6305506e5038c0d5cb572b4b68913d7ba90b87c0dd7df4b9d6a2466ad558ae2a

Analysis

max time kernel
133s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 09:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
Size 1.6MB
Sample260702-lx4cesfx41
SHA256 6305506e5038c0d5cb572b4b68913d7ba90b87c0dd7df4b9d6a2466ad558ae2a
MD5 64b7e4e8ec15ff12907b797883db7750
SHA1 89aca80197eeac02f03e1b50335236290a07c6b8
SHA512 fe2c0c50265b862fc78a34e356e01f99e2dc089286ab8a91fffe38da87a206b08196a22527fe1c5f4040f4a3d579059c5bb8d51604d9263cdb4a12203f2c2588
SSDEEP 49152:AApYO2xqu5u5RU1Y3WxRWiX2LNiXicJFFRGNzj3:ACYO2xqu5u5K1Y3WxRWV7wRGpj3
TLSH
T1BF859D4273E80964F9F77B34987646219B337C819E39C29F02A0955E2EB3E94DD34B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 11 IoCs

pid	Process
5080	elevation_service.exe
1976	elevation_service.exe
2704	maintenanceservice.exe
4664	OSE.EXE
5700	PerceptionSimulationService.exe
4176	perfhost.exe
1588	ReFsDedupSvc.exe
2456	SensorDataService.exe
5600	ssh-agent.exe
1608	AgentService.exe
3172	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\453f35ee80095f6d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102734\javaw.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000090def9fc080add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004673a6fd080add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe

Modifies registry class 40 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{BB72163B-D036-4CE5-92C9-FC2A60BE9DF3}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{EDB331C7-6521-4AB4-95AB-77B29DAA7A4C}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
5080	elevation_service.exe
5080	elevation_service.exe
5080	elevation_service.exe
5080	elevation_service.exe
5080	elevation_service.exe
5080	elevation_service.exe
5080	elevation_service.exe
760	explorer.exe
760	explorer.exe
1976	elevation_service.exe
1976	elevation_service.exe
1976	elevation_service.exe
1976	elevation_service.exe
1976	elevation_service.exe
1976	elevation_service.exe
1976	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3256	2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	1608	AgentService.exe
Token: SeBackupPrivilege	1588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1588	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1588	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1588	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1588	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1588	ReFsDedupSvc.exe
Token: 33	3172	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3172	SearchIndexer.exe
Token: SeDebugPrivilege	5080	elevation_service.exe
Token: SeShutdownPrivilege	760	explorer.exe
Token: SeCreatePagefilePrivilege	760	explorer.exe
Token: SeShutdownPrivilege	760	explorer.exe
Token: SeCreatePagefilePrivilege	760	explorer.exe
Token: SeShutdownPrivilege	760	explorer.exe
Token: SeCreatePagefilePrivilege	760	explorer.exe
Token: SeShutdownPrivilege	760	explorer.exe
Token: SeCreatePagefilePrivilege	760	explorer.exe
Token: SeShutdownPrivilege	760	explorer.exe
Token: SeCreatePagefilePrivilege	760	explorer.exe
Token: SeShutdownPrivilege	760	explorer.exe
Token: SeCreatePagefilePrivilege	760	explorer.exe
Token: SeShutdownPrivilege	760	explorer.exe
Token: SeCreatePagefilePrivilege	760	explorer.exe
Token: SeShutdownPrivilege	760	explorer.exe
Token: SeCreatePagefilePrivilege	760	explorer.exe
Token: SeShutdownPrivilege	760	explorer.exe
Token: SeCreatePagefilePrivilege	760	explorer.exe
Token: SeShutdownPrivilege	760	explorer.exe
Token: SeCreatePagefilePrivilege	760	explorer.exe
Token: SeShutdownPrivilege	760	explorer.exe
Token: SeCreatePagefilePrivilege	760	explorer.exe
Token: SeShutdownPrivilege	760	explorer.exe
Token: SeCreatePagefilePrivilege	760	explorer.exe
Token: SeShutdownPrivilege	760	explorer.exe
Token: SeCreatePagefilePrivilege	760	explorer.exe
Token: SeShutdownPrivilege	760	explorer.exe
Token: SeCreatePagefilePrivilege	760	explorer.exe
Token: SeShutdownPrivilege	760	explorer.exe
Token: SeCreatePagefilePrivilege	760	explorer.exe
Token: SeShutdownPrivilege	760	explorer.exe
Token: SeCreatePagefilePrivilege	760	explorer.exe
Token: SeShutdownPrivilege	760	explorer.exe
Token: SeCreatePagefilePrivilege	760	explorer.exe
Token: SeShutdownPrivilege	760	explorer.exe
Token: SeCreatePagefilePrivilege	760	explorer.exe
Token: SeDebugPrivilege	1976	elevation_service.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
2596	sihost.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe
760	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3256	StartMenuExperienceHost.exe
5616	SearchHost.exe
760	explorer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 4712	3172	SearchIndexer.exe	100
PID 3172 wrote to memory of 2040	3172	SearchIndexer.exe	101
PID 3172 wrote to memory of 1180	3172	SearchIndexer.exe	102
PID 3172 wrote to memory of 5352	3172	SearchIndexer.exe	103
PID 2596 wrote to memory of 760	2596	sihost.exe	109
PID 3172 wrote to memory of 2800	3172	SearchIndexer.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_64b7e4e8ec15ff12907b797883db7750_cobalt-strike_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3256

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5080

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1976

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2704

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4664

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5700

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4176

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1588

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2456

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5600

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1608

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4712
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3047816590-610495838-277027736-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3047816590-610495838-277027736-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2040
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2836 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1180
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5352
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:2800
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2836 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1704
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3404

