1cc3a0ed41fdb8c2aff440deae45b83b6e4b194f963944073eaa0eb20a5933ca

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 12:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_e815cfcd9853898a76cf421fa8f5adcd_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe
Size 6.0MB
Sample260713-pzyfqsbv21
SHA256 1cc3a0ed41fdb8c2aff440deae45b83b6e4b194f963944073eaa0eb20a5933ca
MD5 e815cfcd9853898a76cf421fa8f5adcd
SHA1 8b1abe27f186fae3d2019eb1c60e5766cb2abf97
SHA512 505b0ae6eb072706f03de97b8a905f2d15c7fbba8394606cd8f3d9b355dba1c76c840209e294d1078c490e27a2b61019c14c1dcf32df69a83a5fbb01cfd3bd96
SSDEEP 98304:EL+dsi1nhrMCe4bzM7whp835Tw67wRGpj3:myTr7eao7wf8JTfF9
TLSH
T18756AF66B3E800E8D47AC17CCA564523E7B2B81603719BCF16A4967A1F33AE15F3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4248	elevation_service.exe
3020	elevation_service.exe
1952	maintenanceservice.exe
2752	OSE.EXE
4628	PerceptionSimulationService.exe
4484	perfhost.exe
3372	ReFsDedupSvc.exe
5568	SensorDataService.exe
5040	ssh-agent.exe
5540	AgentService.exe
1112	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-13_e815cfcd9853898a76cf421fa8f5adcd_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-13_e815cfcd9853898a76cf421fa8f5adcd_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-13_e815cfcd9853898a76cf421fa8f5adcd_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-13_e815cfcd9853898a76cf421fa8f5adcd_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-13_e815cfcd9853898a76cf421fa8f5adcd_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-13_e815cfcd9853898a76cf421fa8f5adcd_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-13_e815cfcd9853898a76cf421fa8f5adcd_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-13_e815cfcd9853898a76cf421fa8f5adcd_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-13_e815cfcd9853898a76cf421fa8f5adcd_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c4e3ad7b763f1d8f.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-13_e815cfcd9853898a76cf421fa8f5adcd_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-07-13_e815cfcd9853898a76cf421fa8f5adcd_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	2026-07-13_e815cfcd9853898a76cf421fa8f5adcd_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	2026-07-13_e815cfcd9853898a76cf421fa8f5adcd_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d11be7f4c512dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\explorer.exe,-22000 = "Desktop"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dfd149b3c512dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fa361cb5c512dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c3031b5c512dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4248	elevation_service.exe
4248	elevation_service.exe
4248	elevation_service.exe
4248	elevation_service.exe
4248	elevation_service.exe
4248	elevation_service.exe
4248	elevation_service.exe
3020	elevation_service.exe
3020	elevation_service.exe
3020	elevation_service.exe
3020	elevation_service.exe
3020	elevation_service.exe
3020	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	704	2026-07-13_e815cfcd9853898a76cf421fa8f5adcd_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe
Token: SeTakeOwnershipPrivilege	4248	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5540	AgentService.exe
Token: 33	1112	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1112	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1112	SearchIndexer.exe
Token: SeBackupPrivilege	3372	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3372	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3372	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3372	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3372	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3372	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3372	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3372	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3372	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3372	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4248	elevation_service.exe
Token: SeDebugPrivilege	3020	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 5844	1112	SearchIndexer.exe	104
PID 1112 wrote to memory of 1240	1112	SearchIndexer.exe	105
PID 1112 wrote to memory of 3856	1112	SearchIndexer.exe	106
PID 1112 wrote to memory of 4904	1112	SearchIndexer.exe	107
PID 1112 wrote to memory of 2948	1112	SearchIndexer.exe	109
PID 1112 wrote to memory of 3456	1112	SearchIndexer.exe	110
PID 1112 wrote to memory of 2284	1112	SearchIndexer.exe	111

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-13_e815cfcd9853898a76cf421fa8f5adcd_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_e815cfcd9853898a76cf421fa8f5adcd_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:704

