fcf234682669f7d8b639cf0b50cae6e23e4d29eda2230947ec8b0d6680f6b7a1

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_d2e4e48efcfa8c3d2a4e5dd5ea232aed_glassworm_icedid_njrat_vidar.exe
Size 3.6MB
Sample261027-grp6dsaz2v
SHA256 fcf234682669f7d8b639cf0b50cae6e23e4d29eda2230947ec8b0d6680f6b7a1
MD5 d2e4e48efcfa8c3d2a4e5dd5ea232aed
SHA1 351c1b1255ba2dfe7b7af206a9a61a9f6a7ad03e
SHA512 5eb2402eb1a1f139ea459856a97fa36a1a8a17dc17feb81c5867e71b94e6e09de4e23308c0d1b09aeae8016dfcc315742a0024a360c1d6d9133b1405cafea63f
SSDEEP 98304:9cP234N9n1Jsv6tWKFdu9CrD527BWGjmUYUWd:9cPJN9n1Jsv6tWKFdu9CrVQBWGyM
TLSH
T15906AE2B76A80264E0B682B9CD27655FDF73BC432130952B52DC35624FB322117AFB76
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
4344	elevation_service.exe
4532	elevation_service.exe
3156	OSE.EXE
1128	PerceptionSimulationService.exe
4924	perfhost.exe
5260	ReFsDedupSvc.exe
1668	SensorDataService.exe
4216	ssh-agent.exe
3304	AgentService.exe
5840	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-26_d2e4e48efcfa8c3d2a4e5dd5ea232aed_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-26_d2e4e48efcfa8c3d2a4e5dd5ea232aed_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-26_d2e4e48efcfa8c3d2a4e5dd5ea232aed_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ac72e6323a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-26_d2e4e48efcfa8c3d2a4e5dd5ea232aed_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3004-0-0x0000000140000000-0x0000000140948000-memory.dmp	upx
behavioral2/files/0x000100000000934f-63.dat	upx
behavioral2/files/0x00010000000093de-64.dat	upx
behavioral2/files/0x0001000000009952-65.dat	upx
behavioral2/memory/3004-66-0x0000000140000000-0x0000000140948000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-26_d2e4e48efcfa8c3d2a4e5dd5ea232aed_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000af7554d0d865dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d26310d0d865dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cc078e11d965dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f5078ad1d865dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000609b71d1d865dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bdbc6611d965dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000306642d0d865dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000641f88d2d865dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027109fd0d865dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4344	elevation_service.exe
4344	elevation_service.exe
4344	elevation_service.exe
4344	elevation_service.exe
4344	elevation_service.exe
4344	elevation_service.exe
4344	elevation_service.exe
4532	elevation_service.exe
4532	elevation_service.exe
4532	elevation_service.exe
4532	elevation_service.exe
4532	elevation_service.exe
4532	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3004	2026-10-26_d2e4e48efcfa8c3d2a4e5dd5ea232aed_glassworm_icedid_njrat_vidar.exe
Token: SeTakeOwnershipPrivilege	4344	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	3304	AgentService.exe
Token: SeBackupPrivilege	5260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5260	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5260	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5260	ReFsDedupSvc.exe
Token: 33	5840	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5840	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5840	SearchIndexer.exe
Token: SeDebugPrivilege	4344	elevation_service.exe
Token: SeDebugPrivilege	4532	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5840 wrote to memory of 3740	5840	SearchIndexer.exe	100
PID 5840 wrote to memory of 2848	5840	SearchIndexer.exe	101
PID 5840 wrote to memory of 4084	5840	SearchIndexer.exe	102
PID 5840 wrote to memory of 4696	5840	SearchIndexer.exe	103
PID 5840 wrote to memory of 2996	5840	SearchIndexer.exe	105
PID 5840 wrote to memory of 3220	5840	SearchIndexer.exe	106
PID 5840 wrote to memory of 3016	5840	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-26_d2e4e48efcfa8c3d2a4e5dd5ea232aed_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_d2e4e48efcfa8c3d2a4e5dd5ea232aed_glassworm_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3004

