stealc | 8dd06154c063ae9865a62eca4316481b0dfd2234c79f0b0404ca7f60e92ac828

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 05:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_b1ddff6953995a594ad6eef86c46430e_cobalt-strike_icedid_njrat_stealc_vidar.exe
Size 1.2MB
Sample261002-f95s5aaa52
SHA256 8dd06154c063ae9865a62eca4316481b0dfd2234c79f0b0404ca7f60e92ac828
MD5 b1ddff6953995a594ad6eef86c46430e
SHA1 ec72c56e13052c9cbd4f2fb58d5975fb91cf4a5a
SHA512 d99e876d4eb26afb7331dcaa8baa19105b744b4a2479c02a1b87af869c87add29dfb332971bd0d686bcc13426d40b160df19dbe2f8bca0fd9b39984a33e3dafd
SSDEEP 24576:63WpRwENzlNhc5mVpKdwqrF+L6VMRCPU6CENltmVVdpx7fLrQWd:dImV0616ZU6CENlc7dpJLrQWd
TLSH
T197459C4663EC42E4F1F3A7389972855ADB72BC515B35C6CF0264561E0E73AD08E3AB23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc spyware stealer

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/memory/5592-24-0x0000000140000000-0x0000000140132000-memory.dmp	family_stealc_v3

Executes dropped EXE 11 IoCs

pid	Process
5040	elevation_service.exe
5480	elevation_service.exe
2928	maintenanceservice.exe
5408	OSE.EXE
3872	PerceptionSimulationService.exe
1068	perfhost.exe
1484	ReFsDedupSvc.exe
4524	SensorDataService.exe
4156	ssh-agent.exe
2260	AgentService.exe
1708	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-01_b1ddff6953995a594ad6eef86c46430e_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f28800ca227843b8.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-01_b1ddff6953995a594ad6eef86c46430e_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-01_b1ddff6953995a594ad6eef86c46430e_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-01_b1ddff6953995a594ad6eef86c46430e_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105656\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105656\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105656\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-01_b1ddff6953995a594ad6eef86c46430e_cobalt-strike_icedid_njrat_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000057f9c31f3052dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ceb828de2f52dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e96f41203052dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5040	elevation_service.exe
5040	elevation_service.exe
5040	elevation_service.exe
5040	elevation_service.exe
5040	elevation_service.exe
5040	elevation_service.exe
5040	elevation_service.exe
5480	elevation_service.exe
5480	elevation_service.exe
5480	elevation_service.exe
5480	elevation_service.exe
5480	elevation_service.exe
5480	elevation_service.exe
5480	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5592	2026-10-01_b1ddff6953995a594ad6eef86c46430e_cobalt-strike_icedid_njrat_stealc_vidar.exe
Token: SeTakeOwnershipPrivilege	5040	elevation_service.exe
Token: SeBackupPrivilege	1484	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1484	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1484	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1484	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1484	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1484	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1484	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1484	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1484	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1484	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2260	AgentService.exe
Token: 33	1708	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1708	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1708	SearchIndexer.exe
Token: SeDebugPrivilege	5040	elevation_service.exe
Token: SeDebugPrivilege	5480	elevation_service.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5592	2026-10-01_b1ddff6953995a594ad6eef86c46430e_cobalt-strike_icedid_njrat_stealc_vidar.exe
5592	2026-10-01_b1ddff6953995a594ad6eef86c46430e_cobalt-strike_icedid_njrat_stealc_vidar.exe
5592	2026-10-01_b1ddff6953995a594ad6eef86c46430e_cobalt-strike_icedid_njrat_stealc_vidar.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 5928	1708	SearchIndexer.exe	100
PID 1708 wrote to memory of 3388	1708	SearchIndexer.exe	102
PID 1708 wrote to memory of 396	1708	SearchIndexer.exe	103
PID 1708 wrote to memory of 5916	1708	SearchIndexer.exe	104
PID 1708 wrote to memory of 4356	1708	SearchIndexer.exe	106
PID 1708 wrote to memory of 4968	1708	SearchIndexer.exe	107
PID 1708 wrote to memory of 4492	1708	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-01_b1ddff6953995a594ad6eef86c46430e_cobalt-strike_icedid_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_b1ddff6953995a594ad6eef86c46430e_cobalt-strike_icedid_njrat_stealc_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5592

