2e6f05cef4d9148fc7fb869a9f23be93c93af2470093a3a0c6e2b2df7cbf93ba

Analysis

max time kernel
131s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 09:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_7af6f7acfa1258be4ed6a24c39920236_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 919KB
Sample260701-lbbqaacx5v
SHA256 2e6f05cef4d9148fc7fb869a9f23be93c93af2470093a3a0c6e2b2df7cbf93ba
MD5 7af6f7acfa1258be4ed6a24c39920236
SHA1 da5a0386928269520f092cc5cdfe07f563ee4f65
SHA512 5229625cc1bf832f3290e6f588ee02726789e6bedc2afa83558715fc56869628a5f87b77587c7e1d1fb633c027e0753f6b21b7583c10e0112d6255f63e7c813b
SSDEEP 24576:pEIU58bVMKEz5CYtByxknw4FYnshx8OfVe247:pxQoXEC3x4x8EVep
TLSH
T1EA150159F7A904F8E1BB9139C9664606E772BC56037097CF23E4461A2F33AE05D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 11 IoCs

pid	Process
1484	elevation_service.exe
4824	elevation_service.exe
4084	maintenanceservice.exe
5132	OSE.EXE
5976	PerceptionSimulationService.exe
4144	perfhost.exe
2592	ReFsDedupSvc.exe
1764	SensorDataService.exe
4356	ssh-agent.exe
2708	AgentService.exe
5872	SearchIndexer.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5448	takeown.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-01_7af6f7acfa1258be4ed6a24c39920236_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d28672df59cd5fa8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-01_7af6f7acfa1258be4ed6a24c39920236_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-01_7af6f7acfa1258be4ed6a24c39920236_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-01_7af6f7acfa1258be4ed6a24c39920236_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113859\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-01_7af6f7acfa1258be4ed6a24c39920236_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fa9bfefc3a09dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009ede1bfc3a09dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d41222fa3a09dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000326227fa3a09dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{83BE3B45-26CA-4218-AE18-1B4061B8651B}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1991999443-3181470666-3272020885-1000\{00BCF68F-E705-4FA5-B92E-B4E3B129BC08}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1484	elevation_service.exe
1484	elevation_service.exe
1484	elevation_service.exe
1484	elevation_service.exe
1484	elevation_service.exe
1484	elevation_service.exe
1484	elevation_service.exe
3828	explorer.exe
3828	explorer.exe
4824	elevation_service.exe
4824	elevation_service.exe
4824	elevation_service.exe
4824	elevation_service.exe
4824	elevation_service.exe
4824	elevation_service.exe
4824	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 56 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5080	2026-07-01_7af6f7acfa1258be4ed6a24c39920236_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	5448	takeown.exe
Token: SeLoadDriverPrivilege	5080	2026-07-01_7af6f7acfa1258be4ed6a24c39920236_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	1484	elevation_service.exe
Token: SeBackupPrivilege	2592	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2592	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2592	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2592	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2592	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2592	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2592	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2592	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2592	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2592	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2708	AgentService.exe
Token: 33	5872	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5872	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5872	SearchIndexer.exe
Token: SeDebugPrivilege	1484	elevation_service.exe
Token: SeShutdownPrivilege	3828	explorer.exe
Token: SeCreatePagefilePrivilege	3828	explorer.exe
Token: SeShutdownPrivilege	3828	explorer.exe
Token: SeCreatePagefilePrivilege	3828	explorer.exe
Token: SeShutdownPrivilege	3828	explorer.exe
Token: SeCreatePagefilePrivilege	3828	explorer.exe
Token: SeShutdownPrivilege	3828	explorer.exe
Token: SeCreatePagefilePrivilege	3828	explorer.exe
Token: SeShutdownPrivilege	3828	explorer.exe
Token: SeCreatePagefilePrivilege	3828	explorer.exe
Token: SeShutdownPrivilege	3828	explorer.exe
Token: SeCreatePagefilePrivilege	3828	explorer.exe
Token: SeShutdownPrivilege	3828	explorer.exe
Token: SeCreatePagefilePrivilege	3828	explorer.exe
Token: SeShutdownPrivilege	3828	explorer.exe
Token: SeCreatePagefilePrivilege	3828	explorer.exe
Token: SeShutdownPrivilege	3828	explorer.exe
Token: SeCreatePagefilePrivilege	3828	explorer.exe
Token: SeShutdownPrivilege	3828	explorer.exe
Token: SeCreatePagefilePrivilege	3828	explorer.exe
Token: SeShutdownPrivilege	3828	explorer.exe
Token: SeCreatePagefilePrivilege	3828	explorer.exe
Token: SeShutdownPrivilege	3828	explorer.exe
Token: SeCreatePagefilePrivilege	3828	explorer.exe
Token: SeShutdownPrivilege	3828	explorer.exe
Token: SeCreatePagefilePrivilege	3828	explorer.exe
Token: SeShutdownPrivilege	3828	explorer.exe
Token: SeCreatePagefilePrivilege	3828	explorer.exe
Token: SeShutdownPrivilege	3828	explorer.exe
Token: SeCreatePagefilePrivilege	3828	explorer.exe
Token: SeShutdownPrivilege	3828	explorer.exe
Token: SeCreatePagefilePrivilege	3828	explorer.exe
Token: SeShutdownPrivilege	3828	explorer.exe
Token: SeCreatePagefilePrivilege	3828	explorer.exe
Token: SeShutdownPrivilege	3828	explorer.exe
Token: SeCreatePagefilePrivilege	3828	explorer.exe
Token: SeDebugPrivilege	4824	elevation_service.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
3144	sihost.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe

