e6cf5ac508830fb86b9cc4a275189b6de024311ddb2694295ce8001762ed1d03

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 04:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 3.7MB
Sample260723-fa3jqagc74
SHA256 e6cf5ac508830fb86b9cc4a275189b6de024311ddb2694295ce8001762ed1d03
MD5 edb65f73c178edcefa5f78d8ca91f770
SHA1 0287b3470ceeb774a5e68ec25e43baf9aa70154c
SHA512 609927d082e6f68d94e7a1ed8ac10b5c8d8f0472f766078843973ac5912ff988fbad16292b167b037b74c14ccbf86ad301f990d6de14f53c01fcbb0374e1e550
SSDEEP 49152:wWGzNuUUmT7S7WwLHKDmRCzrfriixw1bLs8CUeT+uXEkjNEEBHLg/LNiXicJFFRI:w1W7W/UBa+uUkjDBHLg/7wRGpj3
TLSH
T1EE06AF06A3F805ACE0FBD278DD569603D77BB8090371969F039099A62F673A0DE7D721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2072	elevation_service.exe
1504	elevation_service.exe
4812	maintenanceservice.exe
5992	OSE.EXE
5044	PerceptionSimulationService.exe
6132	perfhost.exe
2876	ReFsDedupSvc.exe
2220	SensorDataService.exe
3328	ssh-agent.exe
2164	AgentService.exe
3416	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c867936e23e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\javaw.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\java.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2788_1353877947\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2788_1008066472\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2788_1008066472\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2788_1008066472\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2788_1008066472\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2788_1008066472\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2788_1353877947\_metadata\verified_contents.json	msedgewebview2.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2788_1008066472\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2788_1353877947\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2788_1453634659\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2788_1008066472\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2788_1008066472\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2788_1008066472\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2788_1008066472\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2788_1353877947\keys.json	msedgewebview2.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2788_1453634659\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2788_1453634659\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2788_1453634659\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2788_1453634659\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2788_1008066472\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2788_1353877947\manifest.json	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008acb25c65d1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d5218875d1add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ae9962c65d1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000085d15dc65d1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005e17ce845d1add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000096fe14855d1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f81cfcc55d1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000cad1a855d1add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
2072	elevation_service.exe
2072	elevation_service.exe
2072	elevation_service.exe
2072	elevation_service.exe
2072	elevation_service.exe
2072	elevation_service.exe
2072	elevation_service.exe
844	msedgewebview2.exe
844	msedgewebview2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2788	msedgewebview2.exe
2788	msedgewebview2.exe
2788	msedgewebview2.exe
2788	msedgewebview2.exe
2788	msedgewebview2.exe
2788	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeBackupPrivilege	2876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2876	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2876	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2876	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2164	AgentService.exe
Token: 33	3416	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3416	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3416	SearchIndexer.exe
Token: SeDebugPrivilege	4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	2072	elevation_service.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 2788	4568	2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	97
PID 2788 wrote to memory of 952	2788	msedgewebview2.exe	99
PID 2788 wrote to memory of 1608	2788	msedgewebview2.exe	101
PID 2788 wrote to memory of 1608	2788	msedgewebview2.exe	101
PID 2788 wrote to memory of 1608	2788	msedgewebview2.exe	101
PID 2788 wrote to memory of 1608	2788	msedgewebview2.exe	101
PID 2788 wrote to memory of 3648	2788	msedgewebview2.exe	102
PID 2788 wrote to memory of 5076	2788	msedgewebview2.exe	103
PID 2788 wrote to memory of 5076	2788	msedgewebview2.exe	103
PID 2788 wrote to memory of 5076	2788	msedgewebview2.exe	103
PID 2788 wrote to memory of 2920	2788	msedgewebview2.exe	104
PID 2788 wrote to memory of 2920	2788	msedgewebview2.exe	104
PID 2788 wrote to memory of 2920	2788	msedgewebview2.exe	104
PID 2788 wrote to memory of 2920	2788	msedgewebview2.exe	104
PID 2788 wrote to memory of 2920	2788	msedgewebview2.exe	104
PID 3416 wrote to memory of 248	3416	SearchIndexer.exe	107
PID 3416 wrote to memory of 2428	3416	SearchIndexer.exe	108
PID 2788 wrote to memory of 4636	2788	msedgewebview2.exe	109
PID 2788 wrote to memory of 4636	2788	msedgewebview2.exe	109
PID 2788 wrote to memory of 4636	2788	msedgewebview2.exe	109
PID 2788 wrote to memory of 4636	2788	msedgewebview2.exe	109
PID 2788 wrote to memory of 4636	2788	msedgewebview2.exe	109
PID 2788 wrote to memory of 5864	2788	msedgewebview2.exe	110
PID 2788 wrote to memory of 5864	2788	msedgewebview2.exe	110
PID 2788 wrote to memory of 5864	2788	msedgewebview2.exe	110
PID 2788 wrote to memory of 5864	2788	msedgewebview2.exe	110
PID 2788 wrote to memory of 5864	2788	msedgewebview2.exe	110
PID 3416 wrote to memory of 1980	3416	SearchIndexer.exe	111
PID 3416 wrote to memory of 4132	3416	SearchIndexer.exe	112
PID 2788 wrote to memory of 4156	2788	msedgewebview2.exe	114
PID 2788 wrote to memory of 4156	2788	msedgewebview2.exe	114
PID 2788 wrote to memory of 4156	2788	msedgewebview2.exe	114
PID 2788 wrote to memory of 4156	2788	msedgewebview2.exe	114
PID 2788 wrote to memory of 4156	2788	msedgewebview2.exe	114
PID 2788 wrote to memory of 928	2788	msedgewebview2.exe	117
PID 2788 wrote to memory of 928	2788	msedgewebview2.exe	117
PID 2788 wrote to memory of 928	2788	msedgewebview2.exe	117
PID 2788 wrote to memory of 928	2788	msedgewebview2.exe	117
PID 2788 wrote to memory of 928	2788	msedgewebview2.exe	117
PID 2788 wrote to memory of 4844	2788	msedgewebview2.exe	118
PID 2788 wrote to memory of 4844	2788	msedgewebview2.exe	118
PID 2788 wrote to memory of 4844	2788	msedgewebview2.exe	118
PID 2788 wrote to memory of 4156	2788	msedgewebview2.exe	119
PID 2788 wrote to memory of 4156	2788	msedgewebview2.exe	119
PID 2788 wrote to memory of 4156	2788	msedgewebview2.exe	119
PID 2788 wrote to memory of 844	2788	msedgewebview2.exe	120
PID 3416 wrote to memory of 4192	3416	SearchIndexer.exe	121
PID 3416 wrote to memory of 3324	3416	SearchIndexer.exe	122
PID 3416 wrote to memory of 1496	3416	SearchIndexer.exe	123
PID 2788 wrote to memory of 1068	2788	msedgewebview2.exe	124
PID 2788 wrote to memory of 1068	2788	msedgewebview2.exe	124
PID 2788 wrote to memory of 1068	2788	msedgewebview2.exe	124
PID 2788 wrote to memory of 2716	2788	msedgewebview2.exe	125
PID 2788 wrote to memory of 2716	2788	msedgewebview2.exe	125
PID 2788 wrote to memory of 2716	2788	msedgewebview2.exe	125
PID 2788 wrote to memory of 2716	2788	msedgewebview2.exe	125
PID 2788 wrote to memory of 2716	2788	msedgewebview2.exe	125

