a8a8bee6d3405697b140034d46a1731989f0a97fc6e20ed98fcc9c43562372ad

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 11:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
Size 6.3MB
Sample261102-nr5dmsbv6p
SHA256 a8a8bee6d3405697b140034d46a1731989f0a97fc6e20ed98fcc9c43562372ad
MD5 afe452ed11942508781fa3602378ca1f
SHA1 546a5d0c22d1ee9e88b28cd9c09cb0fafe192b51
SHA512 6d8215b5f82e51756526738420c8ddd2206a4ced58178e564d7c137d8193f1b8634e578f9add186aa430eaa9788c06f18e0f74484873c4a483121ba801d5b1fb
SSDEEP 98304:4S9Wh25L+SEVZPvNEbNW+N31IJFgVxiwKHUo2HD527BWG:4E5LnuPvebQW1IcziwK0xVQBWG
TLSH
T150668C47ECA509E9C6A9A23189A792527B71BC541F3223D72FA0B7382F73BD05E75304
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1560	elevation_service.exe
5248	elevation_service.exe
5684	maintenanceservice.exe
2464	OSE.EXE
4740	PerceptionSimulationService.exe
6140	perfhost.exe
5712	ReFsDedupSvc.exe
1520	SensorDataService.exe
5988	ssh-agent.exe
5136	AgentService.exe
1952	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\13d6cd7d3ebf6fe8.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_109328\java.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_109328\javaw.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_109328\javaws.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000e6d52ec9be6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000de6727c9be6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e3653c9be6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000032293909bf6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009edf5908bf6add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c34c92cabe6add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
1560	elevation_service.exe
1560	elevation_service.exe
1560	elevation_service.exe
1560	elevation_service.exe
1560	elevation_service.exe
1560	elevation_service.exe
1560	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
Token: SeAssignPrimaryTokenPrivilege	5136	AgentService.exe
Token: SeBackupPrivilege	5712	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5712	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5712	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5712	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5712	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5712	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5712	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5712	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5712	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5712	ReFsDedupSvc.exe
Token: 33	1952	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1952	SearchIndexer.exe
Token: SeDebugPrivilege	4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
Token: SeDebugPrivilege	4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
Token: SeDebugPrivilege	4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
Token: SeDebugPrivilege	4640	2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
Token: SeDebugPrivilege	1560	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2076	1952	SearchIndexer.exe	101
PID 1952 wrote to memory of 3308	1952	SearchIndexer.exe	102
PID 1952 wrote to memory of 5492	1952	SearchIndexer.exe	103
PID 1952 wrote to memory of 3452	1952	SearchIndexer.exe	104
PID 1952 wrote to memory of 2148	1952	SearchIndexer.exe	106
PID 1952 wrote to memory of 4988	1952	SearchIndexer.exe	107
PID 1952 wrote to memory of 5448	1952	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_afe452ed11942508781fa3602378ca1f_coinminer_dosia_frostygoop_ghostlocker_glassworm_hive_kn.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4640

