37454236cb8f78c1083b9129b3022f6ea5a142564341253d056d36dfda378095

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_c41dbe4f8c297638af63c523e9d1702c_cobalt-strike_glassworm_mespinoza_vidar.exe
Size 8.9MB
Sample261102-3b3mfazy5j
SHA256 37454236cb8f78c1083b9129b3022f6ea5a142564341253d056d36dfda378095
MD5 c41dbe4f8c297638af63c523e9d1702c
SHA1 c51f55587bf5d0d6137c9f5c46b8c31ab5d7a394
SHA512 09e0e57b2e9b1d1acb08217d0d3f5fc0a99d21e8bea7aa11e3d2756078b6fca5d6e2392fa24a5fff05ffbc9a3181819d3ec9cd707e0b65d43487ba1a7f3792a6
SSDEEP 98304:7c4wCHNRasQ65ATWTNHR7eKTsUWS0OGTA7wRGpj3:gjCjaRKZH1dsUVGoF9
TLSH
T142964A625E46685CC91BC530939AAA761C3034CB9F35FAEFCA4991382F74AF42F3D614
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
712	elevation_service.exe
2308	elevation_service.exe
616	maintenanceservice.exe
3208	OSE.EXE
4280	PerceptionSimulationService.exe
1836	perfhost.exe
1028	ReFsDedupSvc.exe
4888	SensorDataService.exe
5984	ssh-agent.exe
2232	AgentService.exe
2868	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-11-02_c41dbe4f8c297638af63c523e9d1702c_cobalt-strike_glassworm_mespinoza_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-02_c41dbe4f8c297638af63c523e9d1702c_cobalt-strike_glassworm_mespinoza_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-02_c41dbe4f8c297638af63c523e9d1702c_cobalt-strike_glassworm_mespinoza_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a6f9a9b6612dd39a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-02_c41dbe4f8c297638af63c523e9d1702c_cobalt-strike_glassworm_mespinoza_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-02_c41dbe4f8c297638af63c523e9d1702c_cobalt-strike_glassworm_mespinoza_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 3 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-02_c41dbe4f8c297638af63c523e9d1702c_cobalt-strike_glassworm_mespinoza_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-11-02_c41dbe4f8c297638af63c523e9d1702c_cobalt-strike_glassworm_mespinoza_vidar.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-11-02_c41dbe4f8c297638af63c523e9d1702c_cobalt-strike_glassworm_mespinoza_vidar.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f8f9bce8206bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c5345ae8206bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081b78de8206bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000771c61e8206bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d2fabe8206bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004856962a216bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002180cc2a216bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
712	elevation_service.exe
712	elevation_service.exe
712	elevation_service.exe
712	elevation_service.exe
712	elevation_service.exe
712	elevation_service.exe
712	elevation_service.exe
2308	elevation_service.exe
2308	elevation_service.exe
2308	elevation_service.exe
2308	elevation_service.exe
2308	elevation_service.exe
2308	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2492	2026-11-02_c41dbe4f8c297638af63c523e9d1702c_cobalt-strike_glassworm_mespinoza_vidar.exe
Token: SeTakeOwnershipPrivilege	712	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	2232	AgentService.exe
Token: SeBackupPrivilege	1028	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1028	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1028	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1028	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1028	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1028	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1028	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1028	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1028	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1028	ReFsDedupSvc.exe
Token: 33	2868	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2868	SearchIndexer.exe
Token: SeDebugPrivilege	712	elevation_service.exe
Token: SeDebugPrivilege	2308	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 5432	2868	SearchIndexer.exe	101
PID 2868 wrote to memory of 1820	2868	SearchIndexer.exe	102
PID 2868 wrote to memory of 5852	2868	SearchIndexer.exe	103
PID 2868 wrote to memory of 5024	2868	SearchIndexer.exe	104
PID 2868 wrote to memory of 2512	2868	SearchIndexer.exe	106
PID 2868 wrote to memory of 4296	2868	SearchIndexer.exe	107
PID 2868 wrote to memory of 248	2868	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-11-02_c41dbe4f8c297638af63c523e9d1702c_cobalt-strike_glassworm_mespinoza_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_c41dbe4f8c297638af63c523e9d1702c_cobalt-strike_glassworm_mespinoza_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2492