C:\Users\Admin\AppData\Local\Temp\2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4568.3488.17128032737086589160 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView /prefetch:4 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7ffc29da5fd8,0x7ffc29da5fe4,0x7ffc29da5ff0
    3⤵
    PID:952
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1776,i,448646401290540039,7458495236933700011,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
    3⤵
    PID:1608
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2304 --field-trial-handle=1776,i,448646401290540039,7458495236933700011,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
    3⤵
    PID:3648
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2140 --field-trial-handle=1776,i,448646401290540039,7458495236933700011,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
    3⤵
    PID:5076
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3364 --field-trial-handle=1776,i,448646401290540039,7458495236933700011,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5 /prefetch:1
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3996 --field-trial-handle=1776,i,448646401290540039,7458495236933700011,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5 /prefetch:1
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3420 --field-trial-handle=1776,i,448646401290540039,7458495236933700011,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5 /prefetch:1
    3⤵
    PID:5864
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3364 --field-trial-handle=1776,i,448646401290540039,7458495236933700011,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5 /prefetch:1
    3⤵
    PID:4156
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3600 --field-trial-handle=1776,i,448646401290540039,7458495236933700011,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5 /prefetch:1
    3⤵
    PID:928
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=3952 --field-trial-handle=1776,i,448646401290540039,7458495236933700011,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
    3⤵
    PID:4844
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4312 --field-trial-handle=1776,i,448646401290540039,7458495236933700011,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
    3⤵
    PID:4156
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3972 --field-trial-handle=1776,i,448646401290540039,7458495236933700011,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:844
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=1924 --field-trial-handle=1776,i,448646401290540039,7458495236933700011,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5
    3⤵
    PID:1068
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView" --webview-exe-name=2026-07-23_edb65f73c178edcefa5f78d8ca91f770_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe --webview-exe-version=7.11.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4456 --field-trial-handle=1776,i,448646401290540039,7458495236933700011,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:afffb92ba176b265721dcbadd808eda2ea188fc5 /prefetch:1
    3⤵
    PID:2716

