352f888e3a1a30
SSDEEP 12288:3bZ1Iy8ywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:LZu8GssZel8Ad6OOnNO5JG7e/t/
TLSH
T18EE4139A13E410FAE297537999F00705E772B4661B3183CF12B557A92F33BE2AD39312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 487ffc1973f4d38accde300ccf759c1910d9d4b8126d6d02fc0efe96daffbab5
MD5 1fd90bd9b841863393a0dd64918ef6dd
SHA1 93280cabfbb0388a5d4f94b14745172e333123f7
SHA512 19e8ae4803c336d45edcfb24e573f27a2de8c9b0b6781c695433569809d17f2f98a0e236c6862ccc269ecdeb7f1d702ad23d993c86a301ad04047277c8de4d1e
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Ud:MQRQyi36YOcPuLvw2gAf+PN3QimOBV/
TLSH
T157667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 610b6f0d0c6d130605a624287922c7338f86f4f8062e97d210276e64acf33868
MD5 0b7af91a254075ba13391bf8f78e21c3
SHA1 00ef587bab10e87d7056ab9edd01fb27a35d350d
SHA512 0fdeb31b07cd86f9a853f2073e5f5db8d0b9bee11dfb48f9687fb03085353fab2d0928cad4db785c336fb1d4941498c39f77f9fb2c44d78e79741470c9ea1c77
SSDEEP 49152:Sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Ud:RQRQyi36YOcPuLvw2gAf+PN3QimOBV/
TLSH
T186667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 76f5bb45d6074365c071131280bc0c0c584794777a6690c281fff2d83f6c82d0
MD5 669aba771286185307e85793d067d5b7
SHA1 a1db6c89d0726c26f28c299d55adef0446806ff3
SHA512 54db15225a7109bc35722125d366781434b41f84effe03b1a8596da5fc91ff66b2c24c37f177088a8d33a2d672516ccd12df63b3224687f9e07c5ea7a9931323
SSDEEP 49152:468Qg55nhxeWu7PNU3/5HsZelmOvJvt/:CthGRc/iimOBV/
TLSH
T130B55A33B2F600A9C44DE1769F46873196D27C758FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8987aaa52ae3e7609ec26671f3d998830e4f94b2a960fce4cb0a6e174c030787
MD5 4350d3bbab66122f0f49f8e0ba40d79e
SHA1 7049fe42623817638c5d099898a23f8699befc08
SHA512 8b874e5e11e85240fc9b8dbcde776af10dbf3a1a87dfd7f673a27564c0fbba6744944d2e2eb4a05a53cb11cd6916d81ae1106de8575b087e46a8c967164658fb
SSDEEP 49152:T3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99b:Gy5112gYy5azzVvD69nLKnhZpimOBV/
TLSH
T164167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 40989ce4eab0aaee624ad8b360a032ec12e27d96c19e2ef29873b255f022f4a4
MD5 14e51cddcddb88fb41ddf4b84c776d39
SHA1 60a9e22e433b48290c639ae32b0271b61ca20f40
SHA512 0c7c929c0ccd0c219220557f06d63bd206fe10fe46fd32f9c86c6915ca8241c8aa599a19723a30b2aaf1cdacddb319f697e8f402885769cb3a86dc8225780aff
SSDEEP 49152:7B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glnHsZelmOvJvt/:tu6JmQxd2dMimOBV/
TLSH
T133D59D13F1DA01E8D05ED578974A9233FA62BC490B34B6DF0A9073562A77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 062233de362f88289e504d7cac9b89e1e9c832435c5dab688ad395c40565c2db
MD5 34f468ce7ee7a14de0001e0662c20be6
SHA1 615eecea08f0343059e69995caf78a8cfae5ea44
SHA512 7bb0702381886ddef39018cd842ad51dbdc2cf6d4394214589cc81c6744a0f14f66f6b2c1c4346efd1f40ea0e9ca0d058821b0a715f55da456df898d52d1ca63
SSDEEP 49152:L1hpsNoJpF1A6yU44CwH7R4x3HsZelmOvJvt/:LmifPVRPimOBV/
TLSH
T138B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7cee318f9d602c5bed3ecb401c2d2b1cef828ddfab1cef34a3885aaf5752c646
MD5 1824c29b9f71bce283d35bcb119e75d8
SHA1 b9b1a04db3e3f97f0d7d33f88688512902baa705
SHA512 f52fa04b19f13b9d8d1b3ca581fff08d0b400fe6bacdf41bd47106ec49d3bc514d69eef0e943f04ccb8db8d5c6783db341062f144c2e48eb7b1da800862423d9
SSDEEP 49152:aSuZQIY0Be2KIRVtOnks6NMHq8HsZelmOvJvt/:E5dKOi61FimOBV/
TLSH
T102C5BE13F2E940E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 58bc2c1f97837ebc595625d71a751e3dfe737dae102b5b820c11c8985a249c54