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2308

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:616

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3208

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4280

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1836

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1028

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4888

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5984

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2232

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5432
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1820
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2740 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5852
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2876 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5024
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2512
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2876 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4296
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2740 2860 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1eabd1b5a5e169c070bbac22f58761eef80eefbe17da03717e22e0274900d661
MD5 4fe8913c4d2ec62c81e1cc653990b560
SHA1 247058adcc90057c687cdbc4541ad742d7ce314e
SHA512 e47063905f590c8dad99eaa52d41a3c2772a347a54058e6300cb5fb3c5806eb629a4438cb361f5b987dd7ed84678bcea9424e389041012b48c49a0a8d9323bab
SSDEEP 49152:Db+632BuPkFKRrdE6ohdstBhuXjfS4LWxnNLNiXicJFFRGNzj3:h3q6mjB27wRGpj3
TLSH
T19DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 4b62e9aeaff825b58a4d585c7699adbedde86b70b3861d038a90c0b7086e6e96
MD5 b3d13d77712b5ad0b0e83e2d19183ce0
SHA1 075e411819031cd848d7ea42155363e1a8c4b7ea
SHA512 d9dcddafb2a82688288c467935a9dbe330ae83a4802f39bc433280722bb978f7d69501b2c0344f66ecdc37418e225ed8d0d2f6ba32149765b3bd126d2892edf6
SSDEEP 24576:FXYfDtczAM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Qtc1LNiXicJFFRGNzj3
TLSH
T12175012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 b473ccaee6c0df3f911d1a3afe7b2e8549c2ff5e368ab93f3f387a614936934f
MD5 3ac5023a5856e5b5572e39d928c78e3c
SHA1 ae82c823ad7ba935f385748f6a470a0211417d2a
SHA512 7659a90b46b727fbe1258b32fa39ae530c2270c882e46d9eea7d761da7002c0254bda8f93a5c85ead2021cfe30356434c3f1f03ede6090a38c319e02c67e3baa
SSDEEP 24576:L0Le5ji0hmxhrMP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LPji0AzGLNiXicJFFRGNzj3
TLSH
T1E885AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 274dd7038229c49dfd37fd4cfcbcf779f509f272899ab9be577bfbe00bc92bb3
MD5 9eafebd507212ab10e406a97b5c172ee
SHA1 015fbc68d095ea492e97bb7991fce840e40894a0
SHA512 8b495d47750fef9cbdc358d4949d7a1067e12270369f22fa07ea45a4af43dde7d46ef991d5e95b72f4761cfd501798d524a45a65eaf107c47f393cf19996717b
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWj6q8wyuF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:W/ezSC6vUzPv+HjyiLNiXicJFFRGNzj3
TLSH
T1EE756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3c71df3a43436f1f2618910925e87e18999e58bcfdc63c5502318aea04f6b8fc
MD5 4da162fcf3057deef49d1c83c8322774
SHA1 e885b7e4d056322f64528ea11d5d96febcc4e7c2
SHA512 d02dc1c2d573b8c880b374b8712b3106e133fe73b674013f343069cfa691fad22eca25c9b2b251bbe25d38d5c990581b21f23be866010ee3c357fca8c06ef9b3
SSDEEP 24576:LVbqPb88hv/l+BA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LVO88hXl+mLNiXicJFFRGNzj3
TLSH
T121559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f009e2bb86ff2683c863ef071fbdd975f073372cf441beecbb52da8e1472a4c8
MD5 dd90544d038067ca3b72888cf039e6ae
SHA1 2ed46828722e92ae675f5b1b8a229ed23fc0e4fa
SHA512 578c2005d35ffa97492d0f12bea5e6381900685387d58dbd07388d3c8ee630b4bf318d8b2173aa885960e821b24059b42b89b5ee3e6628637793c45daec1e335
SSDEEP 24576:SGj/TwSfVcYG3K/cJHlnFR+IGNe8j3IzY:1LNiXicJFFRGNzj3
TLSH
T1BC5523D3468854B1FBFD003A867A5828B5846E2C8A555DE2D2543E5E913CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 a373f5c3c53a5c541a5a07de08890ef0cf3801deec74ef3bbaec16940e333681
MD5 24d477b831e474a548cc983cafd17378
SHA1 6a16e4c791a3870fb5680df3c3baf44c7fb0583d
SHA512 0e6fb51cf2b69cef4829c0065519165559c5ca93dcdc897504c6525923eebc7bd87bda9b8f28389d76e4e20d70a835b56d42471f452b025fa8bb1dcec7c3a7a6
SSDEEP 24576:mJIU4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mJIU4LNiXicJFFRGNzj3
TLSH
T1FF75CF7BAE28FCE2C27E4C7957518600E76278304F62A3CBD165830EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3ff0835dac3007f857f6b18d237a309239284888c20b780f06256a620623462e
MD5 d2610b1d1d5cf1f37967cc9133ad4000
SHA1 2a24a8a57a6be842aa78286a488eabff2976b39c
SHA512 35bfb67bd1bffe703fd02e616f4467c53672af8982abc806b7f605f8042cc7141506770577c2a4c5ef1802f231b8f0c3496dcb0d1f3d5c65e2f77e48fe44ae50
SSDEEP 49152:PQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THm:PQvGAdlCEL8c/WRNw5CV7wRGpj3
TLSH
T1F3266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 62f1392e3a17392452bd58bf00666a456fdac33e885c8d58f7a93745aba5c109
MD5 6f700c508379681cdbc9b763252e319b
SHA1 39b1a5e2ea5348ae9ab55dc9027fe6b37eded27b
SHA512 0efe967d4686cd2c07fec53e2614446aa359b5e327abdcd4403171705a4b2e80dd77d2c7f3b4407348f384afc1ed271a8adab5e269a25f8535e30f4c4f4aa8af