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2072

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1504

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4812

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5992

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5044

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6132

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2876

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2220

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3328

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2164

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:248
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2428
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2860 2844 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1980
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2908 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4132
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4192
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2908 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3324
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2860 2844 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4f335330caf7a143480524d2cfa75fa3f112fc6fec5684faa9f0d23803502ed5
MD5 ecadb00a94f82cc6851dd5ad4ddd63b7
SHA1 a1f85dd2c66d32cb19167bbab75ba0c793a2ec45
SHA512 9b97d8e3d566cb9bd6a5dd0590f2348bc0143a8d22790a3a724c308fcb90b4a1906b2526905d00d3b0a67722313d496507e7a9817e4e28a9de049d8a594b392d
SSDEEP 49152:Vb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnsLNiXicJFFRGNzj3:r3q6mjB/7wRGpj3
TLSH
T139D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 8c9c0cc065da5f93ecdffb8f0f255214d2e71969ccf5c469d870eda12dee4916
MD5 5d0522b1103334851cff8d806c80b208
SHA1 8038348e17d397fe85976d58582dc7190240196c
SHA512 1870ac8815814901a5b31e7767c3fb1035398eb085c2019918604b1b326e16006e7e3a6ea8eee23576aeb55d45c642acb428ce8da6e14af4f8ecd30575fbf9a9
SSDEEP 24576:5XYfDtczAD/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8tcuLNiXicJFFRGNzj3
TLSH
T12A75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 9af8e634ade8c070c9e56109d6311c7abd558b9a00583e3bb97ccf3cfe1eb6ff
MD5 41723b2886a8c51e0b4858cfa9331d8e
SHA1 9c303dab69de46393a1f4de15cc130808b494c12
SHA512 b999f971a5549fbaa38a8729afd9f4bb90bf75733e30dfa23af7904bf9364101d2095e5d84b4553cc34035ce4924d03fa790a0e4264437bcc557e09aaf43730a
SSDEEP 24576:K0Le5ji0hmxhrMU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KPji0AzJLNiXicJFFRGNzj3
TLSH
T1DF85AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d9cf5f007a7520f5bf1d4220d7695dd9aeef500d5b8c9c316941ed2476ab37dd
MD5 49023e2b52fd0ae7c21fb1dd2714ea46
SHA1 79efbca263891d18613050fb20f15d50b0a89fce
SHA512 4c055fe86e9891c002d1657999add805bac11ceb12cebdbfd2eb8dc33d77e4f0bcd00257199f5dcbc6e97041dbc0a5ec3d54a62846d28faad4cb073c37952a14
SSDEEP 24576:La7/ezSC6vUyD/aqgrvWj6q8wyu+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:m/ezSC6vUzPv+Hjy9LNiXicJFFRGNzj3
TLSH
T1E0756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 42d7ad8a3b5133582e9c086bf1975cd21c71ef0936503286d738a18f1ce40aa0
MD5 305e3923a9317bc2924d2dcc9c44bd2b
SHA1 fff69c81aa5f140296de50427856978d02f73780
SHA512 e4c510f34e54bdf38465636d02ab2f75b51fc6c41b51f48669841783263491d87829a096a80eec6cbb81adac93d5f52d598a8b409af46bb14aa5ad034055dcbc
SSDEEP 24576:CVbqPb88hv/l+BP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CVO88hXl+pLNiXicJFFRGNzj3
TLSH
T1AC559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 4cbea937f05cc57b507bf46195f1a83a0cdc3a4ae3729fa7d57532ea980bf69b
MD5 675c76c11fa270cfbc5b5e36c77a6ae3
SHA1 97d444b8af11daad3dfb3ebbe89cc705e8a03902
SHA512 0a9a06bfcc78111dbd791171813efb5c8a801214d6ba5ccc01a3677b61f3a3087e978f3ea2235e50655f93a4f1c43df3a2ef81f9844df358e6dcb21c8cbdf71e
SSDEEP 24576:mGw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iLNiXicJFFRGNzj3
TLSH
T1175523D3468855B1FBFD003A867A5828B5845E2C9A595CE3D2503E5EA13CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 b79f75bfaa8d4b7914e46322701add9f431901d0a8cab88087b08a3f3d4b7b2b
MD5 43d7e29709eeb82883831af3cebc8adb
SHA1 411f5e22c484914c65acb81aa7a52fcfe70160ac
SHA512 2a557a4df7ca68a8a81acaef7813a23c75cbe850d280ef2823b3822fd284079e69c833814c0d9765f66f1695f9e4f1cae2e5b878909e701209752f631aa08c62
SSDEEP 24576:HJIU3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HJIU3LNiXicJFFRGNzj3
TLSH
T1BD75CF7BEE28FCE2C27E4C7957518600E76278304F62A3CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 98bc99ac4f35f75c04a3b58a38c9581371dfc430435092aa15e4440954445b19
MD5 64d33b5603cf199c4b760103145ff424
SHA1 c76d72729a0213231c209bb1f7232075eef4849f
SHA512 56e936ae3ec96e58f9329e995c0db4d3690582c35af876585f56e96152af8536f9d021c96b357f35b5582accb3bddb6bf8842229d2ccfdfda4eadf9510d3b8d9
SSDEEP 49152:WQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THz:WQvGAdlCEL8c/WRNw5CO7wRGpj3
TLSH
T1FC266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 a871c3f10e07bec19a564ecaf3004b7d03f47d8a90fa01d2386e030f1c494950
MD5 b6228c684851b6e814a8dac75204d97e
SHA1 6032a2a7c6cecf11a43db38655b3e2fc6f884f73
SHA512 9ae571543c0f7e5cd885416bc8d79465093d831395a7bc035a1d117d56cfb763060904578857387b58b4179f59ac560c001cf4be16b60d0d36d71e5a5a6e1839
SSDEEP 24576:BfewsAjZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9ljZLNiXicJFFRGNzj3
TLSH
T19375E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 d58b5dc11f614206b5c94f3fb2f1983fbc79cf5ac4e769b7764e62cac3032070
MD5 8777d7979a0389e0bd7b101d7c8729fc
SHA1 9bdb85beef4bcb2b5d906905e3a616d478c93fbe
SHA512 6a07d998e480f091d2d7c1fa6f0136f0a4947d20886a6442abc7e72c5f4e0c0dad8948f8d9c2ed4524b87be894efa2b666e4334b9e4b3c18ea4f8b28a51b508a
SSDEEP 196608:zUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH1F9:zUEtQevvqc2W1cpV20I32r9
TLSH
T186474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 11130084b5955d30b32a54fed82c92a8b7220f70be97f812b74cfb2e7ae15884
MD5 4c274c182c41754cdec120d39de2461e
SHA1 110f5d14e6d2535f5e1bf15dc9cdc5920233acd9
SHA512 1583e87e0f033fbcf53e2d1f49c9b4954f4139f6534da84dd18deb5d9769c8fff7eb24013f3da8909d6df13ea3b5963ba63189479be32d4ecd43c7e245d2b790
SSDEEP 49152:9CbRquA/m2yL5zLfFiV+XenmE3/z5LNiXicJFFRGNzj3:6oq2VjnmS7wRGpj3
TLSH
T1AAD58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d45f697ad8650c48954a99c41f8b9e13b000265681364ee5c172d386e4b806c5
MD5 7f119599ef87efa2c499672041f96cce
SHA1 804db08aab98bd8fc7d70334e028656253f7273a
SHA512 2ea8d44efed11d28edda1c90da10b6047ba5cec9de35899e7e1174768d2f9984f3e128117d9e42516d5a4f9352ce4730266a2f4351ca1bc6128d48e9df5074e9
SSDEEP 24576:eAhGL6IFoiwtA5l7S53y/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eAM5Foiq5iLNiXicJFFRGNzj3
TLSH
T199359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 66ad83e30798934e3e0b6ad2ac121599e851438594a3993778695d5a7e7c78ff
MD5 c814baf2ad1d5033ba50900f25305ca5
SHA1 22763ef2f3ae016123613908e67bc1acb8e9041f
SHA512 c637bf24ebf810de25efe4540d36ff60174d7657fef84a08c848f9b9318500c4b3191319601be15b24c4b3a9faaaf3b8e8a597f8487b06eeaa2bf632f7bbcaa5
SSDEEP 24576:ZwuROWd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ZwSOGLNiXicJFFRGNzj3
TLSH
T17F65F18632980CF9E9B641398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 adeaf100e2272c59063d08dd57c4cabaec0ef69d58162e25badc21bba0921494
MD5 9689c8f2e8a7d7465967d28d2d7ac4a0
SHA1 9adadc4b000ea904609bf882d16d848a7f31540d
SHA512 dde82354eddd886c419a0a02a09db34c0216d96e1c88edb07a62d25b23b5276f99bfa4814868c6e51b5be4bfa384471781dbd6445db60eb8346dc3ef6649d466
SSDEEP 24576:7Zu8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:dLNiXicJFFRGNzj3
TLSH
T1AB55129622C420F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6c98cd2fcbd29a071eb2a41d5f9b27f3b6d42a2c355836a158c903ea2f77517b
MD5 9073a81787c0aa273f8fadac3333a4d0
SHA1 d94bb47c55e63a8a31ed301803536f4526ff41bd
SHA512 7d1843ee9b4253e0e01df6cd229ff5354fc515047f94438d4ea0e9c7c10b747aef97f33b2beb4da2934ecee47428469b10a437dbcff1fbcd66552f5d929dd6cf
SSDEEP 98304:SQRQyi36YOcPDLvw2gAf+PN3r7wRGpj3:JQyiKanX+PNfF9
TLSH
T12C667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 596498a51cccc9327283aebf544552965a5cf4ac2f12220f275aabc8d3d033ba
MD5 46d38247e840039c12e29db3bd9ec3b0
SHA1 00a5ba9e8d8212aaca2705f052c1b1183f97d975
SHA512 4ef9ef4e149bbb69af28531e39dfd8299af6da6bb0390bcc01a9cd512ddc233ff7b1d8cb2d855fe67028e89d539341a9402eefdac4c2e6979f4af9f3182526fc
SSDEEP 98304:mQRQyi36YOcPDLvw2gAf+PN3r7wRGpj3:NQyiKanX+PNfF9
TLSH
T18F667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 931465d9cf24a796a10e45df6c4adb3a0c88633b449d79523a2861bd6f93e849
MD5 858918ec7b5e578d8e5c00e90050cc3e
SHA1 08d84c7c1c6d4077e15a9fcd1dfc6e868c4596e6
SHA512 cdc0f7597c89c35064a8d6404cc6ea65cdeeee47e55476529b7338d47d340c9d5b02dab5f239bfa971629c631d7a85a6cc635cfaacf9df621361e556c1c13732
SSDEEP 49152:g68Qg55nhkeWu7PNU3/JLNiXicJFFRGNzj3:athTRc/J7wRGpj3
TLSH
T131B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 29a4c94763caa0e1b68e21cdad022dfe0503e9cd097bbb147d76488ca799d4b1
MD5 7ef80cea2c94fb99708cac9207e27cec
SHA1 32eea45b1a14a17a5bc110b4cbb708ebba93b241
SHA512 07b87e82bfe8c2a884ead45c25f2fd3fb2dbb67f0712d0b8863c54e759c4cd2ad3cbeedb471d2f83c6db27fe921d656bcb8eb1a2e267449edaeb1c8dbe84dde5
SSDEEP 98304:Jy5112gYy5azzVvU69nLKnhZw7wRGpj3:kLIHRWheF9
TLSH
T142167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c6c1c1a0f1de169b065b9ada6b2d3122d217b75265cacc26f80b4bcdb1502380
MD5 696ed4b48714c5b1dde3c6ee53cedb53
SHA1 319782820b1ab28bff4d830a4cef7dc700bc3c52
SHA512 185e030cdb9267497bd54005bc4b4b2507489b5319377dcab10d41ce7fd88c59e06df29eb6e1c9673179cd3fcd578b6a892bb2510a0db71b13753a959107e4a2
SSDEEP 49152:ZB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glzLNiXicJFFRGNzj3:Pu6JmIxd2dz7wRGpj3
TLSH
T16BD59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2631b65372b8667ac54d7121bd0554c695f9d6fcc0f3dfcfc9076bad6a227991
MD5 05bba1c127a97177d17bf9a8474045be
SHA1 c549f1b2836233632c4581759ea4ba1df11987e9
SHA512 db74615ed2458d7bc376601a7d8b04d287e0a042e8c2c87bf7004f2636ee29d995f0fd82fd89491a154ca4b8dc8e45c2bc307e0ad69afec8d5fdfaa0cceacdbb
SSDEEP 49152:O1hpsNoJpF1A67U44CwH7R4xXLNiXicJFFRGNzj3:OmifPqRS7wRGpj3
TLSH
T1E9B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 bd523b3b061b912ac51e19e54b04a32aadad5e0ab1b5329909371771f6bb80d4
MD5 c89647042fb757ccebbd760d1ffc8f20
SHA1 3c6902218d14de3e5d8a4833b282545a5bd4c78e
SHA512 db1afc01c68d6cede0afc0e5c61c2f18ea5962cf3f4a56b39c711cd23ec00cb65c1311b012f29beb0a069e28b8e7baa36ab6dbca49bbd3e38bbc5540230e0d8a
SSDEEP 49152:uSuZQIY0Be2KkRVtOnks6NMHq8LNiXicJFFRGNzj3:g5dKqi6187wRGpj3
TLSH
T17FC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 623468d94963d16010e4a78ca1d9bbeb4daa9ad2e0abedd928653cbbfbe69857
MD5 c57dc5070d62c4019ba010975585aec0
SHA1 298b1b479720777834eb5c487b6f7d75c1b9c049
SHA512 4ae6720c7c60abead3dfdc7192ba2a8a767bbb4deb34cb901d58fa6c0bb5ee63442aee0ca0001c4ad73a3a6cf58fe20683f029fa735203a5fbc1912eaa30cead