MD5 ba767eabe0bb6c99e3d4504d9ee164ae
SHA1 d75fa3303a9f6360dd12316e00311c09527f3e83
SHA512 7e7559399e838a73c1ff2370d839a6ffa51e5786f522748bea90eec843220bf3b1fd24383dca60a6ef552da60cb491366e080bf67fcdffcf0b8c274be086336b
SSDEEP 49152:bhtSn8EApI0figGgiDn0AP5wTHsZelmOvJvt/:6X2i/phzimOBV/
TLSH
T1DF95BE13F2D900E8D05ED178C7568632E962BC160B35AADF0A90B7561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 a007960444f1bf4d80104249c4e54c664ca10e37b792ee60ed8ae2a39c78dc55
MD5 89874a212e3781ee95031e589531e783
SHA1 e5f28230c05d168fbfdf9b5a20a0b69306f1542b
SHA512 b6cd91cbfbef1b15e0104f4b119aa238b03bd94da9a9bed2e529b701161091fc024b0a47ff980045ffaeb16d06073a5c8cb25b595cd777f6da592f6c005b6ab8
SSDEEP 12288:ORywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:O4GssZel8Ad6OOnNO5JG7e/t/
TLSH
T1A7C42397419600FFE38617B3567017147462F9ABAF46C04BB2FBB6592630BF2F97A042
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 df8da3533701a3a8167b41b8e1f2547c0fa11ffdd671ec9715b91b1631be34b0
MD5 e87e236fa17264d6a57486cadb7d7eb4
SHA1 f6a25f2a85e60b77ebceca8d881bc964e36b1027
SHA512 733611303633ed5ac7cf46a5264cfddb116609d33a5abd72f61e55573da07dc728d9a6b0e14f4d2e855746dde4cdf20e3f69a561641ed6afe47fb43dd48fa8fe
SSDEEP 12288:V4ywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:VFGssZel8Ad6OOnNO5JG7e/t/
TLSH
T114C42397455604FFE38627B3566017147431F96BAF06C04BB2FBB6592630BF2F97A082
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 f38978947fca526f9e1233d288c6e02cf2c09ec48b3eca0c15f0134bb21a0097
MD5 644367e6eb9faf22fb614c5882144d11
SHA1 7eae9c988dece0de60372367b1b855330bd40187
SHA512 839b5acc0b5e869ad6e27933fd6689d1462d604d8d509ca6284e27ac51f7de26c39d0f9ea4b1be7b3816dc8f5895425a6d05ce978a124b391d7e71aac6d68349
SSDEEP 12288:fGywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:fPGssZel8Ad6OOnNO5JG7e/t/
TLSH
T14EC42397415600FFE38627B3566007147471F9ABAF46C04BB2FBB6592630BF2F97A082
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 95687b24029531b678e69fbb9eca8891461aea7a59738a28e8e68a52b5a9a7c6
MD5 e0826c1714e339bc526be96aa5dbd007
SHA1 fba3eb479de94b3f975cd8fc57eba8d59a3a57bb
SHA512 52f8398ac5bfc58fd336eea89b007ef40dd6e3fd394c4e295c0470001f5d9276421c5dbb7856c6e290bcff81e54fb5b6fe9acb490afb2d9d43810cd53f9e756d
SSDEEP 12288:AVvywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:nGssZel8Ad6OOnNO5JG7e/t/
TLSH
T1B2D4235702AA00FBE287A77696700710B572FDAA9F12C18FA3B26A5D1E307F1FD39541
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 54714be22200cee2564e9829097aa31e4bf806ac28f5eef08240836e38cfbe3e
MD5 2dc215bd1ff66aa277a38aae1b5e3e26
SHA1 160b3a14c25a3ee05e26ef305526d63b0fe784ee
SHA512 404e0a0e3679468f925d1d29a5eef8b9f882a626e506f0f6ae0f2ee0fcdb8a560ad68d1d60d1442330f0fa593ba4574adbccf602e8fd064ae11348cb79fad505
SSDEEP 12288:aXywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:aCGssZel8Ad6OOnNO5JG7e/t/
TLSH
T19FC42397455600FFE38617B3566007247471F9ABAF46C04BB2FBB6592630BF2F97A082
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 f5e277527cf2629188655ff9a08c9809ea34a18f7f6a4fdd163253d809eef6e9
MD5 0f92485f3502ddf28526ce48b309796e
SHA1 e0405c69aec65805e120ee9b306cd1b47e6f99fa
SHA512 32cfed534610f08dc086dbcdf684ed08a6a3a8cd747354d46a657ff338dc34e9214820c89d8897b2a369ed34c2ffc4637ef6acaaf2c53d4f9d653e1703dd777b
SSDEEP 12288:5EywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:5BGssZel8Ad6OOnNO5JG7e/t/
TLSH
T1D6C42397055604FFE38627B3566017147431F9ABAF46C04BB2FBB6592630BF2F97A082
