d770a571698dfb24a2170a44ee1ab26bd3b1cb4f5f9391ca20cbeb62cde834b5

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_d514584f2ae1053fa91303414e8e0a82_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
Size 1.5MB
Sample260930-tspmgacf57
SHA256 d770a571698dfb24a2170a44ee1ab26bd3b1cb4f5f9391ca20cbeb62cde834b5
MD5 d514584f2ae1053fa91303414e8e0a82
SHA1 0c8a0ec52a9770ffe0388d1c9b495a925e34b49a
SHA512 b50393bdf640244c2ad695f822227064fa436ef15555fc182eb59a25ae22ff95fb6eaaa8f772e4cb94674b7c3de6034aad6e07607e3530c6514dfd92cfe5875f
SSDEEP 24576:iJx3PTDINZy78sgSnnrFb4PM4MYgLxEVyGLD:iT3vQy8gj4MYPVyGLD
TLSH
T148750194B3E400F9E9B39239C992C55ADB71BC225760D2CB13E099673F336D06D3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5444	elevation_service.exe
5912	elevation_service.exe
3308	maintenanceservice.exe
6036	OSE.EXE
4916	PerceptionSimulationService.exe
1048	perfhost.exe
3604	ReFsDedupSvc.exe
5208	SensorDataService.exe
4124	ssh-agent.exe
1088	AgentService.exe
3220	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_d514584f2ae1053fa91303414e8e0a82_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\69322e237465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_d514584f2ae1053fa91303414e8e0a82_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_d514584f2ae1053fa91303414e8e0a82_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_d514584f2ae1053fa91303414e8e0a82_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_d514584f2ae1053fa91303414e8e0a82_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005988a00bf850dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e7fcbec9f750dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005ad2efcaf750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004a07f00af850dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000ab075fcaf750dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000099efc70af850dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5444	elevation_service.exe
5444	elevation_service.exe
5444	elevation_service.exe
5444	elevation_service.exe
5444	elevation_service.exe
5444	elevation_service.exe
5444	elevation_service.exe
5912	elevation_service.exe
5912	elevation_service.exe
5912	elevation_service.exe
5912	elevation_service.exe
5912	elevation_service.exe
5912	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5380	2026-09-29_d514584f2ae1053fa91303414e8e0a82_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
Token: SeTakeOwnershipPrivilege	5444	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	1088	AgentService.exe
Token: SeBackupPrivilege	3604	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3604	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3604	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3604	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3604	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3604	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3604	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3604	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3604	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3604	ReFsDedupSvc.exe
Token: 33	3220	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3220	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3220	SearchIndexer.exe
Token: SeDebugPrivilege	5444	elevation_service.exe
Token: SeDebugPrivilege	5912	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3220 wrote to memory of 5644	3220	SearchIndexer.exe	100
PID 3220 wrote to memory of 3024	3220	SearchIndexer.exe	101
PID 3220 wrote to memory of 4300	3220	SearchIndexer.exe	102
PID 3220 wrote to memory of 5364	3220	SearchIndexer.exe	103
PID 3220 wrote to memory of 3408	3220	SearchIndexer.exe	107
PID 3220 wrote to memory of 4064	3220	SearchIndexer.exe	108
PID 3220 wrote to memory of 4664	3220	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-29_d514584f2ae1053fa91303414e8e0a82_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_d514584f2ae1053fa91303414e8e0a82_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5380