SSDEEP 49152:hhtSn8EApI0figjgiDn0AP5wDLNiXicJFFRGNzj3:wX2iWphm7wRGpj3
TLSH
T15E95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 1b662b748b0b6ad9e354d12c4c3a71ca1ff6497c2a7ac93db79d44df519896fc
MD5 c032463bc783ebad4410d3a4030aee02
SHA1 e7826b7687709c0eab9d807970b2feaf9f46770d
SHA512 1466e132df69414e5a8c7aa2a42282f3ad0a763b2ea0c638b894e0b2789ab54d26c06547c0553ca27047bc338e19f10a0ab836c98c96dff1dbac8c4a144a5037
SSDEEP 12288:OuiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:OY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BF5523D3558955B1FABC0039C6755428F5882E2DEB5618E3E3083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f5e8a64308df39db0452de2d55d2d2bf69af6e4ce7820b2bccaa7d8ff84a5504
MD5 221fc9b3f428eb6e19ebd5d9d64d17ff
SHA1 31fab064ebf264b3c36b2a36f13ad3fe830d9813
SHA512 a0b5e17c77a3455523ec27d5059fbc6a94e1e35a4ddf43b0152838b4dc4143b96cf8340078fdc20de782b6d789c8bc9f994d45cf166eccc0e61e18ec00fbbe7e
SSDEEP 12288:KpiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:K1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B15523D3548955B1FABC0039C6754428F5882E2DEB5618E3E3583D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 afb711f0a159b9c81ffd9db7655a82f7b93fcc9eee107ef0db9d0a45ea9b7540
MD5 a29ec58854dd175f430bac81d9f06b3f
SHA1 6f2635eacaaddc94cf6155344fc5b5fcf26fe104
SHA512 580940cf96438fd6284615e45c5473e001ffb6bbc3483a6a945d4d2c23ea30c0bdabc8316843f8f214f9f3d595d28a16e7015ece9fcf2d2fa36a15c4d931983f
SSDEEP 12288:HriJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:H//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FC5523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 a8d73914b801b6b4dfad667966ec190bccb6942817422cf8816c9d234e1abdd9
MD5 3d3deefe2b2780bcd6436912f4d36943
SHA1 762a069b7b8a2c73e0cd5b6ad8f66169652d5099
SHA512 de537d899033d6cd6241d677ff6878a7b398fcf2b2b06824d6bc39ae0f9846b46cf75f1847442e7fdea90cbe566a88216a447eaea0a569c87dee3de33559afc0
SSDEEP 12288:lVAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:y/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T180552393168901F1E9FD8039C6764424F2A47D6CD7325AEBD3003D1E5A74BDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 cc06c69718184c638d08976016f17b13ce52c1ef18dbb84a3607f2f98204c96c
MD5 4d2351967dfef3e810f2c389c02c23dd
SHA1 cb3d794d4dc49623fead45f00d12f20ae60d4e4c
SHA512 4dfc5fe1182a8dca78da249612ae2e6340e69931e668d43c0781899e0ce18d2a7663f085119b2921ecd50d648f908726db1cd7a9ee10e681c5e3ceb87e0c109c
SSDEEP 12288:YYiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Yq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1515523D3548955B1FAFC0039C6764428F5881E2DEB5658E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 aba4b6d16364da2c369fb2b9997d542dab5485af0c9d2b60e76307c0d5e44170
MD5 b5477c414670fd20086138426c311ae4
SHA1 bce6a90750dedb3140becd26ba6dcef545b2de4d
SHA512 8e605c1ffe8e6eeb0e394b1aa7f007cacfa64427319ea30685404183b30d538f1013be440ee0888ffa046dda041bcc0368581247430b61ac218a8f84c7d3b3cd
SSDEEP 12288:N9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Nh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B95523D3548955B1FABC0039C6754428F5882E2DEB5619E3E2083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f3cab97244660cc2851c3c9a388a57935b2dcdb13cb3aa0805dc12b34ff1df39
MD5 64960fd812906c7a5041ba2338840978
SHA1 4218d16679aa2f116f79429fca36aef35599da98
SHA512 6ef911e0d8c2e05af1dd9334dd7ba1c984406edf37807f489e94a5220be7c06e76be482472c56d3356b6199ae77b572134c774e1809a7cd44527a70aff610f40
SSDEEP 12288:bhiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12F5523D3548955B1FABC0039C6354428F5882E2DEB5659E3E3183D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 8abe035b2bce7d37cba2c18b14bb1c22eb0bdb5455234321ca35d6a4c0ed9fac
MD5 6e21213588c6c8fabbfe2018450b13ec
SHA1 36c6ba977c92db0b1afd41a28bb2b5767b2f073e
SHA512 60e597ff9fdc10c25fa950d0d7091e03081f65a6d475863222a2a12de61b875b3f51ada49b933a88a0a1338cbfa70b424794329a99a8252300ecb1218ab88981
SSDEEP 24576:JZM3zFVSOV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JZM3zfxLNiXicJFFRGNzj3
TLSH
T1BA750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b74d382d17ff5969e7e80ec4beb8af82cc36a1e0902a1be6e520ffafa18b1ddf
MD5 f207c9cfbd37e81311588d5a6fbf2ce6
SHA1 8321ff45ab0ab93b090f0e0746c1a715e209583e
SHA512 8a17378eb76c3db241a7a38d11aff0292e10ea268e0ac3363cd989b56d330d355107c6f6228cc1bcb436a3a2265705ba366457d210cc34a1ce455ef38bef4f2b
SSDEEP 12288:YKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:YM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13D5523D3548955B1FAFC0039C6754428F5882E2DEB5658E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 69d0a3390c3ec852a235d24a406d744f244b50e6a30be041dd8aaee4ea90d690
MD5 0d99c326d91c4626161720d6f7fc87d8
SHA1 8f9ae31bb50fc17c26ad6c2cff2a0311998bd76c
SHA512 fc1d9ddf525d76fab5242d009d993e92e486c68727adf5cb8d43e882549a482a3d4334d29983d106dc952e1e0bc7efe169ece6dc66e42d5feb374dc953989db4
SSDEEP 12288:22iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2A/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1545523D3548955B1FABC0039C6754428F5882E2DEB5619E3E2083D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 6db208988c85f3c55c6db98f7a42e96ea0bc2fe090a76a0ee1fdff4e59b25fae
MD5 5b0714d84af79a0720a3456492c300bb
SHA1 70be3ecb26dd025cfffa1d8fffd0e9a3639713bd
SHA512 e08ffd711dbf5e59d41b0d5f1de74f720e898a42b5d148a12d2325fe4a18c3c5d51e2a74255c81e7c957892459abebeb290e8d9acae2063d61421df50c7edd98
SSDEEP 24576:Bzyp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BmLNiXicJFFRGNzj3
TLSH
T1F6650247629530F9E17A4139C9620911F3B17C3647208AEF53642A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 455a3b527cdf9d21f4bc4f608e6e641c2a6051b84824e9174b23a30755a41b6e
MD5 f3e89f0693e75bd90816d4dd141657d3
SHA1 dafa877965983a3f7233e74e9776a8504686a44f
SHA512 00c2ebb1b91d442b48baaa2bc79a4212c1fc8133881a02f38022fcd28e70506b46173dd883694e4ef82f8ccd35054eebe6aa24d746cb3af5a88f9fc175159c75
SSDEEP 12288:qKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:qM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A05523D3548955B1FAFC0039C6754428F5882E2DEB5659E3E2083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 4098055d949bf5792796a1fe0eb68291323fe2e586932b51fb0d059512f0c65a
MD5 02549ca202ebe84c758087d53dc9de5e
SHA1 d3425b7fc6b10c0eaa50a307d9a09fc7bc352f7b
SHA512 06bacde9d8b5ec391059f0833670afb29ca7a6cb1d770cc87c4479e6ea84592cc920a42effea1f23435d0c66319812116c34a9e338fdebfddc4b6d28a49e7a1b
SSDEEP 12288:DKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:DM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1475523D3548955B1FAFC0039C6754428F5882E2DEB5659E3E2083D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 3df8d233072fdbff1fa58beaacccbacf1849d985aa2eb1262d4d8d13f1739f26
MD5 89d3ae7df274362e18639ba091253154
SHA1 0b90be4ecc6f5e472a2db3e22adaee120a38f827
SHA512 8549f0701f392d57fec336a6738a182df770925cadbdc1ee9faacc6ca69c51a4e03b70dae6b845c07770b411578859ce2eff40da37ae0a557657693d965007c3
SSDEEP 24576:Tzyp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TmLNiXicJFFRGNzj3
TLSH
T174650247629530F9E17A4139C9620911F3B17C3647208AEF53642A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 4d69bafc23ba52ce3be0c48953e749357df1682068e8414ec71a788af56a7881
MD5 c328cb51a72c70ecf9c776fae9e9bbcb
SHA1 a78ae95d1ddd1bb93817f30b88faeec1c7355a22
SHA512 aa8c6a833f889c805eab544af7335e4f8e6e3b3f88203bbeb2171f56fce0a6801330a83cdfd37e7160aff866ec3f36bbe46e07e335b8de09f2de138e450aaa91
SSDEEP 24576:pfwvzk9RX6wkyAIQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:IMnYIQLNiXicJFFRGNzj3
TLSH
T12A85DF29EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 c1a172bf7a30374c5e959f2d7aa34c369390207c90b317b31467fe431f1a1d59
MD5 4c798c8e9a4943a3fc1e9916b538802b
SHA1 88ba91a50ad7938dc3fa42b1e4d4a47639a2d7b9
SHA512 56344f12bdad8830463b5483bf468889d8a9b2ae662405879989fd26a0d5311af6722d5ddaa7157db493c45032ef3f2b636286c628dda3d24342789c2f32c241
SSDEEP 49152:xYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0jLNiXicJFFRGN:IySzPL7wRGpj3
TLSH
T15F066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 13ae7bbf0203c831ca5db99eda026d63f4ec2b4ac59a4aea519edfff0e1a29c1
MD5 a5b8532b77f9ac00a481ef36e8f3d1e9
SHA1 dcb350a4351fd22d91f5ffb028dd785a5205bba8
SHA512 595cd61c1307f67342f9e965fd4f354674fde400b5da7bd271a6485c3a27692cc8d637c7dffb3836415c1ce78357be22dad52fc7b0d63f2b6b618c89f9061d94
SSDEEP 24576:r47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:r47JUQjqirIhCnDHUPfF/zLNiXicJFFS
TLSH
T1FE65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 88db15979565102f3098ffbca62fa5520e42590eaa11f1101e6c47867dd9180c
MD5 f11d71d3efff4d06bd270605827db18e
SHA1 aa26eb53ac159fa7c9904a8454df0230e7d31d4d
SHA512 820026a45a531075b6eacc20942ae8a73660a2828c7990166692b7bee3faaac198962ba21d2b6193354e6fd439ddf361b7ae1d96c6b3f6b29a355c3851063fcf
SSDEEP 12288:UpsfaiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:F8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E265F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 462549baa1294cc1adf0c2461cdb574041cb72fed73eac42f723b1396fd80b86
MD5 1a8e6d0e53a5bc3d24d6d3ff2f7321e2
SHA1 afe87f8ece1af22cd15c7389ac2b60d221bebec7
SHA512 024830676e8addf16dd65cee2107e5a95c3db9b94c9c74bceb53298929b88c9219a9e2645b1bac1754a7e48a8d6d2088af0f6e2fdaf3dc23bb9ad9d5d6331af6
SSDEEP 12288:bGDkQU3f7rMpE5bhWmgh13Ug4BJVMsqhBFfT9vcpPC:biBUPZbCbUrBJVfqxfT90
TLSH
T1592518517666DB4FC66D40321E33D1CCAB707D01EE04AB0372C9972FD5B6A58BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 8b6ebd8151efbbce6892e2583341bd9a6d6e76f019e8a60dcd324ef7a58ae00e
MD5 10da23741a15063f418269f762726b3c
SHA1 6af6608fe5333eaf2f24b8bd42ff51244dbcb41f
SHA512 b6bfbc7f5fbb0a95d8dae0171d8ea687c5f7690b6047e1f66c7a8acc6f1d49ce9918b2f019062177044ed40ba246fcac2c929fa186bf670b0f5ad74a08733273
SSDEEP 12288:P5cVSelkK8ReRKnesfCCgWfA4kBP8ESdDk8NawWkFUEuD2Cy:RcVStQWfA4kBP8ESdDk8AvkFwD6
TLSH
T1A375F9406536A3CFC1BB6072072A6B4C7BB4EC16B7095F2673C8453AD86AB15B1F93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 22e7f51fa59c12ec30baa9935723d005f0e90174eaa8a3e4058c31e3864bce5e
MD5 87a5bde45e97bac9c1bf0cd2a5c26f34
SHA1 3b3b8888f3c55fd5f411c68072ab47c873663f14
SHA512 56979bbfe54d9a95aa19bb66a4d5fd234e52cd671e2a5a8b9a918b71078a3b4ec944f03e7cb35588da1e55415b32b627976a35537a534f736f7ec416506dec7e
TLSH
T114D004D051000501F005353F303C47155145544D001D1141101444440C70500440353D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 78f13ef4cb1f31d2659708ea5b88510d6d0ff9e8177ed92b55934dee177952ef
MD5 e5abb536f2d22c9a92031212cd370d31
SHA1 ae9a5a6458573134a725a96b7ac2b728b7d3fb8e
SHA512 bf7fa241994ffd1680bfa0e0904077196f5ed85a9e29a441785b2f935526e9d83cf74d1687b4adfcfb2688057a6f5086d303c49a2b58ce1a2d494c1d4ab56ce7
TLSH
T117D0125232010634D01035372026660D1441D10F400D4041642CC95D1E244500D03866
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5ad39d.TMP