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4344

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4532

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3156

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1128

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4924

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5260

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1668

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4216

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3304

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5840
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3740
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2848
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3068 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4084
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3020 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4696
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2996
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3068 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3220
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3020 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3be6d3d39be2d182a198bcdcbaea199938a14ff46bdd5c2f42bfdb31fdb63dbe
MD5 0f687004cb9d194feda7c117d97d3547
SHA1 9fd0a2d20b8089afdae51e67d8812c7aacee59bb
SHA512 f391a3350557fddeb3ee913d7065245a88432c311de78638c7b5e4644c811ee245196f3aeabab1b208cd592c687c6785169af4e106d0fc363b7878f48a924133
SSDEEP 49152:kb+632BuPkFKRrdE6ohvstBhuXjfS4LWxndDmg27RnWGj:e3q6sjBmD527BWG
TLSH
T16CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 884cffb90ead2ccb2a2c40f8fc85859337486656f7943d9e9e7f728f22bd7537
MD5 1b6f0afd97a08aaad5f64a03ae141c56
SHA1 13db632d19d0ee54765ca5db8550a5f4237531c1
SHA512 d755564baafa3f5bb84bc112f07c6532341be6c8e712c37be63681401576dcb27575bbd089ff3e153193cf6a506b17558ad59a4598dec21be4e0f3b2c959d8b2
SSDEEP 24576:9XYfDtczAosqjnhMgeiCl7G0nehbGZpbD:otchDmg27RnWGj
TLSH
T17505F129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 6f972fc65d4cb70aece88bad1b6d3fc6f06ae0b95b2a9c6e9a381b49a5fa7f07
MD5 f322dbed3d5fb44f371e6b2c7b6c404a
SHA1 7bb7fb08627131a3250deb71ea427a53019ad40a
SHA512 5b13f6c5464f4f4fcc4415d853b643e4d5be7a59864ccaa5d2b1b4254705b06675692e0f464672ea1aeead778a4c894a0c1f9c29d2b42577aa3ffeb38fa762cb
SSDEEP 24576:u0Le5ji0hmxxrMxsqjnhMgeiCl7G0nehbGZpbD:uPji0AjADmg27RnWGj
TLSH
T181359E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 db8327815877795a3fafca949d6fea4a02de184e95f2259b1292d07de8436d01
MD5 415be4484d1ab99efa5ab20dfac17d9f
SHA1 744e6b16614e397479cf8773555d94f1079402ad
SHA512 fa88cb15e23b76b775d55a8721dee044088bb41cd8434f4dc30630a4a9cab12b0b5aa6a3d1820f76819ef5eebd4424b74c6e15c0a38e7572c1732c04f211b92d
SSDEEP 24576:+a7/ezSC6vUyD/aqgrvWn6q8wyu7sqjnhMgeiCl7G0nehbGZpbD:5/ezSC6vUzPveHjykDmg27RnWGj
TLSH
T12B755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d675b39426ee061b5dd89ff79fc82759a3175830f4fc4c4cc9b1a51025f55bdb
MD5 1a0c5d6c9f3e2da6c101c8c2c19c6edd
SHA1 ae3951dc114c205f0272010d4c208efa97df2425
SHA512 6475410c6a3fd96172caa0aa88abf8167a0b51f9e574e3108d8ac065fe4c22d7b577a3cb43443546a5bbc6f2f3cf03bc41370fead3960ce7bafe20c7c8d7e8ea
SSDEEP 24576:lVbqPb88hv/l+YKsqjnhMgeiCl7G0nehbGZpbD:lVO88hXl+nDmg27RnWGj
TLSH
T165559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 41bc2c542bc5868c42a7baa213cf8c76202d5e547aed27310a5a6115a0ec4c72
MD5 8fdf57a3db43ff7c0b2013113cf9b413
SHA1 5cdde96db691a6fbc7992c29bdd5f5a6ae6446dc
SHA512 26a0cbe20e2988fad2aad9a4b49a4733da2f0778bac1bb0388ef514e5fc77d1b1988aa557ed7f403f8a9151f7f88bf8e2ab153f969a34d2d80ae9803d609457e
SSDEEP 12288:4LtXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4LtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1ABC423BE834C11CAEA7604B5C3E9F55EAC137D5698200C42AA637DFDE6B5468CB39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 48863d8fa85861db03b53b250e99c525a6b86272f3a3c94ad303f657a2f6615a
MD5 458242710b1972c5d19c9612d1389e5a
SHA1 c62b1476cef64b2c48e4124c70acace1a177f0bb
SHA512 ca395b6fdb5ce9fa94fbca82c4389eae089642852c8e11f3ac3f2a50dda0582d86462a6de31753d70821b10f4cdd47f3b6b5cf722e9fc37110bc8a4432d9b565
SSDEEP 12288:OeBNUbTVO86UiXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:OJIUisqjnhMgeiCl7G0nehbGZpbD
TLSH
T16805CF7BEE28FCD2C27A4DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f34a43acc7040738506f9da9b1c200328f5614240a7f7128c543995b89f7304b
MD5 4611c5f9567e98c9610d59a4471a19a6
SHA1 c783d6a262a55e73110e1f84abacc9302fee2e2e
SHA512 ed65dfdd4100f3be0cadc26ae7c6db3e63f4906bc18ba2ad492bf789d6648812913298e9d240235ca83df2c0696a98573114aa954a94e4df8471fd50756fa21a
SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THF:tQvGAdlCEL8c/DRNw5C/D527BWG
TLSH
T193266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 70756a10223f3f420c1d1bd7043a290e058f4d73bc309e62b210a466dd7cadbb
MD5 5bc508e4dc30433704372f87351bb410
SHA1 3c1149edbee737f1e97d240ed654ca77e3932403
SHA512 0d86f0afe55cd9f7c0badebc7eefb6eeef88da845faafd0d40a6f40eb53ac2a809c2da44d7335e1ad852f703c095f4e4614c4808ca411407df6a232c455faa6d
