ce73a05caeef0e91368865cee44a6f4850c666c02a1e4edd51f607c6c297e41d

Analysis

max time kernel
149s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_b7b4340156e1cf397a55bd89a4d3b433_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Size 4.1MB
Sample261023-3chcwsdg96
SHA256 ce73a05caeef0e91368865cee44a6f4850c666c02a1e4edd51f607c6c297e41d
MD5 b7b4340156e1cf397a55bd89a4d3b433
SHA1 f297c9d14dde97478a8c267b6cceaca286e094a9
SHA512 150a30b25f968b8feafd4d1f5772ec3f53c3e1ebbe4735cda248a1d155ca01b970df8badc75797968ff8786cc5bb7d1b788b6f372b5f94d733485402a56319f3
SSDEEP 49152:Ro4Bs2h0oGZIfKd12ahX/2Zw5v0jQ/lFTjN4:RA21dKJx/2W17Lm
TLSH
T16C166C43ACA440A9D496E635C57342627674BC8EC73237EB3F41AEB82F35BD19AB4740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4820	elevation_service.exe
2532	elevation_service.exe
1936	maintenanceservice.exe
2800	OSE.EXE
1944	PerceptionSimulationService.exe
204	perfhost.exe
4464	ReFsDedupSvc.exe
5892	SensorDataService.exe
5548	ssh-agent.exe
5484	AgentService.exe
2396	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-22_b7b4340156e1cf397a55bd89a4d3b433_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-22_b7b4340156e1cf397a55bd89a4d3b433_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-22_b7b4340156e1cf397a55bd89a4d3b433_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-22_b7b4340156e1cf397a55bd89a4d3b433_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a9daf588c17a6531.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-22_b7b4340156e1cf397a55bd89a4d3b433_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_b7b4340156e1cf397a55bd89a4d3b433_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-22_b7b4340156e1cf397a55bd89a4d3b433_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fba8b29a4563dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dd055f5a4563dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000043389e9a4563dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e346525a4563dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ad1a85c4563dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4820	elevation_service.exe
4820	elevation_service.exe
4820	elevation_service.exe
4820	elevation_service.exe
4820	elevation_service.exe
4820	elevation_service.exe
4820	elevation_service.exe
2532	elevation_service.exe
2532	elevation_service.exe
2532	elevation_service.exe
2532	elevation_service.exe
2532	elevation_service.exe
2532	elevation_service.exe
2532	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6116	2026-10-22_b7b4340156e1cf397a55bd89a4d3b433_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
Token: SeTakeOwnershipPrivilege	4820	elevation_service.exe
Token: SeBackupPrivilege	4464	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4464	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4464	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4464	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4464	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4464	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4464	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4464	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4464	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4464	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5484	AgentService.exe
Token: 33	2396	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2396	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2396	SearchIndexer.exe
Token: SeDebugPrivilege	4820	elevation_service.exe
Token: SeDebugPrivilege	2532	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 5464	2396	SearchIndexer.exe	101
PID 2396 wrote to memory of 2860	2396	SearchIndexer.exe	102
PID 2396 wrote to memory of 1308	2396	SearchIndexer.exe	103
PID 2396 wrote to memory of 5356	2396	SearchIndexer.exe	104
PID 2396 wrote to memory of 5560	2396	SearchIndexer.exe	106
PID 2396 wrote to memory of 4344	2396	SearchIndexer.exe	107
PID 2396 wrote to memory of 5300	2396	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-22_b7b4340156e1cf397a55bd89a4d3b433_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_b7b4340156e1cf397a55bd89a4d3b433_frostygoop_hive_knight_luca-stealer_salatstealer_sliver.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:6116