Suspicious use of SendNotifyMessage 42 IoCs

pid	Process
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe
3828	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4940	StartMenuExperienceHost.exe
932	SearchHost.exe
3828	explorer.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 5448	5080	2026-07-01_7af6f7acfa1258be4ed6a24c39920236_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	89
PID 5080 wrote to memory of 2664	5080	2026-07-01_7af6f7acfa1258be4ed6a24c39920236_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	92
PID 5080 wrote to memory of 4744	5080	2026-07-01_7af6f7acfa1258be4ed6a24c39920236_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	94
PID 5872 wrote to memory of 1636	5872	SearchIndexer.exe	106
PID 5872 wrote to memory of 2136	5872	SearchIndexer.exe	107
PID 5872 wrote to memory of 5848	5872	SearchIndexer.exe	108
PID 5872 wrote to memory of 2504	5872	SearchIndexer.exe	109
PID 3144 wrote to memory of 3828	3144	sihost.exe	115
PID 5872 wrote to memory of 3140	5872	SearchIndexer.exe	122
PID 5872 wrote to memory of 5076	5872	SearchIndexer.exe	123
PID 5872 wrote to memory of 1420	5872	SearchIndexer.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-07-01_7af6f7acfa1258be4ed6a24c39920236_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_7af6f7acfa1258be4ed6a24c39920236_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\SYSTEM32\takeown.exe
  takeown /F C:\Windows\System32\DriverStore\FileRepository\ /A
  2⤵
  - Modifies file permissions
  - Suspicious use of AdjustPrivilegeToken
  PID:5448
- C:\Windows\SYSTEM32\cacls.exe
  cacls C:\Windows\System32\DriverStore\FileRepository*.* /E /G Everyone:F
  2⤵
  PID:2664
- C:\Windows\SYSTEM32\pnputil.exe
  pnputil -i -a "*.inf"
  2⤵
  PID:4744

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1484

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4824

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4084

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5132

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5976

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4144

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2592

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1764

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4356

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2708

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5872
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1991999443-3181470666-3272020885-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1991999443-3181470666-3272020885-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1636
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2136
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2652 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5848
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2504
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3140
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5076
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2652 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1420