SSDEEP 12288:QAwSfxL/2Dc3RDLLmt0LDQewsAj0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:l0ewsAj0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T12515E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 81173ac5d8f4a7e7e5cd859369a55a09fb247f7ac2098a2fdc3b56a334882863
MD5 7d5408eb468af97fdfb753fbedf19824
SHA1 5bf683722dd801894d99259bb1a3c4915d008949
SHA512 6cd8fcd02698712cb62f2b128ec75d133bcc0e272a164d10a59d2aa7769c66d42a728b0f8b3a922a964ebacdbc1fb9841b9248004d82c1ae657d751ff36b186d
SSDEEP 196608:TUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHIVQBWG:TUEtQevvqc2W1cpV2tI32PB
TLSH
T13E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 947c296e82781bca8bf3c42e082217f54c811cead3e3dc8a78591b1bb18f0774
MD5 46e71a98e5a59eac1d891e4cfbf40242
SHA1 0249353817a0c0baf6d089ee820951c73afc600e
SHA512 54abe10afab5f24fa6f8da28965fa67cc64e37cf62846f2f680d0d94795addd8c5f6dacfe246da6f76015fb0d968be458acc95e405c7b597fe90c6e6211543d1
SSDEEP 49152:dCbRquA/m2yL5zQfFiV+XenmE3/zwDmg27RnWGj:aoqtVjnmTD527BWG
TLSH
T1E5D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fcf64bf249451cc8a420207b9195cbf760b8a5f27b4868d626f25695fd1fb2be
MD5 d3a7f4051767933e4e2ddda84e5824a4
SHA1 8368aebc1b8b10da85a55f83c31abcc6b508fae5
SHA512 4a7800e68809f7d84c0b7b8415efc09c37718564896c2411e0b0e305a7e5c96dafc5f8b602cd3e9828c4a7abdde502c2f878871ccc661eb47191ce427ee24d73
SSDEEP 24576:BAhGL3IFoiwtA5l7S53PsqjnhMgeiCl7G0nehbGZpbD:BAMUFoiq5jDmg27RnWGj
TLSH
T1F3359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 5ae7f3e1d0f4fe62411a306d8d7f368ab6639100af247d3d7dee066f927269ad
MD5 3c7b64b08e5b5c0ab328b3498e5da26f
SHA1 0d4c4a0a5b310b395e8f60f39107bf6b975bd033
SHA512 5c058ede31847c84f3242e8f5460867bb8b75eec47b1234f37802dd3996bfafe7c9922fb1cb44640990de3cbfe1ce07cbbecdbd9a4fe5c7a149c3b5152bdba40
SSDEEP 12288:2mw5HEjsChNVBFgl0WDm+CbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:vwu4OWYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15105F14A72A81CF9E9674139C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 ee43dde845d6af1c7975b5acaa5c93e146dd8dbf510bf1adf342cfa2990a39a8
MD5 c4d14d5b57127eb927b72a9843f7f370
SHA1 4c83eb282374e5753c093f0f47e038a403702905
SHA512 7544212eaa2ce4b90611e7ecfe10ae818b0deea4f91fedace6bcaafd54531e070edee2d192e5f11259c0abca8646f98e8989de84f1d6e55b403a4c8270d969ba
SSDEEP 12288:oeZ1IyEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5ZuJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FDE412AE239820FAE5634178C6E5D609E7333C63673003CF166656AA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8dfa77cd2aa34b955fc6b7820efc2d6cf827f89a5d7e25e3da1fb47c84d98e71
MD5 9dbe324dae8beaaa2a39d62cb9bb2dc2
SHA1 6becf3729d0c0659f7804c0d27b7cc8d18705caf
SHA512 3e826bbebc89e4314f71fed68293b28877e2bf7cb618786b1e8766b37bdef15f802247db787e295eeca9026ea989de77338a193ed522a57f97545c4d491c8407
SSDEEP 98304:CQRQyi36YOcPbLvw2gAf+PN3KD527BWG:ZQyiKa/X+PN6VQBWG
TLSH
T1FB667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2ed2adc69eae4c18aff49f48f50827acad829b4d093a30fff0f728721652577c
MD5 9c7bf3237ffc2062ff68c6e88e96a55a
SHA1 c3227298522c27fab687ae44ebe8be2341127283
SHA512 e679a95da65b8e1ea03f1cd0a1657ef2d1792422afd1b55d0b513395690d865f53d85c3b87ae9018b2ec740a10cc7342f930d732f7b45de4810dd715f086f97e
SSDEEP 98304:nQRQyi36YOcPbLvw2gAf+PN3KD527BWG:2QyiKa/X+PN6VQBWG
TLSH
T1B7667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a013f4acab2dde3eae644792577eaa48d06f2035a73d2d8b2b1b0d85681726c3
MD5 ffb8bc86613d5e220a39d8a64aabb66c
SHA1 e85e401ab902313437a1703126d29b11f89ab700
SHA512 8b2cf0b0bbe0992c2de8e6848d5e08a206698ca8e3512c25fa184bf2eb420f4298fe496660384cfe22caa6cbf0971e3a9eba344961c796b5c6cc5f84f3450102
SSDEEP 24576:+wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL05sqjnhMgeiCl7Ge:I68Qg55nhceWu7PNU3/ADmg27RnWGj
TLSH
T175B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ffb3aa65379b93cab230807df798d78ade4b127395d69ffaada6e7bbdeffc636
MD5 6a6b13612a1c192f18c3b53e10a7ba85
SHA1 3cefe17b331b9adceed656bbb21f13410d37fdb3
SHA512 3979aaedb7737fa7481b2ce53ce866334613384a4368e3166873815467ec5ca9bf13e1d20fa2f665bff208e32b0ad15104ebb94a4bc74fd6f84768a3eed13ce4
SSDEEP 98304:Ny5112gYy5azzVvt69nLKnhZRD527BWG:wLIHEWhLVQBWG
TLSH
T191167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ae9ae1db617623fc9a5ae2c2f8dab40f73e268b7d60b489208fea566bf377c5f
MD5 2184398a9f0a878a936537a662d18682
SHA1 877a1ce3c4b83fd3966ce73f9b52b46f830d17f5
SHA512 980c3296ff3de54c1b02dbad06b3f3b9bf754bc0b3b1d6922547b6282b02caba5b46ccbd30a5c0bc2df3e960b845ad31aec9f6cfe112b2fada64d745c832ce87
SSDEEP 49152:ZB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gliDmg27RnWGj:Pu6Jmdxd2diD527BWG
TLSH
T13FD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 00b2379719ad0fb28b7c5d9c433c5391c91fcc0e3d9120843a8d26dd2eeafc8e
MD5 949127f8fdff7383bb510100c3178143
SHA1 10f233274bf5f396fa20ac0dd029ba890f64695e
SHA512 d6d12b9fd68d1f7e23ee163816151ddac5be1deb51ddea3e013a1a8cb34d7502275622cd850446f179e01cdd0643e0ec56de25855766480843446f1fcb7d113f
SSDEEP 49152:G1hpsNoJpF1A63U44CwH7R4xGDmg27RnWGj:GmifPWRTD527BWG
TLSH
T1F1B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 787ca10fcb6fc592417b394da7d9fb4c6b48065f006f63e954dc0129359bf16f