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:760

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3256

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fa7bc54015695bf9f464c43a40893131fc551762f99dc8a16eed46fb34b103c7
MD5 7261a4146b13be224871a2ca4ee277f8
SHA1 9c3210e9da4d808089a1e887aec31bd78626561f
SHA512 6d6abdef37905d4bff739ef068126e56411f2ad23cb42811bcd2fe452abfd267fb746c15dfb7e4e5e459e8bec24efaa5cb9fe964cd09192b025e82ae000e7ca8
SSDEEP 49152:Nb+632BuPkFKRrdE6ohdstBhuXjfS4LWxn0LNiXicJFFRGNzj3:T3q6mjB/7wRGpj3
TLSH
T1E8D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 72e9e563b4688848581ce126d96bcfbdd485d407641b254f1d968d4df8eaff6b
MD5 f5b7303cd3f324535b8b62d4377f0dcc
SHA1 5c1bf1a001e75cccccf41a7690380960d54f1644
SHA512 e7d6a3eb01083e60cc240713530dc402a7df28a8a2bd5d0b57c2efaa2bac94a434a0e5fe1dfb77308729aeb2260df78dbf80065757e0917945d24a84adcdb1ff
SSDEEP 24576:uXYfDtczAj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ttc6LNiXicJFFRGNzj3
TLSH
T1EE75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 c94b6dd2b9c4f94630ae51fb3b7ce87f3a44a2b968b2df368008cf2d356a3c21
MD5 650b27a4bf330fee9d11adbea8740ad9
SHA1 d8cce1a778af72b7fd51cdc64c47878f1c202942
SHA512 92a11ca73bf5f9c8024457472ec8310e518d5f1ebe248ba9183fc436f69e1f80934c233e6de783259e6313cc8a27aac59884611fe5d640bd51c112a574b90f8c
SSDEEP 24576:P0Le5ji0hmxhrMc/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PPji0AzdLNiXicJFFRGNzj3
TLSH
T12D859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 dc93d13370957edb73a829428cc99515ea70565e2d4b8a6be403f8f3d0702c22
MD5 e1fce9774b32e235012c5f84198cf349
SHA1 3a195a6547bee65bd4fb615eb448d87782ee6ccf
SHA512 a07df55ef2fc1dba9c937912cebffdf70ebf717e618b4e1b3e9cda65539ae88d5a420d00780c6f0778e432252ac37c5d0319914541dbee0989473a2ee775dd8c
SSDEEP 24576:Ya7/ezSC6vUyD/aqgrvWj6q8wyuq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:f/ezSC6vUzPv+HjyhLNiXicJFFRGNzj3
TLSH
T14B756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5e09283c9b2b09fb2a2fe6616ecbb6ef20922ae55641e5fd47cd0e07e28ac225
MD5 12b0ff509c8901c1853ea5204eb3452d
SHA1 503b4b3cf29bdf3640df7f903c15350dac72ead5
SHA512 7b635181ff7bd7ae150084478589a102baf019854900cdccaf08e3ffb0ee1675c085a69c84a1e13ca3f4dd60a181f8c2ff9660d371528a74a53b9f0873c886ae
SSDEEP 24576:JVbqPb88hv/l+Bv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JVO88hXl+9LNiXicJFFRGNzj3
TLSH
T1B1559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 934af5c37293560d19ce4e211e999a928b74b07265ad2e9f03fd9ad497e3a024
MD5 391746ab953a6447a178393d27322c06
SHA1 8ac3e20f1580eb8d66dc16bdedede0cb903a9504
SHA512 4f1d841657654389942756714e7e6735d1ab925d4161b51fb1aae1dd5a4a7a4deb0d25ffbfa917d756ea89b722f6f6a3c249d86818723a1761b329e4f2711e86
SSDEEP 24576:DGI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:pLNiXicJFFRGNzj3
TLSH
T1135523D3468865B1FBFD0039867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 d966e470b83350c97eeac2e4ca6a50740190501f414ef70dfc0f9b391b3263d4
MD5 db0d1b5d4018cee604e314e2566033f5
SHA1 fbfeae405078e53232824a5942594d9df7fae9da
SHA512 561c935558580a62976eee3519270634a1222fef2eb27c6c80b8915205f999c4d117d871525ea0b2da86a53c99dea1b8eff984a3ca8983e470c33775295ea186
SSDEEP 24576:5JIU3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5JIU3LNiXicJFFRGNzj3
TLSH
T13C75CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 5cc0da524b8df8b77ecc0b01f660a510e36e33c49a7994fe456906735ac66b1a
MD5 f84b63ca0b63b14c85dbf217200e7cad
SHA1 4913697620cbf6c127cf69b8dbf2d2efa8200072
SHA512 d27d968fb294411f2bc90ade64d53d72887863a814c8b311a6de08d540e223ca7a741f4397799420410eb318503d12f6ee2e9724a79dd25da2bb93912e544130
SSDEEP 49152:+QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THz:+QvGAdlCEL8c/WRNw5Ca7wRGpj3
TLSH
T1E4266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 2c58cd107d1182dfa363dceac011242718d6cc4c766b1b190d280fab05593b64
MD5 0d80e2e8d3ea4d1f04060d0db49f3642
SHA1 4b4d65b8af4eb6fcd5c5cf1b58d7e10b64170f0b
SHA512 3fbfa86833ae138f49a13f0c0208912569f2f39b208b91b3485b410977d80b1ede1dd05f553e3bdc85af9af2e776fbccfb60e019879e6e92acc02435d884d8b3
SSDEEP 24576:WfewsAjN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:EljNLNiXicJFFRGNzj3
TLSH
T10575E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 aeaee6cae6aa16b78e24fdf5d907a895902aefa9b2984cb2eaa7edbdc1900d6a
MD5 474d32f649af439927ea965d07ce3931
SHA1 9b34afa1d66fb2ea4cb03edfc076b7ab43edfc42
SHA512 078fb50b49fa825b9d19d6d22332a959644e2494e5c739880aa14ddffb21ba9ccdd180ad7715687c0468e455ca5c53bbdf5756c4f680525f8948eb7ee3c6332f
SSDEEP 196608:NUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHZF9:NUEtQevvqc2W1cpV20I32/9
TLSH
T174474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6f0121340ab87b841d4c834c34af30e2f46b76c1b1c79b12f356bf84e8050b49
MD5 32f80a850c0fca95317d46cc2e6c53ed
SHA1 378ace2604a3749e8d45e5ff240afac0e35b5919
SHA512 2f4fdbfd6c70beeb175254d4ea656f9d42799f8bb5308d3c489f2c66240f1e6bd3ac0be4d86598576b551e3c5151c8f9bbf6ae612891a66b8702665b3ac5a3dd
SSDEEP 49152:LCbRquA/m2yL5zLfFiV+XenmE3/ztLNiXicJFFRGNzj3:Uoq2Vjnme7wRGpj3