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5444

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5912

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3308

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6036

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4916

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1048

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3604

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5208

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4124

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1088

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5644
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3024
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1572 1560 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4300
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1612 1564 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5364
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3408
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1572 1560 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4064
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1612 1564 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 73e20a92321c0e6fa56aa828fb3bec463e548d7579746ce4f62ea14ac0b5a040
MD5 5ac65a74ab8e7a9c52664c8bbff26411
SHA1 9bcff2370c41a06ceef03fd192e5e5a68b1fa2ce
SHA512 f5960dda47a9cc1b6d18567b2ef56f88bceb3f7fb5bf7af16d275d99c2202990aa98936a7019b960ab4a7a31162ffaedbfb16c9e910a6912496d78139f377389
SSDEEP 49152:Db+632BuPkFKRrdE6ohmstBhuXjfS4LWxnnj4MYPVyGLv:h3q6HjBnVD
TLSH
T187D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 3b3ba383a3f106d5712e98e00d9b998b5686bde59f6c3e8f935cd6d6403d242c
MD5 4d2327377c47900c67282417f538c91c
SHA1 2ef20192ec84758b259b87b89298f68bf87bc479
SHA512 c1125fb9b30767faa862c1868b906107966109f7e8d6d0b1d9d58e99f34bd1172880810f0045a137f7f8233b612f2787df197409f466466fab9aa589ea490623
SSDEEP 12288:O1XLsswWkxy2lRq2czAy34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9L:8XYfDtczABSnnrFb4PM4MYgLxEVyGLx
TLSH
T15F65F12977E408F9DD6B8278C8A28555E733B8518760F78B03E499662F333C85D3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 6a74a5657c3ff6ff762627648e31d91e694b204b08b5e24a549b661c46b46eeb
MD5 cc0a37427338de6786bb7d9a40b39f80
SHA1 8d33b12f85ef92a38fd04802758475dd6f758d5b
SHA512 b4e77394e743ef175ae96aab81ce7e6b6b43c5d1e5d80a96f33df8a45feb0badc8e500aedcd0debd8f85b3e27874e1d0bc849e2ab9582c7c651e1a49676e168d
SSDEEP 24576:p0Le5ji0hmxirM8SnnrFb4PM4MYgLxEVyGLp:pPji0Acsj4MYPVyGLp
TLSH
T171859E66F6788375D073C0B9C5D2A68EE97130825B308ACB4286D77C3F676E68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 23cb6147c45e15acac1e0fea9f84248ec04cebfd679847a2d940617f6a23dd51
MD5 d58a238be4cc0dc3e7aa7d762b0eed39
SHA1 06a883707a71cda2fcdb648292d4bc67cc27f852
SHA512 d9086ce8b0ea3d0a9f64a34c59fa24a6addd171e82d2907eebcd54333c49f89e40c0ca81bda941624db37a9f6938e44e163d2fe24466b90a76d313ffe63bbddb
SSDEEP 24576:Ea7/ezSC6vUyD/aqgrvWE6q8wyuSSnnrFb4PM4MYgLxEVyGL2:z/ezSC6vUzPvxHjyAj4MYPVyGL2
TLSH
T128755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7c8fd24d39f22ae834c918a227472de44f16a69c3afe4cf3f6f3d9caf0b20a97
MD5 dad269fbdcf66006f4cf07be0389982f
SHA1 83f840c851a563d4c88c40f5d866264c3c1e6b94
SHA512 8e41025374b46115ae44efdb164b4f5549d9baea26747127c4ff2e4c2462fe3f4b72a8adff173f077936d1a338baf9b32bd31146e5a454db237f487526772efd
SSDEEP 24576:iVbqPb88hv/l+6NSnnrFb4PM4MYgLxEVyGLC:iVO88hXl+jj4MYPVyGLC
TLSH
T114559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a23ef497559e52350f4151f2e5bfc44b0a6aa5f060cd2ecf2c52a7309ea90840
MD5 0b98d332292cf46733f91aa54720b969
SHA1 2d752b78a26ff75c7eedda8b1487eb66680a8b2d
SHA512 c761a4c278dbd884729dd80a0b6e7ce42b40b3d9ff1c78b3d283afac680bf8f3490a2d7016a075a4ef6bad62975980eb0b4e3b0844902b00ba8a1d1c8111ebe2
SSDEEP 12288:5Rn34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ild:5RoSnnrFb4PM4MYgLxEVyGLb
TLSH
T19A4523A72BDC10EACFAE15B0D1F96AC8E2157C61F875B20B6750785B3A3E60DD891313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 9676859c1a9e79f1a8fd6a16a1a6b6c3168902384da322734595297644954497
MD5 b86f99d6f248f3bfe85709392899b6f3
SHA1 f7b5ed795f0b295db8cdec36a999acf74dc21e79
SHA512 cd22abbd7788f7dc42ece70adaa77eba743e90a69ed09d3b7a58faa437a57f94c4810274df56a0e2bb4313b0e85af0810a11dc199ef9cf301cc029261bd06e05
SSDEEP 12288:6eBNUbTVO86Ue34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilg:6JIUVSnnrFb4PM4MYgLxEVyGLO
TLSH
T1D365DF3BEE28FCE2C67E4DB856918740E77278308F62A3CBD164820E9E235D55D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7498700620529a6361155ad0c51972ad9d4d6de12fc88bf640ac5dbb868e2d4e
MD5 bb7da5c65826cf9eee4b6b7b18757b91
SHA1 b2468f4e9a89453c66fdf3521c4669aba7911760
SHA512 c6e396a5cdf2b2b2a70b9f583a10e9b06ed119b45eebc7198209d8e4012bbf376e58174bfe286ad20c39ea63e83445d3a15061ebd402f6b1358c50d05592bf73
SSDEEP 49152:uQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THy:uQvGAdlCEL8c/yRNw5CmVY
TLSH
T1E1267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 4af5691b43147a5fbf8ed3d886facbfaca9499de66afe02eb4d508903e4079cb