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5040

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5480

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2928

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5408

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3872

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1068

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1484

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4524

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4156

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2260

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5928
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-53044966-3830981193-2402648431-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3388
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2940 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:396
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3052 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5916
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4356
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2940 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4968
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3052 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3eb6fcc277b819105655145faa1aed8df7a31457d6cad1d8b082dac91bc992fb
MD5 5252e0f7f5e3e6a3ef90cbafb0cb683e
SHA1 315470d0c8008a628555168ebcec8872ae307681
SHA512 cf5685a908f1307042ca126cca1ed7e91575684ebbb76ba217961bd3a5ae67f6cb0e53802a70d5fff9c95022e0aacfde53c4dc5b4479f59826d6d7b4544c8486
SSDEEP 49152:Wb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn/6ZU6CENlc7dpJLrQWd:I3q6HjBI69CEN6rV
TLSH
T14BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 791d2b90dade25bff522154397007798732aecca35f7af7dd24bb16bbe398594
MD5 1c67b3ea448c28ac58458bcecfba60ff
SHA1 69e1c2debdfdb0c05590494214cdacaab8b070c4
SHA512 dcaddb3d5bda0193951aa2d607cb1e90f7407d3ae59d1c2aabd16c13fbf0f23b09a3bbd2fa275bfe5bb3b019827f872ddd4051826f87af05a5fffea4652e3bd2
SSDEEP 24576:vXYfDtczA/+L6VMRCPU6CENltmVVdpx7fLrQWd:atc16ZU6CENlc7dpJLrQWd
TLSH
T1FA65F22867E409F5ED67827CC8A2C511EA33BC954760EB9F03B4992A0F336D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 617e771a6867fdf79893b60cd73dc6fe15fa9af8641790335e8b5ffaa115df95
MD5 624dadfea7700a2e34a9f4879d92d3fc
SHA1 ca3c79c0173a8b900284cc957d0823b65ba78ccd
SHA512 edaaf615dc047748cb17107d28a836af756c07a9086d7038ee16ae65c6ab8f2c6fd2cc55e3ccb6a10ab76881781aa773087237c26688d9540a9e0ea3945b1436
SSDEEP 24576:A0Le5ji0hmxirMo+L6VMRCPU6CENltmVVdpx7fLrQWd:APji0AcG6ZU6CENlc7dpJLrQWd
TLSH
T1D685AE25F6744731D073C0B9C5D2A69EED7130865B308ACB4286D77C2F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 84020f2f825a7048c2b8afc80af686f6e02ca2c7beed754289066d22ff4871ef
MD5 f61847c12c34c8f93ea83b39f5eb4efb
SHA1 35b151d881bf9090ed28ae9418f905d8f52b839b
SHA512 2728bc0a210e59b827ed52976bcee9ec9cd4f31a77b07d70a4aa65b02422c239f8ade7c5a58fc0269f5f3ded7e7d289dc2e395c447cb9c53f2b18ffe7fac4832
SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWE6q8wyu2+L6VMRCPU6CENltmVVdpx7fLrQWd:D/ezSC6vUzPvxHjyi6ZU6CENlc7dpJLL
TLSH
T156755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e5a5ceb5027ffbb7605e84828c6708ae6cad076d1cbdf1cda91498e7a4695840
MD5 d5357c3b6ec9dd39ed8783b598c7aaf3
SHA1 78d2b41c9df0fd28fa30c274383428320f1b460b
SHA512 1bf76fa0f5f41458aeea0e04f335fe261d4a9a93130f898a352d87780249ce4d552269256ff6c9ea03798a8d209c1369421c0b38656076ebba77bec3aa32b5b6
SSDEEP 24576:0VbqPb88hv/l+6r+L6VMRCPU6CENltmVVdpx7fLrQWd:0VO88hXl+T6ZU6CENlc7dpJLrQWd
TLSH
T12B55AE66F6748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677E5D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 df24747f0d005aa097188edcca2e06d9653a30d7975e007697f744ab9cb57a7a
MD5 656386a4ef43375203cde5f749d6e943
SHA1 4d007182a3ed6bf5fae2047437765a5f717b0c72
SHA512 9a7a6c3aaa64bc084f18dd7de55c4928130312cc4f93e4f9e1425b837cec2bb2d729e68cc25540d5e1bda3dff9d90d2a18e38d93ac9263632cea1cf5614d21b9
SSDEEP 12288:rRv8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7t:rRk+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T16545233487682D92DBF80238E1E691F1A95ABCD55B00AD1ED2777D0F0D398B4DC5B22D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 c3d4d1ef4d823e91f9951dc9c4eb189a176a276308150f9da7f9700330bbbfcd
MD5 7906119133a110ae50d6af37c9fc70c1
SHA1 bfccd41df0db19c8d43217b82803e4c4e8ac9df2
SHA512 ef44fa1cb32d9a27326d52aa37fe5e88cfe3af6efb73b6cd15a1fb99e074040ff77d3926dd191f7566c2828e1ce1ee0ee525ed75da0969cce26bd181b5a8b510
SSDEEP 24576:MJIUz+L6VMRCPU6CENltmVVdpx7fLrQWd:MJIUQ6ZU6CENlc7dpJLrQWd
TLSH
T17365CF3BEE28FCE2C27A4DB85A91C640E77278704F51A7CBD175820E8E235E45D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 cb200b98a4eef087a40116d31b55bc60cd541c612133263ed9e5d92453901be2
MD5 bd817d69895758330a7a19dd0eb95f8e
SHA1 cbec9da6b672c98c6a9138d97b940e2214f2b2ba
SHA512 e20e989f44210f1e067cb34e9a31fe7fa03bfdbae78e5a71d01fc25ac535036b0ccae35254835b39bf4b952bbcc005a95b567248f0037394c0e253b576c51c3e