MD5 e865a03fd9d827efe3e61ea9338f32fe
SHA1 b62a9c7d7c1bdcc606693d5d9f8ef11a5eec22af
SHA512 55f845c0c25f6d55961b7202b4cdf3b850342fe48caefec03c10e4477cceddc93b84e367f6115945a530f2a3512c7550a619424cdda09ca1a9d5f2e7e737d203
SSDEEP 49152:cSuZQIY0Be2KcRVtOnks6NMHqNDmg27RnWGj:e5dKii61ND527BWG
TLSH
T1DEC5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9a20380f7a489952e57c721358ecafb83a364f9102097189cd809a1aa63ef81f
MD5 170c6477acd0103b74c04b837cc19e06
SHA1 bb2e85045a322b4452c6a6d1603440b7bd93dece
SHA512 6e14c3f95f5f49c9fc77004ace14cb00372f2ac6c0368c8eec3fb9e1eb30a4f47aa2308298c37c25ce9adb66ce222949025cd474ad5db18773902f1f01f21ef0
SSDEEP 49152:ihtSn8EApI0fig3giDn0AP5wCDmg27RnWGj:DX2imph3D527BWG
TLSH
T1B295BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 a054ccdcd552b27176dd1078e6dcbb494848062a58a7a854c5e1efa47d9fad4b
MD5 17073f69dd2f81a9ccf6668be2c7ddef
SHA1 f166b58191c93acd7d2ebfb503fbe11e61cf2762
SHA512 c491b265f17cbe20ebaff3883a6a649b5de9fa993123201baa5f75406cf97a1c07464835defd10046e0527f2d87d1ebd13769cd100f24ceb24296d80cbf0ef58
SSDEEP 12288:JlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T142C423BE924C11CBE92244B5C3E5F15DAC073E5BE9200483BA5B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 c96dda298f645bd09172944350fa60002746d0afd91159238d0d06e9ef29a82d
MD5 bed9c8b1ad13f6a225a56a61473f5f9b
SHA1 293eaf6093532cc03814689c43162148023d0cf6
SHA512 76404aa220750c0773d23acd2e093a20989ab85045f380a9fa7e358311226e364053e1873a1331f0df8b81e8e697ff33f357e51c99ec437ae154bfb5cd4fd797
SSDEEP 12288:7gXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7gsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A3C423BE924C01CBE92644B5C3E5F15DAC173E57E92004837A9B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 978ae90a714dd42849fef06dba90631fa19856fa4b00763fdda248d58b66ddb1
MD5 5bed7bdb4f9a6cf091fa1f3f29634069
SHA1 8fdeece81c0cbbee892151cd30805073019502e6
SHA512 5cbc872ee910b8ca96ea16a2e48d60e4fd83350fa0631286239096ae01d3238eec40e1894012d346e181a018da6f8b33e3ace504d93c9b692f8172ab722b19d0
SSDEEP 12288:v6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:v6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18DC423BE924C01CBE92644B5C3E5F15DAC173E57E9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 ecb8bd60ff45d24926aa3ae250261cde7102c045d74bfc6f77f9434db1537569
MD5 1ac57d8d1fe6a025e495f110d01b2047
SHA1 bbddccec55fbbefeb31a945336cda659dbd2a563
SHA512 a480988f4f1084c6888f896ff17cd0232a0deced3dcf298a4762a55fd72ffd65dedd575e501e234931af345215d85da4eba519edd83c5b7b023aa2a132244ee9
SSDEEP 12288:VVvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A0D4236E535C01C6D83285B5C3E5E11DE8237D57EB3005DB6B532CAE6FB26944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 4c9d81c9ad723e359a6a1e4c3be03e3aafdab15602adeeb3da490c0c4200e234
MD5 735807d9f48589cfcd2b1b575199d3dc
SHA1 3a34c5073bb926d46e23b4d069b582cc21636355
SHA512 9248f5b6f2c5cd696e3151a1444ea364f3bd422d4a48fe03549435b581a6f528538033c42f10e6475390371db4a73f3a9576b08f7f67aa852d2eef4271605c89
SSDEEP 12288:eXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T125C423BE914C11CBE92644B5C3E5F15DAC173E57E9200483BA9B78BDF7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 a304e7c0d9f94d43960b9096b93daa930a94bb37a33079d733317041fb4c0e40
MD5 7219565cf44b3d0ebe164ec3a8117181
SHA1 e5b556b51258018f2b8451527c09355d1ef5a4fe
SHA512 e62d5168795c49679abcdf9884dc2210d88f592c4ee02c28b1944195cc64bdb86e63628c8b558094d6ddaee991dbce36e3e0a5e1981c8c8a155aea81c1ccc884
SSDEEP 12288:qsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qssqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A9C423BE924C01CBE92644B5C3E5F15DAC173E5BE92004837A9778BEF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 08fb60305fca77291f754697323cafee5fa5525864bcaa6e941cf458654acc3e
MD5 79f8d2756792590eeeca5c665a2b76a8
SHA1 b4224a22970c905f9071651c9bf294cc97f3e7ee
SHA512 86a68ae9c38fc03ecbf7e07a9647ee9ed3253836c888494465929923582fb9d28c90c13de2a75b26669ccc7f646b7a5b055de033da783308186bd59a8ee1041d
SSDEEP 12288:ZIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1ABC423BE914C01CBE92644B5C3E5F15DAC173E5BE9200483BA5BB8BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 cd4bde13eee2123e1adaa25840eef6e9fb2849b7bdeb053d7dc46fd5f652fa87
MD5 8f81a29bb35527e26f1cd96c0789d78e
SHA1 50952a74115aa51e5712b38f5c12c3b12a80db71
SHA512 116ce68644ea84ddb809b6b1b24edd57a12692f49b0855fd594dc7925eb9625508bedbc697da89ccd469a70def016c27b9a1fee55ee2011defbabb41c2787815
SSDEEP 24576:DZMRzFVSOAsqjnhMgeiCl7G0nehbGZpbD:DZMRzfoDmg27RnWGj
TLSH
T1920501A9B35418F8EC63813EC965D90AD5B37C1A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 5173ffd9099fc18486e5e72f69aab5e0c311718e35329aae45e1c121e4aa87d8
MD5 88e0af67731064f8daed459f1dc59056
SHA1 3402888982a5b4504878b8e74912e2555777bc32
SHA512 1ccfd08616873f0a316fe0c0f488fcb20149d048f0e373423cf82f27ffad93426727f8f901a0ce489f1c63ac88b58fdfd5d06b2d49cf35c102d78fed839e7636
SSDEEP 12288:+ZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbET:+ZsqjnhMgeiCl7G0nehbGZpbD1
TLSH
T1D2C423BE914C11CAE92604B5C3E5F15DAC173E5BF9200483BA5B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 6eff2b7179bf968bf0b89feebe1bfb0df82099ea50cb7a0f131f61bd1e226a8c