MD5 d4b7186796d895d640449facc8b29566
SHA1 5dd3ac2024ac2b2468b50453f97c988e6614ce5e
SHA512 4b0b36acba4a96314f2db79ae762e1dfff31b34ef5170ff0c8003480a3295c58e7c7e35015561ae6bac81e78cc8091cd86eed47e08c3710b85fc1c2ba0cb1c88
SSDEEP 12288:KAwSfxL/2Dc34DLLmt0LDQewsAjg34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeA:fdewsAjzSnnrFb4PM4MYgLxEVyGLv
TLSH
T13F75E031FE74E036C7BF0DB21B36C716542DB9204B612AC3E3A89D9E59342C26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 209406066df51528192b934d186ab30d669e37d72a73c406c361299f2b1d8506
MD5 addcfb514bc102041f560815ef10a8ff
SHA1 344c2c11706a70bd19d45b2e292e00f0bc9e994d
SHA512 bc8b0b4d9222d6940086d5fd7ab20fef19e2829eaed05ca55f3704ab1bb6f3ec8f438179fe69b3c9108c9bbf41895027f32e16c13da96f0b52ba1ee77bec133e
SSDEEP 196608:HUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH:HUEtQevvqc2W1cpV2EI32
TLSH
T180474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6cf99f8ead98e636f4065a659b15dddb01b1f583f56d09860b085e89c7ee7ca9
MD5 f7a5f03591b4a0888b292fc0680ded57
SHA1 b9d377ca45fa51e2c8fbbefc1797fbea44b4d3bf
SHA512 9d48d2482969c0de5ac7d4c65a5f207d8e675916aa06ea2294f675501378933d16ea07030f73eec0617dffece97c9712c3ba1a63258c32e915cd80b57838dbc8
SSDEEP 49152:4CbRquA/m2yL5zQfFiV+XenmE3/zcj4MYPVyGLh:xoqtVjnm6VF
TLSH
T192D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 98e1ce9e7f58e3e28268d2e563625854eaa683b96dbefbf1e5bc14bcfdd4bde6
MD5 1c3da845cc41d8f0bce29522506988d2
SHA1 2ca23e58fa552fe88cc12fd34c54d4b9d73fabfc
SHA512 69e01b06f20814ef6bc25d100046a156048cbf1a15012f49525971d516a64332dd47b0c5912cab03f76b511fd8382dbc42bc9ec1b6bdcc795e0606499a732190
SSDEEP 24576:GAhGLJIFoiwtA5l7S53GSnnrFb4PM4MYgLxEVyGLq:GAMyFoiq5Rj4MYPVyGLq
TLSH
T1B035AD81EBF955D4F5B3AAB899B68170EA76BCA65E31D20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 4ad6e23b85a6d80307ec508a266868572e92f4d2b7b9290b0bfe175e42b7de80
MD5 0ca1d0156106d4f3f9fbd6a5338597ba
SHA1 10419a725ce66c7b481847357fd4a8e74d43a597
SHA512 dee3ece1c63e46259614e4e6120a2b98a32bd574824bf1de710bdc95c55b355a237b2cae49764a2a6d7a82bdd498da887818a9bc6798a7b4766b948d08d57224
SSDEEP 12288:Xmw5HEjsChNVBFgl0WDm+C134XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyq2:2wuoOWnSnnrFb4PM4MYgLxEVyGLk
TLSH
T15165F14637E81CF9EAA74234C5978536F7B2BC122A21D71F1760C65B6F37311AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 55ed6afa646ff81286128147dbc4704ea71c69581b55fd61d4bc49eeb06d9734
MD5 3cd91c3ac4bc3f079a96585d6dc66cb8
SHA1 fa744d7fde47fcdfe92b011465735e4ec1d57aa4
SHA512 60b1498b8b0462a68d6824d8a1d7340e4dc7ee4b665394c40b4c8fb981602558ef12ffc691db85b316b4e459db86a688c3d9cd87639da46b703b11d5f5db5455
SSDEEP 12288:NBZ1Iyw34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il7:rZuESnnrFb4PM4MYgLxEVyGL1
TLSH
T1085512AA37E820FAC6AB4274C4F55688E3327862B77293CF1650655A3F37AC55C35332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ba5fdd23eed5538d3645d6b70c034711097e41205309486eff930f41a7ab2620
MD5 581b6933b9bf8bf5dd07c17226a96381
SHA1 e305a657d0e265ca86c652165087dd3df45755d9
SHA512 eb3292f5756f326c027b1ee04226c3ccb18e581d53b9cd8a8d549d662a2c9f67a0d6a58c33a5aa1e4974d752d9f57bd9d2088d375a798b106753f2c6cf847812
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U7:XQRQyi36YOcPQLvw2gAf+PN3zVt
TLSH
T1FB667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7412d1c4824ff4685b06d92aeed9194b7abd459632326432e37b5332c67b0b65
MD5 fe55a8fbba62e6506b5fe6f7e2df3e13
SHA1 2624875bf16d3bc1bea8e6355f4f4f6ed772d567
SHA512 ac32f1972f9825561120f779d8bce4a1efe08b020f9f0f387d64f1ad8bea1dee91b4cebd743c09e59c56a2c38aae57b69e7725c373b34534fd93f7e535f457c3
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UL:5QRQyi36YOcPQLvw2gAf+PN3zVF
TLSH
T1D9667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 21822128204f93eed6b4562b9af161b01f72bb21d8e5aaf6d948bc0226d7c84b
MD5 632ab3d82a31bce19fe602cb0db67a14
SHA1 8a8689388092e92ad42f2b98bc4a04ab5b2f176f
SHA512 9a57540cc9bdc65ff4d8bb64746291c50b16a36fad7063901732a444d7c52cb9e4aed2e0ed830a0550a9235dac51515fcc97628156171ce59bfc303ff2064fe7
SSDEEP 24576:bwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL00SnnrFb4PM4MYgC:T68Qg55nhheWu7PNU3/sj4MYPVyGLl
TLSH
T159B54A33B2F600A9C44DE1769F4A972196D27C71CFE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c98e3e2a38ac60777c8d086360ec7023480ad4ed90d507aba7e7638600c8788d
MD5 420e8becb2fd0873d9e3d4d77282e9ff
SHA1 b83575f4190aa6ceae96effa9bc7bbc922703012
SHA512 91432ea3a2a3cecfc7c86ec4a420675f5a928b2c02573565a6f68b535dab6b1d122ea5bf3ec545173564eeb5b9a044cf4a7378c041d0b2b04f0bbe27138ed8f8
SSDEEP 49152:M3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99E:py5112gYy5azzVvL69nLKnhZYVE
TLSH
T124167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5363b1d1106f3ea70d522e2347e318d1bc5913ab85e606bed1ad0b76ad066b0a
MD5 8553b6b9fbf317377f689c18a7599db2
SHA1 faa00c81eab4958934f7c742198d0bbab18194ef
SHA512 52c4c53d6a72b58719f7156fc1e366549e693cfaee874d51dd2f79ff5396a1cb3d6663df7ec4e9f7880f5aa3d8fd6538a1ede8297ee9f56c0f1369bc866e6089
SSDEEP 49152:EB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glLj4MYPVyGLR:eu6JmVxd2dIVt
TLSH