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1560

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5248

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5684

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2464

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4740

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:6140

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5712

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1520

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5988

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5136

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2304238888-3968896904-642854331-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2304238888-3968896904-642854331-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2076
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3308
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5492
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3452
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2148
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4988
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1b710cd6fcab55ca0049029d7dd370b8887ae377ba3eda2b7f6ca593f0586e4b
MD5 17315cdfa5429906c2cd98ab586880b1
SHA1 8b1f40a2741faa3190e1ee1ec47ef81ab37bf500
SHA512 c031a50393a69f020695087d93da853aba7e2c47c210dba09af4575279c20aa42909c97ad53eed2d958fbfe5618f80f5706a8436c009182fb4c222b147460e73
SSDEEP 49152:pb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnHDmg27RnWGj:/3q6sjBID527BWG
TLSH
T138D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 fb8d94f5bd77d71e2b7a3cb1844a340f1ec2e2f063830d29d481bec0797d7c6b
MD5 8ae53a4064b16bcbf633f0db05109e3c
SHA1 c193fdbdc9e28268f52b87a32ed913640e13e688
SHA512 0f6c3c38349950140efa07cdb6a99d5007e36dcb7772753eac037a44ef0c82c2414abc7e307a2764403d6d802a6d1d73f39b1b8a2309204412e5e8d1513b650b
SSDEEP 24576:WXYfDtczA4sqjnhMgeiCl7G0nehbGZpbD:VtcxDmg27RnWGj
TLSH
T19C050129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 323e4e5f554f77c0e3ddda27450f588f9f0cfc48cfc966755cc6b54634a25951
MD5 a062b8f38045b3a7c59213fb45fe1f13
SHA1 915dd3cf82eb493d06068a194118c293f1bb43df
SHA512 e26b22b1422382a4d6b34605554a44bee3fe52e381cc23b52a338f4d6714d2c16296cf238d697caf69a7ab200ffc533d672ffb1d00cc5e866116991e9f79e203
SSDEEP 24576:w0Le5ji0hmxxrMbsqjnhMgeiCl7G0nehbGZpbD:wPji0AjqDmg27RnWGj
TLSH
T199359E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 3f3820ecfa22463b428aacc445bd9eabebb892876783f3a36fd07b6ba212bf71
MD5 1597a0992683c4811850c421feada614
SHA1 8a0e02db4f7b8a475235b221c02c913dcec37fab
SHA512 50882066e2d3c92b84f4e62f1f98788e0e96fcc8c1691c2d22e109ef8d9c49e23bcd46c99e2bb79218402504d62942ebf74201d8b2cd7934bb6c73153db48de3
SSDEEP 24576:za7/ezSC6vUyD/aqgrvWn6q8wyudsqjnhMgeiCl7G0nehbGZpbD:e/ezSC6vUzPveHjy2Dmg27RnWGj
TLSH
T19A755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d7d6bf56c688f2e68e0a9efd0497230704442b4871002bd0e470eaddfd99101c
MD5 7133e61f953fa4e2e5e2bc7449a2280a
SHA1 25fbb77bfee8b639382f56ed2ec601b9a12e9e33
SHA512 3f9ba3ae394b606438160fd70dd05eabe0a05e5d032ee7d16c4d6044212e374ab05217f78e24a5e3a027fd30845ffe0c3c54344b62fe7ae8b5a6ab77c0076889
SSDEEP 24576:7VbqPb88hv/l+YssqjnhMgeiCl7G0nehbGZpbD:7VO88hXl+ZDmg27RnWGj
TLSH
T143559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 a19bc68efa5e07c2beac883feb9b8924c7f680a40624a6b7205ee9d0aa40145e
MD5 cb03da6ed8df185e2b0a6b55c794b8ba
SHA1 fc49a677ec57699410efb92974393da851f5e153
SHA512 aae529ae51f0c054b28cd40bbee14fa435974cc9871176fe48c3f2ab8469eb3c4823b7296ca64ad388d25f68fda46b35924755107df3dc5360c304e89fb4b37e
SSDEEP 12288:aLaSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aL/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D6C423BF974C50CAEB7608B5C2E9F11EAC137E56982008436A637DFDE6B5458CB39423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 c16a681ecf3d738d85e257476c3c638ad8aba74416952f9a55aad3316a928ba2
MD5 1940422f29fd1877eb30a8119babbbe1
SHA1 007677a6171df8f666146327e513b24c0f04a263
SHA512 94214fef0398a064faba05df7439a0214ed99e33a9958ed4da68520d879744b7aff60bcad001bba6f77cc6834451ba9faf13189207cf475ab2b60eacf2bd0f04
SSDEEP 12288:8eBNUbTVO86URSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:8JIUksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EE05CF7BEE28FCD2C27A8DB85791C600E76278314F6193CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8a3a57eca60bd4cfa87599df1741304870da2d2bb53f59ee6e040d32db31e263
MD5 fc66b1d0656520881520e9271d26da1d
SHA1 4bd06d16fb786bf3ffd18155cb693fc0dd04dd57
SHA512 926969f616a567d3bd0b865c0d0c7fef13d2d086b6a2b8988c0e859583f0bbaceca4873cdda861a494e74f3598d7f318defc255f6db442a61e890c7ab54c3ff6