MD5 a994c7874fe105630cdea2e0f70966de
SHA1 2468408dfcfae702d42db1b649becadcd43d8e9c
SHA512 f8928a8bd112576962e4a11af777d3c6dd49a1876f25695e29652e039ce7cfaac454ad3111fc7c68a97c567dd5ea3d8e9999f9eeef896ac1a315feac5e1baf0a
SSDEEP 12288:/9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbET:/9sqjnhMgeiCl7G0nehbGZpbD1
TLSH
T1F9C423BE924C01CAE92644B5C3E5F15DAC173E5BF9200483BA5B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 f68188fe7bdc4ce3af7c22330980b4bde07baed3790ce8bd465f7836b1aba45c
MD5 7270f6c01bcf8f39bb02424d0309e194
SHA1 6768e444ff2bc97f4d077b6151946c1ba7438549
SHA512 8750acb2a85974c9310c868968ba5c90f8908f42d25653d1749a8e0487e9648a5a4651481c4efeb0ddd50fe507ec766834fc91efe8161b0bd479c28dcc5e952b
SSDEEP 12288:5yPz5L8EXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4zyEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T183F4025B73A530F9D1378138C5A29A06F7327C3647204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 7a95f910438b5dfc47d0dc7d563120c578f9462a235246f8875c869e506354a4
MD5 6befd0a2a43ef36801631a9587bc7926
SHA1 154a565651cca81e2f4d5d49ffd1158fe215c8d3
SHA512 5c06fea0d87a8511c5107f928a28194b3c6e222354cf0d9eac9a6542708629918fba63bfbcc7c4498451bbb9673da5a0b50b2eb6bda3c350374d62dc44b3c6f2
SSDEEP 12288:VZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T139C423BE924C11CAE92604B5C3E5F15DAC073E5BF9200483BA5B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 f97547602bdc3a001b28c082ee6afcbaa4cc82565f0765e2f9062c2f9bd2bc60
MD5 d4a468f4ebf72b21f1df9c5b7058420c
SHA1 cb1649189e5a6e3c94c46ab014f2629aae2b1ff2
SHA512 7908a397f6539fe23e06af08163e6ee7d8b9145a9e8bed4d839a4bbb0b02f37e122fe4d786444fe46738bc71bfa9e6f951166f94278f12bc4a7c436f9bd6e9aa
SSDEEP 12288:sZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:sZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B0C423BE914C11CAE92604B5C3E5F15DAC173E5BF9200483BA5B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 e1a0dc77f6cdee32abba2c27a9a5d2639fe036b91a3cb8e16383273d8f0c3d07
MD5 1a0d2e69da78b210ca81d0f70d64c1bd
SHA1 fac9d3c36fc29e36b7c4e2fbd36c04a1e04c94d1
SHA512 c8eaafe949d3f9c60d1337b594d1c945fbf757fc807866373586b658c24727c5ac2ee89482d84106800e953ef8a14fe385256dda1f116a492e7bfef82d8a9d61
SSDEEP 12288:XyPz5L8EXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:azyEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T108F4025B73A530F9D1368138C5A29A06F7337C3647204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 26126c07f76eee610e1c2b80410fa2f47f38db70a8b501d08627715fa5380e58
MD5 94a727f3aabcee79601bb6d57e34136a
SHA1 f49aa3380c859a5b4c3a10b26f0580ca7d48a22f
SHA512 a536d6e856f208567b9e7f773d89996772507a14620c8c4565dad93055a442aa7ce9659e85c229a6f24da0d4d2cecfbda8e760bdb237ebadb34421552e7d6a9b
SSDEEP 24576:nTDaLl3z0zDqsqjnhMgeiCl7G0nehbGZpbD:nTuLljvDmg27RnWGj
TLSH
T12C0501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 de31951a8ffa9519c7802befa41e12b69b7619310aa8300ca0cc18bbbea6661a
MD5 17d2e8c552f1dafd34fffb06cb7edcaf
SHA1 0500e553d8a12cf78e9880ca88abed2ea914a72d
SHA512 558f949da3c97dacc6bb569acbaced526b6c1c1a91205fa5447f250e0f817aa591ae3464d8495459679c0d71a903525b7e376ca94a4eacf24971e607b9b4fc8c
SSDEEP 24576:b3vd9CHKy7GZmsqjnhMgeiCl7G0nehbGZpbD:7vd9CHKyaoDmg27RnWGj
TLSH
T12725CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 dd89230719bc580c3281c11c1020146d02d97bb4545354a8834bf98da977128c
MD5 6af8cde6032c93d1bb2ce72f85fee7ac
SHA1 3e60ca547bc56664211b3f1c1b0630a3633b675d
SHA512 a1fc61fef560e783c6d20ae179f1b7557cc46f1f998fff6e084a169b3d5aaee2b8e3b2d67ff567cd697c4be64ebb211aa8fad8e9d26a58d1e0ffbe34397fb493
SSDEEP 12288:caXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:casqjnhMgeiCl7G0nehbGZpbD
TLSH
T194C423BE924C11CBE92644B5C3E5F15DAC173E57E9200483BA9B78BDF7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 2bcc4e8f2d92099cbe82eb4b773eb8f77debdb2c6cfe122e3e676ae8cfa5802b
MD5 ce19a4a1c65c5c4010dbd62edc057e4f
SHA1 31e3450c629a79d451f6d537c805ba3dbc498748
SHA512 e0ec4f9ba15cb234de6f0444abec04f4ba2d01d7d07588377b3e95005316dda469adc2c6138c0098a01694218bf9a5d1f639ab5eafb5d2b3cb31e5b71062588b
SSDEEP 12288:5kXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5ksqjnhMgeiCl7G0nehbGZpbD
TLSH
T132C423BE925C01CBE92644F5C3E5E15DAC073E57E9200483BA9778BDF7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 b3a2b9db59c2d19c9329707c30439640c62d164e7b28b6aaacd131a5c9a76417
MD5 8875bfc3321fb3bf0f4a3115a3a38528
SHA1 d92c051c11d05d7cd9be5ae4af721b1fb1eddc83
SHA512 928b6cb8b233249990976609158d3daf492b1395fecccdcf06dfe09b3a78355ab87eaa7898f6c6fa9ccf88edb898df5ba547c2132f9f4f2d06d0e33ddcee8541
SSDEEP 12288:zDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A5C423BE914C01CAE92644B5C3E5F15DAC173E5BF9200483BA9778BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 4dea24f08cf28d1c4293ea4f51cf4aa1f6cb74edd2682fdfac88f5a533540cbe
MD5 33ccef6cd5cebfa863af2cce9e9283c4
SHA1 f8b66fde78abb242e106e90850c8002405f61705
SHA512 de33480f74062b968346c3fcd331bae3714231f345ebffc15ab43f0c003fd73be30f341ef96583dbbf166fb66981af34b242546af55adec1495c61d19f3607f6