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 efe3372ae2e61fdf346010fc7aa56476de2e28ff57a58c6a494ea9f2058b9a0e
MD5 f726fee2ec110c930dbdacc0394ee5b7
SHA1 9e4c517cba1de52f17b53eda9994300117d7dcfe
SHA512 95e2d27a2d160e733dbab3822359b36901aa226cd2a752205eed431dcdd222d0cffff853eea5d649f573b23c4ca00fb9e06805a016e7a7f484c20231165a0ec2
SSDEEP 12288:7gywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:7tGssZel8Ad6OOnNO5JG7e/t/
TLSH
T1FBC42396415604FFE38617B3566017247421F9ABAF46C04BB2FBB6593630BF2F97A082
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 018e0726b6bebaad6d6cbc7e51b8260783a8bc4de05cdd17ca64227f9581825a
MD5 c4023dc1e9b84b166d9ec50548d6f807
SHA1 2e59e9042c13ff750cebc087f9ef099f48bcd3f5
SHA512 4f3113dbfa763e73c599ff15671e388992ac8d5f44481e828595de5ccc8823d214a966dedbac693d56b4066916131ae562f25cd1150527fed9481bbd917dab80
SSDEEP 24576:pZMJzFVSOlGssZel8Ad6OOnNO5JG7e/t/:pZMJzfRHsZelmOvJvt/
TLSH
T142050295739008F9EDA7423EC9614915E6B2BC5A0B60C60F13F5366B1F333A16C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 28da458cac5cba29e4f3a1670ba0edf340c3486a813c430f69275f422466445a
MD5 ac84a3d4e40255d66041307f080b97c5
SHA1 93869e24660bbe1f6bcd706303e5c766122fdf62
SHA512 e62034f235837430473698c54848d41f831238880e09bc21d7c74249456489bab404784c0c577069c4406598d91bfbc14036b71fcd696dd75df7e1e65211643d
SSDEEP 12288:ZlywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:ZMGssZel8Ad6OOnNO5JG7e/t/
TLSH
T113C42397415604FFE38617B3566007147471F9ABAF46C08BB2FBB6592630BF2F97A082
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 a6ba9204c1b25ae95741ffb9005960675307b239fa7e035952d25f76f9056031
MD5 3df065ffed2d3e080c0ebdefba5c0dfd
SHA1 0ebc75c565a57599f389f78004bdeb9a3b6603b7
SHA512 a857548a44ef88e0f4e3e96ae9669b83b4975c066c547e6894915cc26234a27f80fbaca211598c0b3dbc9ea14118f8baeac0982d8e88a0d5baba7daf57663bdb
SSDEEP 12288:dpywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:dQGssZel8Ad6OOnNO5JG7e/t/
TLSH
T1FAC42397415604FFE38617B3566017247421FA6BAF46C04BB2FBB6592630BF2F97A042
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 d36b571ec9a5c1ff844e72ff67388fde9e64d937f99497ea6ff63f435997729c
MD5 da2c29b415e16e9ed900374b03af5f69
SHA1 e303edcb0345c2266a5449db46cf1d4685a080ce
SHA512 5cd305e329aa2dcdf4c1d30f944787d84f273a55eee67141192c90c9b5c50cea4944f20d99bf2b9c41c419efbd594c660d2581ed965066b339bbcc322abda1dd
SSDEEP 12288:jyPz5L88ywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:OzyZGssZel8Ad6OOnNO5JG7e/t/
TLSH
T1FCF4125723A120FED167523589A10A01F772B8364B10CA9F63B4577A2F337E1AE3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 9b48042b63efb772f70973903695381800cbb36be70815d4fac45df5b0a6d03c
MD5 848219a31c65686d110a28349f2c0259
SHA1 16e50117b41b21a2469bead813b0a927d1737c5d
SHA512 572bb88350c68ec2d44443dd889bdb2a6c7e37f9663c406c83700e2a9d52110ead30252857a9fdfaa25265621c0597e0dd93c46fb00caf51abcf2e56a477f2c9
SSDEEP 12288:olywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:oMGssZel8Ad6OOnNO5JG7e/t/
TLSH
T1AEC42397415604FFE38617B3566007147471F9AB6F46C08BB2FBB6592630BF2F97A042
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 820b2c922e0d951be8957f1ca1a944e8769cfd56113b2d7555794b5ade438a17
MD5 484b26835f7640f3f7149a0bf2f27123
SHA1 835920f36db4e27e1594686dabbb842e89a5c382
SHA512 ae9551b55ff3b16e19ac7a56b3505fb32fc458f97bdfb2c466b96819ce694032014c9c17e05e064de211fea0e53f94d02f241ca17ebd377b108192dd9f4f955b