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3020

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1952

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2752

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4628

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4484

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3372

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5568

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5040

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5540

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5844
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1240
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3856
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2652 2648 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4904
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2948
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3456
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2652 2648 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 733ac8e5e250dd22139518ce7c990876a11f8757dd080b8b6b8467586595805c
MD5 f969253e7b7613755ab569bf54a0b379
SHA1 293837fae63a2ab75581c029fb7bd6dc7e6892a6
SHA512 cda33d908d65247e71eca266d30ea3bc63306050aeabb11d479c4032af564688b58b1916ee287f38ff582c1335b8cf1e179c22f3308be7f4dc5baa3053ab9a1a
SSDEEP 49152:eb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnHLNiXicJFFRGNzj3:g3q6mjBw7wRGpj3
TLSH
T125D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 13468fdcbccb592b6234f203f8af57a598849015bddfa46b42080c6b2b29b935
MD5 2a6a8f70f79c5283f8200df7633a237e
SHA1 2c767b4c7bf00a55f94c3b8578581dd42f4cb39c
SHA512 0d5b980f22993fbdfb31527063dcd16b716e99419e0af2971fbded0534e7a406d0079a5c5b751d54e038daab240745a6b18e6f73a93a0564b8ceefe5cc3825e3
SSDEEP 24576:6XYfDtczA0/TwSfVcYG3K/cJHlnFR+IGNe8j3Izb:htc5LNiXicJFFRGNzj3
TLSH
T14975012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 ff68831777866447a719731cdc5f63ac49fe5c8ef47e9b0e57ec2056ceed6f44
MD5 f334cfb98d9e1278a3c5968b7f341337
SHA1 c3583d63336a02fc1bd6d03aa373960cf96de3f2
SHA512 9300195816d0f74aac7f242ce347f3105e36e5be694cb44c3fcde25d7a1184f321eccb373923c33bd22ce1e9e915da2950b940074ddbe0a31215076bd9f91ddd
SSDEEP 24576:n0Le5ji0hmxhrM8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:nPji0AzFLNiXicJFFRGNzj3
TLSH
T133859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1f8b7852b58668c138c2372064b0acb7fdc205d6cbaed8141253ddb119c29835
MD5 2ce5eaba684fa8b515cedc6a24a0a6ca
SHA1 de089adba68922fa07586fe2fceed4918bd374d2
SHA512 b1651c29b140d3b55c888b1fc82e3d2c550af8fc9319b77ba4db2c0cffde366445c9537af04f9051198ae364204412f5df4da40b05838c47c2d56ead9458c210
SSDEEP 24576:5a7/ezSC6vUyD/aqgrvWj6q8wyuS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:o/ezSC6vUzPv+Hjy5LNiXicJFFRGNzj3
TLSH
T12E756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 35ef7535fd169db09d94716756a193a267e780b560bbbdd3bf165e0f9ff86b5f
MD5 8d5390ae2978c4cc9a137f410ffb6b6c
SHA1 e1262c523d1b167e83a24400a73c8029a1608068
SHA512 84655ceb490cf5e0723f537d4c118a97bfcefa6ea1274393c4c904a9d2b5b30393e991d8910e1cd076faa663e42067b0efa7338d45ede5ddea4fe4ceca9356e6
SSDEEP 24576:YVbqPb88hv/l+BP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YVO88hXl+lLNiXicJFFRGNzj3
TLSH
T179559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 edac021d90ab1d80117e6d20d3d5c92f82f8cb12ee5d4f91a0b7b12868bd14b5
MD5 a71cc731085850fe6b537888d719d39b
SHA1 e577579de8f3889f8d2311c42f527c6c1643ac50
SHA512 e269afc8706c226a60d359b1b8749c0ea451f1a173d4fad2cf5a2e6db9f159e77b62747287a4910a1a96f5231bb1804863f5ac55578c683dcb67885da72dfc50
SSDEEP 24576:LGo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5LNiXicJFFRGNzj3
TLSH
T1AE5523D3468854B1FBFD003A867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 a2620aac79558e0ba3cfd5e0c3806ad07854dfef5f74cfb756edca65b59b6861
MD5 e4b69b5ea707cf39585d0119660a1252
SHA1 9a815f8f0c9746d9bf9d51c2f7f25504fd7f861a
SHA512 9af620ae4f95d832969b2c67e0a0b4b655647197b0a483691798d77278e54b5f86e91f8d2ca369ae93e4ae870d4b0e4591aa36cfe94eb681dc9225daeb41d560
SSDEEP 24576:QJIUH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QJIUHLNiXicJFFRGNzj3
TLSH
T1D775CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 59b44f5f071447f1ba2b2867d98a0a5823f89222ad7d59518aaf4a6d3c09906b
MD5 e78270e98ea95d1cd0e7a4c0cb4792f4
SHA1 4205a2ede87ccd1ec5686fd825b502303ddbb392
SHA512 fb5e790f3ee18e6c65959d44b539e49d3b373f6dd5684e728405c7bbf83222f1d07021a3ab3a80ce0ba47167a4f35a663ed7ec8080faac4a5df6ec6c8098f3b3
SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THT:RQvGAdlCEL8c/WRNw5CC7wRGpj3
TLSH
T12B266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 773faff3490ed8243645221efe8146f088a36943bce82b496a20f960f8310680
MD5 1f3aedd0aeab4441f3f5f6adc4dcf161
SHA1 2b7fc43319276c8f33e94e8cbdf8d591e9394718
SHA512 2acfdf9a3a15f5455a5ef6dbbfce1680fb8dad5a3dcebb010fde9155316944fb873511f9f421468dbc2af98aa86a8b61155f7c3c530226324bd9d9c91a690dcc