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4820

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2532

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1936

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2800

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1944

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:204

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4464

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5892

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5548

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5484

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5464
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2860
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1308
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5356
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5560
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4344
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 09b6021ca0189801a87a35e0f573bf48408570ecaaf87cb66672ecaf49dbe6a1
MD5 49b2460cf4243183567c4ede4cf7764a
SHA1 3477539568af8139bf23a30ae28c879a832d48f8
SHA512 e9ff822d19f419a8261634629740692a390aef23990bd55ab3b9a98ced9f2849b3d795202053c9972c80f9645f788a03ecf43e58542254b71c0c151c87d84e4f
SSDEEP 49152:Db+632BuPkFKRrdE6ohmstBhuXjfS4LWxnMQ/lFTjN4:h3q6HjBILm
TLSH
T1B8D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 6a587fb66ae1f7a2279ea60ab6994e3eb6111c43124aec0dcefbf71495f13c34
MD5 8653a2f04ea354dd6daa08d952c8aa61
SHA1 ecb22a215061c93bc9feebb850fe71f31d8beb48
SHA512 704379ed45b46398aa3d871c96061f40788bc1fbf53008a7bb892caccddde614bc154d4b3dffeb034652fe793c4d18340d1b887c297a92fe6311317849276acd
SSDEEP 12288:01XLsswWkxy2lRq2czAnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:SXYfDtczAHnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1A165F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 fa6bf0fbdec429398abece848946214aaf7386ff74acdd82b5e757595b4c5c8f
MD5 f27c1344d3873cc0f13c3912b42e2935
SHA1 5e7c1af3811dea90dd5b84840960c52297cfe2cd
SHA512 5353556e0cb9304bf7cf00561a22903fa1c30164e4722a0861455dafceaf5fe8e87fe47a857396fe5336d692abb9f4d327e095a7824369dc5226a23e9043deb7
SSDEEP 24576:w0Le5ji0hmxLrMknQ/tbw/2Mkjy6Fr7g0oQ:wPji0AlNQ/lFTjN4
TLSH
T1B6859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 256252f70a1df5aae61ccd1a261b5d104f3318e3c3d51790bc2b3f144ccf40d4
MD5 accc6af7b0cad39e44a17b3ac66aba0a
SHA1 7cf64a481ec00761dac1cf9da643682cce7df6b8
SHA512 e140077640566dea1fd45d52ff606424b4fc30d8f85fde2e64cbc4245c02bdb1a4c54f3d3a753e3944eff6cab06154fbcbcbc19c87bf5b7cc197e018f7e1a850
SSDEEP 24576:Ea7/ezSC6vUyD/aqgrvWE6q8wyuGnQ/tbw/2Mkjy6Fr7g0o1:z/ezSC6vUzPvxHjyBQ/lFTjN4
TLSH
T17A755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ff18f093741b1b5a355120e979ab59a0f13c070a01a042cfeafcc4fae942c7a7
MD5 67864f59f2288ae9b0ca4a4c509a4809
SHA1 6673009f3c1286e81b05049169a3a5d01633b97d
SHA512 1f81b90c91b75ceba182d2a19a41310c74958e57ca30263818b3b24735114ba530ec8dcc91c7f90100487821a557f9217dfd7b26100964e2206bee3060aceb75
SSDEEP 24576:EVbqPb88hv/l+6znQ/tbw/2Mkjy6Fr7g0o8:EVO88hXl+oQ/lFTjN4
TLSH
T141559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 45ce78345d9b536b4e9a203ccf8e7d35c0d85405f005e5e047af11a15a3a5003
MD5 e2a75d9e6b75849164ef316956055509
SHA1 21c2054e5981e63a5e78fcb4a70799c0001f9936
SHA512 f4064391e07afe502fdbc1a5a1beaa84d6d859b42d2021ef14501ee329961ebb1042b4e42b9b2f14a56973b9b553af65ff0ae3fa4e4ff1f2a9088e7e76a79cd4
SSDEEP 12288:3zwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:3zQnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1715523796A24F897FF2B06B15CC284826B7B0EC1BFD4A74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 5b19783ea5e7145eff2d0091b46d1907171c6d52e0451ecabbc1d8696ffe06ed
MD5 2b92bf8b9cd1e5b84af247cc124ac26e
SHA1 00caf6c76a5ea91261172f493d60711e7ee2c841
SHA512 a07a0b5b913f6c6518f59595ead7b670a07534bf590529c27bcf86e22609cb5ec612888f5f059898ff64173b6e797d761585e0ed76f1768e08231338caae8a0f
SSDEEP 12288:aeBNUbTVO86UbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:aJIULnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1DC75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1095f70c0a846a122e6959a318593f8939fd3d81eae36ed065d374c1e0154f60
MD5 023404d55e3dcaf189d5584d52754e68
SHA1 96ab23fd214f7477383b466292a4bafd0f1150da
SHA512 607841caf506c1a4168bcb1ff391c6f577aced22ff3b741e9760e7b99f7db81fa141e81f0871dea0bc6f5ec1c42f7eeca22ccf159487ae772cd9511ebd262b47
SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THL:bQvGAdlCEL8c/yRNw5ChLm
TLSH
T1F6267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 46591dcdf6e2cbe12fff4939ccfc4779307487988d1442d5d0d925e329674d12
MD5 b9474187b1bb18fc62e84b6fff5c6664
SHA1 8c5088e6f779a1948d23d4f48a0b46d6257d4926
SHA512 952c3093df553a9c1b2b9b6094cd1f086404e19761a4cd9173f875f9b6941c48b73688611192148d9beee7461b992351ba9798c265268acea641aae80a4c6db9