SSDEEP 49152:EQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THC:EQvGAdlCEL8c/yRNw5CV69CEN6rV
TLSH
T149266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 71ec019710d3e661c5a366dd14a517c3e9be263ded003dc3d833f000f9d6ad86
MD5 96880100e048ca18e96fe0f1b9ae2ee5
SHA1 7c588e44dfa3e19657f62b12cd4b7efbcaf2f4e6
SHA512 a39993976c4158c8b9aa7e732cb29951dfc1de0b31d888d84b6625704b80cfc53e7aef8364b76503f4deff3c80376744992f796ee8bd7dafa354e796de7b5a4a
SSDEEP 24576:8dewsAjh+L6VMRCPU6CENltmVVdpx7fLrQWd:klj26ZU6CENlc7dpJLrQWd
TLSH
T1FC75E031FF74E432C3BB0DB61B36C716582DB9604B511AC3E3A89E9E49342D12776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 56102e52bc71e7200f31cfd4bc4d49c519a2009edeba5797a00d03c9b4d752dc
MD5 4525881620648add6db6c07b73c33737
SHA1 d4d882bae542b04a4283497a055d70f7fccaa519
SHA512 a45f030414a07cf0acf5faa087cc01eed3945090b5064f318e4a6c119bb9f5a534154e7b6dc2692ee45db103b4cc01ab51a41d2f33a4d1e6da72767267372c6d
SSDEEP 196608:IUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHeIm:IUEtQevvqc2W1cpV2EI32N
TLSH
T1E4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 09e57234a5b46784bae44b6f6548ba005ba8e1f6e342d7a3f78a75f1015c2de6
MD5 27a03107498c8e7b6d558dd1c7f927ec
SHA1 38ed5b31f69421f7c894dade86aaf7f012fc943b
SHA512 3a4ec84a1d9a815ca3e735d82ca88ca59789970a4fc1d860c750d9eee0f3234075ba7ee444566aded1601cd0123cd74bb1c05a4474f42fa08d24574e9e33161d
SSDEEP 49152:aCbRquA/m2yL5zQfFiV+XenmE3/zW6ZU6CENlc7dpJLrQWd:voqtVjnmB69CEN6rV
TLSH
T1FDD58E1976B8C1E4D1F6C77886A2C647F37178154B30ABEF4266461E1E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 54fb776f405947635d892184f8e7e25cce784f03ea65d70bfbe0e3741cb3b0bd
MD5 d7c06054becad77af716a7f905de055f
SHA1 033ac4e1747737c109e203d5d597dd8567c98203
SHA512 dcb3a5c2a8c1d5f24fc6016c48e226f40993005a282a1fb1a6efced64f4824d55292c346e3ebacc98c56d57a99adbf61345b6c78d8ebeacd04022985f7035e12
SSDEEP 24576:QAhGLJIFoiwtA5l7S53a+L6VMRCPU6CENltmVVdpx7fLrQWd:QAMyFoiq5x6ZU6CENlc7dpJLrQWd
TLSH
T1E9359D81E7F915D4F5B3AA7899B69171EA76BCAA5E30C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 2ca3d308e5482b455d65719934f6b2b2a513b87e0642e445630a57b6dc9864bb
MD5 7d21236074dd5a0068d97dc13c4337ad
SHA1 20ff0c19eaa5907b5b3d843d85f0dd94d37d3420
SHA512 ca8071c01411b6f03659f6cdafb3f3fe254bda5325ac05be1aae825fc205cc5fc2ce7548dd42bbd72c3efff1fa708d58d9a82fdec95e81c38c7aa3711d64953f
SSDEEP 24576:7wuoOWl+L6VMRCPU6CENltmVVdpx7fLrQWd:7wDO96ZU6CENlc7dpJLrQWd
TLSH
T1FC65F14967A41CF9EAA74238C597C136F7F2BC422A21DB1F5360C65B5F37260AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 6563bdd48711d18c5d5f357ac29437545e51277f4b9da7dd94d5f139d5aa0751
MD5 3cb80e3058d266f10b1379c835ff2e6f
SHA1 ec27bb47b181881d4b4ed2e2d9765f594637e45c
SHA512 8b74b57f55a5dbc644d8196113cef23d02650c87a4bd3890f678f76da11c902ed7af62bb9d837e1326fb5a866aec2182687d300eb4c89f531e44fc4de20a7b8a
SSDEEP 24576:+ZuQ+L6VMRCPU6CENltmVVdpx7fLrQWd:T6ZU6CENlc7dpJLrQWd
TLSH
T1AD55126913E834F2D2E6023CC9E29655EB72BC96273147CF5226565E0F37AE45C3A332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9503735a88776bd7aa561b0b6d909c7de1bc94056981b93fedd93fe064a95eb5
MD5 51b85126f3b288552d283e4f01f814e3
SHA1 a26d08dadd7a1b03f323c49b2b095440aab3bd37
SHA512 807bda7b9a5c9dca68039698f6ee41d5dd69fe8c918c81875a03377df2cf824238c22e50e48daf68ef4cb2669b00fc308c93223d10bb5291e86070fa9c3c7011
SSDEEP 98304:1QRQyi36YOcPQLvw2gAf+PN3869CEN6rV:MQyiKayX+PNMIm
TLSH
T1DD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0eace1d5792433c154056cb7e2823b62b99ea68050a8a0f989dac3d496b96e2b
MD5 951073a737289aaee1f9e5a344d265e0
SHA1 36259bebe853ddb8e13c7e273a55b0bf4d43752d
SHA512 7b0be207ba4228796f17c7632fe76bc056299b2e51e39688af9cedec3adca26256e8d8af2507af2f9c80f39959bb2e85da91baa509cd85dc0911ff0d4048625e
SSDEEP 98304:9QRQyi36YOcPQLvw2gAf+PN3869CEN6rV:0QyiKayX+PNMIm
TLSH
T104667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6b22c4217a07de64aefc316983f4b1d34234429be23a0673ab09c897fcdaa65d
MD5 f3ec285813666a4bf00f7fb3b432417c
SHA1 b44c4346e3be7cddc58c6624b668dabc77998da3
SHA512 88ab1b0fd7f24041ce938706db0bb4044503c63a28d532872c8b1c5126c15b3e4af089010fad1bde336136dad9b96b78b1a482cef227f19206b452cee9a8c28f
SSDEEP 49152:s68Qg55nhheWu7PNU3/G6ZU6CENlc7dpJLrQWd:mthWRc/G69CEN6rV
TLSH
T131B54933B2F600A9C44DE1769F4A872196D17C758FE0E7DB8511720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 578b42ce6f6dc67cf9ea8ef7b8be3ee453921a91117549c5bafb39b161478b16
MD5 6f7f2ff59173f1e6664e265cde65b4a6
SHA1 78a6dca1c0a8ee687bb0fc4d6a7ad8a4369b0e22
SHA512 ba9db31d2ca32e3ee3a2f9ea86a6e519f1b52c273d2eb8e311ebce13aeb7f9828f530febe04d53f952ed9c2562e95d4a12c930e51fe61022b4a9a3ba688ea642
SSDEEP 98304:ey5112gYy5azzVvL69nLKnhZb69CEN6rV:PLIHmWhpIm
TLSH
T1FD167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 797ae0418f7c1ea690aa725a5cbd7aea65d81c31f3fb6b230d0196f068db6fbd
MD5 76f40a7c552905dace6091a9b6dc9810
SHA1 0444e9e57192ea04b985f468eab6161232986c61
SHA512 12725699bee14413ba6f05ac382b0b27c5b4dd71ba91305937c33102add0eb4f29359c692d2aaedcd0a5127b747a3fcbcfeae389f9e4636e2c12a49c019b1b18