TLSH
T194D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7df47033a3155eaf12925c54c049887021b47c17fd41e49084b6d9913f3912af
MD5 db915383571390383bbe4997a80af0ae
SHA1 5bc49224d6a79b8b90b00e03e28708428dabca39
SHA512 38fbd9390407bfc77434d96cd4fc1d61431449252196c8d6aae44bacd5cbb2dfe61a6130ba1f7e94c134edc1ac0039ad61954ee9751f35d161e903f9ee965565
SSDEEP 24576:8AhGL6IFoiwtA5l7S53+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8AM5Foiq5OLNiXicJFFRGNzj3
TLSH
T13C359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 e013c842d6b7eba8f0e35c55e2765932c966f83911be4ea10a4218a3c22d3573
MD5 24664dad8d78b45502790e4be65a166b
SHA1 b404cbbe5f0cd29404783b1c2e3852c5d2760693
SHA512 b8d312a9f0a69954e41250dfe71c8ef90ec456c39b7e53dd8d77075d2f32b074393cf33d675010df081fdabe9bd811d01cbdf1195dee4c5f3adfca85e15798c0
SSDEEP 24576:CwuROWB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CwSOSLNiXicJFFRGNzj3
TLSH
T1BE65F18632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 966b1431f93516ba5ac448238199cb689e0ad0d9e1dd91800602e95ae4f54e3b
MD5 ff2e01ec69420a3b47ab82bd7e6729a6
SHA1 b7b4bb8621c4ecad0335b5c58f106ec8edd0a12e
SHA512 e3d023f2d44b3d539a247cc73747deabe8860451c1e8eb845387b8b6453c3dbf6cdb0aa69d83461ee3e9431a292df5e884ea0ee441abaef0623bc03cc5917d10
SSDEEP 24576:FZuk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bLNiXicJFFRGNzj3
TLSH
T18155129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e35f57d9b64503ac81de885b9d692e44924f9f834b56358bfd163135bd3cda6d
MD5 6ba1ca2a67846bffc5f4072d1db9ca22
SHA1 77c378614cc6d20f42da2e24c0d6844d245f94de
SHA512 0388ba5da04b4f03dd2e6dec31760f55151bb98e3e19375f3bf8d548304aadaf5d021ca0cb83f334c3de140dd64e1ab1b8db4487ca3b085e4f5adffcb62dc1aa
SSDEEP 98304:MQRQyi36YOcPDLvw2gAf+PN3r7wRGpj3:TQyiKanX+PN/F9
TLSH
T1FB667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 47f654ce71985045983b00b8c52c17a85180735bf24617f8b43a71c27b429662
MD5 54dc831763cee115e1c8109ee7cfd373
SHA1 0ff014e3df9afcabf7ae90bb10c62b6785526403
SHA512 c6a0b39f3db9c310ec7d7221e5b8fdae6d598298967a88494f342c739b473d56d5bb70e493192018bac55c6708f80d7f7b9144850de33c51b693880a9cf16a72
SSDEEP 98304:qQRQyi36YOcPDLvw2gAf+PN3r7wRGpj3:BQyiKanX+PN/F9
TLSH
T116667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 31a527b3c4a47aaa0c668e62021d6c5a198942495848f457a125b4960bd034fe
MD5 cb405b03a6ec8d4166f25c115b1814a4
SHA1 5aca11b306f6f7e9c40273957d581257ee230f4b
SHA512 9710ddb64e0ee309985c866cdbe485eedd8819e31af8078e3e822ccfd9d4bc8666c52c64c3e25325c37c4874f8787a89021464afde2be8ac909b499e3c53be21
SSDEEP 49152:868Qg55nhkeWu7PNU3/dLNiXicJFFRGNzj3:2thTRc/d7wRGpj3
TLSH
T17DB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9e6904b3bdab0948a2eeda90e282f9be879967586bce4f68d7e4ea4f5b402371
MD5 3afdeb2aba6ca3c4bb087c4a2333da2b
SHA1 56b64523676669ce38f7a52890e307824f6bd3af
SHA512 cc5b7ad2e30babd4dc7394c13cf0037e0b0fdc34bfd196c4181fb55d5fdd192d7ae28301443a5413737924e70996d84b5abd131216cb96a712c4ed8dc75bd34f
SSDEEP 98304:gy5112gYy5azzVvU69nLKnhZI7wRGpj3:5LIHRWhaF9
TLSH
T17E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 00dfeeba0912673c4b2c1c991358bf368c4a621cdf6060de4a17d9d34e71aa55
MD5 5481bf71bc3810d69ff2363d84220612
SHA1 5068950bf6adfb2e860bd2e7991c0604b1c5aa31
SHA512 61765ae1011ea237849619f4337171cb82d04b5809edb22ce45e02de8ba5a9a00fba64b917f3bd0f600d5538f1a6e715bd512a37667a0c73e5fcd9511f532a02
SSDEEP 49152:jB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glzLNiXicJFFRGNzj3:Vu6JmIxd2dz7wRGpj3
TLSH
T1D9D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4d59de61e291c081a670c1af940c0d2115a994b2fe77238dccdcb82f410b7afe
MD5 df737adcf6ea4661c6cf9afc7313f82b
SHA1 807fac97555ab8fcb8f261e6799b745266202a59
SHA512 3e2374fdc34f3f7d9f1975956526a3cae782ba102f6c23d6c80a23c79446a7d22e178bf274758ee2169b74bc729a5c66f0b0ae80f3e422d55592bc9be8525f4d
SSDEEP 49152:F1hpsNoJpF1A67U44CwH7R4xXLNiXicJFFRGNzj3:FmifPqRe7wRGpj3
TLSH
T1AAB5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4979a49c85eec7961b6cd6e80a2f22d08e8cb1a32ec89bdd7261109e87d722d1
MD5 eaf2818edfca03a3b8d3de973c08a755
SHA1 a6db55a97f1c741edc6ae473b117338117674e8b
SHA512 c61038b35fe55362a39024c0f485cb3c30c377d735ffdb5c88ab3a1516610942aeee1da90398399fe96bd67316bf5109f7f89bb9294b33f6022c16d2d1c33e6b
SSDEEP 49152:/SuZQIY0Be2KkRVtOnks6NMHqkLNiXicJFFRGNzj3:F5dKqi61k7wRGpj3
TLSH
T1F4C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ce6f67e831475ba1905cdbce6051a4faf43f62bfdf5bf947684c2307bddd2a0c
MD5 c401cc0aa5d6626ee0344c440514c39d
SHA1 c944531ef4bcd7cdcee9ad3d1fd66f80c92d8527
SHA512 4b162ce4e95dbc2615c0ebf6817fbce654e0f7f24df9f61bf8ea41f5deab41fa5bb1331c2aab3b5c01d956a7d34e01722bf846ea1aa1341f42f20a0c4b68ccda
SSDEEP 49152:ghtSn8EApI0figjgiDn0AP5wjLNiXicJFFRGNzj3:xX2iWphy7wRGpj3
TLSH
T17895BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f5bdf6066389d641d8b8a8c6d891db0a38b2014a333e79c11620838a85237be2
MD5 4de62a61d9b9de4b05c5a8a84489e686
SHA1 f25308751255f133e1bce2d8243a4628bb425582
SHA512 f0e8a6d224177cd1ac953dcb6c65a5beb25bc9b525cd9d9ad19a98c9872b33c0760da405b7e13de194a6bfe860043a62fbd18c737f5a64d9f9e1085afc208e95