SSDEEP 12288:6AwSfxL/2Dc39DLLmt0LDQewsAj9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgT:PQewsAjdnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1E375E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 188d6775becaf4ee698adfd6d296229be6f2a37d58cffaea99ba0ecfbdbabfb8
MD5 0217d33f178bd3c5d5cf1d14e06ee938
SHA1 cb0897880b064e07f585e23776a677ffd54fd494
SHA512 1a50166820a822f173069bea6b3b1c20dca200b3704748d01612f64c9d79ef0e2c293a77ecc4db2b0ad0ade5cffee92b303c80badf29c6db2fb3faadaed0745b
SSDEEP 196608:CUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHqL:CUEtQevvqc2W1cpV2EI32
TLSH
T194474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6f70e4516c5086df78e7fa1bc54296b980ac6435d65928ddc51b260e1300577a
MD5 a72d563480c4a8340a8c6adcc8509fd9
SHA1 cc2e6db1cf3189faecc6986c8e25fc1b041b4641
SHA512 c318cc4e1f872a6aa2c8e577ba14584dd2c2fe359e4e35a7aeb389b414aa51b9d59d62d97efc51958778ea2ce9480bec288f89b88693d0a525d14dacf30352aa
SSDEEP 49152:tCbRquA/m2yL5zQfFiV+XenmE3/z9Q/lFTjN4:KoqtVjnmlLm
TLSH
T18CD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 b3bd493016d033b4445e5ebe0c9f881b205227b196c2cedf1dd519b0aa557f0d
MD5 6938d1cd32ee0495a0d4376b82ed00ac
SHA1 a67383b38608c6c83057122455407e2f93b6143a
SHA512 0cad9287cf0c41a07286323456705b4e6c81bea3b3ba6ef433f14c93a3f51d79f07d7a67c2a977bcb2aba80ae1506c52c98db8d3ba932f9ff93100c5d4b53e30
SSDEEP 24576:eAhGLJIFoiwtA5l7S53KnQ/tbw/2Mkjy6Fr7g0oa:eAMyFoiq56Q/lFTjN4
TLSH
T1C435AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 f0a58624a25d4b3eb633dbe7cb73dce02693b912ee40cd64cb92802797db1738
MD5 c639efd9ffb9d36b052d3ca9c581ab04
SHA1 f05865585df08880b47d4fefd0f64f0c97a27ed5
SHA512 989dedba34ff8f0010836ad898745c0fa80bfa2e2ceb89e1f8eb5924bfa4fc7f65d0c2a5c63219971920e8acc602e4d26ebf0b6a32b3bbd1bb2521fb94dacc8f
SSDEEP 12288:pmw5HEjsChN2BFgl0WDm+CGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMC:kwuHOWhnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1F065F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 adf9987b3758ea11defe3229542b90494f08b77ed702ce833f895c20fbd9e0f0
MD5 3107839ab5234af79e3aeed61bd7bf2f
SHA1 8cab70c94204a25a48abd40a46bbe092d2dfc39c
SHA512 c3959e97edb078fda478d2500785b8b80b56cd95ddb381d4ef1aa847314c05d8048122e8ccd650413d35ed8b96a4d5d7e17077e5772b1918e4115fe16debd44b
SSDEEP 12288:FXZ1IyNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:VZucnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T14A55126937A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e011aab332a54cb29e810c966c62b5ac5c0f40bb2f22c4df2f507e4173bd8722
MD5 6a6a7d2a7707760a8138cad09054f533
SHA1 90e22e90faa98f1efd96f437c4f45cf993bcb22c
SHA512 9aed07ef63d06d9c47a7e3b342f6c133b82c15d29a745fd843bc0854cc8f192ec15ec9be975f73533a0863d96b651c8835c4206e7b7696de12a4d788580c5d12
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UP:xQRQyi36YOcPQLvw2gAf+PN30Lm
TLSH
T123667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6548ee113b1407356d16d23a11b9c8ff9ceddaa187c052c13731d9203bcd79de
MD5 48b37ab89dff0956a940c060de6696af
SHA1 534fd375f8cbb8c58ffb21b2d26780b1ddaa73f6
SHA512 805b12f7b7dd4d4f4f5d1180f1bd82423df01bec2f97994c39735b3f02d13c44831c2e9b3af46243353afda5274bcd3d43273c5697587032f5412cc485a1aac4
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UP:uQRQyi36YOcPQLvw2gAf+PN30Lm
TLSH
T1F1667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 76631e6af53e7feac10ae46228e8660b95d9ab9af2ddf06b56f438e49e633a05
MD5 ca1a2e946f2465e2a56fb8f6ce2e39f8
SHA1 51ea3578e8e606321570584d7055102d66c90020
SHA512 bddb07b506012d7bcc0a00a89000829835e006ba3fb574f5b7ebd3b12e60ed489fee7b688fd7e02f3a194fd2a202153ad68742ab12fb9a9100697132e76f51fd
SSDEEP 24576:QwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0MnQ/tbw/2Mkjy6z:W68Qg55nhheWu7PNU3/NQ/lFTjN4
TLSH
T171B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c480faa2e901ba7a9691a5a0cabac078e3079c8be09ce4fa7f35b59a3311d751
MD5 abca123ab4b928905c261241bc33d9e1
SHA1 d3d859b4788abef09ba303bc0a9d73095a22d82b
SHA512 e803f32980cde5e7b9ad926323017e7a2e7bbeaddf8d57525621e19b10d0887b172adf883a0fd87b2a7efe0273c1d0e5c5ff3baccfebf77c123392cf3d68f34e
SSDEEP 49152:O3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99t:vy5112gYy5azzVvL69nLKnhZjLm
TLSH
T14C167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 179278830f6485b61498c5e34fbfa319725cef8b8d44cad7d7a4458fb132eb1a
MD5 be2ea7a5a4d00f98f2e7dcdba0d75396
SHA1 fff0f997b12bbfd74c0cd4e76d2c3001a8448068
SHA512 ee8e686b7c36d107bbf15712936ec0fd20d15c23fd6895989e9130c28e9878fd4349e61b5dbc28c8cdaa7971f2fa2fbd680182bf1af7ce609a4f5d1a4ddd5ff2
SSDEEP 49152:3B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glEQ/lFTjN4:Zu6JmVxd2d3Lm
TLSH
T1F4D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e3e0a9e775e01e1808b36644667dfd29b2cf6b55fad93e41f57ea44d469eba2b
MD5 85bec4a078ea75768a86cecdbc201af3
SHA1 a1315ea7321354c45a60125355ead4a3c9c23123
SHA512 9887a8b8d92769b50435dd930dceb73d4d76661f01ce2c35561949e0fae83891b9cfb90c7f505097707257e034df4bc6e2a121e84497d22941abd849a60ae767
SSDEEP 49152:t1hpsNoJpF1A6UU44CwH7R4xrQ/lFTjN4:tmifPbRlLm