SSDEEP 24576:yfewsAjW/TwSfVcYG3K/cJHlnFR+IGNe8j3IzY:oljWLNiXicJFFRGNzj3
TLSH
T1D075E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2b93536ce617eed2efda7510efcdde4a9e4309a3dc8838e0705033ee7168aa03
MD5 9d318bf4179ddca98a32cc192f9c4e82
SHA1 175d4ee5291a0af93c17383b51e8ce015831346b
SHA512 286effda0b1081dfe24fbe46029e0c20d8440637dcab97e59166696fabd7c8436c22041a31fa0c37d25e378912663578ea02e328c514f7620884ed86b8dc2e81
SSDEEP 196608:gUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHSF9:gUEtQevvqc2W1cpV20I32G9
TLSH
T1B0474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d9040d803c349cfdadb737ef87328b3cca9ab03aeca1f02210855b16f18fe189
MD5 45862ec3598f7973441adf2d8d92bad1
SHA1 4f6e3fb1957f05a2c0233afc3a7e1f1eb3b74cb4
SHA512 a46bc4a84df902539505a7f93752b547943199e7b61f53645e679e47fcf682cb18eb978f628ebbb885fe561bb6e85b155edfb56ca5e38f37f9dd349eaf5bf5ec
SSDEEP 49152:UCbRquA/m2yL5zLfFiV+XenmE3/z2LNiXicJFFRGNzj3:9oq2Vjnmx7wRGpj3
TLSH
T109D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a8088ca3263322178db3ace377f2ab99e25c0acbdcb6f142c758550f2c9d27c1
MD5 1d73dd0e5ed896c0e8c04bfab2640b71
SHA1 46055865282daedc6fae1dac1b8c0af49708c374
SHA512 27cb3497b6706bdaf4861a68c8d7bad43b740f437c9ac696afb37028673f2d14e8c5f83095f9cdadceed21e335a57ea62947524f96dd4181e556adbd33434b66
SSDEEP 24576:fAhGL6IFoiwtA5l7S53R/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fAM5Foiq5BLNiXicJFFRGNzj3
TLSH
T1D2359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C24F2150911F0E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 ec44c1f6d9fb6b5ddc9d7e8121f1ca5f4b4b72df490cf92fdffd2588b2aebdf1
MD5 96e2b1262924a3a2c5d329946b370918
SHA1 745301a6359c791959fa1aee9f70002947cfb964
SHA512 62c7e535630d2746b82674d484b346c49cab5452e6aab3c25ffcc6785ff77106c96571b69275ab698f5b66452d033f3948a14257e8e79635e91ea072461600cb
SSDEEP 24576:PwuROWC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PwSO9LNiXicJFFRGNzj3
TLSH
T1ED65F18632940CF9EABA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 10ceaeef7917fc79508d8075876d1066b3daa752bafb25a956f8df592e225fd4
MD5 b6f68c865bd3088deb808d45f1f7f25c
SHA1 3ad0837fb153f26492c1c731c2864c69a1923d48
SHA512 aea53a70d5dc55e7354b8ed832b1737e6e001b71dffaf23318c7d2f7a8443591f7edae0de172b5eda6d01a61c707204037e4413c5e7852d9ed8b7fe7d73197ea
SSDEEP 24576:vZuH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eLNiXicJFFRGNzj3
TLSH
T1C955129622D820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8a9b0f93b78300de20726c3d9dd861624f3244a595fbe0930ee9c89e453a3158
MD5 ae3c1b5a119b9edf753513a9a6fe1690
SHA1 3d4e9fdf1266a7c89b63c9e55777713b359a8bf1
SHA512 e69e3d66e462adaf99fdbea7e153dca793281f5b1f6925eb05e092fc345675c5eb2f5ee95858b687f217507279d78451f5e83907694ce93dfc990927a125e125
SSDEEP 98304:qQRQyi36YOcPDLvw2gAf+PN3k7wRGpj3:BQyiKanX+PNAF9
TLSH
T184667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 51da9ab3cb81eae0ae2b17f8f80c153ef22cd7a53e259da19ca8229d8156b8a7
MD5 5faa1b67845ad07b551add6da1484b56
SHA1 7702359374a9e1a49c54cb8e863519f24600ed12
SHA512 1f291c3acb16186008dd5c9a17ce35047dda8837b5c119afec5ca2cd217634984781879f56e652e7ccdc7942a34089aba5924e74ddfa39ef7f14bde4a3ff661a
SSDEEP 98304:wQRQyi36YOcPDLvw2gAf+PN3k7wRGpj3:nQyiKanX+PNAF9
TLSH
T141667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 717d3c5c9dda21a81a9f2fd10f30ff91b51030eeb1ba7e7e3f889f06ffad05a0
MD5 55edbe3222fa722e52bd4ac8b6f92b27
SHA1 9b5ca06dfa068fdbedd23da8cd083f4ef37d6331
SHA512 9fac7662d3e8e0406353853c61ef1c6f052676bcc194a150aa788243d4dd4b20b8bbd92e1026a7df6e1754d8eb7f4e45c15c7c0e7f7c845c16240e0a3b8caaee
SSDEEP 49152:m68Qg55nhkeWu7PNU3/GLNiXicJFFRGNzj3:EthTRc/G7wRGpj3
TLSH
T15DB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a8c80be069210d1fe105987eb23a54261e266756a6e299d72848ddb5b5767567
MD5 b72eeffbb276e50dcee428776a8d2538
SHA1 2dcbfe3123a7ebda5ee1bd4ec89eb07fdaaeab72
SHA512 cb47d090c23522ced63bf0840e055739f40ee7676f0c3fc0d31e297467a6ffd5b4501153f0b882caac8c63945a13f958c0248d22fba6f91cf385d1f1e83be501
SSDEEP 98304:ky5112gYy5azzVvU69nLKnhZj7wRGpj3:lLIHRWhtF9
TLSH
T199167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f8f5529f2c21d5beef4a87db535c6c1f15850f6de6aba62c4a1e0dd22d79b398
MD5 b9fdba48a6c1fd9e807510560f3170f1
SHA1 9b0c2858d41d29b3e35b5ed97aa7a37c7f6a4de2
SHA512 d117e729f1eef1b592fb2d44dc71934d357739aabdc022f559bd8adcca045210199b92979dcaa9df883b9b644296e28e9809bbf06113a06a5d6a0ba227a6f503
SSDEEP 49152:mB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl6LNiXicJFFRGNzj3:Uu6JmIxd2d67wRGpj3
TLSH
T1EFD59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 81028d665955298ad63309c3edb302cdf6be078fe285918f5c74bd8633bfca33
MD5 d238a81e04940e4dba0b3c7dac8a9552
SHA1 09e54d68a60bc1ac22c720dfaa2e2c603baefbbe
SHA512 97b7a0c48ea21cb84b5501c0ce593bca8f4f0d83b1773d812f56655a93eb83e047bc65270987be23163b0a1020f18cf7da3710586fe677154464f226cb994158
SSDEEP 49152:21hpsNoJpF1A67U44CwH7R4xYLNiXicJFFRGNzj3:2mifPqRx7wRGpj3
TLSH
T186B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 139e99b61b383e33f889df71de93c48efd91ff88a5529016f57dd155da148094
MD5 d419e1f96b69a9e0106489c5c5551db9