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3828

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:932

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 716578077fc17cd094a6cf7aaaabe986e0f5e2e1baeead57b7c9351a3ce5eb30
MD5 eadd5d63f1511b83d71c093f7d9e62bb
SHA1 9bccbd34c8e0b5fb15bc62dc4c27a727a1bcdcde
SHA512 731432c046919a2a50f332ee4904963599690498147f90abe10a124691d80b65ce18cd2e11ddc9ed2f776965a23c330c45b0bb4d650c39ee29ed7efaa2f946ae
SSDEEP 49152:hb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnSx4x8EVep:n3q6HjBtix8EVy
TLSH
T183D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 d8e97bb9599c3e24ca7a16d9a326948ba1fc41d04ab6d8a225cab79aead3ebb2
MD5 8bbda8ed048f1f5cf895187ae71f7b62
SHA1 a647156728bd8558837994b63cdd51302e904a46
SHA512 42be3755289f3b612811410cdcff63efbdb2dedc986b08546ac547454daa677c5960819d0563b26487b0f6e7acbe723f57afea26ee6f2fd68dd9d8ebff1d28f4
SSDEEP 12288:Z1XLsswWkxy2lRq2czA2+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:3XYfDtczA2yxknw4FYnshx8OfVe247
TLSH
T12505F12877D508F9EC6B8139CDB28512E633B8554770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 6cd10d30ca6332cf4a4b35584012204bc1b920d9665c77f30686eb13805460c0
MD5 4f16d98b285364b42048fe34627baf58
SHA1 f93641556124b362d713f3a74073daa6dbdb975f
SHA512 2084f34e0fc65843951f048a9a87c0852223a592b71dd64a81ed8ff942bfb16fb83df1ab89b6a2c46c96824946a5f648369ce699078590cbaa52ab5536cdfbe1
SSDEEP 24576:m0Le5ji0hmxirMByxknw4FYnshx8OfVe247:mPji0AcFx4x8EVep
TLSH
T12A35AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 8895969d1a70759d65b3b2fbeeb52024711dbf37fc9025f66d0f9484a86703e5
MD5 c53b00b27a74d039134d6c0238728d5a
SHA1 b1b3f4620eccc094296be8732db24b8f77d6e499
SHA512 4e813e16133b7c67b44a3299f97fd6f0d6f2c337e0a0a359a8296112e3bce1ffe40917e18a07dd9d225ed57f91bc54d38a27786b0c01bbb346430c33eae8d9e7
SSDEEP 24576:/a7/ezSC6vUyD/aqgrvWE6q8wyubyxknw4FYnshx8OfVe247:y/ezSC6vUzPvxHjy5x4x8EVep
TLSH
T1B4756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1336d9211d50e7ac1c32123116b951c2f0d29b98f8cdacff8d62ed23b696eb43
MD5 9f3820224cfe8775f81311f56f6dc0f9
SHA1 641abb37587bcf686fb2f44e3d2563055e6887ba
SHA512 64042edf45da8912a67f041e15a33b56ebf27fcc8c2e1886bd70738b07a5bb912eea05efb7d7deaaea2c3e80c37da651ca383fb2b2183a21d0ee607b5ff9ea45
SSDEEP 24576:FVbqPb88hv/l+6Qyxknw4FYnshx8OfVe247:FVO88hXl+ox4x8EVep
TLSH
T1EF559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 bb115e4f4c08a4d1925f49f52c449f231ac1e23383e1e7f57ae9b5696ab66d04
MD5 38f6908544475cfd0f6303bcc901d4cc
SHA1 ea779717a9c3aee34ef0f5193ffe75b134dcd057
SHA512 7e96ed3cc62ded7fe553e722e448860785d9e30ce9b96e9d7731581acbc6e453d037eaa7ee79d1bab6328a85fad914a72099789ef4a5003737424fb6574cb142
SSDEEP 12288:rR1+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:rR1yxknw4FYnshx8OfVe247
TLSH
T1E9C4237CA7DDA4E1FA5E14331B7572622616F9A0DA74C11BC779B14EE0F0CA0E06E223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 c6d105b6bccc0ba62f9b6f79097808475c8a4fadbcdb6e426dfc8f4c8695089d
MD5 534591203b47006a7ae930acba78da75
SHA1 f7232e8d075654b72204acfd8fa6d18c31139cd5
SHA512 1b9776582d8973cbdc5f891784cabcd4b3c69aa88bf9ec0a5dd612bee4f89e927f00331690aae7a1c16963c0edf2d85079ab38f9307d010c9ea1c976ff62c3e5
SSDEEP 12288:OeBNUbTVO86U4+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:OJIU4yxknw4FYnshx8OfVe247
TLSH
T1FF05CF7BEE28FCD2C27E5DB95B918200A77274704B6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 092b0931c06e8f09848b5b5b91735f79bc5c57633ed4a9ea58354d1df756b8a5
MD5 0b2d4780965ee8bba96c78130b8bca2d
SHA1 0e13fabe3d4820c4d075c369c84a7f42ed06a9bf
SHA512 cd7c03fc450c74b92600e523b98e47b36735cd89cf9965a847680f5230919981e4958c1f8ebbe42b05dc1d21e6bf0ac84544369aa407e555a942fbc531f91e68
SSDEEP 49152:4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THj:4QvGAdlCEL8c/yRNw5COix8EVy
TLSH
T104267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 8ee318cb368e7325cc1444f21e06196c4bce487791022c4a7271d20efafe646c
MD5 bcbfe769e487b044d947d26459857682
SHA1 3a51a8b8f1557642d7aa878f1a4c594c76d242ca
SHA512 94d6819ee6edc1f379402b2a055878e0513be8df58878980b7596f2f3f68d4103ee830f28db2d8bed88b031005af969d68944e9fd4fac06f74cc2bf602d8b8aa
SSDEEP 12288:TAwSfxL/2Dc34DLLmt0LDQewsAj6+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:MdewsAj6yxknw4FYnshx8OfVe247
TLSH
T19715E030FE74E032C7BF0DB21B36D716142DB9604B611AC3E3E89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d6aaed690329cdb23620c77e8b6220ed85d883d5dfa484d9f6c30c1a70c6e5d1
MD5 1deec9c237552ff84af4835a23f3db10
SHA1 88c6d643e00f531670642dc9bd284fee140ef087
SHA512 59fc5f95960ebcd85ae10a4255bacb9801a857dc8bdb651bd559f120347e4770d1e3c046f0e802948478b9469ed1867feb419432479ded80034842926a45c85d
SSDEEP 196608:VUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHw:VUEtQevvqc2W1cpV2EI32
TLSH
T167474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9c0afb7cfb9e864ad9798b457a38874f252539b80daf656a5427ddcb81e604b0
MD5 d8724584fa6b3c8752ffdbe854d8fd8b
SHA1 ea31e6756fd418f2ba8cb709f83465a96048013d
SHA512 0bae89db3558e84e1d9bb7649624225233a1dd107313c44bb714a7d56245a69aae8b780918198816a5e3e523e38704a1b0866dbe42b391083766f2f8de020826
SSDEEP 49152:BCbRquA/m2yL5zQfFiV+XenmE3/z1x4x8EVep:uoqtVjnmSix8EVy
TLSH
T1ECD58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7d1d8a1873091cdef7018bcf36f2c573036fca2564c0cbaf594c35cea047c1d9
MD5 888462ee854bd9c2b5a5984c5f29a66e
SHA1 ea36e7868d90ba5adc2b5e0ff387d1c04f68a33c
SHA512 8283a166d287a49e7c5a64c0af42c01cc6efe0b8331da3c82f1dba4b59da7b8ffe9e59a0dc5441dabb5a122fa59c45cfbff2e47c16007feb9a23b60944a27ad0
SSDEEP 24576:5AhGLJIFoiwtA5l7S53nyxknw4FYnshx8OfVe247:5AMyFoiq5ix4x8EVep
TLSH
T1B835AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 3c42f7245b790a7735b84108a322348bbedd2809024e3b681cb02f6e24c157d0