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\Network Persistent State~RFe5ad39d.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Preferences
Size 5KB
SHA256 465cabd52078a87df50842161dbf43ad76b76f43d6deec019b7e7b66f1e60eef
MD5 24e513ffb52feac1a088461ca8933b24
SHA1 3e4cec163a66c97bcd61097120f6fd56e2b94ce1
SHA512 fe57b1dfbfc3960d32da33dbf867530f49315145f1ec8112a81f1e5afb287604ef3ba325794c25c031eb65a1944ea369bf7b56e83cc35c61e3b2ade33e85fe0c
SSDEEP 96:stz/dxR9dCZb9XkJo5h16ZiZs7/x+6MhmuecmjeDK+gMH28XM1C7K:str9a8obZsV+Fij1qHG6K
TLSH
T19DC196065F24687B4CCAF519BB39BA43E2F5A03271D51D98EBF8461C08DB5DC6317A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 33e710d173a213da28c4e9d240117fed106f3d98cf42761c26f3cbad21884c3f
MD5 07d0289ad8cb54e8982b03c8faa9a54f
SHA1 ae8db346b16a52aec7c851df8f8d6f50c44a26dd
SHA512 611387fd4d133c59ff5f3d788f753236ab1a7ecebfa1a910cba3b5423583f401489d8a9d89e183335cfffe24dc89b57235b4f9a2489cb60f6d4695d4b0f37371
SSDEEP 96:stz/dxR9UGCZb9XkJo5h16ZiZs7/x+6MhmuecmjeDK+gMr28XM1C7K:str9U8obZsV+Fij1qrG6K
TLSH
T166D196065F24687B4CCAF519BA39BA43E2F56032A1D51E98E7FC4A1C08DB5DC6317A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59fdaf.TMP