SSDEEP 12288:fGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:fw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1355523D3558955B1FAFC0039C6755428F5881E2DEB5618E3E3483D1EA238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 b6052dd7900d6db0bff281486e2cdd1f7416eb4859d960a018bbceb032d3ddac
MD5 01abec4539e07da934448b5b4ffdd91a
SHA1 ad23d4bb4952c93095f9dae7960ed4dd5588bd08
SHA512 a81eb77c3124ee117b4e0c1fdffb709a25f404906a27150ff3302c06103661ef68d1fe1f996406de5f1497f72e59be0af5976fe659a23b2df44c20f46c4a43b8
SSDEEP 12288:MViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:M5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1375523D3558955B2EABC0039C6754428F5881E2DEB5619E3E3483D1EA238FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 8f87fb93ca9acd93d3e6ac6f897402d9c1fea0d7b0917aff133b7b1f5ef86fb8
MD5 a88d251adb75f02c6d995bd79acbbf48
SHA1 e2afa0d7b18e6e786c2d8f3c5984cf8e1f94a6f7
SHA512 670f8b2bd85874bdb1bc556adc84996fdae6cce724f47bcfd7b6692a1dab1dfd55f12b7190848cda2c747bdcf181c846e96df965905f9ed6b2a2d42277dee34e
SSDEEP 12288:BriJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:B//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1545523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 6aa7b2974c5b21ab384f08049d9c5d8cac25b1becabb3f37bd9528e980a882b0
MD5 57fd74c6451665b3d579751d5e4751c6
SHA1 3beeafbb8cb7badc5b190a2d3ea0ad303bec5d5f
SHA512 4d2671fa7041be78822690425fff2c29d824f91af76c0f2adac315cbc90fb0d9aca30d5deb5c864ed463120dc2e1c1c1e26675e4049b0e55fa8ce251806999d5
SSDEEP 12288:JV0iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:S/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A6552392168900E1E9FD803DCA764424F2A47D6CD7325AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 2acc0db4f9df141dd30080c93a7c25caf90cf59634d5c7cb9b7265caa9e9d595
MD5 036f19cd3527f11be2e91a77739b16dc
SHA1 7ec48e2d25c6728030dcad362b342e47cb0cd871
SHA512 81c631351569a05479b6a0b09d25d4353db50cd9a0c8e0b881988b914243379fd49852308f7823a7905492ae484ec8751c8c20c994d4591eee3e53db1d0dc5aa
SSDEEP 12288:IMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:I2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1535523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 c8db17afffbd0ec2fc48b9f7c8c9119e3df9b7381654805fe307585a2078c044
MD5 34a3c0d70391779852312ff8b41ec5f2
SHA1 a8d04bce544854dfe1311b249d548058c2f2f96b
SHA512 d7b8a56b3654eca722d6548f5d598ca371799c562a5cdcc94a93cf42b51390ad6a191c869d2f1889d05743382a31e6b83cbd7ffdfd306319ce869ab59b0a35b2
SSDEEP 12288:6JiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:6V/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1075523D3558955B2EABC0039C6754428F5881E2DEB5619E3E2483D1EE238FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 eda39efc316b2d11b79f582497fa0fb661bc6b62dd7990e65bffe631d5b1578a
MD5 2fd67b879af8e6676bf80e402821cc4c
SHA1 601a9cd958d8717fee2a9b194f3b25d737bdc11f
SHA512 2b76feda744bc7871470eb87e80174924bdd1db07090305cfd5f285646b656f35eb3914fabf64b44128d8e477a59165d272c26ef046cc036d7b2821c4aae55c6
SSDEEP 12288:XNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:XR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AE5523D3548955B1EBBC003986754428F5882E2DEB5659E3E3083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 e6d5ce58be223b92520918f52fc46994fdf4900182dafa5f27100a401444cc8f
MD5 4dcb388d02c8c2f4c647ff0440e68e70
SHA1 3ed0ab77a23e3112c5334cc7043c12c67bf46270
SHA512 f6740f9555a30b4b9234c5bbba71842aac883f220d5895f5bc2291679948e7716ba6b3a1d54a331ed0744ea7543428b9a909f90c23d2bf4fa05fe3e861e6e3fc
SSDEEP 24576:8ZM3zFVSOZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8ZM3zfFLNiXicJFFRGNzj3
TLSH
T148750295B39018F4ECB7813EC9258815E6B27C1A4B70CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 3d030530552b5b7736a5a8280cebb4ebafa5411388fa9b025574ecf122c0c9d2
MD5 e0c8628e4e2f1c9f93ade3d5d4f5039a
SHA1 dae9574dc8e0bdede14c3b050e533a7c364b109e
SHA512 6d2b292a8da19bb43608117bfe69cd85d4b51b42d4a0d3d4cdc81845fd0a099a5021bc959a05b7be7001726e3cf8841322679d051a89929e64daf93d7c686790
SSDEEP 12288:4yiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4U/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1665523D3548955B1FAFC0039C6764428F5881E2DEB5659E3E2483D1EA23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 72f204e43f8d6cd007d3e2c8c7dd92891997424f72aeaece2440e688035cf4c1
MD5 df75d582ab8339d437cbbf54e64abc50
SHA1 36412621ef17f870908a587e247f601225102b4d
SHA512 b89b2802bd7b361a531d55af2f192cb6d3e3ff440efcaf5066fb90b4f2879da71322feb868cce8ecd3f64f14e24e258c829f1aa801d797afedcc6baaa9ff74f9
SSDEEP 12288:yOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:y4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C85523D3548955B1FABC003986754428F5882E2DEB5659E3E2483D1EA23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 7ddbf6f8478599be77029ea70ac43edf53ddd1e161d7039e808b9152183c4e87
MD5 f5fac20aeaf7d6ca390b566391529372
SHA1 89d095d8dee988d1fef85ca5962c72501a964026
SHA512 657b99fae8b59eb28967bff2b1988fa6fde582336e5ab62320abdaf27dd07977eda60e79f7f0bbf74daad57734886bb36cad1b0638ef0c72226253e36d892ee9