SSDEEP 12288:4lywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:4MGssZel8Ad6OOnNO5JG7e/t/
TLSH
T1F1C42397415604FFE38617B3566007147471F9ABAF46C08BB2FBB6592630BF2F97A082
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 2f7f2f0c46f61ff278a18e39796a3dd620895a3f38d2f9bb0e9c6b18641abfe9
MD5 b82fbb8f262880beed5adad827399519
SHA1 fbf85e00369ecedcb13aed5c8c8d31101077674a
SHA512 72db4f3fd3c082a257c8b8d88aae226851262f0275bc277c0452e31b117f74c8c81a6b8b4ea352a08cc2c67c03e584d9efd00386042522a3a96bb4a40f799125
SSDEEP 12288:8yPz5L88ywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:lzyZGssZel8Ad6OOnNO5JG7e/t/
TLSH
T1BEF4125723A120FED167523589A10A01F772B8364B10CA9F63B4577A2F337E1AE3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 ba10332f426ee4630a14167ad3eeb5eae7858084ae8a679f8688bb0e04a31fb9
MD5 ca77e91e46d3f599c683beca9bbfda16
SHA1 5c126d5febec4d34ac327fd76c4afff106bd9253
SHA512 be162960556af8087b11f5bcaa5009f893a6e626becb400ab10e45df47570e1381699d7ec67c6aa59b64ee7dbfcd5f11bc46e03ccd9cdb8acbc126a5289e127f
SSDEEP 24576:ETuaLl3z0zD/GssZel8Ad6OOnNO5JG7e/t/:ETdLljGHsZelmOvJvt/
TLSH
T138050295739008F9ED67823EC9614916D6B2BC5A0B60C64F13F4366B1F333A16C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 55b00b41c028d069d0185f6853fdd919fc1004556bb9506aecaedf21b404d1e3
MD5 f7bee00b64728e81f60063cd4ed6c7c4
SHA1 96296287cfafd48544d37e3ca9482d71677bf30e
SHA512 1b84ca3ac2cddaa9d0c0c7827ef00711e077612c97ab7f7577cb972ebcb5b3805c2daf46e90d5736816d2fe53ea66b2ac7f2d75c1800d0799b78e1e47f408967
SSDEEP 24576:23xd9CHKy7GZLGssZel8Ad6OOnNO5JG7e/t/:Yxd9CHKyaRHsZelmOvJvt/
TLSH
T14925DF90F3E410E9F1B79A358D724511DA767C9A1B21CE8F03A4265A1F33BE19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 2cffea729f4f174ef65df8a558fe557ab02d019e9fdafd964000805b4057c2d9
MD5 24eae790d77f40df9329ef292d6d6fbe
SHA1 bcc77a0313d4549adebaa243d15f5cb7dc0f636f
SHA512 f40b5a2ac31e55237f03dc4a6f34c768fc1c51100bc6b6d81c602d0136e35728cc0b18b2677bf9c434e234c86367704fd08d218093c909d43b127f4e92b3a93f
SSDEEP 12288:fmywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:fvGssZel8Ad6OOnNO5JG7e/t/
TLSH
T14DC42397455600FFE38617B3566017107471F9ABAF46C04BB2FBB6592630BF2F97A082
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 f2f417cc180538e80c9518343cda329fe3ce3710586c82109ebb7e8ade6573ff
MD5 5ec74b76ee8a8ad49ad13ffdc6679212
SHA1 46e00903ef7867a13c5afe5fefc7290a842da201
SHA512 ca108028af5b169f77c026fb83cb8c98ae6d5b6ecb2e3ad11ea105d77e8e6c736b8538cea97f029e23a6b4e2315bf2e2b5d3ac423cbed26e0fa24aa07dc89687
SSDEEP 12288:dcywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:d5GssZel8Ad6OOnNO5JG7e/t/
TLSH
T105C42396056604FFE38617B3667007107571FA6BAF06C04BB2FBB6592670BF2F97A042
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 e85a2a29dad4af0266673a0d93dbc15c2663a452c1765d1a0a317e3362dc5730
MD5 0a42bf98461df1a9bf7ff05753f0d10c
SHA1 03e11bbf1162eb23914e5cedcc230bf470ea10e3
SHA512 03f529c58fa345daef38c45240aca9d73cb10e6af752d035447a8cd4b5e2847cba39c98096080b95eb76868077d20886a99292c253bff10ca235b3371771ac83
SSDEEP 12288:AjywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:AuGssZel8Ad6OOnNO5JG7e/t/
TLSH
T1C5C42397415604FFE38617B3566007247471F9ABAF46C04BB2FBB6592630BF2F97A082
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 de8afe3b5712e11ed3ae9a26c63b17873ee9096cd8c957a078c5d4633d842577
MD5 485383d486ab4830a5f4f6ec1bc386d3
SHA1 6fd531c27bcccd3f04f7e8415c97bfbddbd6fb71
SHA512 0cc49f3454198d5cd76bb950be0286f000b7ca71ba7c560c21264c17692ce7d19b2d26d348d288a9c15c56fb4e2af08cdea0be4ed0c757c87c4a4c595eaecf49