SSDEEP 49152:fQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH7:fQvGAdlCEL8c/DRNw5CRD527BWG
TLSH
T180266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 eaa60548f0008f99290e27c24343bc558da2737b2cc6e9b66fcfacff792fd0b0
MD5 5c993389441471088391e9e9ad40f1b3
SHA1 ceca9a7a6b16528f9d250b1896ec84b94aea0314
SHA512 fa8d0b02937003a1937ff965f1d1dab7b6a19f5d13e24a0c40477e9748c40b0f2a1638d032d6c4e7d1ce79b47b3df4c4235eef39cd0cf472cc0d56ebcb6948f1
SSDEEP 12288:7AwSfxL/2Dc3RDLLmt0LDQewsAj7SXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQK:k0ewsAj2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T12715E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 48c8d7ffd7bce7d337cf27cea672e33e9215aa6e15461039988e66834c335cdb
MD5 ebe2425ac981e2fbbcb59b7aad1385c6
SHA1 445d80aa45b74aef5211730e4bcac2aa6fa44b19
SHA512 771263e7ccd6d6c90476f5bde28f115ca49cee5db51649be3c98a691efafca870287b19f1f480e57826578ac264bcf05157ecd67994d764ddd3f81e61ee0ee46
SSDEEP 196608:gUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHSVQBWG:gUEtQevvqc2W1cpV2tI32FB
TLSH
T1C1474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 44f602c344e3b8729321278dfc3df377245ee69c8d8776fa4ea612b96bd83787
MD5 152525e9f297c68afaa13f75ec6af167
SHA1 2024c9018e6b718954b6ee88e0e5e91be11bedb5
SHA512 f60fdd614226443e4842b0f01ca4450e29fb6c5f44e66ae52e6b6f2387674b6df5632dbcab35bc7afe09c812dc55e4e6e7c236f6838feb9d38a2ed181f5cf100
SSDEEP 49152:3CbRquA/m2yL5zTfFiV+XenmE3/zaDmg27RnWGj:goquVjnmdD527BWG
TLSH
T1C5D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 bd70cd784a4277e0aaea5d4f4ea20f1c5815d649d47935ce98668ba23981fd65
MD5 8277d88b9043a65e5f1edbea07dbcaa5
SHA1 b24acdc5a8561784cb2f475463e0bea05f2e0720
SHA512 c31beff790e96ceb955c6e8b9f556ea51b7d7cb178e570d447701e2985e531a63448c3693320e885003efc3dfa5a29e7476e2894b625583910d89023aece73fa
SSDEEP 24576:gAhGL3IFoiwtA5l7S535sqjnhMgeiCl7G0nehbGZpbD:gAMUFoiq5tDmg27RnWGj
TLSH
T1B0359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 f5889f58c4ad119850778cfeca3cc079d28f82f34b9de3a5199dd6e9c2f8d613
MD5 8772898434c37bd97bd3467507c1f632
SHA1 5608d1d7e9fe4af4e14351f456838f25607aecb1
SHA512 dbb395c061e93e31426f564565309cd4b9e6d504cde20c1a4635610bbb7a448843231d19244a310d15ce63d70be7523d048db3cacf8f36733e3d43c2b1ea1aff
SSDEEP 12288:Lmw5HEjsChNVBFgl0WDm+CQSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83i:Kwu4OWSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16605F14A76A81CF9E9674539C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 ff70c4de093e9768c1f323578bd1f6d8f439573fb40ee5937d0ba350ca6f5ed4
MD5 3fbd1e3a6e98b39937beb14ce33ef22f
SHA1 50e9e73a42de2a230db48d8c73e0bd3a5bd5d201
SHA512 548215450c3774ab6056fe4c6d806fca41da4e2ad82525c6700f803852e3fdb806b7bdf3093c4e8cfe77a2d8655d9bb55c9e78ffccf115f84f0021a8588c9d31
SSDEEP 12288:+eZ1IyrSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:jZuTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T149E412AA239820FAE163417CC5E5D609E7337C62673043CF166659AA6F73AC44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0437915718efaf585dbb8a7f447292d14d4d853d6928d0df13d7222136c5afe2
MD5 ced7f7bbe15e1402c13b3d9ddc7c6303
SHA1 940358cfe20ae10b9c365bb1a39fb873722b9b1a
SHA512 25ac96361457eea956f520477ce482cfeb7ced0990b07bd50cc07303d0b06c809614710e7f3b9d90863384d562d387ecb4970a10378123002ed6fc2bd81e3748
SSDEEP 98304:uQRQyi36YOcPbLvw2gAf+PN3MD527BWG:1QyiKa/X+PN8VQBWG
TLSH
T157667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b85de17a9b74924f64b1c8c448eab0a3ace6bc4bf94c60a28820aea1dc44080e
MD5 4f240506ec01addcc0395ff70e1cbea5
SHA1 297fe8f33deaca9c0881c8578a9b2488e3102de9
SHA512 a29c5faadfc89a20f9dcdc114294ed1887c91fb58a5c7c2cfdcc9fe1b266f964088b44ff648161ef4a73dd53c83cba2096164a10e7a43410c71f6ed149f65875
SSDEEP 98304:xQRQyi36YOcPbLvw2gAf+PN3MD527BWG:oQyiKa/X+PN8VQBWG
TLSH
T113667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1c56f6d3d42b21451f6b5a1a4fbc4b045b99f7c2b1f81c2ed6b9a4a2c3d79152
MD5 8e3e307b75620e4e3a2d6f56c0c458bb
SHA1 cf89125fb72c453a70a5fdb75e3f596c4d4e5326
SHA512 1636898a48a750a8b5dd6694055e83d1d30a712ee8c71d94aeae2d6ef2b79981e60046a2acaab5007ad405e9ac595cfa11bcd7a5360af648bba0039a89fb7373
SSDEEP 24576:rwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0DsqjnhMgeiCl7Ge:D68Qg55nhceWu7PNU3/qDmg27RnWGj
TLSH
T178B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a1a73384073a1a8a2d1f328bebb48c56eb58567e8b49a7abacaf3d9325dab0a4
MD5 caa1056baa5c31398c8c30df6562c790
SHA1 d94e9eca3f79035617ec356615bf608d8ec02326
SHA512 ed53356148f5e16d34a4db6f13ce89f7c2736b9d44fecee4151b2927827bb711176cba4a2e72e81c491972bcfb70c798da814735bf89c0c24859a848579cddce
SSDEEP 98304:3y5112gYy5azzVvt69nLKnhZjD527BWG:KLIHEWhVVQBWG