TLSH
T167B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 bd9ec390de89380403c0ac36da7cf4430f74a1bfdf46592361e5b14b527dbf0b
MD5 15d1c1663e13e5a38b1bc61cd2c8f0af
SHA1 de4e06623cc52e07b36a0e80546c761131951111
SHA512 d7a81880593221e2d80efc9e6276551da9ad8e6e7433f723691842320cc2b9e25306cfb6effb3a8d3ae14fae4b87e75b078c38b6b9d29ca9ab1344c94287f6eb
SSDEEP 49152:wSuZQIY0Be2KRRVtOnks6NMHqcQ/lFTjN4:q5dKTi61/Lm
TLSH
T1FAC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2489c529c21fd1c31c51ffcb4847cb5c305e7d0e7069d9737a4f077f83023bb8
MD5 f6d91db08f8be05a2e30e0ffc1adb93e
SHA1 cb635ed55b5d3e65e88f015cdbb674535041929d
SHA512 6ae8c30d41bb20811f415bc3979d7085ba3d4337f2295db32af882a1f16625d7d4339905d8322304e302f47f2a60160905f5766a74386443337e9d76ad11b0fa
SSDEEP 49152:nhtSn8EApI0figngiDn0AP5wHQ/lFTjN4:2X2iyph5Lm
TLSH
T10395BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 9eb6262182a3418b448247de2da9ee8446f275c262f0c124b22846b123af9ac4
MD5 8d5c626c31fb0bd286f493207d31c19b
SHA1 e87f702d1d40de2a6c83a7dc69e5b0be77ee3011
SHA512 bc20fb3d70dd7542d1ccb7c072d904ad73b553cc840c3207a6a9282d0ff7eb5da611e02b14890e8309fe354e788df3bc46140cb7ddc8723ead9715b3d99e72c8
SSDEEP 12288:noGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:nonQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1225523697965F98BFB1706F18C828182A77F0EC6BFD1938F77482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 b0fca0e27635f73652b3aa99795e21b03a1585c3faab08deb208e9a1118a7e6c
MD5 eed9686364291022f45bbb287433168c
SHA1 e0ad6965a5b6a13ed3606664094f500617995cca
SHA512 86de7b0fa9a1a04b0414aba0a9c2fb27101d56f93b0815545afe6990669812d54a69519bc813b18b64f4e8929f50acebc471a5b865147333fb8bfd1c2ecf6b07
SSDEEP 12288:L5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:LJnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1965523697965F98BFB1706F14C8281829B3B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 b04e3d9d53fd999ff6bf00faaad5c5b3e354eb64028073ac94f4f31fa581ce69
MD5 b68b218021248613ebcee83969505b82
SHA1 2c2f03c33ac6e880205cc4c82b6bc93d7f89752d
SHA512 26057f4bb2521a988006262dfee77fb0502a6f3ae0d112df38197234169981091fa6879ebb79be916a4fbfe5c3a35a8bc00076267a5dada7d78e34d2592e0309
SSDEEP 12288:6zGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:6jnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1335523697965F98BFA1706F14C8381829B7B0EC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 10b226dc58b5e38c50c46af65618027f4143785dd7e75bf6da0e32e586a02317
MD5 f01e16da7504c30ff8ddd171ddb37e3a
SHA1 a1654893ffab70b166342248268a0f641bdab98b
SHA512 08325a52ff66d994ac72861788671762e102012d3831a871545a7ddbca0015b3e4ece8467b946678a49cc7876aac4bf0ec41dad0977a622647a8a54f54475615
SSDEEP 12288:oVqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:jnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1865523693B69F4C7F92742B4CC928142E77B3DC5BBA1A3CF6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 5ae23293a13ec0e713517250df48c6229d429d7660de455b44047ffed7783119
MD5 13214a74b8a4c349a4c84c31ee861b02
SHA1 7f00ba1f698ad5087ab0273809758528017e27c1
SHA512 a59f4ea14fe91b5ea6ffaedf003bb6f02ff2a0a9eb153e6a8ef7402492585e3e944d9d118fae5d9b3d12cec0311d67e60e5ca1d8df09a23b5b519608ddc44ff7
SSDEEP 12288:5SGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:5SnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1F25523697965F98BFA1706F14C838182A77B0EC6BFD1938F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 d2ae3a37049610cbf6555d51252c605b49d8b8cdc3723ccdd6170d6ccd5336c0
MD5 79e16605e360a00a4e910592a92f7a17
SHA1 0496a17e720057bcc797572e4507f09a755f809d
SHA512 f9392c5b08718579fe5b3ee4fb8af09208b8e474e697231f10d01b176cec80e742dd50e4b739ba1c63c5af48607cc558fde33bcab9599bf3496e7b073e72863c
SSDEEP 12288:E1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:EVnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1EA5523797965F98BFB1706F14C828182A73B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 d8cb9fa00489572aabc031be588e2fc534bc7e3d68851ae7edccc53476ffd889
MD5 6467bf0250306489c5b037578c1fa6dc
SHA1 b226f9ad00e1766697429ee21f02dbf5e74eadd5
SHA512 1f7a68095c003ce92a607e95711ad946f7ad5eb524692709656e8f7ec77a7d9687d469e1c11581b103291d59674a43e3281dc93820c333a7a1dfd803e9c13dd5
SSDEEP 12288:KBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:KRnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1895523797965F98BFB2706F14C828182973B0EC6BFD1938F7B481128967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 c418984a1ad961632ea4ea240cda5f36fe3ff636c605c1c1dcb05c93e2ec3f10
MD5 9ecf0169101efa0341055fd55d04b70f
SHA1 b27c118604a670c3a349c7cceeb2a3a0cb66b58e
SHA512 9ccc16ac874fb9571d312fa1b9b6e4662ef883b8ae5a8e4913bf756ccda9c9d004b54b395993c702e17b820c8073c565cf239a855b5290750f756c153c112054
SSDEEP 12288:GiZwbDzzFEoS2cPvyZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:JZM3zFVSOpnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1DA7501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5f55c8a24247fa6d47cab9588c48df52db5c66d881b1e3c99e36cee202a9e905