SSDEEP 24576:cfewsAj1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+lj1LNiXicJFFRGNzj3
TLSH
T16F75E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0efbf16af23672c96fb4504458f0c17f335a02d264ca0584a6c256bd08e5f92b
MD5 131b461e1cb068afe3446e69426f7b75
SHA1 340c57f0da49de6f0ad0f178b6ae3b9a9731f436
SHA512 a260fb98c4df71ccadb0d3f0ec18b4ef3a999344e8de8342c5e68083b88508040c5dc955f39f166ddbbf166aded599255f5864fb37650130d2ee1dcae30ec688
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHBF9:wUEtQevvqc2W1cpV20I32X9
TLSH
T163474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 171fadbc55a5dc5bea775058387158b9f4d5a8d40eac7ec5bc6fa4f0879ec398
MD5 ce2edaf7746d095369f06c432cbad238
SHA1 9b811c4b7a20fc929211330ce33548b36dd953d3
SHA512 bf70a49dcd3bf279efcb89f63009db928b9757c0866f111c97499b7c44ce130f3680496ca9639ffddafb721afbde2ecf3c08ebcf981dfc978bc80b4bc5ecbdb9
SSDEEP 49152:dCbRquA/m2yL5zLfFiV+XenmE3/zVLNiXicJFFRGNzj3:aoq2VjnmW7wRGpj3
TLSH
T1EBD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f1f1c68bf4475e1c3addcf607b69b0671304104fd5a4a838dda660e25c78a3eb
MD5 2bfcd7cd4091fd45d8b088d6403de7e4
SHA1 481b279eaffec1e7aaab3b798c75ff8eb0d1e149
SHA512 cc6caf763d6beea5e839e342764d24975eeb73e6b14a6e6a0420eedc39a88eaa35c10a983580cf05a106c667840249ef80520c15809f5564660630683b6588ca
SSDEEP 24576:jAhGL6IFoiwtA5l7S532/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jAM5Foiq5GLNiXicJFFRGNzj3
TLSH
T169359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 9b7c1d34fe9d2a61b2810ee07192ac9ac44f30f5b91fbd6478d3075f4adc25ee
MD5 1aa8f19ada36970ed904cfd5048b92a4
SHA1 e029a28eb550cf1b1463017b0ed71c3c64bbf944
SHA512 32f54506e45eb6ce0ff880481ee2476796ab866adb488175b75654fecf80832229b0a25f54d4897c846a26fa09f4514e28dd32edd966300b73c6dbe2b1b8b982
SSDEEP 24576:dwuROWm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dwSORLNiXicJFFRGNzj3
TLSH
T12F65F18632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5ae2adb3f8aa147dd0d01f95cf08d3328bd94d8fe6d5d238e6866ea052cf9df0
MD5 76970e8b06323cfb28ca31d74270272f
SHA1 8570b56e43c389a4f15b8c094789020388cdf059
SHA512 1f25af49954d0137d2b68cf783634da1d1aee124eb0cccf7ef8f7b201785acd9e111d58c618e80736c18b547b9b6bc374e366d4e9c81bb063c2850de07a79501
SSDEEP 24576:ZZu0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fLNiXicJFFRGNzj3
TLSH
T12955129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a8f5844a9a796e70ebfe831b8108de2a226632194d2068fcd6fe8f672113bca6
MD5 a42b4ffd7ee03350926beba270ef003c
SHA1 fa41ce31b4c2928da8f0b671942473525d57f985
SHA512 425cdf42e450b08fc8e4abc1247b073c8abe17fdb758ed3d9225460c0f3afaf3cefe346cd2414394e5589050fc1e3fc0ce803d09459f5109532824da12a095d2
SSDEEP 98304:rQRQyi36YOcPDLvw2gAf+PN377wRGpj3:aQyiKanX+PNvF9
TLSH
T19C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f361b2087c5776ac67dc3a0bdb4c93eca1f96e63bed4b5e52fe71ebca9b6a470
MD5 e4e1e0fc7390680dfaf376869555ac0e
SHA1 4ef4dcf95e8f62bc50ebb64465cdd28ea52fa32b
SHA512 427c33300af3337f11c8ba0855b4f56129aaf7e9f051f17a9ef24f474507778aa44700b4f8c7aba1799ab8e2cc4374eac935520a4b97c47489128c4ea507d483
SSDEEP 98304:jQRQyi36YOcPDLvw2gAf+PN377wRGpj3:yQyiKanX+PNvF9
TLSH
T1E9667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 84f6ef17666b8ca9b2eaf4c9f340d127e5bf3efcdbf215fac63d461f4f3ee96a
MD5 0a63817f8d0dc2b7727c789e08887b60
SHA1 7e89894bb24792e9f619da96d123ea3ec0fea0f8
SHA512 1865d762334719ea5c68907b2c68540e4120da0e3acc19e002eeaffb125ac45b698f8d8ff56173a50e2fef56558ef184b82013f97e212e5180e2484f153cb819
SSDEEP 49152:n68Qg55nhkeWu7PNU3/FLNiXicJFFRGNzj3:RthTRc/F7wRGpj3
TLSH
T18BB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8ec3d823673b8971b4b5cb14032d6f376244ce05f8e887a9c4f8f746f13c8591
MD5 d553a8d378602691e88c6852c2923765
SHA1 06bb90e7b2387e1dcd62e5aa235f59abc6e37836
SHA512 9f3bce6baf4a78b0bb2a917484a449971e796677248caf594ac56716e662bf537d8c05f87387310fe1c2fcae9298a7711559fca202d7706bdc29b7788022f127
SSDEEP 98304:Fy5112gYy5azzVvU69nLKnhZo7wRGpj3:oLIHRWhSF9
TLSH
T18E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 483f3ab35e149b6e7893b7964770d0d779993876e7ea4a6c632bebe9a0df209c
MD5 2aaf388ea5587982ca225949dbd34da9
SHA1 8058204225fac9fed9ebc99358efd1a1b3bcbf04
SHA512 28839c967e293f748bdbfb6ca8944307b4ae9742d8d59058fbe26c2d296cfa8e1458f7acdde689b92a862cc6903d5cc5f93d0e357a4c3eb41b6ea4ecaffffbda
SSDEEP 49152:BB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glkLNiXicJFFRGNzj3:Xu6JmIxd2dk7wRGpj3
TLSH
T166D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 db00e1c3a893695086d8a5ad1d62a919dc86ea8bf482e2dfe77928d6e8a93190
MD5 13dbf368d924e261220ea70d3ba31e90
SHA1 2d66c9577346b1d2950c1e9771a7f5c64b3da59a
SHA512 f18675ccf4a042d19177846d47d45207d68e03fe56a27b762696ad0d5e86999c748837cc5dd2857f1d3788046c54be369598119ca981a3e657f25f89a129e9a6
SSDEEP 49152:g1hpsNoJpF1A67U44CwH7R4xnLNiXicJFFRGNzj3:gmifPqRW7wRGpj3
TLSH