SHA1 b58d9272cbfdcd7df5a42d674db789e55ef54ed0
SHA512 f03b2df3a4783d7c42d6a8c6b6656a48c1356f734aa9d5f18d30222a57559db4e462ceb1ac605b419c598ae5d50f7cadc34e04dcd340808e49fe716c2900ecb4
SSDEEP 49152:NSuZQIY0Be2KkRVtOnks6NMHqHLNiXicJFFRGNzj3:D5dKqi61H7wRGpj3
TLSH
T12DC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 40da68a623384f1ad9d38cad57400cd7efd3a607e2ee5029fc67375281f83dcd
MD5 7f4df8c4c00d82e0dbbc18623189ff7b
SHA1 7ea332e7244f3242404975f197023ee5c9c9951a
SHA512 9adb4bb206989dbffaeb3e8ca9ae7a047ff23d4b4dea73edfd459ef3c7dab2d3f69b75526ba9e4aa3ae8927bec68963afca559e65dbc53e9a364effd577bb544
SSDEEP 49152:DhtSn8EApI0figjgiDn0AP5wMLNiXicJFFRGNzj3:iX2iWphd7wRGpj3
TLSH
T16895BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b8005d644782896f1fd4daf73f56ad62d2c436d1e38069d219e3a5581cd21821
MD5 5a434896b3653cae002c5b7ae8b30483
SHA1 2688f41a48a3672bb7b7835a6dc2bf77043c203e
SHA512 133405cd262c123b76ff9ca86fdc4d070517534702c98a49141317154bf0a7e3adb7abf584b48d85bcc8b0ac2c237b62b4993f692ef5373de221204656431946
SSDEEP 12288:bPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:b7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1685523D3558955B1FBBC0039C6754428F5882E2DEB5618E3E348391EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 d11e88a570982db6c8f8ff0a68f7569161044a6650908b385c0b3de96f3aa118
MD5 28c8df89ef109ca1134be7dd0bf5bf6d
SHA1 455c839a7613590184052c0343babfbe8090f4d7
SHA512 5147bc71bad39711675c9de089e49d9a19807eaed9b6be83a01b215df6c27c3d140bddc640eac2ae81057010cc545e2d7406579711bd3b8439a39544fc2404a3
SSDEEP 12288:/4iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/K/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A25523D3558955B1EBBC0039C6754428F5882E2DEB5619E3E3083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 938412f258e3a98803964e68de61ce552dca98326a560a333201baf99c63f43f
MD5 ca8f2d255837b9f20f2a318569e5aa54
SHA1 5dc8553605a183be9ece8ef45be5a176f87e3723
SHA512 b23e3d1152480c566993baaf9d089b46b879892e9d1a644f381db71f25c7b159f838b6954ce6544f4ef9cfc3330db032b3a98df42c46d6fee4922c62595f3dbe
SSDEEP 12288:3GiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3w/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1745523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 9e8286a602bf4bd4122c6e608bdf4755a5baed776a7ee3be9068d893268c37c9
MD5 3a31acb1e0d17b0786483699a0cc66f6
SHA1 341117737baae43dc1d28b7ebf31292ba4bf5eed
SHA512 fc8f20543c70f8d6242ddd76d855c5c718242c70d37ff3779f4d12968db86b7584285f17852373b3a68f000777dd8a726c4fb948c3cdeabc96fb36899279e25f
SSDEEP 12288:kVtiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:U/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DA552392168900F1E9FD8039CA764424F2A47D6CD7325AEBD3003D0E5A75FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 7512c2e634976e6e3dfa792934ef66cba5de88f52d192ebd3c47d84418f3a854
MD5 98a930b4446e9e9072f4ca7bc013cdb0
SHA1 402427fcb0ae0ed8b7f2a8bf01d6b217784e7e06
SHA512 03b5740d7e58afbf4f78efd96515946511a3242df58db327460e7ea309242c5c49f47e57a1c2b5535395ebf023db1a55ba0fc5d78bc84ef5e66df15176b5d3d1
SSDEEP 12288:GViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:G5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10C5523D3558955B1EABC0039C6764428F5881E2DEB5618E3E3483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 ad8c1ae1f7b97f5945cb26013c494d2c233bbd4be1584264cd57efa61fe09077
MD5 581316e3f107bf99eb03dfd10e547d5f
SHA1 9021431f109865fc7c3ede8a7f8d7e8f56670917
SHA512 857ebcfd2b1b282edd7d256bbfb4ceaaed9a06719e40248a34efa27a784b791f6cf0025b9e37b85c6fbbcaf74cb67a7ea2b336ece1d872938fcbc282a28ea834
SSDEEP 12288:WkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Wu/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13D5523D3558955B1EABC0039C6754428F5882E2DEB5619E3E3083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b0a3dcdd6bcf26231a1a400de43ac6df5c8cffce8a112a9e28dffe5b013fe553
MD5 86ff156dc0d1d2751a1405c9940eee09
SHA1 eaab8608821eea2c9a067168eba3c8c00caea9f7
SHA512 cfc14f355c8661108e4debd29e23992c8332e39f6c8478ebc2bff6a304bb74ad61b5135bb9418c73e71dff5063a36e74017e27d432499bc6f5d9eb3a4841f3b7
SSDEEP 12288:SgiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Sy/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A15523D3558955B1EBBC003986354428F5882E2DEB5659E3E3083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 90edd8676d09930e75aeee57d4a2e908e912857e8682e5117886966fa6f26c5a
MD5 a54886d8ea7d7a1a63d5fb38e77353e2
SHA1 159373dd3384fd3867e787727e537db0281406f1
SHA512 0296e9b6ac0da29872097f8b5b528895fdb869357cb91b63dc817402eb2fdade3b1543f769fb4251f723a44d8033459593043ad4d837a2894306b57d17d5a42a
SSDEEP 24576:KZM3zFVSOq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KZM3zf+LNiXicJFFRGNzj3
TLSH
T1A5750295B39018F4ECB7813EC9258815E6B27C1A4B70CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 15ab838ea5fa0607d2a75da2580ecada764ee3cb2bdff2d8dbaaf33f3381e956
MD5 8e0caa415a5ae3529b7fb75318be577f
SHA1 3adcb197e78e1e8add9d6829d9ef5da5346a70d6
SHA512 e4ce70e97f372350752562ffb7d4395875e5b74d56592e1b8a2803cbe1b810d4aa206eeae2b9a508758a73626a23961c93c3c1e5fe33c66203e5a090916c124c