SSDEEP 12288:LlywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:LMGssZel8Ad6OOnNO5JG7e/t/
TLSH
T10EC42397415604FFE38617B3566007147471F9ABAF46C08BB2FBB6592630BF2F97A082
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 45ec7926fe3cca8130ed79d808fd647e3d4fe8495899c8aec782880125b9bb9f
MD5 39e06f521ca34edc2bddbf41822dfb02
SHA1 ab95c06ee75df18ce3268d6c1b0e8337110a9ef7
SHA512 32ebe32dc03009ab5e53e5c544b759e69bdb104a892900012566457b79f006a158e8bf12832bdbdbabf1c4b64e9ba52f7c1a0c206bddacdf03f0b74f04a13661
SSDEEP 12288:6mywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:6vGssZel8Ad6OOnNO5JG7e/t/
TLSH
T1BAC42397415604FFE38617B3566007147471F9ABAF46C04BB2FBB6592630BF2F97A082
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 bf8ae653ab46002396785cc18bb21dd5833ee007052c2dd00dc5ea8940257771
MD5 407d0da2150e746788bc5d521aabc322
SHA1 4451f564f129bbc9de43acb05cc2d8b5c1a68de9
SHA512 4ed681805c748a7c1edd851336c2fecde5d03fcfadfb75c897e5e25bad7864d92d861e48489e4848bc5a294999d8aef73892c096c2d0618bc04d504266db7c13
SSDEEP 12288:wNywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:w0GssZel8Ad6OOnNO5JG7e/t/
TLSH
T115C42397455604FFE38617B3566007207461FAABAF46C04BB2FBB6592630BF3F97A042
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 61640cf22e0bb069974138b8178d2c31cd94d3d465728b446bb063fc5dfbbc18
MD5 7c4cc8b0006b85c29c7af4cce489e63e
SHA1 4972caf1ac0eb460197292e9d7335ca28865c2f1
SHA512 82729e608ff0593e49ef14679ded96d2d1a4379b9a105fa478b0aa59b13bd4d755f1cf40c08be2c94e07f3f47fd96da3f7efbd77193b4f217e565a3f2844c0dd
SSDEEP 12288:ZXywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:ZCGssZel8Ad6OOnNO5JG7e/t/
TLSH
T1B8C42397455600FFE38617B3566007247472F9AB6F46C04BB2FBB6592630BF2F97A081
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 449afbcf95e0524b8d33328b81e81729660c05b16156b6d77e50240373025f72
MD5 065eecb83b0335a4611919ef51648b67
SHA1 41c4433a96c16a8743b88286aa8c9134cae16db3
SHA512 33bde65c4b42c73ce274ced452f8c42d95fa3cd025ead1ab6a8fb5515645235a97e47ec329ccc00c16d40044b270d1b42b8f8c28721dcda66c1a756192454b16
SSDEEP 24576:3fwvOk9RX6wkyAIgGssZel8Ad6OOnNO5JG7e/t/:nMnYIgHsZelmOvJvt/
TLSH
T16835D029DBDC04E5E1B7923C99B3460AF6B178691B31C6CF129A536D0E33EE0AD39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b226ff548a1aa46827579317cbb3f80fabe0ca4219d76e35aaf319ecfcc323ee
MD5 6f243b9c85920aad2dbdc344f127793f
SHA1 c4a08b2b6adc627167e47f67dceaaad6cfa5eb64
SHA512 123fbed7c3b6a96d0b0dedf1cf43be559b57e87480d215a865c4314d46daa8aaf069876951784767ddbc371ed60e36a18a1c790ce972ae5343bc895616a71477
SSDEEP 49152:kYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0zHsZelmOvJvt/:oySzPwimOBV/
TLSH
T13F066C96A16801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 2a93308aaab3240b64db16fbac7540bb353ae40f5a6b6afc3d8687c0302087c0
MD5 2eca2745061c68017bb739401bfda516
SHA1 5557de7ae3492059a5a0a873beecfdde215c6e2d
SHA512 285e3b389af2039d7c463d65ec6c7c0718863b0923f0dd068bf63bc1204a674c8b5016860b392d6c81042d7654396f8d9f548f4ae64272a5b2f21de72474c5d7
SSDEEP 24576:947Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AY1GssZel8Ad6OOnNO5JG7e/t/:947JUQjairIhCnDHUPfF/DHsZelmOvJl
TLSH
T17965AF1EA3EC01E5E1BA927885154A5AEA71742E1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 09cb8e1ceef296ecc7ac065aa835bc56ac28aab196a2d9fb37b645058cc53941
MD5 4869e8a5b32cf1e60d3032ee5fa0db44
SHA1 99307c49a2ec43bedd0ea59ac5ad9d5900af1749