MD5 96e7c8d0865268237999c04bbef0cec7
SHA1 cc60847adaaf68575fe60164f91456312304e78a
SHA512 5ebba485891bbcb2be68ef0d27172b5d532df070d0b638358860c09dbc3fcb37e0c6047d0f2f61bd918b169bb7e81430b1d8e7482f110508cc40ba515e6caf0c
SSDEEP 12288:BsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:BsnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1845523697965F88BFB1706F54C8281829B7B0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 6b3dacc2a3e0ff25382ed61d6361e561e694f027f25f5cf46ed9194b4d4d1cd7
MD5 86d466078c9ce4f39156ba450fa91473
SHA1 d6d5341ac96707d4a260413032ed02b433973619
SHA512 e44305cd86131a975cf7e8355ffbff3ee2b010e5d0c41415bb512af65723a53183089d688ee2d277b8e7b5b89d31ddb57ac7f61219d665ab69a30d95c839468c
SSDEEP 12288:CAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:CgnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1D55523697965F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 d0946967b11138a75b183eeb7212f650279c501d20873ccd111630d11d288614
MD5 497bd088869c8da37892992024734165
SHA1 f0df16db96f15f62ed1d4da65f0df96bd4ea4c56
SHA512 8eefdf1d7c8ac7c2dad595d01ca28c9463d62a1cad2e99612537f6339fc55e481443326630a1b4ba8ee8ccadcd54558c2265554a612e73044036c405b39fd914
SSDEEP 12288:JyPz5L8NGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:ozytnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T18465021773A570FAE537427888920A02F77678725B609BAF2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 125f64a553f1b4f7971af1b0cbc79eacbdb3fd788a572838eaf0011ab0276285
MD5 11dca0825156ba3cea07ae5c2618d5d1
SHA1 918c59d427e45ebc32c3459dd4778524d9a547b4
SHA512 5a561db82b5fb54dcb6c3f7573cbe244692fe40feba62ade970eed0708fd691fed1ecdd68a13e26e9ebd2d02570ad879271d368b61c49953b6c9243eecb60b90
SSDEEP 12288:UsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:UsnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1DD5523697925F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 95f0e7f42d09fdbd9cc14349e02a374af98de95a80207aa7082e60072b4a09ca
MD5 298cbc73da085f282b3a0b724bcf3877
SHA1 b69123ae511064c50f6171c520455522bea5efd5
SHA512 6c6fe3d116b339b4a976d5fd21123e9495ce15495a615015bd4bbe3176c8bf71f4a6a4e42b5749e60a106e3a92e58f3d90878ff4c5e1f70d0fd6262c792892b5
SSDEEP 12288:psGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:psnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1A95523697925F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 b84ba35883a6b8d9953088a11f3244b9d934dc264e58ca7f1d0de53c7c256e4c
MD5 01371fea34497f2fcf46ca7d36a5eeb6
SHA1 670c03b87835cff9082f71c617aad68b86493336
SHA512 a20c085d072b236bbaede7f1a2a0c93acc1f1520460de45d569765edadea54c4528455cc290a60e80f24781223395bbadbd35284058f8588c159afa68a290e39
SSDEEP 12288:1yPz5L8NGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:czytnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T19665021777A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 b0bc5c15b39a71e209ed1bae63f64cf16eec5b8fbb74404b50e4977d71302cdc
MD5 60d4aed7da7adfb86843da713e54bed8
SHA1 b36a59459b1e21d289053133ea54ce1ef87c7b6f
SHA512 0d5ec78518805f0b7f25e24b440a91338b1979883dfdd0b04db4a5cc12f36140fb7885497412eab6453853ecf43d61edbefa9e96a19dd473cce4d9245386a560
SSDEEP 24576:CT0aLl3z0zDTnQ/tbw/2Mkjy6Fr7g0oT:CTDLljGQ/lFTjN4
TLSH
T1EA7501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 b1f8ca19c2b80fe80db73d611ba049b0a25379528815a4445fba6a01f10b2c5d
MD5 df659ffb0edf4932e5fe53d0e7631a2c
SHA1 7230891fcdf50c076dbcc8b03023983d7225d3d7
SHA512 a9d8451ac343d2a575ceb0f2d278fe235427cad489b825fd264c1bdf7a7bd200fa2d2d1ca3d0615b7c24878a83136d2af54944e3f40f0bca5f2972e8c0074097
SSDEEP 24576:931d9CHKy7GZfnQ/tbw/2Mkjy6Fr7g0oi:d1d9CHKyalQ/lFTjN4
TLSH
T12D85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 dd78fe292dae61aa13b3ea4ed13c76818d894c884cf3cfc79608d0bdef831888
MD5 2f9e7701ef250593555def1db3e3d174
SHA1 f6f29d00082513ace286461cf65331dc37ef9453
SHA512 7d0570940d562936be2e87bf5d404165ec68205a0370071554575bcd74f3a778eccd5c7e1898e8e32fef9aa55a6bd9c56ddf1be75a121a1d883359eb1176505a
SSDEEP 12288:qTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:qDnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1285523697925F98BFB1706F14C828182AB7B0EC6BFD1938F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 5f19bfebc6e18bbd371a4c71eea3e2ec3b7ba318cc24cdc00dc252d7c878bac4
MD5 66e1bba2f6af0124e5fd5eef8102b9f6
SHA1 11b35b0105222755dd8fb974872f80a9c8d3133f
SHA512 345c956591f97f0b86c251071c96d95f2fec3cb754edd7f318c0588055ce8edf376f9fb8f1bff2b5ba6fbfde6eb670c0b86de07885aef36165893417f8d0dcfc
SSDEEP 12288:LtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:LNnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1D55523797964F99BFA1B06F14C838182A73B0EC6BFD1938F7B481129967D39406C67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 625517d45f555259218e60ed5f54223ed6a08aa769142b1afbd7307acb8c731c
MD5 62f66157610f788023e9148390ea5133