T14FD59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a156b669dea619c20de197f004d624f79793909db48d3a0c4b6dc3c43bfc3c2b
MD5 3b9e5da4f742365e7052ef542f3f9a9c
SHA1 cdf5ef5e3349c3e0e928af6e05b41a01ee52b994
SHA512 8f4c2b12ccc136d09d797bd8dd3ddbadbefb7b01dc92dc458d229bfd445fe2bab60914a2e0adf519fda6aebc634c4ab4db532db1587e15cb0595cc55e9672fb4
SSDEEP 49152:r1hpsNoJpF1A6UU44CwH7R4xOj4MYPVyGLb:rmifPbR6VP
TLSH
T180B5BE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8f243966800be0cea5c20f1cc11410fe3730cd8d622825bf5f10825259ca3b16
MD5 d3ae561e878df6a5cfbac2b9520e7551
SHA1 87adc50be4928b8375ce4fc7421f1ff40cc0b6f3
SHA512 a5a8d5be738bc8d0abfcca35ae3b4f23b08691b55daaa69c7e7aa96235a5ae15f32244fb35a49f686dbd6bacea420de167649cae2c73006579fb6958ea20b5b5
SSDEEP 49152:2SuZQIY0Be2KRRVtOnks6NMHq3j4MYPVyGLW:Y5dKTi61EVi
TLSH
T12CC5BE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 dbc9eaf887c1200604a973e43b4a43fe9b526b7aa9a59ac527405d54a0ca5ddc
MD5 2bdb8685976b8df012ea863c23d11e38
SHA1 51d712eb7436678915f0a820b459e0b36e2472d3
SHA512 7579264252bd0409df30563171ff391fede4dc3e2c06aac161f9eb51a9b88a8a9fb46638d62e78971fd11746cf507294303778bfac8e4c5cee88ee47c700d1ef
SSDEEP 49152:NhtSn8EApI0figngiDn0AP5w6j4MYPVyGLO:cX2iyphOVa
TLSH
T17295BE13F2D900E8D05ED174C7568632EA62BC160B35B6EF0A90B6562F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b2182b3f01a3f7a0f29c595aca1ab7bbbc228b00d1e52d33580570fb213f0088
MD5 e1665b797786625b7e2e7ed0b0a46d45
SHA1 d0412dae927350b4fc388ac99141ded59449e876
SHA512 67c494f9ab91f3b5d3154e8e8328c65aeaec1c07e58066d1df2a751af9d4f38ae8684534432f36e8c8576365661a4eabf9e3ceee3175f5328865efbea2068851
SSDEEP 12288:OP34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilv:OQSnnrFb4PM4MYgLxEVyGLp
TLSH
T1A94523A62EDD10EFCF5D16F0C1A966C8E2097C62F976B20F7B4574173B3B20D5892622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 cc22bfb1a2e163b82f3d7165796a7c603734663d8fe8484d830b936d062e02a1
MD5 9b5d2a212db63dfd982e76db1ccecc7a
SHA1 62f2064dc9bc57f48dc5bc23f75bb39bb2c70e4e
SHA512 9a4792e22c8fddb938958b4f10eec0f7ecd5c3247bcd840c740e9994d5d4d6f8184361b331d7ed8e2f6ea5bf37c3dd79a3ec3a5d7479e3d0be938fd9faf0d43d
SSDEEP 12288:hU34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilq:hfSnnrFb4PM4MYgLxEVyGLE
TLSH
T10A4523A62EDD10EFCF5D16F0C1A966C8E2097C62F976B20B7B4474073B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 11d6f414f5d18dda61de66413b4e572f522582a53c3b5b9f3bbc6f744a448825
MD5 b0216df0fd4b6ea8a65ef02edbe30769
SHA1 b5dc1140212867610fb666bc669908bde711f87c
SHA512 550351d422036e2a90f17583e93cdb8e6ae82afade2c15eda43c8988662a416a18993a623a19af5ddd5ef2213bafab7bf8eb399e9043d4772475fdd8d88dd591
SSDEEP 12288:kG34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilq:k9SnnrFb4PM4MYgLxEVyGLE
TLSH
T1F54523A62EDD10EFCF5D16F0C1AA66C8E2057C63F976B20F7B4574063B3B20D9891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 17214630490a125b062691bb7e9e8f8b60b6b97b09a378256c4f1e23abfd0040
MD5 e35f05f556e74248fb62862f2bfe68d3
SHA1 385e2c5ffcb1c2e180c6d9708e1a30a66932d7e8
SHA512 bbcb0f26945490b837d1df9217a06ccefc37fa8d764083db8fe13be08c125f941c8a1dd5621c4a508d82f1cc3fb453979f1ae88b931b3e06c8d32a73efbc58b5
SSDEEP 12288:sVh34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilg:xSnnrFb4PM4MYgLxEVyGL6
TLSH
T13F4523662BDD10EACE6A96B0C1B656C8E2257C61FA72B35F6740381B3F373489C71721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 b43ef423d0e8c1c82fd558ad9d7367edf3529454ae5c387d46f0f585a31b27c9
MD5 8496fa204049e01893425af317c8cb75
SHA1 e7818989f6e679c0dba665421613c3347d826535
SHA512 8c773e0c49eb59251ce49d960e6257585f39747b55adfe4ea54844089c58287cdb86f6bb2daf7fc93c832f6af6109b7a9d01c2d1969914cc22a81c075f2c5124
SSDEEP 12288:e534XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilT:e+SnnrFb4PM4MYgLxEVyGLB
TLSH
T1434523A62EDD10EFCF5D16F0C1AA56C8E2097C63F976B20F7B4574063B3B20D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 b0553424e0ad3091f420a4558a04afb1ac5d14bdc2a42a565eb9b379bb561772
MD5 6c1c9098a1ede3ffd2ef770b4768f57a
SHA1 d10e554628840c9f2b8ebd818842d9df49871e5d
SHA512 fc86445886307417d849f45efd7c925477ca255e8b969110bbb74e2771308e68fc0f67dab650df607535b76cb5d6ea0d46de7f76aa2d1bebd1fc2d67d5bb6ace
SSDEEP 12288:oo34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilT:o7SnnrFb4PM4MYgLxEVyGLB
TLSH
T13D4523A62EDC10EFCF5D16F0C1A966C8E2097C62F976B20F7B4574073B3B60D9891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 aebdb6dad0021d84e00fa8dc682f83db0cade6258e9256ba943d41ffb43c5cb3
MD5 e7d43bb57941dbd7bb6812ba7e1e02ca
SHA1 42fe55bc77c04d4f7046a62b9903e2237de0aac9
SHA512 1defdbd44bef6743e12c6705fab220e4300c98a7534e8bcf5dfe2d66a79f5fed7879f944b2613c374d75e62281b505fde9a4c39d93fd67402c6d9f71f4639f8a
SSDEEP 12288:RM34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilN:RXSnnrFb4PM4MYgLxEVyGL/
TLSH
T14E4523A62EDD11EFCF5D06F0C1A966C8E2097C62F976B20F7B4574073B3B20D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 6259d7c56db241909dfc56c48c5b0f740c5a0a86d65626cbc5c678d4d451fe4f
MD5 a8f99396dd393ae86daab39f05637524
SHA1 2aa9b88691fc523a863b25e5bd1b88c8fe031aad
SHA512 202acfb33bc0da5e3ac79fbeaf0186ef6c0668ceda7a25815fbb924149c7f4394628c1c213f2860edc6585f286e7357c97e4e7c1fbd8ec48a96e2f65e6199743