SSDEEP 49152:LB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl76ZU6CENlc7dpJLrQWd:du6JmVxd2d769CEN6rV
TLSH
T1AFD59D13F1DA01E8D06ED578974A9233E962BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b3c7afd0760e9b219503e39f9f40d7af71c3d3d0520d37dad0af8ffc38e40a13
MD5 a2c65d4fcb247434609ec54ef457cd17
SHA1 e6c8bad3caa837cb3ad740842344a1d58f73298f
SHA512 1986b89f8594dfaac121ce277dbd77d8c7f25aca2d09c34977e5c055e590de9ad8ad0c1c28bbea6b57cc97b7924ef42bb48528f681c51de5461be4d17cbcc7b7
SSDEEP 49152:s1hpsNoJpF1A6UU44CwH7R4xw6ZU6CENlc7dpJLrQWd:smifPbRB69CEN6rV
TLSH
T158B5AE13F2D901E8D06DD17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4f44fe7749fa1d9464d4d5199d8a71db5825fc31f17904327f8e4612bb5865f5
MD5 c989e6eece66cc0b5771aaf91012e514
SHA1 a5a8a217bfd1f95e9dc990cd74ee539cf61d72d7
SHA512 3b0b5f068c76ff73e4119bcb3e43818c02de80820389db2216c65761dbbb154a586cb6c3b39e353b5e537127ba7de9f2d4518cbaa3043573d505dc81f78cf8ee
SSDEEP 49152:SSuZQIY0Be2KRRVtOnks6NMHqv6ZU6CENlc7dpJLrQWd:M5dKTi61v69CEN6rV
TLSH
T108C5BE13F2E901E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 02abc9db340bcc8a4350c7733ff77ba9736622db5e89b31dd0ba6eb841f1bc0a
MD5 67bb164565eb568e916d909c02d93e2b
SHA1 39ac07d17575aae652c08bf204c162eacffa901a
SHA512 0a340855e4758f173fb758cb86d673d8cd261bfbc95bb453d9b195254678973f08b8e17a2f272005557bb988413819f3ed0385371b4511989cf44b91658bbbad
SSDEEP 49152:5htSn8EApI0figngiDn0AP5wE6ZU6CENlc7dpJLrQWd:IX2iyphd69CEN6rV
TLSH
T15095BE13F2D900E8D05ED178C7568632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 0dd06c85d7f33db5b1cc4fb01d92399e9c8c12303facbc599717f1cf4a4ff46f
MD5 3d45bc1341c0e2683a72ae094a9f52cd
SHA1 5625e8a86ba5289c2823169bd0536d3577b28bdc
SHA512 9a8955edc20653ddc43320e17a7940f2190d65d71c04ac9be5f5ce0cf463b4d0dffb8d0b2bd316c7ff54fedec276fe154321a7e709c9f56b6afb4b19a4b5d2f1
SSDEEP 12288:NX8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7h:NM+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1F945233487AA1D92D7E41278D1A291F5A859BDDBAB005D1FF36B780F0E398B41C5F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 21944227b08da664d1883b19d3ca811dee790268c938b0c86b60b577da24d844
MD5 d2434477f1c01971f36db8848f43496f
SHA1 4d13d0d33e904842c44d44c30e73c80964e427c8
SHA512 96938b693f46ae579b0e5d04b03d3bbd83f56c28ca013478244151661c2a0a57c16270ae65d995f56cba2c1f069561d585ce16d9cde8e05b5c0efcecb7f19dfb
SSDEEP 12288:uO8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7h:ud+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1A64523348BAA1D52D7E41278D1A291F5A859BDDB6B005D1FF36B780F0E398B81C5F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 dbbdc4ee73fe68f33a1a209bcab2caccc10c2a622b0917b2b1eeaa4eb6890a2a
MD5 02edf96464fb4f5e2f3741541ecc3792
SHA1 b42793d9309882aac40baba9118414a1b285da9a
SHA512 8ddaab96ae94dcbb9e5178698adfbedf067f0ba0ec3ec5359d24132e8bf0f9d8611cb83d75bf1926e7d94072fc674993f46bf0d181e20ecfc15db31c3d9ddf1b
SSDEEP 12288:9Y8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb72:97+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1834523348BAA1D52D7E41278D1A291F5AC59BDDB6B405D1FF36B780F0E398B81C1B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 25b620b43de379afc4307006220fade75990868cbe94b8b417b072a0d085cfa4
MD5 100c95f82962e96ff9529b7ebfef8be0
SHA1 6c31f9b90c7447c9e73ff70c16f01b93e07cfe62
SHA512 70cca955ce503eee23bf782472ba0485d9919a62fa22e7643cdd23df93f9c37d2c10ef76b30c75efc75b36f04385417753a28a8f5a99bbf220b89008c69c011f
SSDEEP 12288:EVp8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7d:3+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T11F45233547A919D2D7F05278C5B291B1EAB5BCD6AB105F5FE322280F0E316B46C3B728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c9c191ba890228b672515ce379fdf55e632335eaf8baf856678f12d5ce9663df
MD5 0ba47a152524378d931f9950605100eb
SHA1 3b5522a50770ad27ce158c525e4415fc3fa65869
SHA512 ba6dd095ca28956a5283a19aac21058382c4e049d8360a7957e620e1a9b21f2e2fe6904979d877bf88e036086c8688f59ee13ece2839cef39525b41ab2625552
SSDEEP 12288:AB8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7E:AS+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1A445233487AA1D52D7E40278D1A291F5AC59BDDB6B405D1FE36B780F0E398B81C5F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 9bd699da6be1c361454405082c7b41275ad80f449429a0284b5e7e6a075bc870
MD5 c61b7b9ee9e47df98056758b96402972
SHA1 206ada273fa2d997e459603036448ba8d1a4ce41
SHA512 a692280af26c6158732e5e632294448ec93f0b837315a0aba63e421da6f91c9d8718db5305aa9cc18c7c3e192f28bcf29f844c49c1914385066c16330d4dc163
SSDEEP 12288:oi8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7m:op+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T16345233487AA1D53D7E41278D1A291F5A859BDDB6B005E1FE36B780F0E398B41C1F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 5369b2bf04a10995cbfd7670c451799239b70df6dfaa7ec4e5be5fb0f6828729
MD5 f949f2cd450792dcc74f59c551629bee
SHA1 e09a5094a27fd5785a0eef7856b38a9700490a4a
SHA512 756f5d30d9179ed8859f081f1cff8b3c3aaf75077fbe2b9e48089f5ce22f1d64dcf4b412d3bb0edd2428a31c788f31e362cf456c9b4fb8d4ae0098a4d3520a7a