MD5 d9ec834a52fc660611995a5fe83de13b
SHA1 fd84b4ea079f0b78e8d39b7b31a276b4d31b961b
SHA512 44b75d0ee01dd549e4bda363c9b8e39b086a6762d0f2a72ce3c63e6788931684d481ca271152f786029f1e4d423a273f5a7f934775a9c76cf68c5f517ff4e7d0
SSDEEP 12288:mmw5HEjsChNVBFgl0WDm+C7+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:/wuoOWmyxknw4FYnshx8OfVe247
TLSH
T1F105F14977E91CF9E9A741398657D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 da8072ba564da866383c53bd1620f46d3d76ede93c202519ff484acbd21ae493
MD5 de1835ea263d77609e6e7e63b6e30f46
SHA1 7c703e1e14a6a36256c1338e0c2c4fc1a752a013
SHA512 b658dddc6107c63e9f49550861ddc3936b4db53126b5609b2eeb81d20216e1aaef6084db9e80a521e62683d59f014fd7df84e5f405c06eaa360921750d422a8c
SSDEEP 12288:OBZ1IyK+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:IZuJyxknw4FYnshx8OfVe247
TLSH
T1B0E412AC33E860F1E1A7113A89F15205E76274A2677183CF4768625EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 590cbbee19bedd841780d9d2c7b8de9011e5fb772ad59fede44bc7106e19e971
MD5 decbd878fd4846cf44df3f6161ebd109
SHA1 28653a8028f82c16f1eb6c6a0d5e3ca358c26015
SHA512 c280df9c4b86a2f427744de7839bae35448457241802a2fd3cf2bb4362837bca20ffa6f7dda2bef91797cf7b061bf5a235b079eeda8e64aee8b2040347b8769b
SSDEEP 49152:bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U/:KQRQyi36YOcPQLvw2gAf+PN3/ix8EVy
TLSH
T1C4667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9de92875c9de750afc3eefd5979d14ea62467160d7ea69536182ebddf82fd498
MD5 451a3d3f91428c1f87edba80b2c80b05
SHA1 7bf516482ad1bc74daf706b9d47fd9add16b88f8
SHA512 0a45b881bcbfedc7a5b5bd0357c59615154e7104ae0d0f18de32a2cdacb21f769aa1074b5fc1129813f364a9610fd47cd44af3a80472179983032ac98f685843
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U/:bQRQyi36YOcPQLvw2gAf+PN3/ix8EVy
TLSH
T184667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 927bf02172b43510af67679cfc18abf352201735d235dd4321118256ebb2a4a8
MD5 abab85bb0590342d97a8f0fc365254ce
SHA1 d2c4e7892388587344e0e4dc96c4067097a9c60b
SHA512 4bd744de4dcb658d6076ae8154e552d827e20c3f81ad4ff74d415b2636be529db4038ccf53ff9b1912de002b10c605cc3c6159b4067f4dfab502075b02e2baec
SSDEEP 24576:2wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL05yxknw4FYnshx8Z:g68Qg55nhheWu7PNU3/Fx4x8EVep
TLSH
T1E7B55A33B2F600A9C44DE1769F46973196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b8598b6c48e31a8072a3017bedd1b2fde63e7b548520c068000fd0269c1333ae
MD5 89c6d845ab57c1e54cc80107ba29f84d
SHA1 b6dbfad6a50693a3500e49399c0f48c34d4ae110
SHA512 fb0d8c0a19ebe671aadf46728d606a22357b55ac9d395116242954c73deefebc993add920efe0023ef1499445750e17a6362a3706d38f33170f3621482e23142
SSDEEP 49152:v3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99N:Cy5112gYy5azzVvL69nLKnhZAix8EVy
TLSH
T150167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ea8cbdc196448ba72ba4347f4b825be84b25952297085b3760784180010960e4
MD5 7729801a5eb062d7771229d7ccb17d26
SHA1 17996698211050b8cd32132d322d44de91689a82
SHA512 93a44aaf1402f065cde25f3225f387a105681358ac4cf2be57cffe4152cd515f6408e6353c872e72d75c675fd280b3c3e9cfb5e3befa6a922a5355caf35468c6
SSDEEP 49152:vB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl5x4x8EVep:Ru6JmVxd2d5ix8EVy
TLSH
T15ED59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 768f1ebd3b577f268dcf7e4a4c867d2a71bcf845b73ec1b8b1283061ae54f631
MD5 7a53bb2fb0aa6a61d9a1c8d38debc338
SHA1 ca3274a8d5127b22236fd8ee43d7fe775aa7215e
SHA512 584d71faab512ddbb8b3c710af4909210f33cf223b3cbb440b2d8f547225480784b46adb5d93fd13a3ae3f51aedf01a7037b643fa8021afe1f38e415264e9951
SSDEEP 49152:71hpsNoJpF1A6UU44CwH7R4x7x4x8EVep:7mifPbRSix8EVy
TLSH
T18CB5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e2b04a98c218d82aa0ff8a40ee3775379707711d13b6f78e4bbe05c05baff683
MD5 b3357534fd62658c8daae1710f1b9a05
SHA1 e6ef12ff141552cf447a4d7842720c2e94d0e275
SHA512 97600c1714aa3cd2e3586344fa8d352c14fbb50f893dd4197b7043fdab5a0484fe7b9aeb26217af8878bafda566e1cf02f8c44f6273ccd571bbe1ab7ca48bbbc
SSDEEP 49152:FSuZQIY0Be2KRRVtOnks6NMHqMx4x8EVep:L5dKTi61Mix8EVy
TLSH
T13EC5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 19470dd964dd0f62d56dbbe6fbbb84b3b5a0c6bae7128cb5cba16969e09842ed
MD5 8563936a6f31749e61b3b948fce9607f
SHA1 1425755b9dfd3626b935669e3ce7f4de665eb264
SHA512 ef36e55e77e17c20f54d14719e33b49f628113e85ec86a3fd7ad68725fa0e30d6c1598203c5ac3a1ae119a5fe666ab0f9f0c31e0171fffab909e134c4e576d3b
SSDEEP 49152:rhtSn8EApI0figngiDn0AP5wXx4x8EVep:qX2iyphGix8EVy
TLSH
T1F195BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 01b784b6d3ee46008bd70c49b575f9966b41330ad4008267fd871de2378cabd0
MD5 05c06b25a917b025553965212146e5ac
SHA1 c0cc163b4ee57f0a63e9c95d9026e8a0b7a82824
SHA512 641600031ff7fbeb8fedaea93c3261479b301bc28b3fe0027bc76a7394ab1ec79edbf0fcd66c8aaffe3fbe1d11e820afe4c6a035b3f08be696a567d8b5aba40c
SSDEEP 12288:a9+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:a9yxknw4FYnshx8OfVe247
TLSH
T17CC4237CBBDEA5E2F50D11734B7172626609B5A5EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 fc628f1df2402360219cf883eb756b9cb26eec973614a8c61c648f23aa101e6c
MD5 984e791aaa8e760cadf6500d2a8719e9
SHA1 bb551133a4bb79ebb93841366c391a7634585296
SHA512 c0a9884ba36bfcccb91450422e5ea8fafdcab60a02b78bb82ff47eb06836f4ffe3e6ae97746c456673e4eb47dbafc36b4b2dd34fbeae3917cb8e4c4276189b22
SSDEEP 12288:ye+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:yeyxknw4FYnshx8OfVe247
TLSH
T142C4237CBBDE95D2F50D10734B7172626609B5A6EA71811BCB7DB00EF1F0CA0A06E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 8fa38a5394478a7e6f8f2260a348996c8112ba9438679aaf0c9aeebacb240147
MD5 37672ded544e17ee4e9d1c9c9d966419
SHA1 07fe6b63e89121b2cd90af2ea1d45a1fe49d6c3d