SSDEEP 12288:5ZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5ZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T151C423BE924C11CAE92644B5C3E5F15DAC073E5BF9200483BA5B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 7964a4b394b4ecde7dcce4f4c8f5336e9a56eb9083b5b0051b48bf9295758690
MD5 15ddc43730cf67f56751f43a26e8ef34
SHA1 36030a076b84376e4e4c10d9f6a55098c386fe64
SHA512 aa7d57125586cfe85b5d8ce609d7b336e930539c8cb1ee2b692f66bf7ab69555d0448ba974175b63ef5bac096f05ed7ff238548b3a634f91093535b5d66c17e5
SSDEEP 12288:KaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C2C423BE914C11CBE92644B5C3E5F15DAC073E5BE9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 d444ed8d5233fe30b4fb0ed83da6454feec1f40f3cf82f45ee2ed0d65186a7b0
MD5 abae10cfdf60a609028feb5d341df180
SHA1 05080215575111a6d92f3caf3f5aec77f23aecc6
SHA512 87875dd448d270ab9ff58401439fdbcb4616c84b807f821be59afb1fe5117fef867d7c7faf62a41876a5d16159aaf3613f3c0c9dc206eafa5a7b6173b655ca89
SSDEEP 12288:mhXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T100C423BE964C01CAE92644F5C3E5E15DAC073E5BF9200483BA5778BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 a055d53831908694008208f2b53773838b5e4ee504338673e3ec2fe3145cac4b
MD5 16421ac714744bd84e17481ec88d58ae
SHA1 7aa6a592bdd6310bb271058fd6fd1fcc342feb28
SHA512 74c2764bfb3f351609710c5f482528f567167ed8adb9599c0b6ba980942bac170e9342f1bb89ed1f2b1df15a8f8a70af77e2d98ad51ac71f0b7ec7b166317170
SSDEEP 24576:2fwvUk9RX6wkyAINsqjnhMgeiCl7G0nehbGZpbD:+MnYIxDmg27RnWGj
TLSH
T18635D029EBDC04E5E177913C89B7860AF6B278591B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 6701c9581c3cb010d516a6f00f24357be9aea38433638c7bed2e7df991f9c697
MD5 bea01012355f0df3b2d737a4c9918298
SHA1 417249bc6b1033fe791a388c563de19d0d629c37
SHA512 f2c039e602ccbcf13ff71bb5f8d956b9775560c607cf1635ced7da83aa2ded0942fef771d922f06d8f8b0ea586a02da42e940836d05a570142b9a413e240aa51
SSDEEP 49152:IYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0iDmg27RnWGj:fySzPqD527BWG
TLSH
T114066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f32a78db0335dcedeca375598b6c02fdab434e61f786c4f38829207dcd1fe628
MD5 53cf921047123999f257d1229d54f1b4
SHA1 0328e86db8c8be35aed9826e886eb5cc30ab080e
SHA512 4683c44bd1d3e2c4da7a029ab6adf8f1eb479293f8f4f26433bb7f451cd3b7cd185b8778d17c417d69c39245e77f94e1c2ba3d2d04b7329d20a6592820ad82ad
SSDEEP 24576:U47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYQsqjnhMgeiCl7G0nehbGZpbD:U47JUQjTirIhCnDHUPfF/yDmg27RnWGj
TLSH
T13965AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 39ce0359e7b90ab16373f9356bff0207aef94dd447c7754fe8a4b8ba6c207e98
MD5 f4e5a63e967fd033f3240e8bdf719dcb
SHA1 dab35d1ee70fa2fb1c828c52879b5b76c50c1fcd
SHA512 19755e694ad7ab53bdac4825b018acaadfce50ab20c5f8202276d60154597ddc3fb8bc54f3dfe314bfc3e40e3f514fb08352d3077ca27fc9ffe84bae80bed5e2
SSDEEP 12288:TbsfJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14BE4011AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 3874d4f61cdfb13ed7f48c22ea28b4904fe29836654e6e6994c341129add754f
MD5 bd3054482d2a07abb09cea839ebbc7e2
SHA1 39e84bcc4d3d8e550f581659a541c6b6c509453b
SHA512 6b0090fa0392767cb402d7d67c31e51930d4dc8f7e8960adbd436b086eca68c52f6d89541d3f0224faa9914f30278aba63fb47af76e9e12f35e1e0276653a57e
SSDEEP 12288:wcV5ZBqg1AoBzucS2wmCpUgrNd+yLGFoJu56AQ2dQh5D:wkZhocS/dvLg756AtdQ
TLSH
T17E4518107666DB4FC66940321E33D5CCAB707D41EE05AF0773C98B3F9676658BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 adf6f6493bfaa3d238c5847f50362188fbaa7371bf0b4d9cc496e4ee73e367d3
MD5 893b919894e9d6a1538e933dc06adf5e
SHA1 6beac197b18b6b505662ed9e0fad7b829a884b6b
SHA512 1a41f9b1f5f42799a6ad611a08f0343d7d33ec3a4181f8f39fee7984460196a9b9f8b55655943a379201a795061be609e674de1a1790030cf7af0712d933a4e6
SSDEEP 6144:/I+InvGzym33OtRBIIGyueKDeoHyeKDeoH+96bjIBS0xwWhQDzXMRc0F7W:BzySMnl1uOS9wIyWfRfFK
TLSH
T1F1551841A536E7CFD1FB6031032A6F8CB764EC06B7095F267389053AD86AB45B0B97C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 2af98a18c6b11971b23d9b9f4a20cee032ce0e8b2a1fc0ee20117f3fa1fbd753
MD5 62354bfad4e48dd95b7b13fcc2068e5a
SHA1 b691bfdeff7526b3e554cfd1d27f10dc3c878d9f
SHA512 5d4089140056d48570df88949b403ac81dac3e79a12bafc90518731cf36d07ad4dcdcdc7f8126b0801e7f38d9d532fe6f4b1e87ab5eadb43e1f1b0cd6785eff0
SSDEEP 3:OlH/lQUOLGD3u/2FipJa3mCllltq3mCllltGlslslslslslsl6zVX:KCUyRpJ8mCtSmCtEEEEEEE
TLSH
T1328192895B416A24CA463031082483A41330E246ED5287DF010C20234D006A80D02A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 0f000d8a33ca2cc3782fce1f51dc13c38e2e402997a40c766de4382fb777e6de
MD5 291fa364123526652a0eb8a96cfac3fc
SHA1 6b7a4bad9969d32584d0c2e56d212b204b9907e8
SHA512 da2bea598e6ef725c20db76cbc2fadf727f2cb2babc82e0480b5a6e2e4119eaca59b57c4031e476fe4260756b61d225f0b562cb28702f8344d7562a26a07ef10
SSDEEP 12288:EM7RXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T170D4237A934C118AF93605B482E9E12D780B7E669F2044C3BA4779FDF6B18D48F38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8eeb42def46e6a27f882e294c4b427b14866bde4908e67ad704d2b0afb375def
MD5 e3a92f1fa026962628d594f36947f591
SHA1 82fdf7ac5db548c2e7629809fe4e65a9e244348d