T171B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4f4127872b5a106825cc36cd27684c7ec73b0e2c8bdea541eaddfa7dc76c9846
MD5 fa9044888e91d2f1ae76b7690d69e94c
SHA1 86b85df067723a5a26a7c1748458ae51da77e6ee
SHA512 2a2c0f1ed3f23ca8a79da7d2208b1b09302631df7b0a20197107cdfdd490f6edc01e823653ed3ff8df1344ff0464d90f2261e81853a709b24d39e2f829fc82dc
SSDEEP 49152:eSuZQIY0Be2KkRVtOnks6NMHq0LNiXicJFFRGNzj3:w5dKqi6107wRGpj3
TLSH
T12EC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8e2dbb5b616c85ceb126deca8eb2496b12f09ae0a5aec9cb6239d58e2ce25dae
MD5 1aa6185462cb6df4a589fdd8d0df6f9d
SHA1 e68563ef5d185d98744520a38d2db9516972cd16
SHA512 1e4e5ff5c369eeb007771fadb6760c8a1be760ce7b0f6cb1ee1211a81bab699f2ec231feb2055663a5a5bbcedbb2b4d0b13f2fd45b607ee0763b605e845c154c
SSDEEP 49152:whtSn8EApI0figjgiDn0AP5wDLNiXicJFFRGNzj3:hX2iWphq7wRGpj3
TLSH
T1DA95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 edb162237ee1abebce6476a53fb80a38a3cd13bbdb8101ba46a98a1408f6d3a0
MD5 73bac7f66d3d792e225eb4082fce10bb
SHA1 ee2d4e6a7a6307be870719e6d5b96b930e0bdb34
SHA512 46d525a5e1cf15d4d9b131c26e6fac2c9795eb2b8289ad003d7c3aaafe9c48a2ce26f54358fc31ac2f633b4a885022d9b1f886d0cdcd278243fce117d3f0ae86
SSDEEP 12288:OWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Og/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DE5523D3558955B1FAFC003AC6754428F5881E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e77da6b8256da6d34fcbb1f85d6346a26b4b9bf118b9a4bfc4fb4b228974b3e2
MD5 9c1de00ddde8ed68b1d2f43248bbd22b
SHA1 79c2b6fcc63bec6d3c16109cc303982b9bda86b2
SHA512 077e5dc826fa7e50b39759aea436d231a116d175c5d7695722566c6c222342bf4cf3baad03b15c5c839c35004c018df1796628a95e7241ca39bb77efe27a744a
SSDEEP 12288:79iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7h/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1435523D3548955B1EABC003AC6754428F5881E2DEB5658E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 ae71f28bf8ded5f4da86d99fa37ca169d7dff2df56a083da11f125ffcac5b02b
MD5 1beca24391c0a4d3180bdc1768c4ab7e
SHA1 1e2c0c03f1a60ee5f9210565b0df17b2e38548e5
SHA512 3e61c22cbf518c2e77674b1c1fca982099b751cf2dc2d82acc6e3fc21a1ed36bc3e74346b8209d3d39f7c4a721dc33f14d6d2b337bb4722858312ede068a3783
SSDEEP 12288:KLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Kf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C45523D3548955B1EAFC003AC6754428F5881E2DEB5658E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 7e9acf3f7959a49052b8cee57119186ca21ef7d8c32c7b4aaaef634c5dbcdbd9
MD5 c20f30e9ea6972b90ed0b811aafe7a98
SHA1 298ffa4e422345f6120a9c5adc8ad558f0dfa36b
SHA512 795e9d117e7944f4312051e0e0b731ae1b0818de9b8ea2b8f3fa00e05e3b0c8bf7c9e87af0032faac1f3dc43719ad4348b6e858093db1a4cbd9df968a3c756d3
SSDEEP 12288:YVsiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:v/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10C552392168900E1E9FD803DCA764424F2A47D6CD7325AEBD3003D1E5674FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 be38064c2997b924dff8280ea52ee34203bba480d491ccbc03306a5994a9bd12
MD5 45821d9aaedcda5819c33cd660ce0629
SHA1 2fdf487524a4c30d46e62422e044524b16d81ebd
SHA512 2e40ec565337d3067786eb947b9358610e64768cb95bbda3f7a6091c5a922b58e9449dc6c6866c5d0fe4ff3f9cb76fda1aff5c6755274fe80ba2127eb2c953ec
SSDEEP 12288:dUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:d+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1805523D3548955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 bb7ca72a0b942eba8e6c932e45fda4ff7485128da66a870c189a9ca211b66d6b
MD5 0ee9bb07306c715360dbf201e537f828
SHA1 0a99e2d0323ab86477b10d769e1929935b0c01be
SHA512 49a82d73a26b7f1864a1fb65d93e4962a475150cfb0417494ea8074ab4eda13e53c736489aabc2462d7981082eddd6fda9b84ec57830096b81552419bdfbe6a4
SSDEEP 12288:YBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Yt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1395523D3548955B1EABC003AC6754428F5881E2DEB5658E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 4c88dc525dbb84e5ed175649511057f5a019d6452665c4a6f9974e0fb2d07f25
MD5 922490fa739e97d4d95470cebc2049c5
SHA1 b96e186b519b49cc8e19a0bdb2af3a434df98e8f
SHA512 791ba96e9b6abdecdea3d2cec1a3720a88a91290ffb997675a01ab6a6c9ceee2039fc63066f780e66173a4c6f3fdb9db4e773ead4c026c0d55d2ebaa855efdb6
SSDEEP 12288:8liJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:8p/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F65523D3548955B1EABC003986754428F5882E2DEB5659E3E2083D1EE27CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 4dfa49df210a916e188261beb2429efd20d561321ca339f8699ad08a7d591f3a
MD5 1bbbec1977b632f9fae0d2dec2fa0d6c
SHA1 ccf5b4156da397cd83d1395cb6a4ae8973fc1043
SHA512 c22abf23c85ee624679b44f049360767da247eb6a06ebea060f46cbb64956d417efdebec8ecbe55a12351729cc5ac9465c7f0866d6f714517d7cefb054884508
SSDEEP 24576:WZM3zFVSOB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WZM3zfdLNiXicJFFRGNzj3
TLSH