SSDEEP 12288:VjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:VX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1545523D3558955B1EBBC0039C6754428F5882E2DEB5619E3E3483D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 dfebeca3ba88a3e78bcd97ab5a180e6f1ff22315292fc349caf1de08fefc3c5a
MD5 0749796b84775e3c82d15ac640831c0a
SHA1 1df2b466977619ef012555c1db4808bdd91e272c
SHA512 6a328ab7a32fbd3d1e51703c7fbb0916b6c4c1a362afc331dc6560f0f7760a5596cdaea86d9d5451ccc44a67862dc22145702a8145a37c37ae7a1f864eefbb41
SSDEEP 12288:oHiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:oz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B55523D3558955B1EABC003986754428F5882E2DEB5619E3E3083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 05784dc372f45f6ed33d9edfaacd0a3a6c7f47083f3531ae6c9b734f821f7e07
MD5 ecbf843072df614f305519fcedd21163
SHA1 6dd0ef4def65cb8035542f1e7362fd046b98331a
SHA512 877a579fbaf4ff383bf6bf25d03ddbfe2aa433ccf6c4ff3d7e0b270073330abd46241bf03992510447050c25e12c086e059e5ac1b9a92579f6fb9106feb0b882
SSDEEP 24576:wzym/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wdLNiXicJFFRGNzj3
TLSH
T1F7650147629530F9E17A4139C9620911F3B17C3647208AEF53642A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 418eb62fc290ab0af95acb04116a3b49ff4dc2afd82e890d9183c71d03c4848d
MD5 6ec16c5105da2c7d15de8df6930e3dd2
SHA1 e5eb5068f6d931e31298b41018efe3557a8aa3f6
SHA512 3111ede729118ee7782afdb6d2565b613e5141193e8d93d8c6be12ac205bd7b92b389a0f14943eef4fba6585336310b86e71e5b229832bc0cff7ebdf4831f4b3
SSDEEP 12288:XjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:XX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16D5523D3558955B1EABC0039C6754428F5882E2DEB5619E3E3483D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 1ca37bf3349427edacd7998a1452b85b275bcf831f451a1ba227eb1af48d6eb9
MD5 848d859906a46099b5139c6b9755563f
SHA1 39b57ee2af121236824318bc8cc5a63ac2ee107f
SHA512 c78b24fa5eca3d7ca2ac7915e49c076922e0cc0f9563a180616e08dfe3fb83c05745d1fbbea62c87fd7ce4e5cae9c9bd50af79751702b503966242ed395769ba
SSDEEP 12288:RjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:RX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1355523D3558955B1EBBC003986754428F5882E2DEB5619E3E3483D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 2c142160f4be9a961bda7a3558e6bab41772cbc549122b11804bd29d72ced078
MD5 7cf55b98343c33a5d683a84883cd7c3c
SHA1 3abfd8bc7369b6ab2c5db668771e16ef9605e8e6
SHA512 b7e5b2cef8bb22bfc8faf3903de0d1ad5c727556b025273142aa5790ae0a5276f6b077f711566383ff9c7864943bbadb1e695ca5d011c1678fe57dc92453bcd4
SSDEEP 24576:2zym/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2dLNiXicJFFRGNzj3
TLSH
T1DB650147629530F9E17A4139C9620911F3B17C3647208AEF53642A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 8e9d7f886fff0da23e5c550775a7d18134ea9364da79dc0b12af904282b68362
MD5 2fd997bff452f38fefdee3393369d17d
SHA1 b0eba474f2e9db652392918bdac07a8b4da41e4c
SHA512 d5fa4ccd656011550df612d4c894d3806ac1fd613abfb666513ccddc2f0c90b4b853f4dbd8fd28dd4cc3aa2ca7b68b5504dc77818727208ac4a305a866933f23
SSDEEP 24576:ET8aLl3z0zDg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ET7LljFLNiXicJFFRGNzj3
TLSH
T1C87502A5B39018F8EDB7813EC9258815D2B27C1A4B70CA5F03A4362B5F337A15D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 4f4e8e62162fadfd488a3d39a6a9e6a2254ba96bbc89bc0ac2fd119127d74321
MD5 a4586a42dac37265ac408901fb3eea62
SHA1 c9ebe71ca9c8beed841c850214f8d4589625bc9f
SHA512 bdbca0d246dd866b87eba4f34c60c599c51c31f42d02d2e8bfa0d9c00dfb37d5300add9a2e9a9447f2f908c83a913411aa62039eaca3ff5dd610079d03eb9d9a
SSDEEP 24576:g3rd9CHKy7GZE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qrd9CHKya+LNiXicJFFRGNzj3
TLSH
T1BA85CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 6abca2bd782bed4c0dcb77475ef26a908b5530018b09f55b20a805d060bf28dc
MD5 4e12950d83d5f39c296c1218ab3228b8
SHA1 7a9d013038bf1c94e431e68b425d5d9b756d0951
SHA512 9c67f6b5952b8fdd93a197f28f1063ab600ffa477bf9fcdf313ab15e1a1598fe946a4a5725770b6e3c2f3052bcad0e307a20dc3121dbe0c6219292e7b1dd5639
SSDEEP 12288:3miJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3Q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E15523D3558955B1EBBC0039C6764428F5881E2DEB5618E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9168f3d94c04be1da5530162901e45e98786f6c6c1b4ed5a1a1874920879d247
MD5 d81ce011861adab3f7951fcbbf011b43
SHA1 fdfacb44d9ccad2a855f8c3176de5f7bf89da4d6
SHA512 12a400fd9b1c2914a747d89614763769b69a9ab09b7fb8ba37ab568e25536afc3dee9ac1b1ac5bcba24934b8fef467cbd033e54eec42d4e09acc0ee9ae919123
SSDEEP 12288:O8iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:OG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1065523D2558955B1FABC0039867A4428F5882E2DDB5619E3E3483D1EA27CFDBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 9e6f8896becb424001bf4ea69fb447884d97bf8c6919ec2a12cc27b2d3b0846d
MD5 c5f0675cf5e5a40e2a2a42388cfc3492
SHA1 f87de8a0ae4e76d1afe5b4ea99ad71d48c59ed7b
SHA512 426af8cdd89c9ec4989c0af717c5b7dd7acbaee96a86745f5b2a3dc24cc968b97467615a0063f85703caee1262daf8c0112e2457b4f914df0530f690f7dd9b4d