SSDEEP 24576:jzy9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jyLNiXicJFFRGNzj3
TLSH
T1C8650257629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 2ec1f0115f84e8aceb12fa9a9ea00b191a3bcb21bc5449a0470a871854a052f7
MD5 f7fb8f083896ea077a74e81477f3950f
SHA1 3522edb80868b1e57ac13d8fa381b207c8ce904a
SHA512 2e9c90256d55d9673de63432dd9873aec82bfe6cb9cb2aef0302ce793605bd24bca34e6cb584c25b970f6b104b09060cf004ba68f541ae299ccc3d9a2f07fdaa
SSDEEP 12288:kyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F75523D3548955B1FAFC0039C6764428F5881E2DEB5659E3E2483D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 d34db659f5f0643de97863ea70866787bc56704854faa2c4860b9adef655d3d1
MD5 44dfddf0dd005232bebb99bf40615aae
SHA1 6935bf173ae0e57e077e400dc805c1760e7acf54
SHA512 d85b70d0861d622f2fd51d373b82a7a0a58f40c203ea764bc5f39b28a9c575b3ff69ade11f9bd737b248283e7d2c7869a61690b68a73ac99b79efe05dc997082
SSDEEP 12288:CyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:CU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E75523D3548955B1FAFC003986754428F5882E2DEB5659E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 2bc9b13f2d8e86d5b8555cb7df1eed9b022f0f9fedef8f0ba9cb6c46ccaa1c03
MD5 6d4e490a590ad9a7c4d36d41cca521aa
SHA1 14ab50035f3385e9e8ee63c3123706f2c32d6ee3
SHA512 f40a061cd3fa473d26f2ff3dba3c070f2fa9577056a8561a1410eb0fd79013ee89b2689dd37eaf7225cc31f9f78cb39005c7ee199a62717e1d8ee30cc6a3aa6c
SSDEEP 24576:Lzy9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LyLNiXicJFFRGNzj3
TLSH
T163650247629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 312537bdc96ea676b983213ffb75f96cb2d9f58d44a80521d0ad84d029a18b51
MD5 555e49f5f632bcde44546be851f3727e
SHA1 cb9b502c128a3501913754a5414bef5a1229bda8
SHA512 d31e811b2227b6ea42266c4ddeb390a49d54f5af83dabe08df1eed2c14f81f214cde456ae0927c9c12cb05e6c64cb1a5a20b031f844a6ab7a0e2767519a17d1c
SSDEEP 24576:DT8aLl3z0zDP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DT7LljqLNiXicJFFRGNzj3
TLSH
T1747502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 cfd453d01f362522ca51dc5dc23145473bb0688f56a294ec878a0e92bb44b9a2
MD5 60e84814efdc8192c8af95c6110aabb4
SHA1 d627a5a9b658a3316d9b935eeb66698eb8cb9d53
SHA512 a745204d1a4b6876c9c34cfa786ab479cbb94d390b510f747adc202abe2e6d83966bdaa8fa9d8053c44b7a364823f37659f14465531e0873da6825037c7aacd9
SSDEEP 24576:03rd9CHKy7GZL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+rd9CHKyaFLNiXicJFFRGNzj3
TLSH
T16A85CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 dd5d997c5ac4d214a3ab1e9422d3cc69d10acff6251fed42731ae68402d488f5
MD5 b5363f1599f5557dc1bffcb6e882a813
SHA1 14ab7ba8d29781f609edd8cf1c547f8c54261c4a
SHA512 69538d335cc0a8dda86fa6845d2d40093716624f2581fefbab8869bf8d072a6c703a4450487ed7c34fdd9c15f140721ffddc306b3ed9328eb59d50b9ba5939bd
SSDEEP 12288:oLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:of/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BE5523D3548955B1FAFC0039C6764428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 30eb2f1e741b211660ba28dafa2807736e8cf90d56e1bdb5d7f12102b2c20515
MD5 2f217e9b6caa8d8eac183ea78761f1dd
SHA1 8240617d384a47d72ada3ade75456b86db9b754d
SHA512 dcf7134d4a8ad2fe01b8f9d39b88028e8f46dbc071d8271ed429dc03a18d0bd73b439d291a1b07f43a9190d08419da369c02c43ecdc8efb219b167a9616d6b1a
SSDEEP 12288:rRiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BB5523D2558955B1F6BC0039867A4428F5882E2DDB5619E3E3483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 8898a610ba8582e1b253b1453e1a1217c9af124b313bcd11b62d1fc783b25a2b
MD5 f32e5d3af9eef3acc7b1ecf643231d51
SHA1 8d725e57788349e2d2b337359673aac3faab63be
SHA512 8a5d2cf71725731cc4e72357ab3cf2e82d7a6547bdc064c9b9dd68ab7f81da658de04ba505b5810ad62d781d604fbdc4c9673b670e2ceb9e8b02aa218bb86cb7
SSDEEP 12288:9wiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9i/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C75523D3548955B1EAFC0039C6754428F5882E2DEB5659E3E2483D1EA23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 fec8a75b0a9c4cc9227d64fcf8aca79c125df0102701fc41711f074d661916e6
MD5 66eeb493e894c7367a035de7ac696ffd
SHA1 901f41ca632bc654580c664bb9cc4cf1450cd320
SHA512 31f5b30c0ba290f3135ca65713dc61cb9599988d386c19c150628dcabed2c69f284d0a25d1889b06610034badd1b563de8e36313e3b9d2f2aed8137a0f2e3804
SSDEEP 12288:7yiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:7U/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1225523D3548955B1FAFC003986754428F5882E2DEB5659E3E2483D1EA23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 7170b8ca86a43144d755f61f4570a2cd35899e29099a545abe113ff09c308fa3
MD5 5dc2bc450d1b561a3c2c1e4a3bdd2006
SHA1 daecb2d62daa2a759cd75f0e387663a447c1fabf
SHA512 bed910a482de6a1f4e6e0168a207603799ff3946f73ce32d7ecf6e6a61888f557ab96ef88040f6ac163bb693c9b0cdb2b1e51d2dc778a95be84d61792a4159c9
SSDEEP 12288:KLiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Kf/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1695523D3548955B1EAFC0039C6764428F5881E2DEB5659E3E2483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 447efa787d3da33eb0d97512242eb5ac018c16b2abd009e49cc2810ae1c7f4ca