SHA512 201dcd2672ce87117c110d7b3d02dd5efcaf3b27671ef308c0ae63f2726084ce971e1a3c5b3e3afb2f240e2573aebee1ebfc92732453793add1cc98df18fe60c
SSDEEP 12288:tA+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:tAyxknw4FYnshx8OfVe247
TLSH
T143C4237CBBDE95D2F54D10734B7173626609B5A6EA71811BCB6DB00EF0F0CA0A06E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 7049aac489cc837c649b755906e3cefbb3041ee6463c42d33bfcf8227a34f684
MD5 2a45c9a38badb2b29557f6fc55aae158
SHA1 18aed0b900aba4a3f0660bb75b938a04b94c4061
SHA512 b33a6d36ed44017e9bd2f12e59368777d44c0f029dbfb9a90bf7f96287120e705096d27b2c39ea3a02e06fd1c21c35bbd6f47e7530d6f08c70dc9eb51223976a
SSDEEP 12288:+VH+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Kyxknw4FYnshx8OfVe247
TLSH
T11DD4236C77DE50D1E85A51738A726222B365B8E5EB31835FCB24710EE9F0890E43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 8d223678a2fe916fbc3e596177af3552c7b06738f168bf7bf93e4a626c149542
MD5 56868e6be285fadad916357878b35fa3
SHA1 10bdbdcef352d8641b9d5903b59c5a7c0cca4cc7
SHA512 3cbfe1ee4867b63e6af99d3f0537f8c0c4d38acee51462718a643e2deb2870f7563c615dc0218f9853f4cd3008a947f2752f03aafb5d08875abdd222a6cc6132
SSDEEP 12288:U/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:U/yxknw4FYnshx8OfVe247
TLSH
T1E5C4237CBBDE95D2F50D10734B7273626609B5A6EA71811BCB6DB00EF1F0CA0A06E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 a917f3ba58771c35e6c732fadbc835ab8ea9ec71f4b42406b9348974e9f63845
MD5 9e3242aa0bdf870818d50344601082bb
SHA1 b69abb48be11a71801cae0b5a2c75328d896727d
SHA512 3ad897c2de778c3acffd9e7d62cc63642b0cf2b29139ea1a3b3ad56d706ca1bc9797013bef1b4c4bc0766195e693fee624f2603626459067ededeadedfe656d3
SSDEEP 12288:ei+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:eiyxknw4FYnshx8OfVe247
TLSH
T1C3C4237CBBDE95E2F50D11734B7173626609B5A6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 a4eb21f95a790d0f0e685fa5c7c010c26564cb9548a6e4d112fe3ac6905f4c61
MD5 0583ad3ce146de7bf8777bfc7d220dbc
SHA1 52f0c2a23d6c6f654a7a528c5908d937d6751bb7
SHA512 8a78653376adc2936aa874dd51aacb04e3a4fb0430ecfe84d83e15add6af1c8d8a93c45e8dbe51836cb6e9f6a59e17857c661d7faec2bd2eb1260b9a4a58f526
SSDEEP 12288:hW+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:hWyxknw4FYnshx8OfVe247
TLSH
T174C4237CBBDA95D2F50D11734B7173626609B5A5EAB1821BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 6162dc631f21aa97fe79e017ddcc8c1851925dc4c0fc991b77f4a871ea761a02
MD5 0fc637d2038ea6e6d46be9543b84099a
SHA1 133dd9664eadd9c6424d2391d51e151acc40cff9
SHA512 ec1158b96982e1607ef6f2a51bd0dfdd4fc371e825a758004b54fb990644602b75d0b331ffcd547b175c6896b92c88e74bd48949016271f2f04cb474111c7a67
SSDEEP 12288:CiZwb6zzFEoS2cPvy++hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:lZMSzFVSO+yxknw4FYnshx8OfVe247
TLSH
T1DD0501A8B39018F4EC67413ECD259916D6B27C594B70C21F43B8362B5F736A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 fa87d4e3ee6645f716b8f81ec80ed84efb7586786973f38c732edd29ea287cd6
MD5 ad1f895614d2e920c0137fa5378bafa9
SHA1 3296ebac60e8386765886665efcda9d72964589a
SHA512 e3b27ce9e98909312cb1bc71dbe9a582e566d07fc36fa00f03065fcced784e6a402542b5e113e1443926baf2ce5cc2c3bb0acac1003b99af736e0a5d0dc1b2e6
SSDEEP 12288:AZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:AZyxknw4FYnshx8OfVe247
TLSH
T132C4237CBBDEA5D2F50D10734B7163626609B5A6FA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 d41a1a64ffb922dfa2c6d0e56bc1fefb5b4cbc058e88260a51303f3e2de5baff
MD5 b2ed74b25a60a011ef39a851e768453b
SHA1 8a424a62f603e5b3cf4fd7098ee941c755ec4e8b
SHA512 b67267b95769c1df859c32ba1c61d760048374c60f171474ccbf36e9061bf2d93c0065052ea7ee218bddc4b499ade14787cd42db5e822fa95d756a4236055422
SSDEEP 12288:xF+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:xFyxknw4FYnshx8OfVe247
TLSH
T1C6C4237CBBDA95D2F50D10734B7162666609B5A5FA71821BCB7DB00EF1F0CA0A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 1951ad0d1f2dffc359b2ffd12e12ec95529169197dba78f19094062797aeddc5
MD5 3e62f1a55f06c550cdadca7b267d7c74
SHA1 99df399c4880535d3a7f2aff48c3c77997c4718f
SHA512 e208806956387420abc20b99870c40e41398d488c91b87dbb200f5759db2872382f7c4837e7f5314f4a8e055f1cfbadf5518140dcc59790184db7bfa12f8c8ac
SSDEEP 12288:xyPz5L8K+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:gzyKyxknw4FYnshx8OfVe247
TLSH
T10AF4125B73E530F5D12A4236C9621A12F372B872473086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 da6b671e8d8c4c40edec05b64bea63ba7f8d6d04baea2c334895b0f4e5f6f769
MD5 3dfe06573ed9177757e54438af7450d8
SHA1 2151a9ef4bc4f2eafb6711ff6344478b521da1fa
SHA512 df1325daf0d2e569aabd90ddf7a2f84d250461c806f7460bbd7a2d9cf0ff78343c609b30e886c1968b80ba62a35e243fd4c1fedcd50c4707bd0aa78e1aa9c852
SSDEEP 12288:1Z+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:1Zyxknw4FYnshx8OfVe247
TLSH
T1F2C4237CBBDEA5D2F54D10734B7163626609B5A5FA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 2b03cdda2676ef534c96f2bf529c4131fe0301ddd766b89364741e2824adb676
MD5 a3ef89281d4c365b1cfc90e092c6a90c
SHA1 33c3f06b353d12dd573dd0bb0635512379f59e88
SHA512 cbb3d851ce6af91bb42ffdf9618b27a619e289a52217965f33eedf74ad0a4ad25f4e7758d6c105e8a06bcfc88b84808894eea894dddafb9ba56166a11f32895f
SSDEEP 12288:QZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:QZyxknw4FYnshx8OfVe247
TLSH
T105C4237CBBDEA5D2F54D10734B7173626609B5A6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 effd7f5ad3fe365a9aea131c9e2671adfb1466bc5262c1cc29544771f495d2c9
MD5 2158388d3e6f3ff79bf77a6242158703
SHA1 86dcfe702d11649b74edab7f80960006806fa774
SHA512 bf6a3cbfce5326c6c78c3b7f6922ad113daecddc22d616578797b075875de172601f8282a3e5df5ef63c72c096f32f34b81987d9addc972b495fd020f3936a07
SSDEEP 12288:hyPz5L8K+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:wzyKyxknw4FYnshx8OfVe247
TLSH