SSDEEP 12288:piZwb6zzFEoS2cPvy034XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2L:sZMSzFVSO/SnnrFb4PM4MYgLxEVyGLy
TLSH
T16E6502A5739018F9DD67823EC9658945E2B27C265B70C61F13E4362B2F333911C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 41999e0eea3412abb2fcbe96c7d1972f458a224382dff23a0ad16a050a3b413b
MD5 a12581a4e88aa0a038d554509fcf2540
SHA1 b7be1e7726419eeb0ccf245c4971c17f64c2cae7
SHA512 f901e0072347e5a16cacff47f6bd1e6cfc0a70cbf79d71cb8a362685964378bf68ce6545ebcb16829b41e67a1aca564aadf80ce9fd8250a121cc9a650852be1f
SSDEEP 12288:Qb34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilR:QUSnnrFb4PM4MYgLxEVyGLn
TLSH
T10F4523A62EDC10EECF5D06F0C1AA56C8E2097C63F976B20F7B4574073B3B60D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 dd7c1d32de78821c97e04cbe63f82fc38be1908ae28569f2476a0f8570b96e7b
MD5 c24578e1099b212dd910a47532e3366c
SHA1 48553e8b702f97c0a28503eb4b3e859b09ebf46b
SHA512 81fadd4714c7e6378004174345063f06aa0c82ef3b2195da88e2861b2327e9a99dcf67637d17f5d79545dd49613061c0c3bac451f23a4fb59fe16e89767c7c1e
SSDEEP 12288:A334XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilT:A4SnnrFb4PM4MYgLxEVyGLd
TLSH
T14A4523A62EDC10EECF5D16F0C1A966C8E2097C63F976B20F7B4574173B3B60D6891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 1540fa0d553e2e86b3e134c71660b7331f95e3cf088e252815b784bd1ddf3d4c
MD5 33099bdc5c94625f4079eb8cd989499f
SHA1 150a9a7679e57a2806efa9232fac9b0da5312c5c
SHA512 5a00b92dccb1ad2e3071f666bff36dc84939e3f059145e2ba497eb70cad1e0f8fa69fa8485c8b7a621eab3298119c5384e934e8116ee480f130c6b3b35a2b712
SSDEEP 12288:1yPz5L8w34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il9:czyDSnnrFb4PM4MYgLxEVyGLj
TLSH
T12D55025737A530FDC67A9274C4A21A45F336B8329B309A6F279016773F372849D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 773c21cbc013688fbff6b5f83a0849885440a7e4644f8a62376f5b481fb1f530
MD5 e6efe1f5a6f0e590beef8209241372e1
SHA1 2ffbbdffd6803f9c8a5e700c2e10d01a76a7c1bc
SHA512 271d44b15b4c5a616e1704d1dc1ef042e192a18149a0c6b01529e510d0903a274bfb396d1a013b47cd28ce119d07ed056fa004e31d7def4b5207c94178afd99a
SSDEEP 12288:cb34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ile:cUSnnrFb4PM4MYgLxEVyGLc
TLSH
T1024523A62EDC10EFCF5D16F0C1A956C8E2097C63F976B20FBB4574063B3B20D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e1395dba565940526c256820ef2bdf88984a80940d0375c5cb4d58a31d8731f8
MD5 5b11e14702fd59bc29ebaaba58075d80
SHA1 be15a008021796d78967106de4316f45f231a9e6
SHA512 8af5057fb88112a1e1da1f650729c297df15ab53bfb6fbbfccebe392ac0da3b7634bbd18de24caca14f947ed92ccc6cd62ad2eaf5afce9352e20997b0d17d4a9
SSDEEP 12288:vb34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ile:vUSnnrFb4PM4MYgLxEVyGLc
TLSH
T1D64523A62EDC10EECF5D06F0C1A966C8E2097C63F976B20FBB4574063B3B20D5891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 58a0e744b8249d1aa7359f0e7b36c8a353026e11946d9af74b8ac24051360b28
MD5 c3fef71427be3fff6845319dff268eed
SHA1 28a36d2e4c051c9cc1e5f9433d76f9c1b5f2a48f
SHA512 4e748a8642a5f26adb17c977c9112600ae10baecb87e42b16c33b9dcc18176280cc2417771aabadf9295f9c791df29caa932f7160d5ced579c45bcf418ecd663
SSDEEP 12288:lyPz5L8w34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilC:szyDSnnrFb4PM4MYgLxEVyGLE
TLSH
T12355025737A530FDC67A8274C4A21A45F336B8329B309A6F279016773F372849D7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 215b125dffb5a7d29171e1fe6d9efa6d6a62ead53b7417afb4588e5b2b0508a2
MD5 886d0a6c7b479545a7abfcd336a15340
SHA1 aa9d08f79756c17bc9c2e27c477218f301030223
SHA512 c05c0c43a6c486b0c366a207895f8c769a1f0223e97cfc1872347603b08aa9439be17fea712412cd496963346e0129e6e1bb53bb4dee69bc99a649fdbd69f845
SSDEEP 24576:UTHaLl3z0zDtSnnrFb4PM4MYgLxEVyGLA:UT6LljNj4MYPVyGLA
TLSH
T17D6502A5B39018F8DD67827AC9658946D2B27C265B70C71F13E4362B2F333911C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 9af175b067895d0b12c6d104a67cf03c6b2e9ad7a080fa4eac8be4a63aecc062
MD5 8b66613ce09fc040cdf71c81aa05b288
SHA1 30cb056741939747da6f2a44b6c5303e438b7399
SHA512 9bc12fcffe21b280ba501cb6da54e9cb2410db427f5f8a86f75a25d0e7b9c20ec4318a65b026ac3c817f875af7c2cc838ce726a9f9d3a093afd9c2a4ed748628
SSDEEP 24576:d37d9CHKy7GZpSnnrFb4PM4MYgLxEVyGL9:97d9CHKyaUj4MYPVyGL9
TLSH
T11C75DF90F3E810E8F1B79A35C9765501DA767C6A5B31DA8F03A4251A2F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 7ccb84c334b85713af17e1a925ae142b75c2db1e7b6f38bcaa049931f2784113
MD5 f3037497c009e8faa756efeb2dea6d9e
SHA1 384d27722207da1b8d19c7f8b0bd18ffd7a3a035
SHA512 867fc9db7503e93aff960565784b1eb6790608b35f87198f10ba3ab1aa2d00ba0592fbf42a8999c00e4d318ca6fa6302c836dbc00898da8d699ec902fa92654e
SSDEEP 12288:5m34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilw:5dSnnrFb4PM4MYgLxEVyGL6
TLSH
T10A4523A62EDD10EFCF5D16F0C1AA56C8E2097C63F976B20F7B4574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 6b3f73dd7916b2da1bc81b9244152f62ef0f22cd69dd654e4df271d623537e30
MD5 52b8534875c3cf5bfa92c2b60bb0819a
SHA1 5d5b0a16c1f98583f531d273737aa69100dd01f5
SHA512 d5ced9098e54f6071e9933fa46792820c7fb2589e753af23a3bf1f437e8c280f984a05a4f49f5f7f31c4e50105e76607e6ff7923f82a109346fe2e8c9f83ac94