MD5 de20a7b31ab2f2e205d7731cac7ef24c
SHA1 334b776c63fa494cb2fd73ef988e1986b49d2042
SHA512 a6ded8f04325e7702f18ba541e683ea9f45a636bf61d58ee3e42b66bff7a212f3bbee133b772d1a4acce4dea0d4d550cd3cfebaf3b7e1cf42643cdc24e973b5a
SSDEEP 12288:TqiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ts/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1485523D3548955B1EAFC003AC6754428F5881E2DEB5659E3E3483D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 37fe1f0888c7375b9b0970e624710fa7e8dd539674478afd5fdb60cc3474759b
MD5 4af0c3a32cd53e5169b8e9d70eba4e91
SHA1 b9f42949ea14effdd75bd5b671b3ab3fdf538a38
SHA512 c692a0d6dab2dc13d216cbdea5edcd3c33a4cded6d34df8106c1511deef16956a96a491b5d577dd71f25f27fe3ac3a9edfe77f7fd66578255c6e239002dc3fc2
SSDEEP 12288:GMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:G2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19B5523D3548955B1EAFC0039C6764428F5881E2DEB5619E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 eed4a6dbbd702290eee6d5ac994e13e6c57cdee89a04a9eeb65532825c0ce2a4
MD5 0e791fbb413a0750c942153ba819670e
SHA1 46935776ea625840f47c932973ec702a396b6219
SHA512 7c433a5d2f7d77a2a9bdc21eaf5d50a3bae5e95e2b08ee39ac473f39d9f50c3c8e205e87e08ff9474020ee4914ce2684aef3d48f62e6804a6bbb4702f6b15d08
SSDEEP 12288:uTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:un/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1BF5523D2548955B1EABC003AC6754428F5881E2DEB5659E3E3483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 03b8386a2167ffae893dd7c4802f7bb586ce806da996fadafaee2b1dd9e2c083
MD5 6fecc6c639c5eed43338104d680eca28
SHA1 18503935dfd9be839315d85961dc97b30f7c0cd3
SHA512 7da37a688d0950ed7ff01dc57fc8241fd8a5a0d41d91b0bfa6e28fe324980173297b3f30e6e9f87be2522310b7a484948d9c4816216ec310006a280a5766c523
SSDEEP 12288:xMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:x2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EA5523D3548955B1EAFC0039C6764428F5881E2DEB5619E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 db8d02cef7211287e37418de80413d666532abf1410d87552c78a7e53c0a41a6
MD5 b3d41c86ef25994231c41720897556e8
SHA1 e588bb3c199276bd907f6f10da8f9fc8c0c01532
SHA512 643a9ab072cf8b006dcce1ec1e7442ab37e87cf9a44dae49b9c27e5e381ec76495f4aea399ba35158754a4d501f172bfac50f7f1ae0acd371e397f5e9b346e7a
SSDEEP 24576:Vfwvzk9RX6wkyAIo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:sMnYIoLNiXicJFFRGNzj3
TLSH
T1B785D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 09973446c5542ba513a95713d2de2fb5c94b57afab3a3a1c2a9946d236794b0a
MD5 35fe6c563ca61464dc6a39825a351cf4
SHA1 2439dece7adfd2c80efcd9069b26d3e15d087a1d
SHA512 3c825ee60800114ebca61a4f4a8ccd38be3d8a886d0c988933c4eea2c1e584d27a6a3f3b48023ef9d70a07dfabb5cc8b2810610fc851df64dd8cb9adef8d079e
SSDEEP 49152:4YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0DLNiXicJFFRGN:3ySzPL7wRGpj3
TLSH
T1A8066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 f5d6316a6a7520a54867a9a7befbe56c46d0815db9015a49eef6dbf9b3d767be
MD5 69fe0cbab0ddf6c6232a3fec84d093f8
SHA1 5f683130811bbc85d1b48a3924f8ecdf72bfe9d1
SHA512 cb9e422d8981ce09438ea804f2519601d01ed428a6e7b4547da66b83bf582aaae941262f18d01335e517ecab4c50e468077883507a695075a7c897d51fc6f70a
SSDEEP 24576:c47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:c47JUQjqirIhCnDHUPfF/zLNiXicJFFS
TLSH
T1B665AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 5d6cd649c21a12db08046b610d1843becab4eb95fce8e01276e186bbd4f69d63
MD5 c888b2f639ad9c354469f3e0f996c678
SHA1 5e02d5130680bd27f827e3a7d5441b941429a8d2
SHA512 ff1b41f8818bafb4538e1ee9d1aefd9a6b50a4a21225c25863d2bdd2799ed3c18c40fa58f5927bb58d523e93dc441148d3bc42a10c3b770eb1ed8d248694944d
SSDEEP 12288:tpsfiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ek/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16965F15AD28802E8D1AE5139C7664900F3677C2987E1D3CB52C0F93E1F3AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 08c544f48eb6b6001b3a8c0a2c2ea3e1eff7d395ff3070503840ebcfaf9d4c13
MD5 bb98d722883e29eae4cb5e5615a47eaa
SHA1 a177df9d89833648a9feca0cb0e4b0c0773a7284
SHA512 f43a4d9c6fed3e59ad1690e050fa136c4667f1dbcba31582e65ed0ecb7ab406cb061cd2e2806b0d1c83c297c8342aa3bc7351b085c0ee1a5a586a6191912485f
SSDEEP 12288:tF7aiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:b8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1125523A3568C59B1FAFD0039857A8434B54D7E2C9F1598E3E2043A5EA138FDACF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ccf116db1b1f8d518db4d8638fbee797b3d571209828376bed13f2ceee0d6829
MD5 a5e4ea3657c59878df1352a74aa80816
SHA1 cf7b2742dda02c4a6f3f47ff6e6934dd0d28f244
SHA512 304397ba320a87741b69a31ec6dbba1cc7ea2ec562b9a83a13eecf18b08e28489c2b952b6c7e0ccc69a2ab0193754216f59d792c38d150d5d0d7aa039e3b90a7
SSDEEP 24576:kgb6bmBIi49WNNFpg1rSvFv7bYq/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kgb4mBIBhGFJLNiXicJFFRGNzj3
TLSH
T10F65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 b930ff8a0b21ff7fe910675c2f75f9e1201955ba8b67651dfa8e29076777839a