T1FBF4125B73E530F5D12A4236C9621612F372B872473086AF87A4537A6E739E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 499609c56e72c3767ebfb2ea081ebeb48f5f5617da908cceb98fad696f34f546
MD5 fcf98ca6f66d27152b1703ebd16b2ad4
SHA1 2d910a77f10c8d34357948e87127d1a7b9fbb0aa
SHA512 07dc2fc1126a7591c813952b6efe2045efb03a4f978e2e1586fd7c1bdd3d865076609600ef5e280ffbcf05032b6233c17baa39d4e632c40dfc42c35422943ab3
SSDEEP 24576:6THaLl3z0zDwyxknw4FYnshx8OfVe247:6T6Llj+x4x8EVep
TLSH
T19B0501A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B9F736A05C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 43288baece74427077fa30f99d78d06ff7c37fde26621b69e7fd94a58cffedca
MD5 e909ba34415d92e516c7d23acc10a868
SHA1 85fa6cef7c246ab202a0457a3b99f02b9c777c68
SHA512 ab964f0dfb92a46ce8d7529a4caf758f1ed7d9a079e6075c4f89f0f2d8cd23b47f830b66ab5d0338716e503f9acb3a20df9d976531e7990bc35c2fa2f83eb7cd
SSDEEP 24576:s37d9CHKy7GZEyxknw4FYnshx8OfVe247:W7d9CHKyatx4x8EVep
TLSH
T1C425DF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 dc0c118a51e33abc412f7b8a9f6c7762a5b423882cd2fde94c02b33a475c9b1d
MD5 4ca2e7f34889b7941a0ceb9082035a02
SHA1 e8e8000ea961d24d4b9db9fb9ae81e0ea2b55636
SHA512 49b2c520a2c516022ae5569a2848656335ae5a21e54cfd37cfa8db2e419b505eeaa8d7f7e22f2f1ea66d1a01fc996145e8352897f64b8f90fff4adb3a04350c9
SSDEEP 12288:8g+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:8gyxknw4FYnshx8OfVe247
TLSH
T1FDC4237CBBDE95D2F50D11734B7273626609B5A6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 30053fe2673b178a29811a0b009e3621dc9149146ad28191d9b1f3f3296cc9d9
MD5 3275c6e3b0f27b04b9714c63bfe09b51
SHA1 8e9212f009469462ed0f95d6acbdafb18cb03f3c
SHA512 a7a251f08153d45340bc934c33668f93c9556aa204e159beb8b402249be9894014ce7aa6a2c499540a0194cb103c85d33caacf658a8228a307c6b85ffc00e372
SSDEEP 12288:Aq+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Aqyxknw4FYnshx8OfVe247
TLSH
T109C4237CBBDE95E2F50D11734B7163626609B5A5EA71821BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 e5716b5f52d2d986fcd77f08a6d55b7774f3425e9c0b5e613e8ad78ae138ce48
MD5 329168fac83fa2aa5cf6ca86e388492b
SHA1 b228bb8282b3959489ca45c102258cf260a6467f
SHA512 a4ba64cfe1ae3b824efd364e418e96069b284b0cb7618b47110be9220793ec5f48d8fe881152aff8ee2ba0eae7121a46dc9ad7e56d42af431e6535d9f7398e93
SSDEEP 12288:aT+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:aTyxknw4FYnshx8OfVe247
TLSH
T1CCC4237CBBDE95D2F54D10734B7163626609B5A5FAB2811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 f97dc3c65becd90da2adecb9bebcdc89cb90b6a231a1b5c1cab05390430ff44d
MD5 c5088a387f2ad62086d01f0cd365be35
SHA1 3b4c0fb83b4d01d290083e6133faf839b4cc8e6e
SHA512 19ea2035c6e12ced4d1bfd5992c8890b523945ed4eabdf7237d6786403123cb59e4f51a04707b11bdea534bbf2055131a73743ef752fb95edc02156f50b84c57
SSDEEP 12288:JZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:JZyxknw4FYnshx8OfVe247
TLSH
T170C4237CBBDEA5D2F54D10734B7163626609B5A6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 83c0989b1d48be0f5a053ad4abed33726fc2bad98ab1346643cdfcae8c99d002
MD5 51e7da0f4c136c90141fce55685a24f7
SHA1 60287ee85c849a1e820bac60a63b29496ff4e705
SHA512 ad1153822f1c58a60676e4adfb347fca12c8248c221d8ac113d3e4fe6669e5f41e3fb79b1d6d3248a83e016542a94ca6e4217e2f836ea3ab3d48e0f079d3e6eb
SSDEEP 12288:Eg+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Egyxknw4FYnshx8OfVe247
TLSH
T1BBC4237CBBDEA5D2F50D11734B7163626609B5A6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 8acc17ba24f77b8196a499c0384cddeabe035355043d0ef70859c84d6f3d0e8e
MD5 2297433f4cd5ff258b362d75ca78c8f6
SHA1 04a894632fd4f53ca6d7324b317d38c7155ed533
SHA512 5264b29102e7f78ba87d98ebbdad485fcca1c99cb85c159e147e99e06273c1aab9bdb241846cdde802db248ec0e010d08318868a3a33eca2dee62ee158b437d0
SSDEEP 12288:9x+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:9xyxknw4FYnshx8OfVe247
TLSH
T178C4237CBBDE95D2E50D10734B7163626609B5A5FA72821BCB7DB10EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 db1b01606c0fe9fd3e1e9d8c5a84c3aba2f37121eaf06e79a9f4524feeb2b46b
MD5 460a0b255ecd52d35cbe99dc7c3ec6fb
SHA1 de99dcfec60499f00a3adee71fef0c9d7caecb5e
SHA512 32d5f078fb4640b0cb6995d58809b121da99ed5043dac2500a75e80e19f81e8251aaed703876cad4ccb29f429b5515dcc363c16ae70c44077d5ecb982731aae7
SSDEEP 12288:v/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:v/yxknw4FYnshx8OfVe247
TLSH
T1A3C4237CBBDE95D2F50D10734B7263626609B5A6EA71811BCB6DB00EF1F0CA0A06E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 0fb8e64981afc515c04b82fa6bbab0de0ec5d791b10804464f6da6628b3eb47d
MD5 3cd06d777d32438ef0c9dc1ad8605bad
SHA1 0ccb5abb261f6fd7bb99c27b9fd309a16f853e31
SHA512 2341cccc2284ced1a7673361c8b300b6159a6184734f56ae8e9916a694778887d2742aba3da4e2f33e97ddb0504047e05eac7b7f698d94b59d076e8503c8f596
SSDEEP 24576:ifwvok9RX6wkyAIVyxknw4FYnshx8OfVe247:OMnYIgx4x8EVep
TLSH
T1E535CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 bed759c2e990b626d70d911fa3b8e31e3d13d8da81b8670a4a15ffe96662e62a
MD5 f601ad51a1af999fca568c8c5478946a
SHA1 a5def9c47caba5a61da967869c085278faa80797
SHA512 037c63677cb0448ec941b1411b93d92303b52b51bccc8581c77e6ea47c56f0678390d4cfc88754a63ef57487a0d562b374e78c6f2bc586915ec5826486afd9ac
SSDEEP 49152:WYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK03x4x8EVep:IySzPfix8EVy
TLSH
T13B066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 627bc2688ad05a6a25e182384e5aade71fc4018600dbc574e90069026a84c54b
MD5 af88814e26cda7e9f57979f80194bab0
SHA1 71051f7ba4dfbcde61d92b58de3fc17a99b7e330
SHA512 6064dbfe1d8ddead932c521be170e9ed4dc186e4cfbfa8af97f86784898b6f29b5d725ee3e232a94187d70fea9323e20ea31ff0e6b5ea8d9f2626581d7fb2c00
SSDEEP 24576:347Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYOyxknw4FYnshx8OfVe247:347JUQj1irIhCnDHUPfF/Hx4x8EVep
TLSH
T1A665AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 27654cba83acd71d5e056db776af47d9ee0a1c249e4d2d6c408aa8b6de84e53b