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Preferences~RFe59fdaf.TMP
Size 5KB
SHA256 2bf08991fa7fad677925fe70d06e682f1a6bc376c1f83ef9f0e667e90fecaf94
MD5 182f68abba3618232e33991c6ca96e1e
SHA1 31e17b9d75ef4f5b5b14bb7fd4fff4d14ca34c7d
SHA512 e6c2c411052d343f2308fcfda5bdd3b25d61c50db2c39c962f7b0822bd9d957023bb84c052103f6d9d666a8fdddcc3cb0f751fb395f645e8d51c9e1f0650e3c7
SSDEEP 96:rz/dKR9dCZb9XkVdo616ZZs7/x+6MhmuecmjeDK+gMH28XM1C7K:rr4awojsV+Fij1qHG6K
TLSH
T16DC196065F24A97B4CCAF109BA397A43D2F9A03271D52D98E7F8461C08DB5DC631B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
Size 2KB
SHA256 a29fa48ea5289b7246ae138b4ef7d0518d23113c6d22d3638d97a97b5da91b05
MD5 583270af59e9f0e1e667f4420cc4bb4b
SHA1 fb9f76d2bfef4e8b5aa948987c2c39736bae7b36
SHA512 49d12cb23e3c54c3f6cb64928a3d1f4c6f0555095e0dddec8aa2dddf6031ed8520ab73a90fe902af86bff5be1d5dc347b2c2080b61054980d508777fcaccc6c8
TLSH
T1295194376950AA7386F796047986BE638EA04065D7522FA0AACC0F0C00DB50C134BD37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 2f33cb637d984297b19bf14c99a4784f4acf0deb437a6c467c834bca7e3f7586
MD5 6cbcc5599f76a1e15ff1237293f793de
SHA1 fddb0d446990ef4494e71ef6bb4c55bae54da373
SHA512 3fe9f5a10a7b83d799cc5b1854ce576efb70415b5e94710339025281484e11f38adb599303825eaf879f552efdc5bea0850a7d13733fac59bcaf72a7b4177ab2
TLSH
T17B71857B69A4A96749F3DA0478867B57ABD04027D6953FA4D6EC0F0C01DB2881347D23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
Size 3KB
SHA256 76bda585503d4a4a3fb712de5fe21ff81d76f9b676995d090c9d67e25decbbe3
MD5 f88c40c750a5f7ec19bd577a3f41ac28
SHA1 de9d0e0106a4be5123669de8bbb87678c695fa6f
SHA512 ff6d1cac09969495c16c573745494d2c3023189edc5ae8a4026839f8df53de49ab7ac6eb4cc40929bcf151d78778447f74e24809911b26bd79716ec875b45834
TLSH
T1A781953B69A4AD674AF7DA0978867F536BA04027D5953FE8D6EC0F0C01DB2881347D23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State
Size 16KB
SHA256 166e8eb6598a49325be4391ba772012cac91b107c917b35b294a8563c8da50e7
MD5 825114f87c0b5e08c66634d051c0c84c
SHA1 9bfff5bce8540b16960ada83e98ca5e41377d265
SHA512 e522b69cfdbb86ee26666d2984b0ff0ac68126d00614a84c538d1feff8bfd9d3fc5c49bef610eca641ba3eb33fe5392205defe80abc77bc79fef06437d0ef88f
SSDEEP 384:n+aQikB+z/xvxjg/qhEb3NBSFXK0uuisdrd9z8:2/UxvxjgC+b7duisRdF8
TLSH
T17B72AE3B59687D2395F7EA05798D479BCBF8847291C26EF88AAD5F0C06C72980347E13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59ac92.TMP