T151750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 cd3209ed783c8c97605cb359ba1eefe9ffecf0839dc00eae777207cb746c54ac
MD5 06d68eb672589ba205b8c937315b2d84
SHA1 2dac76e0490b1c9d18b85cc0578a17383e19353a
SHA512 92490ff811f8784d3a53ed0dfe764311292163bb2d3d82f0724bc07735abb103e7d390bf2e1e46140e91d3cf55f603190b912691c96f9f75a50123523488382f
SSDEEP 12288:GiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Gk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17F5523D3548955B1EAFC0039C6754428F5882E2DEB5659E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 9e5ece541e5456da991dffea10945a35973344f4851c68cc847d876365580983
MD5 072305380923a58eb33825f726e98a80
SHA1 8180f488677e91bf5db48bdf9067df6b20728605
SHA512 bc2b31a566431d6d89fdda4e189b72aa10383d9517daa8d688c53b5457dd576bb5f473ba766ea6cf7ab42399726a9f354aced907ccf41675b23fffc6dbb0a222
SSDEEP 12288:HuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:HY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1115523D3548955B1EABC003986754428F5882E2DEB5659E3E2083D1EE23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 14087226b41fe1c10b4e96c34d6dae895fbead9f3d816c445e8b6271f5543b91
MD5 e17b895a41f78c9ea578a770a450ab5e
SHA1 4356dbc7ff2e010f5a9403388d1ff848a4c376a3
SHA512 990d1f410dc847998f471406167ad812567bd8775b78abedee56b6b5b3d5171e5e3506bcbf443b43bb7395d5e91e566da343b5a09ecd0ce1adf825a0364ef530
SSDEEP 24576:Azyl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AqLNiXicJFFRGNzj3
TLSH
T13B650247629530F9E17A4139C9620915F3B17C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 8015e7f9b57cbfe51fa7d6fa8b08de4d392d8f4e3d00988d1fa54d9a81ccb15a
MD5 a3620f859e2e2711ad1ad425991628a8
SHA1 e5894746a90c7b97382fbaee11cea5cb8d4b7aa9
SHA512 5066c02b96f154bf54362770b6802d1481bd103ddadc2b79757e90e67ac710666276709ece51e5c570232cd3e4047386b5c4ba9be881a61b456732aa5bb4e4cf
SSDEEP 12288:QiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Qk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BA5523D3548955B1FAFC003A86754428F5881E2DEB5659E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 cfe904769de6e0194a5c9e1ddcd60f72d3766f2737cf5eac8dc9cea60b301bbf
MD5 b23f83b4d095d292b2071656aecead0e
SHA1 3d25a1238dab292e1db37e2b0dae9fbbfbeacea6
SHA512 5607ce3779f94c087d6f1903916f59c6c3eb7536a8cd017ad32ec709dcc3e0d19dbd65273a86e9e89fd00279b1684c58073070b4e4e3ff4f497b07e6a1faf9bb
SSDEEP 12288:QiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Qk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CB5523D3548955B1FAFC003A86754428F5881E2DEB5659E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 f2dba11db2a1d06b865836d8814b2991606d5a11f5488dcb0b698232fd6623d5
MD5 04fff5fb9e82f9d698ccff663e768908
SHA1 4b2d9355a625082e886d42a58122a15f1fb287f8
SHA512 feab7e9b12aaa7a0d2827007eee8a1053da25c2ceb17a271f7077f7beb6597c0d68e92369ebc79ead76c046ede7df77072b6b7a71e7f371109051d054fdab49c
SSDEEP 24576:fzyl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fqLNiXicJFFRGNzj3
TLSH
T1F5650247629530F9E17A4139C9620915F3B17C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 97269f15c3e30f3d0c87fac83083d85fbaad6aea511def933b2520cb7870b4ee
MD5 13df2cbe7e5b5f3f1bd588b6fe9588ce
SHA1 5c97271d6b90a8ec3a145bbe52975a6eff0829c4
SHA512 ed72878399e9e1141c8bf8eb4a9e8d999ef292e91aadf73b96c493687f34dc7cac8b3e98725ef0e6b36287aeb02ce17f1309702ca2466d1b15a5991adc657f2a
SSDEEP 24576:oT8aLl3z0zDv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:oT7LljSLNiXicJFFRGNzj3
TLSH
T1D97502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 a2179ab1ac8e01a8219884b8344b4043f87fad646c068abde2ce706f7ac3492b
MD5 e43ba7f9c31c881aea09b71c4871f27e
SHA1 385a1ab59222ba6a8103987e565c5ec332051332
SHA512 c7416ceb89c9715c9b47479fff595bb4f9e13668aafe8a0809fe6491af81864165b226c32e5fa9d7df7a3210b074c97303896bb3f9314a34d791496ac832f1af
SSDEEP 24576:I3rd9CHKy7GZb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Srd9CHKyadLNiXicJFFRGNzj3
TLSH
T12E85CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 e421eca331e48359c6c1cb2779a9e02ea549b3017191b43eb54f34b95a0f7993
MD5 be9de04ebfbdf8c927b37f5c4f11390b
SHA1 1795c174cc4dbc9dcefe3e3ad8bd54f7a3c16dbb
SHA512 74ae697de1408095481e064b035ca26c230112bbc9bcbc39b4da52a4f3cc17d589d0cc43d207e57908d0d3b0ab6641360eabdf2af008dfbd48801e7ce4a61006
SSDEEP 12288:nriJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:n//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1425523D3548955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 00b248afafdf58cffc99e037644a3effdb2711a8896a2c802d34d57c07d0822e
MD5 440b89d1ed6e2a6c304edbbad4a22660
SHA1 c1eec842e2f91c3a38ea9b2fc9846e86336a6651
SHA512 4f045cd2d1ca026b5f2d7004d27c255c2ea5c9b355e3db3e3e918a5fd5849429617fefd90c6007966d49766c20ae0e65a07a84df1473b9be7388f1377b21c13e
SSDEEP 12288:lZiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:lF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1575523D2558955F1FABC003A86794428F5881E2DDB5619E3E2483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 d1285475c1406f41b86c61ff4336468d0ebb6746575a0777065cef2eb6c5939a