MD5 8a2b46e4e6988be244b098d74a7fa63f
SHA1 82ea9adde2e3195d7746de5c92fe6d6bcf47f221
SHA512 fb353c9f16b67a0e5b4d138d668d9a9b78bcd97d83d75490f60748cf55c7467ae11efd61422be269a9500129dc2a9c69a73e6370124ceebaecb17c3aa31d8ff4
SSDEEP 12288:tNsfJ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:CJyxknw4FYnshx8OfVe247
TLSH
T1F2E4F028E29802E4D06E2176CB625641B3237C6597F1D3CB97D0F53E1FB1990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 bdd747b0c5b1588082f9fe1d2c7c03a8d5868710b7d64e118c6adb73b21b7fc4
MD5 06ba856c8f9520719612a55a3e389a01
SHA1 88a6638d0f4038f4924f20e7ce9913ea05ceb200
SHA512 a433057e585c73faa17000b080e0401685cd85815c31026307b4daf333191ff44f8ccc7ee01f3480efc79c6e61ba80df3e5f0efa36974140ef3a8bf08921b704
SSDEEP 24576:cPsqnfUPqqwlsLyB8uytCKzWdEtQuK7K:ofUC4ucCKzXtQz7K
TLSH
T1DE451700B626D78BCAA940325E76D6CCAB707D11EE056F0773C8873FD476658BAF5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 965KB
SHA256 469fd66be44d81b8ff984f40942e3a4242818d6aa9632737e89809c5100fb976
MD5 a5bff760b768bd55f75c360f1f4c31f0
SHA1 b61406a23316b97d4555e85852840b56af56b5e5
SHA512 7db2560d575a298288855061fe10cd4215419cc4cc3990ed85305b2334dac96272947a8ed55b97adbf76a29d662cbe1fa602c9c82e714b122d60bc1f7ff001a5
SSDEEP 24576:Zfy7fOs4+gjBQlWnsUjrIHQRsLlRKQrph:ZswjBQlB
TLSH
T180251A05B177E74FC9BA4033433186CEA7B4AC12BB453F1673884D39D46AA19B9E63D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 f9635750b77ec0e79c6b31450104c51307a8d9a99d7a1e968403e064856733d5
MD5 d2f8387981e7168e62e743dde580d718
SHA1 d26089e52e1f728eb3cb78c311c5b12d91397fc7
SHA512 e944bf26e9690fec88f0c2427093cb813af9bc15cdcdac57c05ff9de95c6ef0f09e0d20af90b41098687f2b9d375e5affa77df1fc70826d797ef8664c885957d
SSDEEP 12288:RM7h+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Khyxknw4FYnshx8OfVe247
TLSH
T1D5D4237CA7DEA992F86D11730676A231320AB5B49B70C1DBD728B14EE0B0CD0D97E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e3fb7038e55c97a621a43c5ee37fa22c42d6e154f459292bda12f06343525c5c
MD5 42a09336952c9b8c292933556e743300
SHA1 72772f6cadffbbd375bfba326b89ac81a53e81c6
SHA512 b0c5bb90ff4ad5f232e94069bbbdf52b44f4b929df8888251865d2de21d859889067cd6f64d7ce3fad58d4966279d03ff0b64b5ae1cbfddb2464fb2b60a1238a
SSDEEP 24576:mgb6bmBIi49WNNFpg1rSvFv7bYbyxknw4FYnshx8OfVe247:mgb4mBIBhGFBx4x8EVep
TLSH
T1C265AE1E22EC02F5E0FAD2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 60e97394a06563166135006d94befb0ada0b78ea244f9bcdf054bf16195f32e8
MD5 908b9414600693c826bfadd8deb24b4a
SHA1 bafdc8b6e92f09fc99db496e330255ccbd777c77
SHA512 7dadaca0d3312c748fee8270be24fbda083b2d88955a5f8bbcc6b93d525a27bf41beef8619dcc2900c9f2c90758b83525d4c50d8d1ad70a059b5f33ed3286c82
SSDEEP 24576:7G88u8FpJqH1bzria7/m+yxknw4FYnshx8OfVe247:a7ZFPqVea7/2x4x8EVep
TLSH
T1D335F16877E101F1D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 2f11b479f73f33b5926f137c8e0a8d3f46b5de2ee78365851be4a712e20d400c
MD5 eebc75dc59ebe558adbaa0da9e07ae5c
SHA1 94ab07adc632ee1511bfa2b932614292ae887b9e
SHA512 5333d069920b6e248ef4a7d59ceb6a45d793775ce49d738b53498d47f1f75a28d9777c7f26dc9e07033e113c69a5454629fb8ac37a9ee99fc02f6148edc617b4
SSDEEP 12288:qHvUrBFrEjwaQy+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:qPUr+NQyyxknw4FYnshx8OfVe247
TLSH
T1AA05F12E22ED18E5E67AA17D89924319F771B4621712D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 1226546180df933abc3652cadee3b2db97e53a8a573f465dd292978366a66897
MD5 abd687cab5ca1d635ad634d262516fc0
SHA1 8ca9d7c6ed5b24a78f4f400ff5b4c39e3dc4a8a9
SHA512 435ab7a44e9f245be64dedcbfdae636503dc599d3d1e3d79abff167aec3bf0cc3f26e5602362174d57f8ccbd865612c48bf1b42afd7f434658cdd259b65043a7
SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjdx4x8EVep:SG05lO43b4ix8EVy
TLSH
T11DD5CF6E62EC11F9D1BBD17CDAC6460BEBB23425033556CB02A486A91F23FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e78930d048d3992c13205fcddbbadf4cb0439fc95c9e82c82a2c27f1d4ecdfbe
MD5 361a0aee7c692720b22cacb4bd165ec6
SHA1 88955c96aaa866685afdd97632261a983ff56c85
SHA512 b30884c1120f032b01405c6e93d7bf1365fb82a78bed6940cd2f40d76f91ac54f2d79184d352e0681a5519a4115f739f369ddd65ccd2d429d1202b2ffaa529fc
SSDEEP 24576:pfa5POZ3dpFWVM50JicR2hG0lasx2+47eidncyxknw4FYnshx8OfVe247:5a5POZ3+Jt2pasx2+mFx4x8EVep
TLSH
T19A65AF5DA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 753554ae3ee9591d983705b130842ddd3f7248549d5071924a600fcc0d16bfa9
MD5 e725aacf06ae4f193ca7e6d8775accd3
SHA1 f5d9e6b4bf307769023cf725e881a51a6d25336e
SHA512 2c27437ec947dec0d62bbfd4839323aa38efd163f62dec452fa9ec93a1fa26ae7ba73a2644203bd245ac575e96f3d17d4ccae4c0d621c672e9cfc38d65e864a5
SSDEEP 24576:eNcwHdjbyQ4nLC18lb/EOjowL7FkGyxknw4FYnshx8OfVe247:eNc/zEOVHFWx4x8EVep
TLSH
T151857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 92ff8fc02b208a151557897dde7c4d4b0b7aa0c848d3821795a99ef5fe382f4a
MD5 bfc0d575e4775b04750fae4584177366
SHA1 821406377500d1f578f430fb8ba4143d16f5cbd4
SHA512 d56de22cd7bcf6a8c0e30e2a343425e01e62028762f71ecc2ab18ab39b7b6a79464dd9df4ad92ab23d5c0ba5eb6d1b4c3f88cb6c261dedd4577ad4363b5605f2
SSDEEP 24576:68kNvNnaFeYhJNtmZBmqyxknw4FYnshx8OfVe247:68MwBtOmFx4x8EVep
TLSH
T10555AF6EB6F846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 43efcd26d943c0f0d54d948ae3e90d406e94c843a8d1cbe6961364d3406cbca0
MD5 766793924a1ce84d21525f2e75995158
SHA1 7d0b0015d43212b15a3fb7de150c72ca5c16c4b6
SHA512 4e5ad3fc9c4a89b910a328c70edb1a9cd22f8f84ce58fd2b7716d813ef2f3ef327f8ebb0adcc8f5fe89e1fc8e1b4f78fd128df6b6fd29dd896b405a0f3b2dca1
SSDEEP 24576:pD3FHshBIYQgAdyxknw4FYnshx8OfVe247:pDVHeBIAAIx4x8EVep
TLSH
T11F25E17DE79C04E4E47AD1BC8A638606E77138A9033256CB029491BA5F67EE47D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/932-367-0x00000234835A0000-0x00000234835C0000-memory.dmp