Path C:\Users\Admin\AppData\Local\Temp\WinRAR.exe.WebView2\EBWebView\Local State~RFe59ac92.TMP
Size 1KB
SHA256 547cb645759c3a8b0fb74d0e23f338c09aa798b59caeb91363c5ecc8979f9aa0
MD5 d6680aca1d83a6367c2fc12e7f874de3
SHA1 8810b289de0aae48d63395dd3d78bab4ee3f4267
SHA512 e7c7831f4c1c8d1800e38e4cc086972d6f9adaf8c706f743429791665e526b2af247daad3ef7fed4d0ef72800ab3dc069ae64e20980e191e525cf5bafa69b13b
TLSH
T1243162BAA5906FB349D6A6463181FED71EA0007AC2510F84A2CD8B0C11EB04C5B6FD33
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 ab9b7c5ade60daa205ee7a5692c1b8e3e3ee85fee395a143e981c11f13968387
MD5 3b3841aa5c037757e34c6fef9f01c9a5
SHA1 931bbd0ef3731d4547c3d709246676ccb2f37e54
SHA512 b590ffb787f98c82587edd329d4d39abf57c0245356f9712d3eab3e87450da4a8297cf4282309e8ef37d6ef20f0ee64a33007289214dcfe39bb66936770d6365
SSDEEP 12288:rF7SiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:B0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1185523A3468D59B1FAFD0039857A8434B5497E2C9F1594E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6be37210a25c4b397d53925fef5f7554cc9ee7ed0a6dd1ef20af1dbf786f8b4a
MD5 2b775c9e981c23a7d52a302cdb5f443a
SHA1 e4246aa5baf26fb1011cc16a62b8f7ea7082ad0d
SHA512 8d67a01dcc02f2ff6f92bf07aee0a05d7a29443a78c82f3ae24fc7c620dfeaf56f326470627a354cf9dd20b25c58deff48b4f8092bbffda2ec0c49239a67e86a
SSDEEP 24576:rgb6bmBIi49WNNFpg1rSvFv7bY+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:rgb4mBIBhGFlLNiXicJFFRGNzj3
TLSH
T1B465AE1E22EC02F5E1F9D2B8CDAA4417D6B278160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 52a2467e15aacae62c7e37cb71589458cdac26b6134fd91748956d79de8fb6a1
MD5 7297f03ec523e185d538e905b699ec1e
SHA1 de37535d93c1a64483365bace8db095deeef1f17
SHA512 7d61f9e3e06a4aa4acb35209016c64e8b67065c9dbb3a347cf621519a64127ca1bc00d5d85de79cf812f005c943433ce5fc076db1fbf01e0cc65440ae3e3760e
SSDEEP 24576:RG88u8FpJqH1vzria7/mV/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:07ZFPqVya7/WLNiXicJFFRGNzj3
TLSH
T12F85F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 79eac518f3496682d29dd2f68cee3c676d412f983d6c851d95d347c822b95744
MD5 176e563492ec67eb8a0f1b4ded364c4a
SHA1 2cdd626578f62f01d2bda135217b9b59f8959b3e
SHA512 47829bb81fd0b6bf9351359183f47c24704f59c31b0ee91abcfefb77f295f09b519806b3041a107db2a0742b48df24df7e9b276d84b0151612fac0e14c2a88b1
SSDEEP 49152:RBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjhLNiXicJFFRGNzj3:yG05lO43bo7wRGpj3
TLSH
T167D5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fecac42e3327f3b71c3bcc6792677d5083fedca0c13a90d96f103215404a323e
MD5 ae3b8426bba5bb480a7c56e663f0d112
SHA1 8332c9b92b7a633674c874230610923154028cd8
SHA512 d85a8365f0e855057321bf79439051a9cc7ee1d6c9e9d0ea1592236d168b3682927f9841f2dbfa1a4633772c2a5aadddcf28610caafb7c56501c41d6eb183a28
SSDEEP 24576:Ffa5POZ3dpyWVM50JicR2hG0lasx2+47eidnj/TwSfVcYG3K/cJHlnFR+IGNe8jg:Fa5POZ3lJt2pasx2+mJLNiXicJFFRGNf
TLSH
T10A65BF5EA2FC01D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 af0638815696153c9a1e7c3625024a5204b5a59c2e57a7a122131f84ce44948d
MD5 fc1a7be368e8987e09d133548cd504ad
SHA1 6902cae6434f8d3572459caa24b1e4347b682ac9
SHA512 cfe59c220d584f00c03736d11562b5872f05e08cc419d9f2699b6c909dc2c2d8069e7670f4b6b0c840008677c471a08696823597ac198a93b0ba1e774cffb2b2
SSDEEP 24576:jNcwHdjbyQ4nLC18lb/EOjowL7Fk9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jNc/zEOVHF2LNiXicJFFRGNzj3
TLSH
T199858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d5341725a5aa186984e890781864b49cc4811ac72c96d2b18eab1b71de5eb027
MD5 999beca03f602d8afb9e273d5e6e43c9
SHA1 324ac774db3ee0ac98feae893db59bcc5ad296da
SHA512 b9fad3c073378de74140af94f5f115075f6ea687c30a92df5522ddbf8103c420c7e58a9abebe5824dad9d878140943d6e7d9a97849521ac28d0549d2ab0eb771
SSDEEP 24576:ezkNvNnaFeYhJNtmZBmH/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ezMwBtOmHLNiXicJFFRGNzj3
TLSH
T18A55AF6EB6E806E4D1FEC675CD238512E6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 a71c107a45d47f2860bf834fbc2b90b4edcbe7d3df73671756a037b054e63bbe
MD5 0c2eb6afba585988007e1cc113f91040
SHA1 1db1b1204fa1dd2613389f19537073b615254794
SHA512 71cd76b5332cacb098c4c0bc7e8b1ebb2b1850b7e8750fb710c46d48dbad3c4f774f5da517a9a05e09e98bef5f49fe56855d0b6c676a52250a61848aa04150c9
SSDEEP 24576:APUr+NQx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AJQxLNiXicJFFRGNzj3
TLSH
T13265F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 e2e3c7f39acb97f62374ee58f49655ac0c198f872aa427a2a699038f935261a2
MD5 bb51f17c2cec929e5e24dc48ea08adce
SHA1 34cce1ccd9d8d2478d023f2b4381ea061cc43ba0
SHA512 20da0f6a06a354c76af1e78d4b3a1ef948a2c52e003d02d340e7a5cebdd626c14ae2352925e9c990592e0be3a49a7600b3de5ed6144fa3f355a0479f7b837409
SSDEEP 24576:vD3FHshBIYQgA4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vDVHeBIAA4LNiXicJFFRGNzj3
TLSH
T13F75E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/844-719-0x000001FC45620000-0x000001FC45621000-memory.dmp