SSDEEP 12288:9Q34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilv:9jSnnrFb4PM4MYgLxEVyGL9
TLSH
T1314523A62EDC10EFCF5D16F0C1AA56C8E2097C62F976B20F7B4574173B3B60D9891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 0af6df3b9039fc6ea2782faa25530ba9ba14cdeb08d2f98069a8d504989de0ee
MD5 530eea0a515578e4869035d427a2a479
SHA1 a9ecbca9256cf7792189dbf3a475bf2166d7a95f
SHA512 90083c6d6df9367d43eee83f04b439df5f9ac475f2ad57d4eb61311a38aabfe515b1adeaf5c489d09cc82a2b3d226b404989bb8ca86bb9b83d6716bc8ea51687
SSDEEP 12288:9t34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilG:9qSnnrFb4PM4MYgLxEVyGL0
TLSH
T1734523A62EDD10EFCF5D06F0C1AA56C8E2097C63F976B20F7B4574063B3B60D6891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 6cc7af6fcc290add0c41afe6ec481234637cdebd3c13a4871637c1a054ee9d53
MD5 72640334552a4c1d2611dba23ef5f50e
SHA1 c8de65932cd1f6df82e3b8ec8beab92c0e2b1063
SHA512 2dabdacc80f0212d35cff6b136ca1102bcfa64dea910ddaa9aa3d431ae088ae0e2395cdd90410eb0829c8baa164d2bb87b7a7c26c8fbd40fd7b059eac7b9150e
SSDEEP 12288:Gb34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il8:GUSnnrFb4PM4MYgLxEVyGLy
TLSH
T1AC4523A63EDD10EECF5D06F0C1A966C8E2097C63F976B20F7B4574063B3B60D9891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 c0cd676cef74cee14e53ed18cc60370417cbb52e00de0fbb7c7271c6407f4200
MD5 0fde5fee6b7fe9400c8fc6bb33843edd
SHA1 332a71275658d8f5a8b232a8ad5bb5dee0b20471
SHA512 9a1825f5c0735c614d9fffd644b7a1d43bb340b66b2815e7547ddcf7caf25e19c968c11a4ffc06c94bac37146951aa41f124c1bf0980b922829b870c1f575849
SSDEEP 12288:tm34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilJ:tdSnnrFb4PM4MYgLxEVyGLv
TLSH
T1FD4523A62EDD10EFCF5D16F0C1AA56C8E2097C63F976B20F7B4574063B3B20D5892662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 54813ea73dc8b91d1f97e23df04d6ce17b0beb0f6ce14e1a20e2c6c62bba0796
MD5 bdae17792310a9f59d3ee07e577b309f
SHA1 7133299c0faa492a200030cf59bcc7048c559995
SHA512 79a9783d36fca15828084612986324ef881ce464db3a88ec9ab7a03a76c2340fcfc6261cd28ad8d214206ac8d57b3e8f8535d5d649437c281a4554316c03d71e
SSDEEP 12288:ST34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilt:SsSnnrFb4PM4MYgLxEVyGLL
TLSH
T1F14523A62EDD10EFCF5D16F0C1AA56C8E6097C62F976B20F7B4574073B3B20D9891622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 1caff2db8b40f7e0023bc2db38ffffec07f296ba4f370165116dc1f4ec63ff73
MD5 0b83a2a6e36487a417eb924057a11498
SHA1 08d2f0eaed0e98cc24b6a0e754ba1a4528fc8cd4
SHA512 122e982c819e08b9d394588aa0a63818af5ddfa7d4927748582301487b088db27e884b2bba42edbdcdd1592a697d63c24e8a8cf64f6e492eeda65610e16275ce
SSDEEP 12288:T534XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilp:T+SnnrFb4PM4MYgLxEVyGLP
TLSH
T1014523A62EDD10EFCF5D16F0C1A656C8E2097C63F976B20F7B4574063B3B20D9891662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 f7153ecec12c46aa806e3cc48d43c5acc3253d98a089c3098a85849c1ef551c5
MD5 5fbd8a59c7542da2cd2f41fbe2b2b452
SHA1 2b679709c0c8d6d607d08a7591c94dccd60eff3c
SHA512 29621bac900edc9f00a5c22c5c494e76a2d6a247eeadfdfc2e9cc30da968efbd089ea493c7058eabd1846bdfcb404c995556d287470b30e697669e28c6ba35ea
SSDEEP 24576:Ifwvok9RX6wkyAIISnnrFb4PM4MYgLxEVyGLg:wMnYIbj4MYPVyGLg
TLSH
T1F485D029EBDC04E5E1B7923C89B3460AF2B178695B31C2CF129A536E0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 226f11f743f9861ef093c49a774d61c0338d0f7e1c7f99b35ae3598babfbcb72
MD5 c004818a0269bc93d21ef9ea36521978
SHA1 9055a09e41a18a5edbd0638878ebddc3ee7f7ab2
SHA512 032ce1a3cf2ff14cd501330bab7e71dd80e72ddd6e5a4471dc5f2b2b75577563d75f2ba3389f860ccbb38c63bd4fff1d4bd30aaedad29f82972e0c199d73c321
SSDEEP 49152:zYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0aj4MYPVyGLV:3ySzPTVJ
TLSH
T1EE066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 94464fc6030ab0fa6a673da0e19941ef9229e6abdae3f9871398ff3c1878d4c9
MD5 ab0501cf6d4a09640f162975e267af88
SHA1 94ff75b78bd14f565efd22ea5f7274984c1316e7
SHA512 59d2e810c79fccbff631a4a5a8de7bfc8dcd52047a4fc40a0785c3a40fe33432ff7604bb756c1eb71a7929eb6cc498ff374989f7d54734b65aced2620b7139a1
SSDEEP 24576:/47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYPSnnrFb4PM4MYgLxEVyGL8:/47JUQj1irIhCnDHUPfF/qj4MYPVyGL8
TLSH
T16A65BE1EA3EC01E5E1BA827885154A5AEA71742E5F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 d99d6ee6233435d7efe5fcf9b9a1ecdd12364c2e77a6dccfe1f15ba5e402dc91
MD5 fe6a694b088bd42136133e5bb4fa200c
SHA1 806db07d5de8467a1b0e26f695a270b27d585787
SHA512 2d8056ae75bec45abf28eab34e588709a5adacd5e15af3446f47bbd65e22eaa88eded6b39e4e2c55cc454f253068aae0e5448db16b9efe483dbf6969c370c98f
SSDEEP 12288:3NsfL34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il+:0ESnnrFb4PM4MYgLxEVyGLM
TLSH
T1ED55F15AD29801E9C56E6271C3565A84F3237C21A7E1E3CB67C0F43E2F366849DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 f66d60e9c9fb1c488ab62e0a2f8667bb9b6f7e94c254a90fb5a83fc1a17e60a1
MD5 7946dbaa4428c4cc78ce97f84e3182b6
SHA1 5920ca090aadf6af1aca7f6826a58a317dca213c
SHA512 141ae74ec867005048f38e25ad17183b4e24828e9e46e4b821cecd95fe198ddd31597b400206538231c23214558d22616db8aeb058cd0fe195844bae569c7a76
SSDEEP 12288:NMjbEXmU3feXVdvJS2rayMppXn2CvAQfAMOezpjK+:NMj42UPeF3FqbIQfAMDz9K+
TLSH