TLSH
T1B1167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 8d51637976dee752009486dcad565b4a30f22ec0afa055e2b7af8f104d8cb06d
MD5 ef139dfff81d57cff559c9452c7101c3
SHA1 ea118c24db1b30b698209986c533cdb01c6d0c76
SHA512 1738c3c2398a0e1519abf9b702b48da0c98ce6a2e6f6e02f74fb5119b266a442f2cdf0d8786abc53cd8f75b59d84c632cde8c0b42f188529a29d4e5cbef79dce
SSDEEP 49152:vB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glUDmg27RnWGj:Ru6Jmdxd2dUD527BWG
TLSH
T19BD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d8414efdb22a208ce9ae98502c8c1a5001a335b38d3035da24f28db684fc64d1
MD5 da6f400fee26b96b7ea66029c74d5109
SHA1 9794957ed532e5a1a0e1e2c9d1bb12e0b00dd601
SHA512 23e21f5b432d1fd0ff8715c6c6c9777153f8f2d7f73181098c234d85f382e03972d5cf576b62b5a6e694fdc275412c2ef6b9eea300aea43c5efd58c47293d032
SSDEEP 49152:s1hpsNoJpF1A63U44CwH7R4xgDmg27RnWGj:smifPWRdD527BWG
TLSH
T1E9B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a2a3b350aa17fd15d89a0e71d95310af41d3d171c4d1a36c87e51df6b43e7d44
MD5 f315ee251f115389b61a33a485194c8e
SHA1 1d331ff2e3f6d50bb02233662721734bb00457d0
SHA512 411dad822e30e14ec5bdc34cdd45571fe515ae75fe789c5b1db789e3ad003c58e87c7bdfb9aba57f79311173ec53b13f96c6dda237c31c6a5d14ee9e0dd6e3f4
SSDEEP 49152:zSuZQIY0Be2KcRVtOnks6NMHqXDmg27RnWGj:x5dKii61XD527BWG
TLSH
T103C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9301491bca3d6e1f1d9842eca5a89730264d8865680b11503e1f2a0e4852717b
MD5 712ccd7703a5222a05010a8418ed4560
SHA1 cacbf15fd1d534502203cf69eafd28486cb0b579
SHA512 17d322c155901be67d750b60e93466f0f0b9eb980c40021dc7b0996b3446daf51cb18574da5e1dbbd06a6aff07f2a2e4d3b8eb12bc827ab0b7cde18bc522d97f
SSDEEP 49152:thtSn8EApI0fig3giDn0AP5wkDmg27RnWGj:8X2imphpD527BWG
TLSH
T11295BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 74543b808dab91cd9ba86a1b77b2673a92aee226769e290e403689414c70720c
MD5 dd5220872ff8a52fc9567214bf85162d
SHA1 5b2e886c0c249b4fc1ab06c9e7fe6ef9e3bcce85
SHA512 8ef89525667c96ab5e4903f871926d03e3f6f0bb276ba7d3a16b9f4e3ae8e9060ae4bae0a44bc0eec4c2f1807c3053e2118cdb2535f83b805556f2b7aafc1860
SSDEEP 12288:miSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F8C423BE964C41CAE62644B5C3E5F14DAC073E5BE92004937A5B7CBEF7B24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 58b9bdb1db9ece27fb811f3e7f2f2c05eaedfa74f058c097fffcfdf6e6d8e165
MD5 107920a958d12ec178daf00563eb2142
SHA1 f5b8ad3047f238713c1e6d1e5ac9330d1ef99d5c
SHA512 c63dbbd8794eabda05a153fe8599d4d5498592464deae15c8cc63ad985d97337c2f5d537e96d5bd42a6a00e1bba6df2255df2598fe80bfc12bdd4dacde318e72
SSDEEP 12288:0fSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:06sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D6C423BE964C41CBE62644B5C3E5F14DAC073E5BE92004837A9B7CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 3d2ae467c14d7e8c2a9a540f2f90fa318568de794616de42c985da534de34228
MD5 a27aba17fc741239d04c803167ecc90a
SHA1 d6b094f30b1a54d85dc6ee91608cfa7ba438272c
SHA512 410bc87dfe6ad2a63691c3144c68be44b5a7d04f72fda6d5c61bd8a56472a5fee7285f981044772a205e50883427c095dec5428ba837c99708a46141829cfe53
SSDEEP 12288:d5SXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FBC423BE964C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 87f26088b69bc9e31a47a6c7ba0deec26493e7e1018a1954e6c4ec29d116c4c3
MD5 ab027f4b78d6c05e40f26a7c028dd3be
SHA1 cf7514cd38ef0e925a3220a436c6041eeef71ac0
SHA512 bf199d9c4e48c4d122d1b86265e0b79766f01956afa94ee9b095a7cb1d1cc722f6c3a331071a8467a544ac31c3d99a239f9bfa8c67e7dec87dee9fc56fa62a08
SSDEEP 12288:fVsSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D8D4236F675C40CAD83285B4C2F5E11DE8237D96E730059B6B532CEE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 9497060cd1ebf5f5413d96b831bd9696a1bc64c8b32043c0e20b0e199c3f0797
MD5 7ead11dfaf0d7a203426b891b6a3d9ee
SHA1 af4009f14bdc4269b3a9fc140d7a257ddbeeee4f
SHA512 633da0dace09473789c4d7f17ed8205072ec944ab382e5d2ef1d3c28841391f3fbfd8b6f69cc7c0b9e70092735f3c1472ab86c21dd0e6a8449cfab66788a7d6d
SSDEEP 12288:nkSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FDC423BE964C41CBE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 5017c7209b47c433a978874a0a738f171c4bbea44d8d81e57f92495d6e178423
MD5 99cb86b11bc4d7ac982868ff6dd138de
SHA1 cdb3b96b605c184a4924713ba4a5572b04bb7853
SHA512 5c351f55d6ae73d8d2878a2e2cfea8692aec1eca7567e8f7a63c538ae52c2a243ce18a36a332cd2bdf4942873a853979e1e448d26e3a70dd0634f21bd1995956
SSDEEP 12288:UDSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C6C423BE964C41CBE52644B5C3E5F14DAC073E6BE92004937A9B7CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 f16c37f081ead516ae15e0c9409784acae6c5a99d455179af59ce5a40843ab49
MD5 743af67ae5941a753c853b7a68a5b4c6
SHA1 a13e727ae4709f28923b42184f312b0c1fab19a2