SHA1 7b0eec5061647ba5114f8909489d90a8e3c7e93a
SHA512 8ceeee7a7d3ff03a99b43c5a0986a64971da9430a53aea48de845a23b5757935408719d5231275aaf7acec45ea36b77599b81649c9d7c61ef4f0bf36e6eec88e
SSDEEP 12288:duGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:dunQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1F65523797925F98BFB1706F54C8281829B7B0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 f133e40644fc1fc2c0bbf0dc576ae489d321d6f1b42abfb0bfb617bfea4baaf2
MD5 51ed55b4a9ddf2761140f52052e56654
SHA1 0d9bc4884721f76e96c576237cf61a625995ca40
SHA512 4afe0b6f3a1ab977522d57dd02a7e2ca0783ab338475a48e1c78d6610d7d5e47d231b2c443ea5e720b85cc8b47ac5a9692eac995345aaa4493088373e30005cf
SSDEEP 12288:IsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:IsnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T19A5523697925F98BFB1706F54C8281829B7B0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 0158bf3cc618fe3b4a7362fbb498600a77235cd88b30923a804c0db1a8750da5
MD5 f2f7f4602aea67cede3830da03e380ae
SHA1 d2fcbf775727b66bf1e01d4a4f4318fbe5784cb3
SHA512 e2eb67f44682cded6f9c220540aa5e827a8acf6c0f53cb0ce3ca2b0b977373b6f9a95bc1e8932553e24a96deacf5e26ad70fb7c24869333f2ebd07fecbdb2f19
SSDEEP 12288:TTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:TDnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1A35523697925F98BFA1706F14C8381829B7B0EC6BFD1938F7B482128967D39416CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 8f6583d70ece9bff2c6fb2d9af2a810743dbf3b3e8b704c5d240d9f7237609a8
MD5 e935b807da40ad2420e954f24ab8c7b1
SHA1 2e9d591a63a0c9e0ed78f7aaf51bf57191e6d618
SHA512 d94ccd5120f25156a70caa79b443284f3f0781f6601dcd464df5487b29851df93251d1ecf52c9b3081a3cc6cc8d19bb842c268ccf38961d7c731fcc10afba79b
SSDEEP 12288:50GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:5UnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T12F5523797925F98BFB1706F14C8281829B7F0EC6BFD2938F7B481129967C39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 6cabb92874b3090c901499d71052def8e857053ca01c0eb3636d1bbae77a03c5
MD5 e0bb1e6c93f31391e3712c5f733c5a4c
SHA1 da2a0752766000553ac981049e13be164d2f5591
SHA512 01dc6c23c045cefd45fac60f2986afc3929b4a40a46d6aa6c2f0258e5c135aff20844fd63b44a0a3d739306f0074c1e726a9c2959b4ff094411be67b3d1a3b5d
SSDEEP 12288:YSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:YSnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T16C5523697925F98BFA1706F14C838182AB7B0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 0c88f5afd3565fe11aab628a229132ec6d92cab9be023779a7162d9ba75e3c90
MD5 e19e52a5f737e1c55c262a13d007e328
SHA1 ac9805f12df4654e90d8a7091b882f9e626de919
SHA512 100114bcf0e783979244f050a7637e43605f0ec7ded8459b2fabb0bde97d1dfb456f1fbca58de54362fabbaea476d8ca0b4d798e0c8828a2c86faf069ceb0e18
SSDEEP 24576:vfwv/k9RX6wkyAIwnQ/tbw/2Mkjy6Fr7g0oB:eMnYIwQ/lFTjN4
TLSH
T1D885DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c58b3185587ab93f9161e30279e9a167b8ca2504720cb3b24b96b261110129f1
MD5 fdfe7d10db1b3265a7aeba651a44172b
SHA1 a049cde439a6d133be090c5d076587b646af69a7
SHA512 ff6e5dfecaef9da10caf8f4a15fbd833be67229c8c06a8a68341bc1cbbe3d8463aa26bb02d51e4baef404db1fe58028f1eaca647e8c413d0856dbe1afbe0900d
SSDEEP 49152:mYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0nQ/lFTjN4:YySzPULm
TLSH
T116066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 dd1aa71875afabad56ad0e9a4498091fb2c775c3d47ed084508ed4b9b805668c
MD5 19748c9499e05370c48e644826714df8
SHA1 9f9ff71e8b9492f5344e569872c552c6c131974b
SHA512 1c0f5ba5923c179416621a214a9dc0cd9f57c16e44ab0fb753f87f7a21f4e5989816b162bfb87293433d7091f6dfeb6bb4e99ba067ad18b0f537fb5a4789cb10
SSDEEP 24576:547Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY5nQ/tbw/2Mkjy6Fr7g0oS:547JUQj1irIhCnDHUPfF/3Q/lFTjN4
TLSH
T1A765AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 dfa830eb6e72e9511c7d632228e92056f3d45f4a7b794ea8be61d0ec0aea3e93
MD5 9dba1ddd5fd008f5b62bb1f9a2dc675f
SHA1 94ec24551a221a2045b8fbe166495aaca29fe5f5
SHA512 d9abb563eda8d7a045b36a37bea3f0eebd921e80023c5286b58d76f755a2e0eb7711926334b803e1e07a86b912e4494d094b24bba8602b18fa73afd5701ad4cd
SSDEEP 12288:4ssfcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:WcnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1BF65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 da4d90f0fffd73c25b88aba01de70e677fe24c18dd979d06f23da38d1c0aecb4
MD5 73815602d0e1bd8e83821c0bace6c4c2
SHA1 ecb345c17d5a6ef40d3b90e10c5de9b8efb4b061
SHA512 0689f77d47c8c58ab47895b48879c820396606da87a358a7c99450b9eb0c25d472041929de9829d49defaf58a47bf7b6eb6fd7d424456ed31c047fc7300343dd
SSDEEP 12288:fZC1U3fD2ePkVDtmFH2JkrkRl1qxWrlToLE:fZqUPL/QRl1qOln
TLSH
T1113517007666DB4FC66940321E37D2CCAB707D51EE04AF0373C98B3FD576659BAA2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 438cec14010d1fd595c2b942622fddd5994de0f8f5b0a29c86fc0921aadff6ef
MD5 475fd5925321b11612c41ace71335912
SHA1 7271b1c8b495a54feef43653383f0fc220fcb849
SHA512 d2e796d8f9cf8e6137e24b4e5b7e3aaaa265f7918de178717871d2f8fb51fc150e7682c7da36319d1b3db6a771b01c425157d82b70ea94dbf033d5469ad2ca2f