SSDEEP 12288:CG8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7P:C1+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T17245233487AA1D52D7E40278D1A291F5A959BDDBAB405E1FF36BB80F0E398741C1B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 d3c595e77526021e24d53341e9b5dc9ab42d30e0498e0a576717e4f19ccb032e
MD5 f90b955e619df61f32d15f0d064937a6
SHA1 8529f977d5629d3a2c252d367422366c94dbfbc8
SHA512 0d4d7d970f79f0f2a3bbcfad9b2720aa59f597adaf1eaf344d63ac48994d09ef9649cdb3e45dd8f89425c8bae25b7aab49af2d8bd3f131696654d1f64d93a133
SSDEEP 24576:WZMSzFVSO9+L6VMRCPU6CENltmVVdpx7fLrQWd:WZMSzf+6ZU6CENlc7dpJLrQWd
TLSH
T1CE650265B3901CF5EDA7423DC9658956D6B2BC5A0B60CA1F13B5362B0F333A01C3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 c777e521d38737ab093f0045c58a16019d6e03a3367d861ad8218ad7988bd4dc
MD5 5846177de29785aa8a36b3d3fc9c54f8
SHA1 88a8952a0a1d8dadd85a299733d795e1f82aff90
SHA512 324618b11173117909846cac1d0e00f79a212162cb3a1df9e841ae53c85a43f9a46a6dd7ada61bcb011a695dfdbfeb5ca3472066be565aec2f73ee2fe26b9d07
SSDEEP 12288:5z8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7M:5A+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T18A45233587AA1D52D7E40278D1A291F5AC59BDDB6B405E1FE36B780F0E398B81C1F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b108f326c410acc289c1c608a1ebc3db3424f3a1738fe6445785e1a05d8041b4
MD5 a90c40813d4c3e40e4376cd87b194e00
SHA1 23f762eeed15948ea6ca47496ca030adfad9adb8
SHA512 27f5cb4324d0ac6ceb848ce623b7775bee400566f8774497a59e7bab982d7f07cb92241d9fddccd13e89e8d895494142ccda354784f51b986e6c2976c990bcca
SSDEEP 12288:p/8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7N:pU+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T16845233587AA1D52D7E40278D1A291F5AC59BDDBAB005E1FE36B780F0E398B41C5F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 5b2a4551b1eccd05247c2dc260a2608f996f32ba4aac7888521b32344d36c998
MD5 94fc74994b63f67491635d8ef7c5535d
SHA1 507548c1bab71f2d7e1091c114ecf86adb98abc2
SHA512 9ce05501e9494d7f34fba9f357fcba9a2283b4724e79b57104c85a32af15df5232ba7195e1513d6f397c4514d2f335c1a66b0ce67e4b50cfdf945f6d0fc11d6d
SSDEEP 24576:SzyR+L6VMRCPU6CENltmVVdpx7fLrQWd:Sd6ZU6CENlc7dpJLrQWd
TLSH
T1BD55021763A530F5D2764238C8A25A52F776BC761B208EAF53A4563B0F376A05D3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a1acb210f78a68528fec72225559edd9f79536c5d45df612534f67916eb99db7
MD5 cf590b8729b62cd50c9561433071aaca
SHA1 1f63095cb567b972ebdaaed8fb21db9f8281cee7
SHA512 200d9b2d775957aba026378a1dece5a81287c45c3124b3926ba1ca76c53f468e36cfbd399df5c5a81d8aea25e3aa04075040d88f8202a7f348a4dcc27afa8d75
SSDEEP 12288:Jz8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb73:JA+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T12E45233587AA1D52D7E40278D1A291F5AC59BDDB6B405E1FE36B780F0E398B81C1F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 6afc19b530dbdae672809a9c0814f347a21681f5bb7fa98d4d793e9e72fca4b2
MD5 4361d6f62b74ff5d36a86a0c8c99c22b
SHA1 a964ac9ba57fca44e0816c4cd790eb2bec2b183e
SHA512 36c79006e33e158f9738d6e3f5c77462bf70d0604078f6927165521f6811ad4fc236774ac6e3c888852acd40b75eaa63c048f186ab5b19ef631c47d631b363c1
SSDEEP 12288:Fz8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb75:FA+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T14645233587AA1D92D7E40278D1A291F5AC59BDDB6B405D1FE36B780F0E398B81C1F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 bb700207112decf2580e894b006c4b826c0c329b74ae933fb58ef44659ef187b
MD5 f0194baecb9e0bc919daef7f935a00c8
SHA1 7723c0ebb03a0c3da10a38ecc62aba2b9263a043
SHA512 0b90875b362ea8cb68144bc7f52542d0242748a04c9d65b50a6d2f2acfc9b919817ee899cb4197481ab28b634979e580744d9e8463b81bfe2feb315010367d62
SSDEEP 24576:0zyR+L6VMRCPU6CENltmVVdpx7fLrQWd:0d6ZU6CENlc7dpJLrQWd
TLSH
T14C55021763A530F5D2764238C8A25A52F776BC761B208EAF53A4563B0F376A05D3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 e84476d4268e151001970471326228b54f48aefa3f77fb6aee574d06d5a65cd2
MD5 c197fb460ff74d6a2fb693ab82c633a6
SHA1 9af06534257bfbb236b661b1c148d385169e8e93
SHA512 24fa0a2a7e4a0394cfb9bdca66461ae7a772c82794549b7528f80e67d8aa1b63d537d967641f89579252cb3b462800ed31ab4a06c0e397300097972e73abf76d
SSDEEP 24576:tTHaLl3z0zDL+L6VMRCPU6CENltmVVdpx7fLrQWd:tT6Lljl6ZU6CENlc7dpJLrQWd
TLSH
T1EA650264B3901CF5DDA7423EC9668956D6B27C5A0B60CA1F13B5362B4F333A01C3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 04369c7f8cdbf35f041f11b9df698af211f10763d91f3a6e2aab43ba4b93e439
MD5 1892af524317feb3d3890d7b3e51ba2c
SHA1 49df837badf13bd67ae981c2be415e2a07acad96
SHA512 8dbeb31c3fb92177c9d95ff4d7d6b2502d449a2d02b4419eee7bb6d37520a07650fe86f6a7274dd4a90478bccf744522a7d2f89473e2adfdce7eca5c55dc4673
SSDEEP 24576:/37d9CHKy7GZn+L6VMRCPU6CENltmVVdpx7fLrQWd:P7d9CHKya+6ZU6CENlc7dpJLrQWd
TLSH
T12675CF90F3E414E4F1B79A35C9768511DAB67C9A1B31DE8F03A4251A1F33AE18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 9913cf838d630d870f48b9a0295bd56b9a4887e91a112d62e8144af448b89765
MD5 2588711bd1ffe12cdd9ac80d16da25dc
SHA1 78ca82844d263ee76105f8f0be45788383dd8432