SSDEEP 12288:7BiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7t/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17F5523D3558955B1EABC0039C6764428F5882E1DEB5619E3E3483D1EE23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 221dd2a9ec27c85981d9b4a76537bd327ea6442dc800e997b7061e6b04904522
MD5 02d9b2893a77ab555fc94932788b59a5
SHA1 fb007e2aad420b48792f8b79a66755f27c44d65b
SHA512 95753431553613f1317c1d907ace43576711d6b96b464339ce3ea0f4c93b837b1eb6b4818125d81fe885a896fc35898a768762a117bb6ce920816796dbc5cdfb
SSDEEP 12288:QjiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:QX/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BD5523D3558955B1EBBC0039C6754428F5882E2DEB5619E3E3483D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 68b1d86eade67f69a98e00329189370b109594c2a19c2e4813082c81143025b2
MD5 4a39f080d59412476723887934cfd83f
SHA1 2546c72dd4fa7dadc8ac9cb735b35c205cc699c6
SHA512 052083d1ccf8a56d62dc47ac53ee6ebafcbf445e49d9d541559f70fd654eea5312711c7abc7cee63c9181f37882e500a49f108f8bca8dd016956d7b74556c600
SSDEEP 12288:LmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:LQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E65523D3558955B1EBBC0039C6764428F5881E2DEB5618E3E3483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 1804e0f54377d1c6debc462b58ac53a8e873511f1ad40b83cddaacfd27d2671f
MD5 ecf721609f06e10e3f21e54188615a14
SHA1 85c8d26c09684ab68a0d67379e3d37ea1479ea43
SHA512 4ebdc7f64594e2c3ab3c80072bcad555af972f520916f41e22f8e52232f4c667eaea72562e97bf2937bdd99c2babf05d62d1cd0591ebbb709618a7938d7e3c7c
SSDEEP 12288:1riJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1805523D3558955B1EABC003AC6754424F5881E2DEB5619E3E3083E1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 30918f7e771d07a44c428de7f6ffeb39462a4684cd8890223bcc47c748cd70ce
MD5 704d9eb51fb12fa17456c4302b4cf78e
SHA1 7defbd4a04daa8d5ca73b1fe06c66f8d5b40f1c8
SHA512 f27b4ab488bed4e698fdfb07e7f8e7c6ec120fc68e8b2fc99346ed738aa4b577eb56dbe63a6173d30a4200523bfd5467680aa846da2736f748d1290196110709
SSDEEP 12288:aViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:a5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1755523D3558955B1FABC0039C6764428F5881E2DEB5619E3E3483D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 d3194a6feb05429013c1d101485442abde2212570e35bed5902ee6d33e0ac10f
MD5 4b1f88def22bbaa2fbcb45ef3922fbd9
SHA1 78df476f040982c671a5bd546fa7d126d2a07d08
SHA512 7ca2c5307287024de7934737248dc05a944057406ea900521c05d075c9944038acb002456513ca61ba08ce06f4cdcf8f40cb4d1541789d4b2bb8cffe0e8ea403
SSDEEP 24576:Cfwvzk9RX6wkyAID/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pMnYIDLNiXicJFFRGNzj3
TLSH
T1F485DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d4fe749f8e0b419d50eba1d5d5e93fb44af3a5265e10b4ea7e793d066c0dee9d
MD5 91634086a75e8b1c0b59518a59ab5c99
SHA1 1718f5244e4fca9bcbcef0183824839bb420a79e
SHA512 902fa26c467c3b1dd77b2e45e0823d5b8b5e592bc9cad4fb9b5a745bb282cd93023c5e05822bd1850bfae8e293ef3e275aeadb722925f8d083625691061b3931
SSDEEP 49152:sYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0sLNiXicJFFRGN:jySzPE7wRGpj3
TLSH
T12D066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 dff56191d4758c5a125c0aabaa8f72b3ac0236d96cf0822a4dff6b9079c7cda5
MD5 f27a6fc0d66b901df59a9b557d5442e1
SHA1 e245975f828d82bb21c8bb7631cc4b2ce32166f4
SHA512 5aa6b98798d7dae18ba5045f90a22af70e3f08b44f43ea83e6e00d2b139e363c94ddba846a3c151bd95747781afdcb808bd040bfe5b3f2d6b73092f871ebbe94
SSDEEP 24576:S47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:S47JUQjqirIhCnDHUPfF/8LNiXicJFFS
TLSH
T1A765AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 045ce45658ab2ad4d8ac0d1cb3aef540f55490d0a6209343dbfd444c60580de1
MD5 e2f60f7502c46aae7d5873c40956c0a0
SHA1 9506b4eb4e411c3a7e8240317ca07e178f89571b
SHA512 1f4d9ea2887d258d143b7bd59a5335001d3eeafda10717a26fbee51a13866f04fb912dafed307d0b187a274bd91e0a8f3a550d4ec7745fa16b73472d25108bd2
SSDEEP 12288:dpsfziJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:uH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F065F15AD28802E8D1AE5139C7664900F3637C2987E193CB53D0F93E1F3AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 e1d0de239df1ab56f62f695e4e2797f0150722e6e20102b45c433500a39cbb8e
MD5 0ed76402074c7c82caf6f9c5346fb62b
SHA1 d203bd8d796fd2bd1e8b260c1738971a69acd266
SHA512 167ef7528a496b4409ddc7c752f1f811ff1c123d0537a5049409e61a8520b3624198a720ceeea390c9fc022c4946ae9b1f5f323db86afb209a619af11b820264
SSDEEP 12288:ml69W5EU3fkYXGw8OpiCGQudf3PsYzXpz5pgmiHLDn:ml6gyUPkKjplGnfLZz5pxiHLD
TLSH
T12C353811762ADB4FC6A940321E77C1CDAB707D41EE44AB0372C9873FD576658BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 0a390d25e2e2579fd3b83a8874307bed971e478332644b29c0d7f2a88e8dba39
MD5 ae8672383756ac54e418036962154d86
SHA1 1e9ef6a92efaeb37fb0d7a13e72133c2fc200555
SHA512 b767fb3a3ff958ba9268210767aad4f303009ec59cb99c2db4b3ee6326491b04ff055e06bd6582f5cc39f57037022f3045329f7ef37c9fcfb4bedf634cd07260
SSDEEP 12288:YnryAGmdnMwR5vXDBRTTgwkhdJvowocBnZm:kvrvbAnZm
TLSH
T1407509415537A78FC1BB6032037A5B8D6B74AC0BB7086F2773C5487ED86AA11B0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c519426928c658dff5fdb86ab6f07fdf8726cd80d577f17c1855dfdcf6bf6d10
MD5 e7341308a21219036a74e9579632aed1
SHA1 0d0426fc54a60dce25018af89443953083538844