SHA512 6c878dfa4f23a34fbddfa4169f78928fec53f9d759a8316b4bb8e377cc15bfe0897027e8746e371ead3bf1dc6c3a755a7a05d45d621941c217e16b0442c01665
SSDEEP 12288:cksf1ywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:W8GssZel8Ad6OOnNO5JG7e/t/
TLSH
T15BE4F15AC29801E9D19E6276C7514A00B3337C658BE1C3CB62E1F57E1F366E1ADFA603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 8c94f8597f9bc91c7de7527480adc49e53783072cd4e9b0231a8da9638683f67
MD5 33cee2788c0908c24041fdfc5747b965
SHA1 dcc8778a2baa8c05e4bdb9e1ab8c500d184a8751
SHA512 81c43806e68d0518f105c3f0d61d6efda89d882573168fa242c3fac0773d74b6cf7115c8a7cfb6fa81939ecd6a98fad4647aac122bcbacf94ecce75a123792a8
SSDEEP 12288:iQ8Ik4U3fKaN/UQplZ7H1I4GRM/ejJX3sZ1Gkp:iQ8IRUPtpldHC4GRMmj53sZ1G
TLSH
T1F93529007666DB4FC6A950322E36C6CCAB707D42FE099B1372C9473FC476659BAF5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 d1fc6ce6b2a01231bd5775aed9e6d87d0b72a7e1ddc06a57d52561c2f69cea5e
MD5 2217c6c28c99113f14ee0e64b5e690e4
SHA1 c338afd714f851f6db8a0cb66bbdba2fa3d4fb39
SHA512 1b1a9fdffb37ae5d999b2ec0ddcd40d5621412af30b2ecda8e7036c0659c6616ca9f72d8f7988459a5a1647823975de04729bb8bf185f0821f670aa372f96d85
SSDEEP 12288:mzp8kks5MQY1woscwQFUWcdbMU9JopHJJiqcKolS/Ljpo7yTpBFLuuBh2HYZNkqX:mzp8kLqycwQFF+gm9mpmw5FpHb2S
TLSH
T16A754B0195B3EB4FC9BA6037533686CCBB74AC02B7493F067385893A9467A1EB5E13D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 41a0161421be9d5e013dab9309a08ed4ff75994c0f65acac7a03afaf98b1e716
MD5 8fee0db899c772a8bc74db93363bd89a
SHA1 550ec918c2ded2825f596c3a0b292b1b608f04e8
SHA512 0601aebbbdb437de7636365cbf33a420f372f640ba52d7f6fa1caf31e58872c44e85cc493e9b0b65ab46cf803999ee38e37d48dec395c93971eab48b97b559c6
SSDEEP 12288:cz7dywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:qkGssZel8Ad6OOnNO5JG7e/t/
TLSH
T1E1D42367429904ABF2AA27B2167457303526FA795F01C0CBF1A6B79D2530BF2FD79043
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7e9cf52faa6387b2eab70299cca899cb4d9c467e253eb2b711bc99b8324a8696
MD5 ecd073559f9abf08a10115116d1df800
SHA1 3a1183c4c5a9fa8283e3c4021f4f53a26781f854
SHA512 335158f9794e6f306ee99c679e5dc1c381a94311e769e0ed9ed4894d41995cbb8e5491c332083126a4492138b6c33384283ad3debdf87b82cf499ba6806db342
SSDEEP 24576:4gb6bmBIi49WNNFpg1rSvFv7bYGGssZel8Ad6OOnNO5JG7e/t/:4gb4mBIBhGF1HsZelmOvJvt/
TLSH
T12865AE1E22EC02F5E1FAE2B89DA64417D6B278160731D2CF1251427D2F3BEE49D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 61dae488e207f3c7f2edf1f0927d4ec13787e143093239b0dc6984bfeff228be
MD5 78f9acbbeb90f6467234679d9b3962fb
SHA1 c33074bcb2815209c747f642739718f2eb1e8b37
SHA512 19a52e49dbdffaf8ae12f5aeccb1bbbf522eef09f407d25867c616386a2e91602baabefdac4220b5c269cd9c39d39aba693ab0ab0d6ac858a64ae61f767bc407
SSDEEP 24576:UG88u8FpJqH1nzria7/mlGssZel8Ad6OOnNO5JG7e/t/:n7ZFPqV6a7/OHsZelmOvJvt/
TLSH
T1E335F16667E101F1D47BD1388A824663F6B2B8250364EBCF07A88B551F33BE15B7EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 3a376df2934df9c528756bc8ac81c3ce26b35d8c7fef957daf5a1b5541d46546
MD5 3b470299c1fef9c464073deefc47125f
SHA1 1b2eba9441df5bbcf0d6d70cd840eb47411478fb
SHA512 65557ef3fefae5fc7e944ea77c92d5fe61356ce621d490161dc97cc7607a1509068309a51d02987591f1f130b8202c989b5d198d4d0800751d76b9ecb794a3a3
SSDEEP 12288:tHvUrBFrEjwaQ0ywXL4sSOY9wwwooabNn6Dt82gc+SDnuBSd85JGy0eB9t/:tPUr+NQRGssZel8Ad6OOnNO5JG7e/t/
TLSH
T1DA05E12F12A918E5E676A17D89824719F772B4621712D2CF02E1817E1F33EE4BD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7c0f0027ae3c9f227ef4e9a019809020517d5393680c8327bf96d5ed3caca116