SHA512 3771165d41fb9b946ef7f93747f3a968a59f6e98d4fa23f7a3ddfcddd452592f1fb60092b3f309a4e2cb75cdb6881d3f951b33654a03e99ae45ca036833da517
SSDEEP 12288:448+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7q:4b+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T10E4523348BAA1D52D7E41278D1A291F5AC59BDDB6B405D1FE36B780F0E398B81C1F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 9b8d9b78cefadd35e45968560673465468ede140ec9766517e74051a4ace184f
MD5 b703853e8f9f02dc55e8c77ffdcc86d0
SHA1 f09d554a217e4e903e4a15ad1436e957a2c58d01
SHA512 911d88c498f6cf094f6ee0b05a55835759e8cc3dcd850919b604b575dbf2eb3ce7753348152c3699207f2493eb5f6a9401e916e8e40df95e266adb54c6c7bbbb
SSDEEP 12288:Zq8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7d:Zx+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T19D45233487A91DA2D7E40278D1A691F1AD59BDDBAB405E1FF36B780F0E398741C1B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 08e4cf0d26be4532dd6ad344485b410f50afa9b549becc07b2b3926a68be7f63
MD5 c0fc597c1b583440f4f46435d5f65c45
SHA1 52b117b99c1d52433e3b7a5b303f7daf935cc6d8
SHA512 5cc9dd17fc0aa290767cc6a32e116cf73019724599c52b9024a2b3861403314c02f5b3e2b77a1df1c5c847d24dcbe0100e343a7d064b224f1e1f416162879d8e
SSDEEP 12288:X18+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7R:XO+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T16745233587AA1D52D7E40278D1A291F5AC59BDDB6B405E1FE36B780F0E398B81C1F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 d9dfa93aa9a5ecfb92320b5bcacbb9ad947663617ae769bb929a2c71e5768051
MD5 78cde05f85cfb12d99885d44ba99300e
SHA1 1fa763ba8f0a70c0566e2b56c83791e873286fc6
SHA512 9a8da26b7fbc8c98a3697d22e4681e7553b26e2d4abe9af37223f29ce0f7e4d265cee0eaa5bbca2fabf23abdbc1619fe5811818afc1033cd0687c048ccf436f1
SSDEEP 12288:Sz8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7z:SA+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T12545233487AA1D52D7E40278D1A291F5AC59BDDB6B405E1FE36B780F0E398B81C1F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 dd0a3142a9787ddab5deb774850b9f0205fb1f50154142604c1480aa020aaab9
MD5 f9453a3000fff62314cdac29d8361337
SHA1 d230f05a03f44d7f71487c70fcedba8f161cd8d8
SHA512 f373b19c8c7c8da4d4ac91edcd041e2b51d3bdfa59c9891fda194bd9130a9e37d2b989bacbae4079f4fd3f79cae54206e9d89e9b7a3721c1952283d283d2b3ae
SSDEEP 12288:P48+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7X:Pb+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1784523348BAA1D52D7E41278D1A291F5AC59BDDB6B405D1FE36B780F0E398B81C1F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 c55e270daa95ded98dcb84b144ee59c85d71cdd3b1e396dcb0e80af9b1de13ee
MD5 7083edc9c917969e76947b675c912300
SHA1 c342fcc648823a22102372076afb90b938115b86
SHA512 6a496032294c43a7e753f022dd7cc79a9bd3f93ed90f30b8e22e76aa532cb1398affef543382acb1e816df028896730429efe6cd655ce752978d76ded1c4406f
SSDEEP 12288:xr8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7a:x4+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1CF4523348BAA1D52D7E40278D1A291F1AC5DBDDB6B415E1FE36B780F0E398781C5B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 7298a22b90d0eec7f39638fc3e927fb52ea8a0d2f050aaa564649d9c64c93374
MD5 1d49ce32b5ac133fd38ce6a246b8800f
SHA1 5861cc028c06edd65a53242650818061b3d343c2
SHA512 f7dc7dbccd92004f1a9729ca8aadfd4ae672d7246e3c239779673580120dd3782b69df0037b24e461a525b8ff9b19736c53ee3fcb64f7763fd567e9ed9f6dc9c
SSDEEP 12288:pB8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7Y:pS+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1164523348BAA1D52D7E41278D1A291F5AC59BDDB6B405D1FE36B780F0E398B81C1F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 da9523ae4da4cceda4777f00d3750b318fcf9015a08839b1b2a6ebfaf9631602
MD5 4b1f20efdaab807ea7b10f03eb52b809
SHA1 868711e2aabf8b565449ebadc5df58e652871c50
SHA512 79e320dcf34523c7d9b965a1e2da5167bfe721b731ec3aabbc39a165bba49e4cae13d80f6bb4fda4c24d67ebe3869bd637a78d7853c6ed55ec5e0ba38cac875d
SSDEEP 24576:Vfwvok9RX6wkyAIE+L6VMRCPU6CENltmVVdpx7fLrQWd:TMnYI76ZU6CENlc7dpJLrQWd
TLSH
T1BF85D029EBDC08E1E1B7923C99B3460AF6B178591B31C6CF125A536E0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 578e7349fe38e66250a34e9e3c55f58602a93ad7ae8dd3378c502b51760d3852
MD5 1180c9d4aed9c6fae045affcb8c047d3
SHA1 1be14a7f70267f3fcbff73dd3cb5e9ba7eb82e68
SHA512 56d5cff125ad180bcf2c4743e3420d8233f513e8cff507a1b47c22acbae06d7bc0e1718b72f96c458cf59183979956e6326ec9b428c21f69f24bc0fde41265a8
SSDEEP 49152:DYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0k6ZU6CENlc7dT:HySzPc69CEN6rV
TLSH
T18D066C56A1A801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9563192df2e543c710d548a6316e1e8153a88b224d1b1859945776cf6bb97c17
MD5 8d797881a0d3aa60c5c76c8ec48d6fb3
SHA1 647e9fb0b71906fa25f419975bed2a9632380ddb
SHA512 4b35684351399dfc66b8710b637e2e8ddccf9c9bee401c3f3357b04f7a939e1eaabb263d0df51f4c574c3f3b89b13462d78d4c599643c2f655385ca73ebcfd6b
SSDEEP 24576:t47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYt+L6VMRCPU6CENltmVVdpx7fLrQWd:t47JUQj1irIhCnDHUPfF/U6ZU6CENlc5
TLSH
T12565AE1DA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 e09a3283c7c25bee3c8fad290291e7def581405fa0920776139da02a3b06e761