SHA512 c11c1b0e4694a8e0fb883dbc23390fe7325ed33f455b6ddb4facc60bc6a0b8ca3a8c70474cb082b983d7870c4b3e09f23af9c90ee1f4b3786880c6c07fcf13aa
SSDEEP 24576:dgb6bmBIi49WNNFpg1rSvFv7bY7sqjnhMgeiCl7G0nehbGZpbD:dgb4mBIBhGFMDmg27RnWGj
TLSH
T12C659E1E22EC02E5E0FAD2B8CDAA4417D6B278161731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 832KB
SHA256 0ee1446e6b1213028d41c8fd896fccc08cd443bd25e5b157f08a473c3b89d51d
MD5 4bcf3a9ea187016bcfaec2a0e31b5b5d
SHA1 2811263c857e13dbd6ebd68ee22b653ba189eb8d
SHA512 781eff86e3b7c73fcd56bc60109e169ad79fea4cc7407ce4aa1178b999e0396e685264bd94c5756433632d105525926fe8e643d368e9b0e6c01bb89afd92eff7
SSDEEP 24576:xGOl8eOKaa+EUmUGhtgs4NmXEbZsLTQK1:xGcJZHUmUYyH0UbETQK1
TLSH
T19D0523BC315A3998D03AD7B27A609183B8A074B907281BFF95A1E2717F01CF5E17DE25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 7d646e70553900cad4aabea1d832bb31c7b1c512e96456d38d1494201c14d4e9
MD5 bdb889d0364947733be8755eb23f9921
SHA1 c10779697895928bdec66de4694c9dc4da57e884
SHA512 d21d638a8aa78e9099567ee28c9ad41458b7bd9f0476f1af8397b0bb324861bd8252f125f6b502583c33ca5dcd59637f56c8ed6c749e5a4fd187644a00121f28
SSDEEP 24576:bG88u8FpJqH1bzria7/mAsqjnhMgeiCl7G0nehbGZpbDC:67ZFPqVea7/nDmg27RnWGj
TLSH
T10C35016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 103ca071e4e5f5ea0293a0fd69ed17561a961c2c887d888470dcf479e6f666cd
MD5 227f87a3db0d3dacf26f7d8544cf40f3
SHA1 1e3099acdad1e43bb20094c25fe688e9e1c18b05
SHA512 90ca2be5c5c183b775c2ed3c3127853550d24bfc705c4fd4273ec64372bc30e05cfda94f6b878b9dd850e281386399ab2f312b21c4697b8e2acf684be95be416
SSDEEP 49152:HBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjYDmg27RnWGj:4G05lO43bpD527BWG
TLSH
T1DED5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9379d84e9f78d8f0230c6f20d17f20e55e8ef646bf22902528ac6bed75a6e710
MD5 1a3d9b780402b14e377f80d30a83753f
SHA1 3df2b188810b6f6c3739066e7b4406999a102d92
SHA512 eb7ca63f48b7f51ab862292e9446f9c6f93c001dfcd2f7d4c8ea159b78484139d8c8303417355fbc6d17938e492a42a1cd2f87231bca5eded88b2d06d0149ab3
SSDEEP 24576:Mfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnOsqjnhMgeiCl7G0nehbGZpbD:Ua5POZ3BJt2pasx2+mADmg27RnWGj
TLSH
T14865BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 20781bf6c9bd2c33d03898c6943ceedfe43a13a8df0d4cbb9a0b6b5c368638ec
MD5 45ea567bd9034f7d0060ff9d87d787c6
SHA1 3fe4aa370f6e34d7dad9fd0f2e5f1ee0fa392700
SHA512 36177eba86de5c986366dc9a37a12bece9350cbc7ca7fda55f491b7b18aa779bbe46ed6f9bf2f1cfdec1702fde05eebbfe7a22a26e42e9bee22c2d987495ed91
SSDEEP 24576:gNcwHdjbyQ4nLC18lb/EOjowL7Fk4sqjnhMgeiCl7G0nehbGZpbD:gNc/zEOVHFHDmg27RnWGj
TLSH
T1F9857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 6e70587a335b404e7803d336ef2eee1e08a6ac02410284debe0e12ad5538b98d
MD5 7597f044f9043707cc4fc966b94cece9
SHA1 e674a749cb5428293ef7ed1550c48a4615ad1e72
SHA512 202104332cd2ad61cd52b51968841304072a0bb59091f44c9ee92cda56c4a0b633c46832d1a95bcb096add89424f347bc1c2256e179d589b6ab0107f81e8560b
SSDEEP 24576:h6DIBl8eOKaa+EUmUGhtgs4NmXEbZsLTQK1:h6DIDJZHUmUYyH0UbETQK1
TLSH
T14D25126C336A10F9E07BD07A96820142D1B1B0B583221AEF57A0C6B96FA3DDDF53DE51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 037c6e1a247b4b55fd5e1b12aa62dd96109b1b07c505267743bff19f3fb55512
MD5 4c674caeaf4dbf87f8d994425e0d3bab
SHA1 1305ebd7435e08121c6ee548fab730d9dd9e9a13
SHA512 2cb248c645d791d40b1659745deaaa6d7665113ed5215fa1d8df49efadd1c959c51d781868259e0eb1d24dea5995eebd86a1657611adc742ce82231083ef9451
SSDEEP 24576:aTkNvNnaFeYhJNtmZBmFl8eOKaa+EUmUGhtgs4NmXEbZsLTQK1:aTMwBtOm/JZHUmUYyH0UbETQK1
TLSH
T18B75B06EB6B806E4D1FEC6B59E238112E6727461073253CB9390C13F1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 35f95548710f6338d8b40bd5c2daa35a7c6da9aaeb7660f480475c08736abdf6
MD5 5aee1f2870274a926b1d1947484f528f
SHA1 b99600c0d8a343149b3de4600ec50cfb07444826
SHA512 214df5c986e5f914a1b9564ec646832328540e80f95d32b7482ae97a282588a1aea64b28afc00cef196e6c930dd44d228d53a1c447194a84972144fa0aa50059
SSDEEP 12288:kHvUrBFrEjwaQ8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:kPUr+NQ8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T10905F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 79b2586e723bc796380d880665ce6273d1635dfc72d8697031be4ca3fa910908
MD5 804be8580e3679d7cd2a0947603bb995
SHA1 ebbb2bc18255a4dc5416a173a48cdeaadc2ea9a9
SHA512 0fe6eb40839b03dc55b0ca8e44da73367d9543822af0c01a089efe4a2a2359746232e2de3673975ed32d48a78a70c4df6765bef6744becb51aae382de5979405
SSDEEP 24576:+D3FHshBIYQgAFsqjnhMgeiCl7G0nehbGZpbD:+DVHeBIAA5Dmg27RnWGj
TLSH
T1A325E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1128-310-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1128-81-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1128-83-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1128-89-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1668-327-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1668-330-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1668-331-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1668-116-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1668-123-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/1668-117-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3004-58-0x0000000002BF0000-0x0000000002C50000-memory.dmp