SHA512 2976000c6fe0716b57d7b1e171358d7d0694d4b172ecf68afa869c9e4d2d49c490c5a7412fdb51af2304ac7c4b38b0a6a6a2dd2c3193ffa41cb74d65abf9320d
SSDEEP 12288:e3SXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16FC423BE964C41CBE62644B5C3E5F15DAC073E6BE9200483BA5B7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 6c5d8e694ed4cae624e1d4c74576bcf445c127400a314ade9789aaf7759e1c8f
MD5 431033130322114368bf08ad7144c3f5
SHA1 a17c40965168664c02299a5909739c8d7509cad3
SHA512 edcad200b0a82e1f1722678fc5030af521a68953587dc9cba1745f150509c436ea3844456431de445d173732dcbdd2573c1899d09f0158f152679d217102f1e5
SSDEEP 24576:zZMRzFVSOasqjnhMgeiCl7G0nehbGZpbD:zZMRzfyDmg27RnWGj
TLSH
T1F10501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 220143038bacbfe395bff2b9ba364dd1ffffb5db9d39381f3f4f5b2c7e31b7bb
MD5 83ec71296ff17e35937c1ee06e7184bd
SHA1 b5a04bd85d5d9bfe3e421cb14c92b0263689ea28
SHA512 c89fd1fe95ecb9ca9fbe22466b93d78e8d4507b25058e7fb71973e8974c705500dba974cd4854e655283b8b4b1aa53ca2f1f93db6aa6865442c9dc4a42336eda
SSDEEP 12288:4uSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4jsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A1C423BF965C41CAE52604B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B18584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 d544b3568ddd3a89e01e121a7bc4326be6d04381ae6b534d086e9f86cf83c1df
MD5 a94a88947c6fa17a96fc287f8777c803
SHA1 1faa7ea95f1799e1ff05a95364370336a2e1400d
SHA512 afb354a5eadbcaeefa29ab3f4e9ed7a65c22edda7a09a74ac07dba888cbc4ab96c104711d702fac0dd17ac2cf04467fdaf5c627e446c97907a9948411e3ce66c
SSDEEP 12288:1KSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1PsqjnhMgeiCl7G0nehbGZpbD
TLSH
T117C423BF964C41CAE52644B5C3E5F14DAC073E5BE9200483BA5B7CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 a365042879ac5743e329f8f717ed378bf921ef44830a348e3d5ffce606b5f43e
MD5 43621d5bb683bdbfde3d429f57dd5821
SHA1 208e56a190e607c75416b6bf997a2007539add8b
SHA512 c6190301176d445252a6c83111572bfbe379a770b27c5c60b17a65f4eeb57f331f8c43466172171aa9c668a9465d151e623d8ae7f610fc447f62d43f98316e78
SSDEEP 12288:LyPz5L8rSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mzyGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15BF4125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 d41219e713737c4dc88579670c8c31c829cfea63d04c68400ba69cc8e9f67f9a
MD5 4f82e4e2cb7f75af27c08f09735ce073
SHA1 134c9e0ba22c21388106f70d9c4bcdfe05b34101
SHA512 7bc8d005e2254c2eb36692f1092c33fce6a6a37be927f984624f7fe42d9c630875a049ed900324fed03b3723a500602c0140dcad6f6de71139c8157e7e724924
SSDEEP 12288:IuSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T118C423BF964C51CAE52604B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B28584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 24a6df83882faa00ea64505333bbed125919927f695dbffa95089b00006f5ab1
MD5 670247accc21f15cc92fe23f868afe52
SHA1 56d70546e62f475b6ae69e3e12b08998877c2aed
SHA512 d70c2c9605eacba0da1c3071c19f65d018ad1a31834ed450abb7f3c7ac9ecf2ceba6d76b66520e17e8da0ab5762b86f1a21012bfd2fa82f43ccf699eb3bcc345
SSDEEP 12288:VuSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B5C423BF964C41CAE52604B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B28584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 986e898ee42d59e78b2194e5c287cefe9c61ed0031fbad9df2da559c207af187
MD5 432049d842564dba4bb3986d87d9318e
SHA1 f1d618e920be38b3718af875a617062def6a02e3
SHA512 997d05521268308dd75983d655781e170a100bdaa3b5da9226e1fa73e75847cb9ec45f43e5c1712cb1a3f0f7627fc3d78c2ecea66766dd5f9cfbbc0afc2fb35e
SSDEEP 12288:vyPz5L8rSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CzyGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C3F4125B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 44fc09bb2250b1547c3a273a4cfb44acbb901af5d7eefbd665226c127c3809b0
MD5 9799797b7cbedd515bea1a4548360792
SHA1 3c181c924a1a7eeff78e955286252f706dd09c2a
SHA512 43111c65609658ece8d7ee486835b3ec4c1d4a8e9ca612bc338492ef86b093d4bdca088dba91dfe68a5cfc9904612c2a2eb8cf55f8de68c439bbc8f3864b2b3b
SSDEEP 24576:jTDaLl3z0zDMsqjnhMgeiCl7G0nehbGZpbD:jTuLljBDmg27RnWGj
TLSH
T10B0501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 16ac10f5d437c1ae9a099b7a0dd3aaab3b992470439e7d172dd32a45adc8f55a
MD5 f8c0eca9faa9610d6d0946f82b368bc6
SHA1 9474891c814e159b462ee4daf258b92e050e0d92
SHA512 66f3d5eee61bbf56220ea2796c875b9edd39fb732be38e0c167f6f8a91a82bf283517596acbae205377c18113947439a6b3d1cee6b6002d34c0cf13fdca6fb7d
SSDEEP 24576:M3vd9CHKy7GZwsqjnhMgeiCl7G0nehbGZpbD:2vd9CHKyayDmg27RnWGj
TLSH
T1FF25CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 1bb0129b9d4a0a2ccc1b04be4d65771ce051619473e2835774f73e8f77320c4a
MD5 0425c5a2a5081d212296ebf612fc6259