T18A3527417626DB5FC66940326E33C2CCAB707D01EE04AB0772C9873FD576659BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 81ddb95ade74bba7c83a9bf3321007fbb1a0658aa86b1503ce5a99fed5ee3431
MD5 4f6fa12c09e88c6bd0379286752afb26
SHA1 74c7baa274169be874e49c3db2f4dd83f1065e6f
SHA512 ec3080b2b1e1d9ba27a7d8ec6116c8ef0e92651bb693aa0a966152cc514d787aed4638132292d2ac927449de549ea1738005540f98d06c2142b1038ad94214b8
SSDEEP 6144:KWT4rP2X+rg0o+yl3ErD/n0h8qPEYHD/WQytMx8QytMxaJnLMd/51S8xzgu4:KWT4rP+FO7ne8RYHD28T4
TLSH
T1BC65F8819537A68FC1B76032072A5B4CABA4EC0777096F27B3C9453AD82B751B1B83D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 967d2a9fdd8c7f6dc3b03a3d05b7e2803e0326939c183972945bbd191abef77b
MD5 858c5aba44d10a9726ee57b6200bd96d
SHA1 fca408e0d8b45b3fa022c2fd2b27d100a19287bb
SHA512 093b1b9db938d9e8264ffc9f75ec8adc2e8a3bc3ea2885f2c7cbd9a40c3d1d119568341194d8a0d5bd0627bd619831a13cec2f0c6d72e3d5cd5661cf11be7d38
SSDEEP 12288:bM7D34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il2:AcSnnrFb4PM4MYgLxEVyGLs
TLSH
T1AB4523722BDC14EADE7D16B081AA5698B209BC31FF61F18BB7407446363B68C9CB1717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5067f2888d41f690f0bb41ef47f46e56794a565151dd73db78d0f3482e68b1d3
MD5 fab7ff6d3066f8c6a62cc03496bb30ca
SHA1 e38535905deb4b05e581ccaa31d5f44f1262e1ab
SHA512 7ca40751f125896431dfcbd6f5d0d51f8e01cb93cf9c05828a8a529690ea30939dac81dff0979a6a71d5f872dca02519fad94ac2fca3065ddf0260548cf7fd69
SSDEEP 24576:kgb6bmBIi49WNNFpg1rSvFv7bYSSnnrFb4PM4MYgLxEVyGLO:kgb4mBIBhGFoj4MYPVyGLO
TLSH
T1A065AE1E22EC02F5E0F9D2B8CDAA4417D6B278165731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 8404906c43beb8b72fe5ef85005fc0285dbe1aa086942227c8e66db733c30308
MD5 76a81b8e43d617d38d88270f411b2bc8
SHA1 a17d11e31762792cd2e6b0538ad013ce3fdf0a9c
SHA512 02bc72ab293159d0023769d7e0b62419e3c033c0555ecf9c4033088486688e5941abd1da1a54c3a8aab9f5b0d3209f630aa748b4fc5b494aa5a010204b4f7b2d
SSDEEP 24576:IG88u8FpJqH1bzria7/m/SnnrFb4PM4MYgLxEVyGL9:r7ZFPqVea7/Fj4MYPVyGL9
TLSH
T15E85016577E001F1D47BD138C98646A3F672B8211364FBDF07A88A522F23AD54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ff572624f7d12ecdc78266c076471f8d64b8cf049b898cbbb0b9a2b1bb2795d0
MD5 d6089355805bcf1b8d81e893c5493eee
SHA1 d5c7220a2b05a7be9cdb2c8599caa4e0ab808a3a
SHA512 b4383dca581ec244be2d446e7cbe8966b8abd7ecfe3cd627e158bf36eb2451020dc2557377f16f8cb310a1375164c73cce1b3a8060f6a965f57a0eb1ac61abbc
SSDEEP 49152:3BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjEj4MYPVyGLu:oG05lO43bgVi
TLSH
T1CAD5CF6A62EC11F9D1BBD17CC9C6460BEBB23815033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 75cf34a200a6b3f07a0ef132276f4154220713f7b5c8d666986fa10d84c785c5
MD5 b37009b0a22dbf1facec1424316263fd
SHA1 c1be2305087e57ade75962c4ef7a1bde79b12834
SHA512 44491d7aa828342adbbe1151217f21a51fcd3b8c6929c28e8704171c34279aa7da295b36f159b3c30e0b7f02d69e9b30dff25e79b0deef2b67520970c8f2eb42
SSDEEP 24576:vfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnhSnnrFb4PM4MYgLxEVyGLl:Xa5POZ3+Jt2pasx2+msj4MYPVyGLl
TLSH
T17D65AE5EA6FC01D5D5B9D17CC583861AF5B1342253329BCB122182BE3F27EE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9fadc2d52538ac856408d30c1f3936d1c74bbed74436a2277dd3ff89a08eb2f9
MD5 b79e0472f8d3abda38ac80b08ba5bf43
SHA1 dbc1c87f79d8120bf3ddb908aad7845843675929
SHA512 9cbddffb09ac346ee363cb82e86362c07cf35cad627086f4f39144cfb9b8e00a8a9971fc80a54da53d1c7aaa1103a51294ca5a6ad926b522a9863ce43d7684e1
SSDEEP 24576:KNcwHdjbyQ4nLC18lb/EOjowL7FkHSnnrFb4PM4MYgLxEVyGLG:KNc/zEOVHFlj4MYPVyGLG
TLSH
T118858B2623E901E4E5BBE1BE89779646FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b3b777433f004629354de8fd551872aa160a6801541602ce847ecf071ab1c72a
MD5 e167d13d68e9fe0937293a687b7f1832
SHA1 0b0a4c3172b58ec8b5c84fc0814f904381ca2c36
SHA512 21090a4c6ad440cfbe8bab5092234cb41eafd7bceb47d151549df7a71c5390d1487e71cb9ec2480ac4e641bbec3f50e529bc28542b5a81a29e76a0e196fcdfde
SSDEEP 24576:R8kNvNnaFeYhJNtmZBmsSnnrFb4PM4MYgLxEVyGLR:R8MwBtOmfj4MYPVyGLR
TLSH
T127559E6EBAB806E4D1FEC6B4CD238512E6727461173293CB5290C13F1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 3f8cf687a0708f5a550628b974a39a98a62cb5d5106c90e674e7312b268a1111
MD5 8bf91447cc30e439313c3cdb844830c4
SHA1 f2187d9da34690524eebb61b6bf7084e006bf2cc
SHA512 df6ce3bda10b4ee4a057793d0aaab6b5701707761d738b109e0ed141dccc2dabfd649855f14a16b64b20628fd644a2c44b936c28f9217d13d35b62f9451926d0
SSDEEP 12288:HHvUrBFrEjwaQ434XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2il1:HPUr+NQLSnnrFb4PM4MYgLxEVyGLX
TLSH
T1F265E12F26EC18E5E67AA178C5864749F771B8625712E2CF02D0817E1F27ED8BC39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 fd33089b03c1f014e287f429aab82a1ad122f3e52c71767cf60f09db80827326
MD5 08227c7cbf411ff83864c4afc8ff92e0
SHA1 c25c7f6df54307c17f2897560bfec416e7e1b38b
SHA512 fce3715633496657b3c9daa5860b59adae5b5b82c91efaec02c3081e4f6f2491dc1134834a744dec902714b851fe0f9db4c1e1e998cc11eae472c7b12105add6
SSDEEP 24576:jD3FHshBIYQgAwSnnrFb4PM4MYgLxEVyGL1:jDVHeBIAADj4MYPVyGL1
TLSH
T10075E17EE69C04E4D57AD1BCC6638A06E77138A9033266CB12D491B61F2BED47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1048-89-0x0000000000900000-0x0000000000967000-memory.dmp