MD5 9411544ef94faf6c81dea1b31efdf3ae
SHA1 3b21010c707e8359ff04813404ff31b447ec2309
SHA512 81146793122ed004cb69a9181cab45e677046c414abe6d07f0a7e21d9b3ff7ac7824fc9f0640e2028066cd4b5445e55ed7569facbf589e339c0a434f8129de83
SSDEEP 12288:/oiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/a/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1205523D3548955B1EAFC003986754428F5882E2DEB5658E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 36a8aff6233dce3d5f24c7f111c4ff0247f9b1e6d0037defe5516cfe41e363d5
MD5 0add50c9f95c8ace2f578ee5de9c5915
SHA1 03eab911d7e1bd14830b7d803b81f0088640bfd6
SHA512 15d88f1c5416b5a6ec2b4f28a2020e1c67ae3c6decae378caccab208e2ce205964712df7b2fc8fec85bce09597deb911a9ea208eebe605745830149ba1e31a81
SSDEEP 12288:7iiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7k/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1445523D3548955B1EAFC003E86754428F5881E2DEB5659E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 71ebc94ff93b563f11c0f03fc9f44fb18eff80d2de7cb0ed15feaa3a1eaceb08
MD5 5e3d75a64de6ef528a27ac3777be99b8
SHA1 6edafcc03c0a110451af90c1c4dfad96247c1b53
SHA512 310fc9bb696de17b044138b8fc15964c850da7a3aaa9419a2caa938b5a1f3012ca20fa6cc609ee791235cf8d02a664c0c7966de7aa3c5c24633ce2509a07ce3e
SSDEEP 12288:QriJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Q//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1465523D3548955B1EAFC003AC6754428F5881E2DEB5658E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 29caab0e596fcb436d2b0e7968ca801f0e310c1f84574e783a0cc73e1846b192
MD5 1724658e3beb3581d71545e002999101
SHA1 f9ba8fe8b3d3086fa69a0642241540ec3346fc9f
SHA512 0a507b4066111549b766d612720dcf7f3bc127523224ea82fa5fbac121908bd3ff8d69148a846664bbb326ea0c8212c0e08428ee3975eac9e7c865d2135ef052
SSDEEP 12288:/KiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/M/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EC5523D2548955B1EABC003AC6754428F5881E2DEB5659E3E2483D1EE23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 5d88afeee9d257cce7e15696f9519d83fbfe2c67f594240d98b7e3c5191dc026
MD5 010a38f1de52256c2bb26eb1f75bc59a
SHA1 0bf17528396d4e56727e189c4b053fac61cb54f1
SHA512 f91635aee6d90e66a26be370c8aabfc0f52f2b10fcacfb4d34a9d6f017ff8d7193e2b7f7484ff317e309c8efa9790209f02ab92261068c81b88947cf53867ebd
SSDEEP 12288:YUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Y+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1945523D3548955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 4d62a3960dd72d5e1301908c432c7de48e14c205dd8dbceb814c2a94a6e5f02c
MD5 e4a9af3b14cf5314891cfe5cb292156f
SHA1 5c319422423abb7c7e804ae13e9152de6074a74b
SHA512 a466f5e700a45225590df4cc1fb5f11a6b3ac9bc5b24570fca8241a19a7497e89b58392257a56faefc577b07606ebac679cb54ef7c4b144c27d5e40e6794afba
SSDEEP 24576:Dfwvzk9RX6wkyAII/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WMnYIILNiXicJFFRGNzj3
TLSH
T1FA85D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1923b8b772df811d86ee491a82ae830ff7c191a302b815c85467ccd22fd753e8
MD5 15c238b1a603ea4005d3ef3f2c9c0f41
SHA1 e9b8194f9d67f782ed60d1585712488517a5aea9
SHA512 b7b9b9a1750beb72600aaabb7feafc5d12f41230cd459e925853eab1efbf47b72838762f25cf4ef815422edc070e00e06abcfb7da3cd28535e2a90d9147ec4a0
SSDEEP 49152:jYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0jLNiXicJFFRGN:OySzPb7wRGpj3
TLSH
T19B066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4eec9614ce48a9293765d22bb727764f920e3a6970c6847b521c5a51e861a0b7
MD5 5ca55da9422f3eb71b535189d4cbc3ba
SHA1 9544aa55d3e73b49693f14acd7da2f03d1050439
SHA512 0714723a6ea2fedb77f09db8b5eb494626d9d7d648b600ae7ab7c20c57d29a059df89a91a7300f12327e7d8be318d366d2e1ef7fb939c91dfb62cf8473d03e52
SSDEEP 24576:C47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:C47JUQjqirIhCnDHUPfF/TLNiXicJFFS
TLSH
T1A165AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 3b477a80ba408f0d1b63ed8035b8ebdfd61a4c7145a89445be4ef8e34ac44bb9
MD5 6cd927d59cc3426148603625fc49912d
SHA1 013c1f2b6e1343cba63a2ca8c96e005fc6b6594a
SHA512 3b498ed76619ebc810c6f8588f0ae5e238e1ea355636bb7d5f9b1b1ecf647e7b5a76f9a0140ae49cfa6d26bdbc7840d284a70659b0a73cec963ff56365d8d77c
SSDEEP 12288:opsfSiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:J0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17F65F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB92C0F93E1F79AD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 b13c56fabb7f69bb4ee31489e5582eb1fd6d2532cb01ca7f3168fb9127d3e6a5
MD5 f208bfe8a8f26161dc8753e35fd30071
SHA1 0609aeb477c8396e8768a3717db8ed13f9ff225b
SHA512 aa2b6fb917805484d709b11fa1e7ee4b684ccc92db729f91f93d6da2d160583132c489972ddd349d4cdb94b5e6bdd3b1955a2b62b9d00de825c02de4b6a6f456
SSDEEP 12288:ZeRuU3f23WENTBmlqF4kJ97QLcXze74sfLRpcW80znt0:Ze4UPgW2ml+3TQ4XK74sfLLV80zn+
TLSH