SSDEEP 24576:EF6Ncj8Y3cjWcjfVakDgrcjicjkcjmcjHm9ka:EF6Ncj8Y3cjWcjfVakDgrcjicjkcjmcW
TLSH
T13A55E9406437E78FD1B61032072B5B8C6B74EC17B6096F26B3C9453AD86BB56A0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 43e1a944a5ab9cea1c6cda09d9ff17a7c217bb45b2768dd3f883b3ee572271f7
MD5 789cbface27ff21e779318f35fd7c82a
SHA1 994194be337288b5705b0cd1d16e12972d26e636
SHA512 fe723deb367345a5d4e544b9c02d71daa7eae802f1c24fffde1f604a6d9ce6bf35a3257eee5b86b06bfe849a470d64871b8fa028d7e068406c5e9e38262d05ed
SSDEEP 12288:c67kGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:XEnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1EB5523796668F94BFA3B06B048828111673F0EC5AF90D3CFBB082269957D3D41EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 225445f9037b818f4747e0ae9294e998e272993e2c0c7053b1c0f152266582e4
MD5 07d38ade3e0869540fbaafd2388b08ca
SHA1 9b05352fb3321208b9d08f7b28f12bb190d194c5
SHA512 1a3832e943bbb46b0a34a2a5d6d1afdc7414046265c860ad2db0d95b4d4560c6256833fc8d9d339b6ed24cf890c1bc661a52222f0c61428630f1bbea8622a067
SSDEEP 24576:pgb6bmBIi49WNNFpg1rSvFv7bYGnQ/tbw/2Mkjy6Fr7g0oc:pgb4mBIBhGF5Q/lFTjN4
TLSH
T14865AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 b4ac190006ad83f6162cced3b48a3d4c501812b7a64ec5a2b7bbe2136f4b1080
MD5 62ae6c0ecbdad345b614a731191a27ab
SHA1 5e8db06d97c20635332ae15727e85e14e528eb12
SHA512 daa025966f7bb40ba06625012e4ef24d4b06df105cd1c60945ff7deda72f56a489cf14d232ff967b52e824b299ea66bd8863478c499b75b13c977b5589db80d7
SSDEEP 24576:2G88u8FpJqH1Qzria7/mpnQ/tbw/2Mkjy6Fr7g0ox:d7ZFPqVva7/OQ/lFTjN4
TLSH
T11C85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 1d9b969e2b80827b113eabc3138b094201d1caa59e54d9ab27183d7c9fde55b4
MD5 c5967e542f2cd78777d777d31a9cb428
SHA1 3b5cf772d5feff609391dec0b23874303717174e
SHA512 e1dc9823db3f9b710309f5aaa18f1336563ecea46a700fa795ec902eadae8830b40f20637c813f19af5110fd583b8fe9042ec07c40b6d2a09d60daa711c7f847
SSDEEP 49152:QBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjVQ/lFTjN4:LG05lO43bbLm
TLSH
T1BED5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 143b7b93d4898ab1e755563ad6de6913e433b84216f291d90091cc14623d2762
MD5 8bdc9c80f4862ee815e5998b8f0fbfd8
SHA1 70d764cf8edc49b7ec16b3b651d17ea039a22f67
SHA512 de25ae7c61e2f9fc534d33245655b6abca8c70bed423d056c75adfb090a236a73ed09f139914d5e357d1ad1b6d7bacd4c3d36f0ce0d168e3c8e9f60807fd23a1
SSDEEP 24576:1fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnnnQ/tbw/2Mkjy6Fr7g0o+:Va5POZ3+Jt2pasx2+mNQ/lFTjN4
TLSH
T1F265AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c6da8d3c65444ddd583fbc5f44a35f3d2a619aae3f43b4255c3a51e1d3d0dd36
MD5 ff804393e4c426a1977f19ac129793e9
SHA1 6ff6530acf79eea5ca979fce9c8cc85cdebbfc76
SHA512 4e8e0c5257f0708c7eb1ab0af6a8cb51777c6a1a189f7e9458d69e40acb7b404a4db2d0ffb68a0ccab6b030152068501fba1e317390b9173b5c30e295fe372bf
SSDEEP 24576:FNcwHdjbyQ4nLC18lb/EOjowL7FkBnQ/tbw/2Mkjy6Fr7g0oA:FNc/zEOVHFuQ/lFTjN4
TLSH
T1C4858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2b86a5e2274ca39db1c83750836947938c7fbf1ad93c731a70b91a4edf8a5503
MD5 1fcdfbf0a6a6265739895d0335213b54
SHA1 8036fabf907b78ea8c39faa6502739a4747b68a6
SHA512 16af507633b1731153f15ca39bfab88fabcf083a7e5ea264c85e79a511e1c85ac6b1253672388471a208f31a458d9ab6285fdaba9cfc66eadc14d068bd28d904
SSDEEP 24576:68kNvNnaFeYhJNtmZBmonQ/tbw/2Mkjy6Fr7g0o8:68MwBtOmoQ/lFTjN4
TLSH
T14455AF2EBAB846E4D1BEC6B4CD238512E6727451173293CF5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 68cbbda1adf91a199faf2afe50e23b18d315997f6e7ba04907f7622eb3ecc47b
MD5 83f4e3c8e56eaf22d6164da95fe386fd
SHA1 d0b8f5bec1b146a2c1c2658a80c5c290d0776617
SHA512 cb8063989a075324434b25d286f29b40b4c2776648e4826e6243c71bc9f1db19adc031a06d9bbe26a2950a69b4c0b107053d3047746b88ac84b6e9a6734588c2
SSDEEP 12288:UHvUrBFrEjwaQFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:UPUr+NQlnQ/tbw/2Mkjy6Fr7g0or
TLSH
T13E65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 a714cf6ba4b45dfaf0abbee1ffb269e4a0b3d599ffee97ad236e5db6caf746f4
MD5 c215ca74b6ad1472ec55ea2551a72c5e
SHA1 6481dabbcdb1710389aeb08b9b16a315ba39b830
SHA512 24873a0037ee895d04e9282c2f6595a668540374065ac5f0df6ed43c3ee1aa4994cff247fef3751b56ebc63eecfa6507b3ad07714ba41191a69def9169713acf
SSDEEP 24576:MD3FHshBIYQgAInQ/tbw/2Mkjy6Fr7g0oS:MDVHeBIAAIQ/lFTjN4
TLSH
T11075E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/204-89-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/204-315-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/204-83-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/204-84-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/1936-53-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/1936-45-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1936-46-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/1936-171-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1936-52-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/1936-57-0x0000000001AE0000-0x0000000001B40000-memory.dmp