SHA512 9081ce781a92a405ae45b37da087db08c5608f23d457c515cea9c07f210cc227bfd2c1034886e714f37aee56375e47ebc18eb541e8fd4b264aed09c631a26303
SSDEEP 24576:xv/TwSfVcYG3K/cJHlnFR+IGNe8j3IzX:xvLNiXicJFFRGNzj3
TLSH
T1235523A3528959B1FAFD0039857A8434B54D7E2C9F1558E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 aa0181eaa913572ef49c5c01aaecc904cfdacd48dd6173b344b3065127371b6e
MD5 a6f52484da1a61fc19924af565b02d3e
SHA1 b3b90b468a8b60985e0d044b5b3eea51115e96ae
SHA512 f84b5904ead203bbf20410c43808561e60228a28a7b4005e212fcc3c040673a411681508f006f5c8fcd325b5f3c5499162fe6a93844d377efa1cdfb1c1a820e7
SSDEEP 24576:/gb6bmBIi49WNNFpg1rSvFv7bYF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/gb4mBIBhGF6LNiXicJFFRGNzj3
TLSH
T1A965AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 35eaa392c935660cf8c76bcc772315478bce12d2c52b5473712db42d83b4c489
MD5 f2d4f2aa9c6d4c85b047c9ba3821a9b9
SHA1 dd909afc9b44362b5f254dfb96149ef9ca1efe18
SHA512 cc15789e5d799d6ccaae043f7040c1f47d3d0eb75a8cf7f65b24d554d1fd0c4845ad0f35f33e53aded62b27d06b981d82911f61645cd72c6ea30da65e8353688
SSDEEP 24576:bG88u8FpJqH1vzria7/mq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:67ZFPqVya7/NLNiXicJFFRGNzj3
TLSH
T1C985F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 d4abe0f9dcdafb65e3780e1d83beee81a5245292ec177b0985e695a42e8ca240
MD5 563ead0d039e7442d5957c96ef0d6400
SHA1 4e119547ee244a20c59db8ed8d4e196c5da2ebab
SHA512 ed1706db443b9910024ce45109d9c0237f4f751002e8698f89026b564183027d8fc42b2e464bb714d4c6aacaef9553694cbc600c2833223d2a5790d4fb5b8f91
SSDEEP 24576:sPUr+NQ+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sJQ+LNiXicJFFRGNzj3
TLSH
T1E265F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E5F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 75321ed34f64e5e90947ec65e7f084afce2c4638448b4de8fb1a346d6e28098a
MD5 e3dddf8fd5f109fe2ff3af811acf5817
SHA1 ad6b6240da3047303bba5fb4411fa8c73f4c69d5
SHA512 7859c16e380f33f7ddb7423b936888b06f266d73612de5d25203f4408c2252c264671def0a6c8b78bbfec3df788ab76b6db8557cb29b1a2769969c40d9a07dd2
SSDEEP 49152:qBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjuLNiXicJFFRGNzj3:VG05lO43bL7wRGpj3
TLSH
T1B8D5C06A62EC11F9D1BBD07CD9C6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 010716c1bfe26b3365e29dd802c60ffcdc28fdc50fe16778794da11363ec6f01
MD5 00688d9a9155a0326b869ba08f7dc703
SHA1 e5d22cf470f3d8ea4fe8b0d8d8d06f02a3f5fc24
SHA512 b8d42e22b7322196bd7120bea5690ee9fd57c7ee9301d768d2087ddba8cac29a8225668eebc0f8d4dd0437ca1931c509f6bdff51c44f8d5dce3c5025865a3792
SSDEEP 24576:mfa5POZ3dpyWVM50JicR2hG0lasx2+47eidns/TwSfVcYG3K/cJHlnFR+IGNe8jg:+a5POZ3lJt2pasx2+mGLNiXicJFFRGNf
TLSH
T1AD65BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 1a74f586987771f6ee06a4f451b6cb5738d6d4c3946a457e3ee4916338bd1715
MD5 ca60f348fb408cd43512ea5602281d29
SHA1 b41c3ac5a9342c5297605a62cbed48b52af4587d
SHA512 8a67acc5e9e054f8aae33de4ceecf9ec805944f94ec51158e5268200d08517e448476fbc10e268abc03d127149f890da2783513dfd12d3706bba14ecf28c2ba2
SSDEEP 24576:rNcwHdjbyQ4nLC18lb/EOjowL7Fki/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rNc/zEOVHFtLNiXicJFFRGNzj3
TLSH
T142858B1622E901E4F1BBE1BE89779546FA71786913308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3ebd1cb75d07cf117ec2a4a180fdf6d3e9da8b04026c1cd5f6002aec90b0132c
MD5 7a6f1cffa588bb86adee036b07b896f3
SHA1 67c5c46df2cf15fd999f3ba1e86aac2536222ca2
SHA512 80a910264166b8f99d4bd987e2feaf2250bd74296ce2c03e718345ef41d1905de590f805243bf05699b0ff5861fcae6cc9291e8738039ad0c8fe9c4c644b69fc
SSDEEP 24576:DzkNvNnaFeYhJNtmZBm+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DzMwBtOm+LNiXicJFFRGNzj3
TLSH
T1DE55AF6EB6A846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 535e3be4af2ccc1b739e112d05f35d93f71b000c497a71e04a83de68e3c189d1
MD5 6cb7823e86cf1c3afda597e85bb615aa
SHA1 bc2aea203f4e18c956179b6c359e07248c187c55
SHA512 dc706ab46da51eb4d8ad335c57b6464e69695ec2c0a0b1f1a41a988202e5649e66872012bfa6e757219628c6ae2bab03e22cb70531dd0277e5d8f9a6d8d91343
SSDEEP 24576:8D3FHshBIYQgAb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8DVHeBIAAbLNiXicJFFRGNzj3
TLSH
T1E375E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/616-121-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/616-57-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/616-51-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/616-61-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/616-50-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/712-30-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/712-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/712-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/712-122-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1028-320-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1028-98-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1028-97-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1028-339-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1028-341-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1028-104-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1836-93-0x0000000000810000-0x0000000000876000-memory.dmp