MD5 f8a0759148d28727762e7bb88a17f5aa
SHA1 daa68b9c8a120038c5681ee377ac4d36ea24da7e
SHA512 08abb7e14dc6707244e49089ca0641db674b9b69443888a1132264ee8c5e1cb697b645fda07ee5077d3f87b4b806525c8521342fa811f9a14711f89e441cf5b0
SSDEEP 24576:KG88u8FpJqH1vzria7/mZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:x7ZFPqVya7/CLNiXicJFFRGNzj3
TLSH
T10785F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 576bddb8006dc8fb38550b421d5928bf118415f8ca6ff74190f28e58023221ac
MD5 284b88efeea5dfda9310427d463c8ed9
SHA1 24440c5cad000daa10276981ad040fadd341d7ff
SHA512 18dbbac2787b3b9c2eea2397e225aab0aaac8f5331dcece5a615c5e66389b5f2b7037dce31a6f6eaa912d6eb1aec0638337f8418a67152ad9e6fe54acc46df7b
SSDEEP 49152:4BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjVLNiXicJFFRGNzj3:TG05lO43bg7wRGpj3
TLSH
T131D5C06E62EC11F5D1BBD07CD9C6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1d510e55ada3471167d022ccfe481f6e298013124e5b5ffb010901e264fa58a0
MD5 596883836fe35055aec39a3fe7adc39e
SHA1 f0500148b3af40d198ff48037c6bbb0d136ab981
SHA512 0b712b18771be69da0994c7167c270d3df20e2f9f697afa1af51005c7b08a1c745dad96422092d01fa9491bc339d59482b1a806886e1741557c4bc4ab369979e
SSDEEP 24576:Xfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnD/TwSfVcYG3K/cJHlnFR+IGNe8jg:va5POZ3lJt2pasx2+mdLNiXicJFFRGNf
TLSH
T17465BF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 bd354af6cc28cde77e1cfd33c8fbd7e34ad9b43c760e376abd7ef62e2b5f30ad
MD5 9a4601d79e73874abecd11f2548f6581
SHA1 90fb08e400874bb94f2093e4fc4ec248c7d14fc3
SHA512 de51a14c2e5ab78f6aa466da4d6123a5aff615e4d83fc72a6bec375ccb0f8609eec1cb74c542d9a5b103ff795862956f1222ebc4bfbf8daa6d28242c4a91a1e5
SSDEEP 24576:UNcwHdjbyQ4nLC18lb/EOjowL7Fkh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UNc/zEOVHFiLNiXicJFFRGNzj3
TLSH
T17B858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 2531d02ddc726ce42e0e86420c0f27350b831a649d4559b6b314d3788b58c549
MD5 05f7b4f37535d3157413c33e5246450c
SHA1 872fc0dd6c69a4080611f10660efdea6e1e02064
SHA512 092aa8bc0600bc0b1fe06f79fe9da9750d95d841ca18dcec76a71c5f67ea13a194623384042ec26483251b346832f53c249774cb3f87891568622b710e5eac99
SSDEEP 24576:jzkNvNnaFeYhJNtmZBmn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jzMwBtOmnLNiXicJFFRGNzj3
TLSH
T11055AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 140c196fca06ea564d192cee076c9d3068dd174af22ece256b65578ae215af7e
MD5 2043d8a5c521bb73f0ecbe0e6587884c
SHA1 7d005f81ba06f4800ff73d10916b4bcecaa93dfb
SHA512 74182ff21772d874bde792aeb659497c334ec166d609f15b4d5dca372229290df6a021dfc4cc8ec7fb719fa471480066b220c63ad49b50b9cfbaf0b3483f5f5a
SSDEEP 24576:hPUr+NQF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:hJQFLNiXicJFFRGNzj3
TLSH
T1C765F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 51674f081b6a08935819cd6cf984f6a01b71709a3f2131078d7f1987e943a8b5
MD5 a43fea794fab739c8589b3b38962686a
SHA1 96605c541b5aea8b0e2336d7f226633d1f93e498
SHA512 34f89d0404709f629081ca8a997a3e4edfebb911769d83f7b39a98a83f3806eaa85c691ef6e3fdca6cc95d9b1ae8dbc731f11045dee574191dd023225a7e5cf9
SSDEEP 24576:KD3FHshBIYQgAQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KDVHeBIAAQLNiXicJFFRGNzj3
TLSH
T13A75E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1588-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1588-93-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1588-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1588-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1588-87-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1588-381-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1608-125-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/1608-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1608-137-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/1608-131-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/1608-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1976-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1976-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1976-45-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1976-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2456-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2456-369-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2456-106-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2456-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2456-367-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2456-100-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2704-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2704-37-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2704-47-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2704-51-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2704-43-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3172-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3172-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3172-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3172-370-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3256-1-0x0000000000AB0000-0x0000000000B10000-memory.dmp