SHA1 6c4d164c5d2fc26819905384e7d595d7fd6a9656
SHA512 81772e46d27f50502dcdf5d40de52d58d23a4bfabf68275fb28ac7a012b67e7e7a42d1803fdd4bc21e2232e37eef50b7f8e97bbc8e3e01597eb5aac8fde7d0bd
SSDEEP 12288:sZSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:s8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E2C423BE964C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B24584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 895ba221bc67a0eee1d2dfd3063f4d4feb326a9127a3aaf4021260d3059f0329
MD5 c8e5c0789ae9ac0a5c4dc6b9ab043cee
SHA1 fb14c0234834d428a9482e51ddfcd3e2e796bc5a
SHA512 720c401c6d3fefff1f5f6c5ec9fa7e2a11fab1068c52f885c5620d1e5e7a8ccee8b092410b8bf1f1106844969d97b215263b2cc581b39d5e7f8fb78f19d39a8c
SSDEEP 12288:9LSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9msqjnhMgeiCl7G0nehbGZpbD
TLSH
T14FC423BE965C41CBE52644F5C3E9E14DAC073E5BE92004837A9B7CBAE7F18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 b8edcd4eb06251d92c213fdaa0bd95b21f776e416849221e520757c581ada222
MD5 307936cf44db1dbf0a720958a556f6c6
SHA1 c74a31849ffd845513bf1fb25e2ac29eecf73678
SHA512 4e4155618b2c006bd1aa3dccb80d56d189661560335662ea240b6356b964035c8891a6aeb21a7d6d21b7e919f911b7caca157cb0c62fc6464f70a1575c9b24bb
SSDEEP 12288:+ISXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+FsqjnhMgeiCl7G0nehbGZpbD
TLSH
T109C423BE965C41CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 c2428b2da984912e171f6e69550c53f6f028331c2584519413f292aa839d3eff
MD5 4c43dcd3b96b40acee6375f24cb9412d
SHA1 440bbc1e5edfef8b6740cf9eb2884853b1a415cb
SHA512 fd5b337ed21d9233a54618855cc1eb3dff1e4337f8661736793cbedfb470d441b6412f1a6a49aebf97d80fded2c774e77c0ef58419cb61f5eadacc4cbc29aa09
SSDEEP 12288:SuSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AEC423BF964C41CAE62644B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 6a2c38905e5bf420e62c0ede4be328d9eab85276beb82cfa1622146ec5f31385
MD5 4d21549c296eb8ceef0b09fb26a15158
SHA1 c1a8e705c5b0ff90035757d1d761bd9b326ef4a2
SHA512 a96723bb76112f447feb4af5c2f5ba357919212055759181d19c6b043c234fbbffb144320efddac1f6224e6a74f1afda09d65a093a7e680710252e1c5f995695
SSDEEP 12288:8ZSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:88sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B9C423BE964C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 de93f3c82e506e612be2992eb3a9048d54e5dfeb57bc987bda77f0e537454dfc
MD5 f242ae698e6b6b3725f267f5710f4203
SHA1 b26f8675a27f68a7bfef09eb63964bedf0f3b8a2
SHA512 e412b548753e967927220680e336bb35a9b2c8c09a30b448060d7083e7ccb14870e12e41a496223c3691b81f3f5fa19e7b014fdd182b94aff1be24f919f0ad56
SSDEEP 12288:5mSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5LsqjnhMgeiCl7G0nehbGZpbD
TLSH
T143C423BE965C41CAE52644F5C3E5E11DAC073E6BE9200483BA5B7CBEFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 f33fc84fc540cd53fd48f00367f06139e76b14b7d36529e0c3010a24ee9875ee
MD5 f3ccc2f7c09e0b84f9c8a8b752ea290e
SHA1 c20a1b16c9179e7765043a448d5bd5273bc0a8db
SHA512 b1e701040e25ac6c6c73bc151c5bdf6f2e944e708ad6b0349172e25df3b36fcaa0f314c3bb845454c6de5d9b4bb828b66a3ba2cdf51e5068d005db75d8e5d39f
SSDEEP 12288:ukSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11AC423BE964C41CBE52644B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 d862b3fa3a346ff9540abbeecea0b76198a92134c9dace2f0ff5a957e07f456f
MD5 63a278a3564f8f944aba1eade09012e9
SHA1 d856a2125c9b90aca12af6053859101a1dbf264a
SHA512 5b8b4b16eb6d88f3dd311a8764ff4607cda8b8b0c1e7b68bd2b327d74c9f5c229bb71e653e4c9002aa9415ac4e4b095784df78de3f334cf4471e94d407afa70c
SSDEEP 24576:KfwvUk9RX6wkyAIfsqjnhMgeiCl7G0nehbGZpbD:aMnYIDDmg27RnWGj
TLSH
T16335D029EBDC44E5E177913C89B7860AF6B178691B31C2CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 aa5c413bb4a927dcf219f91b323a37cfd94886fe35a89f4079f719d512d1c2eb
MD5 3bc3c75283430edde51222d1fe0cb875
SHA1 559907f34ad86d742c5668ca05fd78bd6293de33
SHA512 184e334d2474737484f975a5d6c75af76c3f9df5ec4987173f646de695d4e0c253059ec2bd003bab5847eafdd2e690ce4bf36f8e2fd9bbc6dd478aa4acec4687
SSDEEP 49152:UYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0EDmg27RnWGj:jySzPsD527BWG
TLSH
T1A6066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 2a9839f9bd7e9df75c0a3708304c676e0aa96c5d52c01a811106aef1eef8e673
MD5 63a0f3eb19ed8fbf637ffd980341da87
SHA1 3944fc5bf5a95d878522dd1765247c94d5f3d444
SHA512 6036eb15ae71391471df4ca0f3b8f9c95484b4a6949dd723c738066554a22616b9a1d50b3a7abe22f9d2e4ec8bb4565f290bdf79643c449706729c2aa0780d88
SSDEEP 24576:H47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYqsqjnhMgeiCl7G0nehbGZpbD:H47JUQjTirIhCnDHUPfF/UDmg27RnWGj
TLSH
T18965AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 c126dc21fa58d6699bf58a76fce032702be95b80cd1f9286a9d42c39cb7a6b71