T1CB351850766AC75FC6A940325E32D1CCAB707D05FE44AF0773C8873F9576668BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 c495b5ed35754594bea6ddc6c2060fa249ca1f29dfbfe4d47b522d12b55d3d60
MD5 420463e902768133ff937dbcdf4ddf5a
SHA1 b2826dcaa85f5b5e10156012e8d49963cf61f3e8
SHA512 3d64b00d37a3c79c3d9481c61abf65471868783dc2b14b6a82d7f20c68facad78e651158f97c3edc1a3c852b5efcab4aac379901464ed2539f187efe5c498e8c
SSDEEP 6144:RE3885ma0FMpfvWMBoBgBej6zWXGpSBMytMxHMytMxbgoR9Da43CdfuwoKJPHUyW:HMpfuEw4Oi0KAKJPHx9+T
TLSH
T134750B815137E28FD1FA5071032A5B4CB7A4AC06B7456F26B3D8493AD82BB25B4F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 6cf9b54b44f5a43d9abcebd5a33d34f36576bd8eaeb3acfc04e7b583fdb9e8ca
MD5 e9aeb476f207611ad72cb0dbf1d3821b
SHA1 cbfe611fcc4dbbf261d8d8da7bc760f16f252e43
SHA512 7eb676a6df2c8f919b5ea32f7ba393542ffef3b3568ab0d31e34ff1b43e02ba6a704368877d491720fcc6cdd5d2d01e180580ff2f354cca56af6fc4e9d563e41
SSDEEP 12288:dF7biJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:LP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1275523A3568859B1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2686145b6c37030ac90871fd76829f88c02e4f1fc764f9d92940516156fd13e6
MD5 475bff3667ec3e0000a7dec43275ed0b
SHA1 93b6235565624c911662278d9e50411bf8e1170a
SHA512 4bd5e384973c64825abf6c06fe55b47d272694d1e6ee5eed3305da2037e2c119281ef9e04285aa2ce06dcb154443065b6c327ab9dce1717c505914a9a223114e
SSDEEP 24576:Xgb6bmBIi49WNNFpg1rSvFv7bYS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Xgb4mBIBhGFxLNiXicJFFRGNzj3
TLSH
T11865AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 e2f1d523058611454a41fad24cc208cfac5cb293bfc2a9372fb2562122aed272
MD5 88b4799412c3c3f6a9044901731ac208
SHA1 2c782e38cd68dcdaca3faa90cdd6b227c4f24a9e
SHA512 8625af09b20eb46766978b10177819fae9b72dd6fa98ec667a7c4c75e431e74956264aa4c72e1615bb3251f846d69c1ca2578718470d75c885ff0aa329960264
SSDEEP 24576:IG88u8FpJqH1vzria7/mB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:r7ZFPqVya7/6LNiXicJFFRGNzj3
TLSH
T1AE85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 047d6c7f5dc8a1154a3fcbf4a4169358c9868053ab35f2496fae3d13ec33f9b9
MD5 d1be231ff42762b0fdce55ee839b1036
SHA1 808cb080397e921181d634902610599ce9cf9735
SHA512 c993ad96eedcc0832fb166ec203cecd3f52685ed30def9f4061e331acd3cb021566df06c57ee789f828967b7878419de6f36babb97d27a9c7fc26641cdf5f7a9
SSDEEP 24576:FPUr+NQa/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FJQaLNiXicJFFRGNzj3
TLSH
T18265F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E5F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f70e72ff081aa9b5bf28a97fde1d0ffc49ad722fe19c33d7e92b79c937adec5c
MD5 762cdc08362414d7da2fa3921f81f05f
SHA1 31ace8bf34625f1292fb472f43b587e340d3128f
SHA512 5adf479964fc7a0e26aaeeb86793ae98d2c879d55e105e4010e498547e9efdf05927ebc8a6b3d3f424e782c9c4858e7f03fdb89be1480ca47d5fa7e8e7b0a052
SSDEEP 49152:YBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjKLNiXicJFFRGNzj3:zG05lO43bz7wRGpj3
TLSH
T142D5C06A62EC11F9D1BBD07CD9C6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 99932c8ab866d1c80082977c53d22c2de3ddab0d8ad0165a3311b816ea65c5d7
MD5 8965072d43744723e98388e124de8cbc
SHA1 9e477ab1d6c3030d70d0ef7791987f0d7f7269ff
SHA512 dfc8862237a9ba30710a83fb34eb6109e86675e90cbe837c5d31b1425ed45028473a0a0d3eba47bf81db1d2b18bc5caf92ce67422130fd72d6bd8cc94cddf886
SSDEEP 24576:Lfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnj/TwSfVcYG3K/cJHlnFR+IGNe8jg:Ta5POZ3lJt2pasx2+mFLNiXicJFFRGNf
TLSH
T14365BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9d58fcdbf476686360fe75cc94054e62dbc1c10ffc9065a76e094ef037d64ba0
MD5 f93e95102f8eabfa7711ae9b69f8b024
SHA1 3613e3a1f67d1952be0f23c2d009f4cf4fce2bbf
SHA512 0c330f1df9902c9d03b2b3624f72e9545c60a7d0f8358830b938582ffb19f8ed2fcc8ac2e256d4a9a9a87ce9271de9cc012460c3d8121215e69ceabb2f72bacf
SSDEEP 24576:gNcwHdjbyQ4nLC18lb/EOjowL7Fk5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:gNc/zEOVHFaLNiXicJFFRGNzj3
TLSH
T1C2858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 991aa6e1cd31a53b090ea8fd52e3daeada5d8bade174c3e44beb750b9a375eea
MD5 3ee06a9f8dfda3f4bf09ef857807e56d
SHA1 aa2d66a496060f1c00278819418b1976c082ee82
SHA512 b3e4de40e0ea644983251f418d874c00d2ce5e99128de48618efcbf2aac9ca07c23f0afd3f48b29abad6c1606679f85245964d9696bfa0a684ddddccb0bb17d3
SSDEEP 24576:HzkNvNnaFeYhJNtmZBmY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HzMwBtOmYLNiXicJFFRGNzj3
TLSH
T15055AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 fa93ed3738b7c08e9e1dcc65b27c211eb4e324d9e796696a0644472a479e09ff
MD5 2a9cb6e21909b7f507ebe7d86bcff7c6
SHA1 d1dfbd601990bcb5227a16e7b4ee5e9749676e2e
SHA512 c6534f629011107c6009cd9c354ff8745bb357106f4ed43246e1126a4dceddb9cbe233ff55acca1ad72dfbf2e820595ddcf67942fa58b111540d50d248e50039
SSDEEP 24576:YD3FHshBIYQgAA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YDVHeBIAAALNiXicJFFRGNzj3
TLSH
T10C75E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/704-95-0x0000000140000000-0x000000014088B000-memory.dmp