Download

memory/844-723-0x000001FC45620000-0x000001FC45621000-memory.dmp

Download

memory/844-727-0x000001FC45620000-0x000001FC45621000-memory.dmp

Download

memory/844-724-0x000001FC45620000-0x000001FC45621000-memory.dmp

Download

memory/844-726-0x000001FC45620000-0x000001FC45621000-memory.dmp

Download

memory/844-728-0x000001FC45620000-0x000001FC45621000-memory.dmp

Download

memory/844-725-0x000001FC45620000-0x000001FC45621000-memory.dmp

Download

memory/844-717-0x000001FC45620000-0x000001FC45621000-memory.dmp

Download

memory/1504-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1504-29-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1504-234-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1504-28-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1608-228-0x00007FFC4A3A0000-0x00007FFC4A3A1000-memory.dmp

Download

memory/2072-15-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2072-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2072-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2072-23-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2072-22-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2164-248-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2164-292-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2164-290-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2164-251-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2164-257-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2220-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2220-485-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2220-483-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2220-106-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2220-481-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2220-112-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2876-549-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2876-551-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2876-90-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2876-96-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2876-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2876-480-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2920-216-0x00007FFC4A3A0000-0x00007FFC4A3A1000-memory.dmp

Download

memory/3328-482-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3328-119-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/3328-121-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/3328-127-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/3416-307-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3416-507-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3416-306-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3416-320-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4568-76-0x0000000140000000-0x0000000140407000-memory.dmp

Download

memory/4568-7-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/4568-0-0x0000000140000000-0x0000000140407000-memory.dmp

Download

memory/4568-8-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/4568-1-0x00000000020A0000-0x0000000002100000-memory.dmp

Download

memory/4812-51-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4812-47-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4812-41-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/4812-40-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4812-53-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4844-638-0x00007FFC4B800000-0x00007FFC4B801000-memory.dmp

Download

memory/4844-637-0x00007FFC49BD0000-0x00007FFC49BD1000-memory.dmp

Download

memory/5044-66-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5044-74-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5044-68-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5044-448-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5992-337-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5992-56-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5992-62-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5992-55-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/6132-79-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/6132-85-0x0000000000720000-0x0000000000786000-memory.dmp

Download

memory/6132-479-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/6132-80-0x0000000000720000-0x0000000000786000-memory.dmp

Download