Download

memory/1048-314-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1048-83-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1048-85-0x0000000000900000-0x0000000000967000-memory.dmp

Download

memory/1088-144-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1088-141-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1088-138-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1088-132-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1088-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3220-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3220-321-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3220-148-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3220-155-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3308-49-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3308-58-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3308-43-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3308-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3308-57-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3308-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3604-315-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3604-335-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3604-93-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3604-100-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3604-94-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3604-336-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4124-119-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4124-120-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/4124-127-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/4124-319-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4916-79-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4916-299-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4916-71-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4916-73-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5208-112-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5208-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5208-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5208-317-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5208-106-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5208-113-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5364-332-0x00000186B7B60000-0x00000186B81E0000-memory.dmp

Download

memory/5364-400-0x00000186B7B60000-0x00000186B81E0000-memory.dmp

Download

memory/5380-23-0x0000000140000000-0x0000000140230000-memory.dmp

Download

memory/5380-8-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5380-0-0x0000000140000000-0x0000000140230000-memory.dmp

Download

memory/5380-1-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5380-7-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5380-15-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5444-105-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5444-25-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5444-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5444-17-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5444-24-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5912-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5912-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5912-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5912-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5912-130-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6036-60-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/6036-61-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/6036-67-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/6036-282-0x0000000140000000-0x000000014020E000-memory.dmp

Download