Download

memory/704-100-0x0000000140000000-0x000000014088B000-memory.dmp

Download

memory/704-1-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/704-9-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/704-0-0x0000000140000000-0x000000014088B000-memory.dmp

Download

memory/1112-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1112-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1112-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1112-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1952-40-0x0000000001E50000-0x0000000001EB0000-memory.dmp

Download

memory/1952-53-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1952-50-0x0000000001E50000-0x0000000001EB0000-memory.dmp

Download

memory/1952-39-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1952-46-0x0000000001E50000-0x0000000001EB0000-memory.dmp

Download

memory/2752-61-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2752-54-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2752-291-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2752-55-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/3020-130-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3020-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3020-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3020-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3372-333-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3372-335-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3372-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3372-93-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3372-87-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3372-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4248-117-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4248-23-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4248-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4248-15-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/4484-77-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4484-313-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4484-78-0x0000000000900000-0x0000000000966000-memory.dmp

Download

memory/4484-83-0x0000000000900000-0x0000000000966000-memory.dmp

Download

memory/4628-65-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4628-310-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4628-67-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/4628-73-0x0000000000B40000-0x0000000000BA0000-memory.dmp

Download

memory/4904-331-0x00000182FF700000-0x00000182FF8CA000-memory.dmp

Download

memory/5040-126-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5040-118-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5040-316-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5040-120-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5540-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5540-140-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5540-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5540-132-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5540-138-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/5568-106-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5568-112-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5568-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5568-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5568-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5568-317-0x00000000007C0000-0x0000000000820000-memory.dmp

Download