Download

memory/932-378-0x0000023483980000-0x00000234839A0000-memory.dmp

Download

memory/932-400-0x0000023493E00000-0x0000023493E20000-memory.dmp

Download

memory/932-352-0x00000234BED60000-0x00000234BEE60000-memory.dmp

Download

memory/932-368-0x0000023493A00000-0x0000023493B00000-memory.dmp

Download

memory/1484-22-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1484-114-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1484-20-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1484-14-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1484-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1764-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1764-316-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1764-103-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1764-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1764-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1764-109-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2592-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2592-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2592-331-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2592-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2592-91-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2592-97-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2708-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2708-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2708-128-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2708-134-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/2708-136-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4084-53-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4084-42-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4084-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4084-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4084-55-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4144-86-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/4144-80-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4144-312-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4144-81-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/4356-117-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/4356-123-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/4356-116-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4356-315-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4824-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4824-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4824-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4824-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4824-144-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4940-524-0x000001CBBC3C0000-0x000001CBBC7F4000-memory.dmp

Download

memory/5080-1-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5080-7-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5080-41-0x0000000140000000-0x00000001400ED000-memory.dmp

Download

memory/5080-38-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5080-0-0x0000000140000000-0x00000001400ED000-memory.dmp

Download

memory/5132-296-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5132-57-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5132-58-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5132-64-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5872-145-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5872-146-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5872-152-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5872-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5976-68-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5976-76-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5976-311-0x0000000140000000-0x00000001400CB000-memory.dmp

Download