MD5 915c830b3448e5797ffd6e9eeb55fe7e
SHA1 ef7e3a597d0373d166e813bf2ecf815c6b134c1f
SHA512 0e51c32f85b8668d2f619be84072226285a6447ca3c50dacce7e0206c4f8ecd3bf0314477297a4b8a1a6372c128c74ae098990050c0abc212bb074ff9a4cb2f5
SSDEEP 12288:hNsfj8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7C:mQ+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1AE55F019C39802E5C1AE2278C7928691B7237C6597E1D7CB63D1F43E0F3A6A05DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 e0f63ac3210040122f0e0f3032d859147f0315420e69a7858d88f85f5dcc65ad
MD5 e840b23684156df1ea6a4e656eb24de3
SHA1 75facde0fd475d16a741de60d18874330b30033a
SHA512 45436f9fb041a5641d0b5e728ec1901a8d24d8f3bf057daf1e5b46166a4eaaba642babfc989ee3cf45184e182ee4931ee39bb1ca3809c4921b48c3e870b95bc1
SSDEEP 24576:b2JhDUPngecHrgw562OmgZTCFDyp0B2nBaU:0DUvgecHrgw562OjTCdVBGBaU
TLSH
T16D5528417226DB8FC6A940325E36D6CCA7707D02EE05AF0773C9873F9476659B6F2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 4KB
SHA256 eaf67db4399592ab8ec65da6cb708af2fb5948ee4c5376c3bb05c239043ba1bc
MD5 0adb90b6c913ac10ddf48ff4295aebe5
SHA1 a593a99429ce3845daeb5648d5558a620b55e9c1
SHA512 0911265fe4cafff9053d4898ff90d4d7b933a7cc227941427bb917801ebf0c15814702f74919d1ffb4c7a374a1d91885cf23b64d5f1348b4f676e9be6474bede
SSDEEP 3:OlH/lGSnSM/2llbdQdtMl//Bl3y8jK63mCllltGlslslslslslsl6oA:KUS9u/bOdtkDVKcmCtEEEEEEE0
TLSH
T1CB81924887800A20CF99B4B588AC0B991B21E54DBCC0AF9B128460A19C10ABC0C02BA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.0MB
SHA256 b43eb57debb6220a7ffb7e9b848c180ebaaa68f8b02ec795024dd94f8e0bc2d3
MD5 ba7de2ad212a449349ba05755fee5543
SHA1 85340848073bd6016ec782def0da297f76665994
SHA512 91e692a0325b23c74427073c41e4e3dcb2f0d846d605f5f774c18b900a3c1842affaa9d0290d5b5c5eaa5c9a7e6aa6021c7e6163c038626ee5e31269259759de
SSDEEP 12288:TVyLJDvhp1nVnRALr0OTUz0oMTzakD221tmseZkH5g5UNG5P5N:TVyLvXVREg+HakD221tRFjGNT
TLSH
T1DE35E600A5B7EB4FC97A9037063286CD7B685C07FB452F056345893C986BA6FB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 04112a0b22b431fcd3a851a174c24adba960e0de56deae40d6c1a5b64c1dceb6
MD5 f246bfdd8ce9bbb116bf95204602b444
SHA1 d4fd5ebeb44cd8169a143296f5610795fc7ce687
SHA512 322180818c6b0df1f3a21677632d26d122e7f453502f2ce2e7b9308561c1582ac5483c8098bc362cdc3faf83916266a0aadba8cd20cfbdc48eaa6052f081c318
SSDEEP 12288:OM7b8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7P:rI+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T10F45233187A92D52EBF8127890AAD170691EBDEA5F0099DFF226750E0D39CE45C3B31D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e764bbef8dd5f4d9d0271c6c749109b06f0dc65ba2f5fb8c848b2449bad802b5
MD5 0118a9be820179ed64c8bbc768a0b84b
SHA1 e226b2caeabe98850bebfb83469e63ec664ee308
SHA512 187806bb4010b3bdda4ca49a032287ea5acb4c1a52697e4f62bf06ef9f26e1eed1a4091893de32baf89b6b14aebf29575c6fdd7c667b25afc890a05fdd21a210
SSDEEP 24576:Igb6bmBIi49WNNFpg1rSvFv7bY2+L6VMRCPU6CENltmVVdpx7fLrQWd:Igb4mBIBhGF66ZU6CENlc7dpJLrQWd
TLSH
T1A965AE1E22EC02F5E1F9D2B8DDAA4417D6B278160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 a0990b37fcb16ba8fa3ebeafbcde4a8c82f14325e54329142bed3fa8f1d62980
MD5 d3ccc2bdda75c810a3c38a6556b3a09f
SHA1 9336596faf115e834237b25f1c16eb9a8128e60e
SHA512 81f2605bfbbb81c69b593774ee725e15d50575bd3e16cd9161ec9d14f62cc50f8a4b71f039f6995e0376fdf5968b360ef57824d8b03d9ef65bbdfe08976e315e
SSDEEP 24576:GG88u8FpJqH1bzria7/m9+L6VMRCPU6CENltmVVdpx7fLrQWd:N7ZFPqVea7/t6ZU6CENlc7dpJLrQWd
TLSH
T15885F16567E101F1D47BD13889864663F6B2B8251360EFDF07A88A560F33AE44B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 121622af8b2a1f17d600293fa3ebed427f24e1024531977316c0398b4128a012
MD5 e90e6903220e1f957d03835cf7b30dfa
SHA1 57a71d6bd04a0ed0c595bd0f324db06cf10a3ffb
SHA512 36bb0440980f7dc5bcbdf9eaf54fa366b1fdf9f594bd757bec5e0509abe8e67b623619783a5dc702d72e03662a973ff17faddd79d4684f519498f8d8868f02d8
SSDEEP 49152:jBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjO6ZU6CENlc7dpJLrf:MG05lO43bD69CEN6rV
TLSH
T17AD5CF6E62EC11F9D1BBC17CDAC6860BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 6b21e6df7acd89fc99c1b875c7cff336aaa12b9bd71c810fff32ed3d4ae23a20
MD5 aa06a89007d18c8798dc79e1e03b7a29
SHA1 4ab17afa0d6b8bf056b3cf9de921f126fd687614
SHA512 22e029de5533499b7e8d9d4f2ef341178d65d0cc3644415f77b743a0c432a0884d8c23b8081e8977ae524c9e6c8d32b6cb0823277bb7f0fc47c232196bb43555
SSDEEP 24576:Afa5POZ3dpFWVM50JicR2hG0lasx2+47eidnf+L6VMRCPU6CENltmVVdpx7fLrQw:4a5POZ3+Jt2pasx2+mG6ZU6CENlc7dp5
TLSH
T1E365AE5EA7FC01D5D5B9D17CC583861AE5B1342653319ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4faddd113b39b32862a45696dcb2c4b835f0b72e14b937ce7be2fcba6ed70697
MD5 230468e294032f4b10b218ede1906d49
SHA1 1378d18ab602143dfae550e08663cd73ed69a130
SHA512 48c2a2b3115a19c22edcbf296571523506f32fee69b1d7d35e6299dee5293d90d79eeace1b0314ae09f1915462362f89d9ccc4c1feafb1e46b5b04f575a15340
SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7FkF+L6VMRCPU6CENltmVVdpx7fLrQWd:VNc/zEOVHFN6ZU6CENlc7dpJLrQWd
TLSH
T14F857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9faaf6e21d1346580912c28798140d040d02a7f6d066894aa7819593b97bfdd0