Download

memory/3256-7-0x0000000000AB0000-0x0000000000B10000-memory.dmp

Download

memory/3256-316-0x0000000140000000-0x0000000140283000-memory.dmp

Download

memory/3256-0-0x0000000140000000-0x0000000140283000-memory.dmp

Download

memory/3256-311-0x0000000000AB0000-0x0000000000B10000-memory.dmp

Download

memory/3256-8-0x0000000000AB0000-0x0000000000B10000-memory.dmp

Download

memory/3256-98-0x0000000140000000-0x0000000140283000-memory.dmp

Download

memory/4176-300-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4176-82-0x0000000000800000-0x0000000000866000-memory.dmp

Download

memory/4176-76-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4176-77-0x0000000000800000-0x0000000000866000-memory.dmp

Download

memory/4664-216-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4664-53-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4664-54-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4664-60-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5080-123-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5080-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5080-15-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5080-21-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5080-22-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5600-119-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5600-322-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5600-113-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5600-111-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5616-407-0x00000232001A0000-0x00000232002A0000-memory.dmp

Download

memory/5616-453-0x0000023204620000-0x0000023204640000-memory.dmp

Download

memory/5616-439-0x0000023203B50000-0x0000023203B70000-memory.dmp

Download

memory/5616-419-0x0000023203DF0000-0x0000023203EF0000-memory.dmp

Download

memory/5616-418-0x00000232039F0000-0x0000023203A10000-memory.dmp

Download

memory/5700-66-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/5700-72-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/5700-64-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5700-280-0x0000000140000000-0x0000000140222000-memory.dmp

Download