Download

memory/3004-1-0x00000000021F0000-0x0000000002273000-memory.dmp

Download

memory/3004-59-0x00000000021F0000-0x0000000002273000-memory.dmp

Download

memory/3004-66-0x0000000140000000-0x0000000140948000-memory.dmp

Download

memory/3004-7-0x00000000021F0000-0x0000000002273000-memory.dmp

Download

memory/3004-22-0x0000000002BF0000-0x0000000002C50000-memory.dmp

Download

memory/3004-0-0x0000000140000000-0x0000000140948000-memory.dmp

Download

memory/3004-14-0x0000000002BF0000-0x0000000002C50000-memory.dmp

Download

memory/3004-8-0x00000000021F0000-0x0000000002273000-memory.dmp

Download

memory/3156-77-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3156-224-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3156-69-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3156-70-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3156-76-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3304-151-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3304-152-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3304-148-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3304-142-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3304-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4216-130-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4216-328-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4216-136-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4216-129-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4344-29-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4344-36-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4344-37-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4344-30-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4344-115-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4532-48-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4532-55-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4532-140-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4532-49-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4532-57-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4924-94-0x00000000008E0000-0x0000000000947000-memory.dmp

Download

memory/4924-93-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4924-325-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4924-99-0x00000000008E0000-0x0000000000947000-memory.dmp

Download

memory/5260-326-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5260-110-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5260-104-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5260-103-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5260-344-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5260-346-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5840-332-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5840-158-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5840-157-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5840-164-0x0000000000620000-0x0000000000680000-memory.dmp

Download