MD5 edb54dc1e7bc63b91a58f40570b722fa
SHA1 c202c32e0347ac7eb6e53e3bc41af729e0bf6321
SHA512 49f5f5a18a0d6f460e591f3a35f3c215398f2930e652ed9ae0edd9d715390dcd66673e57d5ec84cf229b555c8bf7382800d87b9fde563f1c7c646908e375d04c
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjBHsZelmOvJvt/:eG05lO43bximOBV/
TLSH
T1BFD5C06E62EC11F9D1BBD17CDAC6460BEBB23415032556CF02A486A91F27FF0A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a08d885791a46ac89d1846b5631c5a9763b7f486f2d60bf4267268a4da60ab9a
MD5 30e46516fc5241ea175839d5e561141b
SHA1 da6f69a156fc3340e50c746cbff955b3d5291422
SHA512 471811386e3fad9b07cc344f492699f2886984d6fa529db4cd42637579a22394dddd3f23a48d35e3531f0db8ade29cac2160dd2cad4e551a032894523a292dc1
SSDEEP 24576:8fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnzGssZel8Ad6OOnNO5JG7e/t/:ka5POZ3hJt2pasx2+m5HsZelmOvJvt/
TLSH
T1A465AF5EA6FC00D5D1B9D17DC583461AF5B1342653329ACB122182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ff28c73acad8d5029389c1fc43a5b483aafabcffe871a4acc689cf83836c0e55
MD5 218d123ae8fd8eed023556d3540b2f85
SHA1 29d5fc1bee5a0e1172b44fded417c1484794e10e
SHA512 f398972150bbdd84dc1fda2616f7413fa3a8d5fd46fe21993852352408a6cda273e576e04851127da2a4d4dd0a51f44296735617e3f420111bd762d8da2dae43
SSDEEP 24576:dNcwHdjbyQ4nLC18lb/EOjowL7FkdGssZel8Ad6OOnNO5JG7e/t/:dNc/zEOVHFuHsZelmOvJvt/
TLSH
T1AF857B1622E901E4F1BBE1BE89779646FA717865173086CF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 4862d08a95af2923368e906d8199ed7b3b77f4bec8db6d0b295318b47b4d4177
MD5 855efcbb520e2cd48460e7bbc59f5bde
SHA1 8fca952defca4a8d2d6f195383e77de9a9427290
SHA512 fabe5f706bc6c65381387a56861a69310b263f40522764c322cf82d244184649b5c93a036f0b8d5a04291d8d8f4461edbdd25902c5a170bb4c987ff459a5e7e1
SSDEEP 12288:11H1kej5ZI7luoA7uUpzRXOQ7s1VJq6gXGRz8esYnydrFzBPi0F+lAutu2CbY7c7:GeDIwoEHkQw7jd9sNdbiLlubbp
TLSH
T12725025E232A01F5D167D07896934506E1F270B08B621ADF0299D4BE8FF3EC9BD39E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 55a2f2f395ab93f9b3c3cd4340546e425b6a88bd4bf182b9cf391dba6ce0fb9c
MD5 8cb7ed0b048fe7afdd8b62fcca5b26ae
SHA1 81c601fee2dc59a6ebf604010bb2325edfda464a
SHA512 9ffd6cb53bfacb80a56f9d8418cec4def42d8893a8e0e95b2ae9c584c6a7ddfaa8e536bbf705d5a103526e5116f1a00cd02791ffdcdc27ac75172c5b4bceebc8
SSDEEP 24576:UD3FHshBIYQgAYGssZel8Ad6OOnNO5JG7e/t/:UDVHeBIAAYHsZelmOvJvt/
TLSH
T15325E17ED69C04E4E57BD2BC9A634A06E67178A9072255CB12D481BA1F2BFE07D3DF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1104-158-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1104-160-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1104-156-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1104-150-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1104-149-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1184-111-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1184-36-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1184-47-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1184-35-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1184-43-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1544-69-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/1544-76-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1544-71-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1544-63-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/1544-62-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/1544-74-0x0000000001A60000-0x0000000001AC0000-memory.dmp