Download

memory/1836-87-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1836-318-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1836-88-0x0000000000810000-0x0000000000876000-memory.dmp

Download

memory/2232-146-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2232-144-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2232-138-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2232-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2232-150-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2308-46-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2308-136-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2308-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2308-45-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2492-34-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/2492-1-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/2492-10-0x0000000000F90000-0x0000000000F91000-memory.dmp

Download

memory/2492-48-0x0000000140000000-0x0000000140A08000-memory.dmp

Download

memory/2492-9-0x0000000000F60000-0x0000000000F67000-memory.dmp

Download

memory/2492-12-0x0000000000FB0000-0x0000000000FB2000-memory.dmp

Download

memory/2492-13-0x0000000000FC0000-0x0000000000FC1000-memory.dmp

Download

memory/2492-14-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Download

memory/2492-15-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Download

memory/2492-11-0x0000000000FA0000-0x0000000000FA2000-memory.dmp

Download

memory/2492-0-0x0000000140000000-0x0000000140A08000-memory.dmp

Download

memory/2868-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2868-326-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2868-153-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2868-160-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3208-259-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3208-64-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3208-71-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3208-65-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4280-77-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4280-295-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4280-83-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4280-75-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4888-110-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4888-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4888-116-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4888-321-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4888-323-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4888-325-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5024-337-0x0000021CA7B30000-0x0000021CA7DBB000-memory.dmp

Download

memory/5984-123-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5984-125-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5984-322-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5984-131-0x0000000000890000-0x00000000008F0000-memory.dmp

Download