Download

memory/1944-294-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1944-71-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1944-79-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2396-148-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2396-322-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2396-155-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2396-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2532-40-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2532-131-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2532-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2532-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2532-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2800-67-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/2800-255-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2800-60-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2800-61-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4464-93-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4464-100-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4464-94-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4464-336-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/4464-316-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4464-337-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4820-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4820-26-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4820-20-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4820-105-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4820-28-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5356-333-0x00000240C6340000-0x00000240C6588000-memory.dmp

Download

memory/5484-144-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5484-141-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5484-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5484-139-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5484-133-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5548-118-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5548-126-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5548-120-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5548-318-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5892-106-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5892-113-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5892-321-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5892-319-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5892-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5892-107-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/6116-18-0x0000000140000000-0x000000014003E000-memory.dmp

Download

memory/6116-17-0x0000000000400000-0x0000000000861000-memory.dmp

Download

memory/6116-9-0x0000000000170000-0x00000000001D0000-memory.dmp

Download

memory/6116-14-0x0000000000170000-0x00000000001D0000-memory.dmp

Download

memory/6116-0-0x0000000000170000-0x00000000001D0000-memory.dmp

Download

memory/6116-11-0x0000000140000000-0x000000014003E000-memory.dmp

Download

memory/6116-8-0x0000000000400000-0x0000000000861000-memory.dmp

Download