MD5 074587133b17a309ce0c24f5eeff4dcc
SHA1 030b07b7aa9c07488bb2c34acdf83aa82ce57e5a
SHA512 51e4abbd0d5b9b1e86a9c11b3705dec875cab4daa686a57f0184e6f96f8bac9bc3490e4d172a221a40a5940a2953ea28154301301fcab41dce8c52268f1bd1a6
SSDEEP 12288:lbsf+SXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ATsqjnhMgeiCl7G0nehbGZpbD
TLSH
T173E4015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 c1d31b20a807c0ad9dfa6d446d32976fbe41ac4f5b860d9a6a1e3b178075d8dc
MD5 0944845b87a01164764e77d6100125e1
SHA1 e53d4e1539e1b96426c6698ea2f3a50b010092f9
SHA512 c614f906f7faafc7ca108729edeea67dd479c73f39075b9f26e37a67d64295d80c4779a295d578946074bac178c8bd840b041035b52565ae9b8cf04a53a4221b
SSDEEP 12288:0meiaKctU3fzZOz0vQJmvnmIU1dHwLQSz5Z11Ba:0meNKEUPxUmvnmh19wLQc5Z11B
TLSH
T1113517007626DB4FC6A950321E36D6CCAB70BD42FE059B0372CA473FD576659BAF1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 3cb263e5c7effb707615e8889b07bb05ed86926048b917bb42cc80c24dba1f43
MD5 af53756c9b19e7832ab408fb85501a9a
SHA1 f17441475a4726d13d967da80143f44fab11d229
SHA512 b5549fa1ebc26e78906affc387007ecd08c2f338919e2efe7ca9d665fa9a539808bbc217c870706f131f50eace6b7806d2ef7753d622d79be6458f99bd0f9be9
SSDEEP 3:OlH/lshgbd5A/p5v4S7JXlbl3y8Dl63mCllltGlslslslslslsl6F7:K+hgd2p5zMmCtEEEEEEE
TLSH
T1698192024B549B20CE2AD03204654FC683A5C18A31989FA76201A28B0D911A90C61794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 bf6a2cac3c29254e964c97f32a9898ab12eb5c29b83438f9b07a94948eac423e
MD5 d6241a30043e9ea31696916755bee5a7
SHA1 7062ec4f8832bde2d2f9409de2a3345cd8f702e6
SHA512 d60c57402d1242d27d33c61eb55e0533b713216b4253bdec4f48f287d16072e3166a82a5b5d8ac00c69e8afe8790b16ad5baf3591da632ed849794fb93ffb769
SSDEEP 24576:gejL81I/OQaLU6zjA2zpT+qNPw9cybTqFfd64NrOP7Dy7QzClv:3UU6zj++imrACp
TLSH
T1B9754B016577EB8FC9BA50370732968DAB74EC03F7492F0273858939986695EB5F23C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 039f2106fe93ac86075b22888f09b5510be7fee9675c0c359dd068bba7ecdba2
MD5 cbd0dd296d259d427cb26f9bf68f1fc2
SHA1 426ad1473e13179f2f91319897aa70c796004669
SHA512 2a1efcf457ef5ded6235eaf81ebc560dc7fd1b4d289c180e0df55657aecd6d52e0f27d934209f73c01b402fe9736df86f7c4901d3f8019d6c98e5044d84bc2af
SSDEEP 12288:3072SXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:U7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T171D4237B935C518AF93605B482EAE12D680B7E669F1044C3BA4778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2278f26b4c5d080efcb5f0f5b06ecb11cfbf4e32ba62748659248c4ba8cbc43a
MD5 4d6d3bfdea2c8ba5c1deddb1cbc29f00
SHA1 1e9c385af01e520c3c04631c711df0848f1f04d1
SHA512 f24ef5b1a0985da6502d7ca61cde7c44d6f58d1864fd4f4b9c404c932ecfa94d5e7bf8752ebb12f96e361d43f3bdec8dce8ccdcec24cbc1f391786923f1cd759
SSDEEP 24576:Kgb6bmBIi49WNNFpg1rSvFv7bYdsqjnhMgeiCl7G0nehbGZpbD:Kgb4mBIBhGF+Dmg27RnWGj
TLSH
T172659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 058e8bd12d041f18bd8fc222331fad31a2a654c5a677ffaee2e45a1923b0c299
MD5 cb591415ffc6f28cdb0d5d2752fb8bf6
SHA1 0498b65298460d272a1f47a35fe7d2a4313f8b5d
SHA512 c4e45535ea94386c37849e309b556955db6587492917e1f579318a1c316d3cf1c2e8a0686fef49ca9818611a231beeb4759fbf333d577a19749423f67ed632be
SSDEEP 24576:NG88u8FpJqH1bzria7/masqjnhMgeiCl7G0nehbGZpbD:A7ZFPqVea7/ZDmg27RnWGj
TLSH
T18E35016577E401F1D477D138CA868667F6B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 dea9307e192c74cb01d141615204ef8aa4a7eedb6db9b7b8dbcd388b06b2a2c6
MD5 1a024c22564cef62fddf43636aa4a0dc
SHA1 bcad4734833d9ddd74f57d69e9086bae82ddd6c2
SHA512 ca3b193b672135a86405f90978f779b825174c7bf8788b10c5108f3ff00695aaaa62904d0031d7787000565faea74b035af04ef45652c6d15dfd91b79256b779
SSDEEP 12288:EHvUrBFrEjwaQzSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:EPUr+NQesqjnhMgeiCl7G0nehbGZpbD
TLSH
T19005F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 d7cdb1a849788f65a70072cdafd4dd079c233d354053f5d881eea9662ec39b01
MD5 7fb975eae0dd9f292d8198bf39302739
SHA1 da3be807f34138d691f259359a2117ff09860975
SHA512 d36f943b7ef9da916bbed09ae3adc6cd574770895ecaf7617890f41131cea58181d929956fa78acfaf6199c15bb9035c46ce7ab60efbcce53bcc82e8c801006a
SSDEEP 49152:fBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjiDmg27RnWGj:QG05lO43b7D527BWG
TLSH
T123D5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fd21c2b99ab713064f02abebabca4eb15de3b5313a42a43ed653578c10bfbabe
MD5 014663de2db3380b0e266600f726202d
SHA1 5b7aa58d0f2a25e0ff00359724344ee3afe09157
SHA512 51d5169773fbb4d0656e937b55d913d3cb166ea4af7c82d13f21a80ac6ed5038bdfdd706e44e09df7a6417ec0267f8021f86f6c7788e49c4b0f0e7cdc9e2006b
SSDEEP 24576:0fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnYsqjnhMgeiCl7G0nehbGZpbD:sa5POZ3BJt2pasx2+mqDmg27RnWGj
TLSH