MD5 fe5c9949e70ab52a8f3055ff3e65d868
SHA1 77a08e9505ced0995fab7904290c0b4d0ea434df
SHA512 f9b69742c9cae040a10a990240ce6ffed366c103238945b3fa0a5289ab8fe50ca66483b00f0b92e8a02975c1fcbd71860ab4b8659d2bd7f00637d8534307061f
SSDEEP 24576:68kNvNnaFeYhJNtmZBmo+L6VMRCPU6CENltmVVdpx7fLrQWd:68MwBtOmX6ZU6CENlc7dpJLrQWd
TLSH
T1EE55AF6EA7B806E4D1FAC6B4CD238512EA727461173293CB5390C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 307b0c78d054bdc64d0c960302c6bc922a5797f3b30ca048f95a8e290a3dece7
MD5 13eec2a286b3e374b535c21ed4f14e3b
SHA1 83028805313a7544dd28c367ba6373862ec797b2
SHA512 565a0a96ff8bfc7fd73832067cbfc42efc857e15de023236ceefdc82e1a94870d869d97e0712c59160b91e62e0a6e788a6a5f3a43305138f5ac18e2a7b169135
SSDEEP 24576:yPUr+NQZ+L6VMRCPU6CENltmVVdpx7fLrQWd:yJQ+6ZU6CENlc7dpJLrQWd
TLSH
T14765E12E63AD1CE5E676A17C85828619F771B862171196CF02E1817E0F37DE8BC3EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 9a8eed28db006c376f1c6443f6374e4887536e5dbda7ebbfea21bc1ff6c0af01
MD5 880d544ba8cdfd44609c528c50227e12
SHA1 b980ce2550423f20ed7d04793165017b8d8f5a8f
SHA512 1b9c722c28deaad0a80c25f80f8f17a710af7c856366c95603a4da4505cea69057d93db78a034725b1053384e3bc97e38381cc05db5e9865a642bfc1e4c40e1a
SSDEEP 24576:BD3FHshBIYQgAs+L6VMRCPU6CENltmVVdpx7fLrQWd:BDVHeBIAAz6ZU6CENlc7dpJLrQWd
TLSH
T1E275E13DD79C04E4E57AD1BCD6638606E77138A903216ACB129481BA1F6BEE47D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1068-82-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1068-88-0x0000000000A00000-0x0000000000A67000-memory.dmp

Download

memory/1068-83-0x0000000000A00000-0x0000000000A67000-memory.dmp

Download

memory/1068-314-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1484-334-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1484-315-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1484-93-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1484-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1484-333-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1484-99-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1708-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1708-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1708-321-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1708-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2260-137-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2260-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2260-131-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2260-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2260-139-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2928-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2928-44-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2928-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2928-55-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2928-57-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3872-299-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3872-70-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3872-78-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/3872-72-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4156-317-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4156-119-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4156-126-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4156-120-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/4524-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4524-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4524-112-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4524-106-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4524-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4524-318-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/5040-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5040-26-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5040-23-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5040-15-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5040-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5408-66-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5408-60-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5408-59-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5408-284-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5480-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5480-41-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5480-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5480-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5480-146-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5592-25-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/5592-0-0x0000000140000000-0x0000000140132000-memory.dmp

Download

memory/5592-24-0x0000000140000000-0x0000000140132000-memory.dmp

Download

memory/5592-7-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/5592-8-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/5592-1-0x0000000002150000-0x00000000021B0000-memory.dmp

Download