Download

memory/2576-166-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2576-339-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2576-167-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2576-173-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2672-124-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2672-125-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2672-338-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2672-336-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2672-334-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2672-131-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/3204-101-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3204-107-0x00000000006A0000-0x0000000000706000-memory.dmp

Download

memory/3204-102-0x00000000006A0000-0x0000000000706000-memory.dmp

Download

memory/3204-332-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4136-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4136-113-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4136-351-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4136-112-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4136-353-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4136-119-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4544-22-0x00000001401F5000-0x00000001401F6000-memory.dmp

Download

memory/4544-31-0x0000000002230000-0x00000000022B3000-memory.dmp

Download

memory/4544-1-0x0000000002230000-0x00000000022B3000-memory.dmp

Download

memory/4544-20-0x0000000002D70000-0x0000000002DD0000-memory.dmp

Download

memory/4544-23-0x0000000140000000-0x000000014065E000-memory.dmp

Download

memory/4544-14-0x0000000002D70000-0x0000000002DD0000-memory.dmp

Download

memory/4544-42-0x0000000140000000-0x000000014065E000-memory.dmp

Download

memory/4544-8-0x0000000002230000-0x00000000022B3000-memory.dmp

Download

memory/4544-0-0x0000000140000000-0x000000014065E000-memory.dmp

Download

memory/4544-29-0x0000000002D70000-0x0000000002DD0000-memory.dmp

Download

memory/4924-89-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4924-330-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4924-91-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4924-97-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5372-85-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5372-78-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5372-79-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5372-316-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5512-137-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5512-335-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5512-145-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5512-139-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5960-56-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5960-136-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5960-57-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5960-50-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5960-59-0x0000000140000000-0x00000001402D4000-memory.dmp

Download