T1CE65BF5EA7FC00D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 fdb674b4f4e325d15ccf25e65ca5d9b17eeb01650ab8e9307fa2116dc0c7e82b
MD5 cc47be5c2830cf4c3aa45872f39f6922
SHA1 dc5a1e6989342252c86388ee83bebb9b3b53a895
SHA512 b9f05b0efb7b2a9e9339997456abfc5b7cf9461e126e644141241b676bae5c19134f8eb1bdbfcd28e1c8fa7fb50eaf00e9df9a4ea5be3eb8e6b3a05c17d35273
SSDEEP 24576:BNcwHdjbyQ4nLC18lb/EOjowL7FkysqjnhMgeiCl7G0nehbGZpbD:BNc/zEOVHF5Dmg27RnWGj
TLSH
T11B857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 56a34466ca2f99c9b0bf587b46f0d91e1b69c6146ea9bdefe6c4f15a44785544
MD5 119e66983eb4287156858476d22e5d48
SHA1 fe98b92fb20435cb47f5d216cec2bcb3c1e0aac6
SHA512 85a23e2955f624f22f61f84d6e02db89657916305519a7c9e21038734e9d2af16594f4ac8eb96401c6aa406e844a0b455815df4c44a8654e60adc9b0fce8ff2a
SSDEEP 24576:NTkNvNnaFeYhJNtmZBm0sqjnhMgeiCl7G0nehbGZpbD:NTMwBtOmQDmg27RnWGj
TLSH
T19355AF6EB6B846E4D1FEC6B4CD238516EA727861073252CB5390C13F4E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 09be904bf7be5e1a6f937af49095932afd08015e94489ca0bd8bb31468c32b21
MD5 31aee5122d35e1119a336362200a5696
SHA1 4eb2e828e0991a7def8539d502b32a9b6d1f8f00
SHA512 7037af19d75507d95daddacdc38e39b356190be1121c33f151364f1cbe222b6062701a2637c54315938fca620af182684c79c1b8ac34c87cc88eae96c0698f09
SSDEEP 24576:iD3FHshBIYQgA3sqjnhMgeiCl7G0nehbGZpbD:iDVHeBIAALDmg27RnWGj
TLSH
T19125E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1520-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1520-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1520-307-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1520-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1520-100-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1520-94-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1560-92-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1560-21-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1560-20-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1560-14-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1560-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1952-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1952-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1952-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1952-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2464-61-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2464-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2464-55-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2464-271-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4640-8-0x0000000000170000-0x00000000001D0000-memory.dmp

Download

memory/4640-0-0x0000000000170000-0x00000000001D0000-memory.dmp

Download

memory/4740-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4740-73-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4740-67-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4740-287-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5136-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5136-119-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5136-125-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5136-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5136-127-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5248-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5248-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5248-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5248-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5248-106-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5684-45-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/5684-46-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/5684-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5684-49-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/5684-51-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5684-39-0x00000000016B0000-0x0000000001710000-memory.dmp

Download

memory/5712-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5712-87-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5712-81-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5712-320-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5712-322-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5712-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5988-305-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5988-108-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5988-114-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5988-107-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6140-77-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/6140-302-0x0000000000400000-0x0000000000497000-memory.dmp

Download