f154e3bd79a8a6af80e689544cd3500b030705e15c7ef9e3d69f5f032323c5c6

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 09:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
Size 4.6MB
Sample260731-lf94msdn8x
SHA256 f154e3bd79a8a6af80e689544cd3500b030705e15c7ef9e3d69f5f032323c5c6
MD5 54c1f3eadcd0e16003f39c45d5e54f18
SHA1 90a6a09f187e939964d727d43be94447ca33e15a
SHA512 4cf58f8483027bcc66e5a7a4b86a9cc88005cc17e7bf6c141498a396b6f6ecb74076cddf3d572c201ae612c25e5779744e7ee4cb1b6473095ceae627d06a605a
SSDEEP 49152:9dRba8fD8qinfMSKJXIUQREV1QOTu1U5ai2wzYo5UC9RhuCTFKlaxV5dgbT8QKKE:K/IJsiCwsop7cTAKYpfg
TLSH
T153266C656BF880F5E1A7E138897AC9B2F77678020D71DB5F0251CA1F2F33A904D29726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3420	elevation_service.exe
4640	elevation_service.exe
4216	maintenanceservice.exe
400	OSE.EXE
2028	PerceptionSimulationService.exe
1936	perfhost.exe
5316	ReFsDedupSvc.exe
1860	SensorDataService.exe
6048	ssh-agent.exe
4156	AgentService.exe
2532	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5ec4ad54e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000059659370cf20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c0cc622ecf20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f69d7532cf20dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000087d71f2fcf20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000f975670cf20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009fba832ecf20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f03a830cf20dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000090835132cf20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
3420	elevation_service.exe
3420	elevation_service.exe
3420	elevation_service.exe
3420	elevation_service.exe
3420	elevation_service.exe
3420	elevation_service.exe
3420	elevation_service.exe
4640	elevation_service.exe
4640	elevation_service.exe
4640	elevation_service.exe
4640	elevation_service.exe
4640	elevation_service.exe
4640	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
Token: SeBackupPrivilege	5316	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5316	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5316	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5316	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5316	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5316	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5316	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5316	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5316	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5316	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4156	AgentService.exe
Token: 33	2532	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2532	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2532	SearchIndexer.exe
Token: SeDebugPrivilege	1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3420	elevation_service.exe
Token: SeDebugPrivilege	4640	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1240	2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 5104	2532	SearchIndexer.exe	100
PID 2532 wrote to memory of 2996	2532	SearchIndexer.exe	101
PID 2532 wrote to memory of 4180	2532	SearchIndexer.exe	102
PID 2532 wrote to memory of 4120	2532	SearchIndexer.exe	103
PID 2532 wrote to memory of 3456	2532	SearchIndexer.exe	107
PID 2532 wrote to memory of 4704	2532	SearchIndexer.exe	108
PID 2532 wrote to memory of 3816	2532	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_54c1f3eadcd0e16003f39c45d5e54f18_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1240

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3420

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4640

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4216

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:400

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2028

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1936

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5316

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1860

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6048

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4156

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5104
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2996
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4180
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4120
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3456
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4704
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3016 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6c119c6fdd5424791365893312329618364af598c7b2f7e3a0a00b9e421d9fe0
MD5 a83ecb4529e0151ee113de88d275b3fb
SHA1 be469b793be4f9b50f263f44b7a3f41c4a17583e
SHA512 eaf303af0ea6762653bec0f3f803d8ea5ab34632fbf98e6024ba6a892a7270bfe0828ef58a01f641f2586558a1f4353bc39df2aee3235e8c093a6067d206c911
SSDEEP 49152:Ob+632BuPkFKRrdE6ohvstBhuXjfS4LWxnbQKKYpWwl1+NY:Q3q6sjBQKYpfg
TLSH
T135D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 34ec3702f8032b427ba96fef810b3adfacafcf402e709bee24a27e7ee6d7e047
MD5 61ca750003d61cf220ffad57b2547d6a
SHA1 fe19041b3131e2f466e66137c51108a818c6699f
SHA512 d08f292a1a90bb502bb5ec5e58d1e97bdf64d7cabac05fb06f5cc682252842649f50c10adfd0541dd3d00a112aece1e6c424968735742c8ebd9bf429f2ff4f54
SSDEEP 12288:b1XLsswWkxy2lRq2czA4JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rd6:hXYfDtczA4voKFLgYHJWwl24C15rDY
TLSH
T1AB65F12973E508F8ED67817DCDA28402D633BC5547A0E79B03A0A96A1F337D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 99210314df2efc06564d404db5ba211df9102a682ad31ef5c48037567a9e49bb
MD5 7ab8f207a27fffb396d5aa6bf4c0ecf4
SHA1 f877b919bf7412b32dc38881f06a72941f1a27dd
SHA512 fdd3f035dc21901a9b48d45bee45c8f54cce9ab3866ae5e7f815d0d8278282e6cacbcbe686efcbab05baffb0a6d3653dcc2193bb8825341c5e74397b66a40fb9
SSDEEP 24576:I0Le5ji0hmxxrMTvoKFLgYHJWwl24C15rDY:IPji0AjWQKKYpWwl1+NY
TLSH
T1FC85AF16F6748371D073C0B9C5D2A68EE97134865B308ACB4286D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c2afd5999d040b7f83ec8d616eb8fcdfa86d1068e7942624ec44f5e690f501a4
MD5 affee5bfebdc50f503cf0b463e85bbf8
SHA1 ba18f18a3e1dbc2ec4252a2c6a1f5394bd62b903
SHA512 5f6e6d4921d1032d79bfc8ba9c47527279891cc4f54fdb60a1d279997208d0e28871a29f47855c94fef408e142fc6ddf996289f0dfd874db4b0a682c3634ba54
SSDEEP 24576:Ja7/ezSC6vUyD/aqgrvWn6q8wyutvoKFLgYHJWwl24C15rDY:4/ezSC6vUzPveHjyyQKKYpWwl1+NY
TLSH
T1BB756D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 160174b9b03f0a086c4ff74e1703e3c63ff26512a5504cf2301371787e2e3a7e
MD5 4e080824c7fcf5c1f2386a4f11371809
SHA1 7e050c02a79f53500f7be06197d0b6df782d4522
SHA512 157b9fcf4d5eb0b1f92fe9146edade9200785b771684a6ed94477a75f190da51280c8dc078b44bc7af2adf9185d19f2ba1349483ed7ad9a45d3b08b64fac5dff
SSDEEP 24576:XVbqPb88hv/l+Y8voKFLgYHJWwl24C15rDY:XVO88hXl+VQKKYpWwl1+NY
TLSH
T1E9559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a4d22b1315daed59ecbf4ee793743d7fe3bdd73fcf0b5bd97069b54dad61bee4
MD5 61ac5b0757b624381dc0e9973ec4504d
SHA1 c2df7f93202ecff5df4c12c8d9affee4d804574c
SHA512 ef47fd94c758292cfe411338882dd0bd6e18295617560380f2aab5ac1351d06b09d894ee9acd17c6f5c54def30ec2f0a6770bdd5d0485f89baac0663ca674289
SSDEEP 12288:/LXJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:/LXvoKFLgYHJWwl24C15rDY
TLSH
T1EF45230771ED80F0EF5A0EB5BAEA64478131CF0858C84A57D4117ABF28B7EE8B71D159
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 1b1aed0056e2da2075bb0e74cf6b5d55bd1aaf075af1bdcba826a99609cd103c
MD5 cb484fb467cbe8a07ca85efcc781dd83
SHA1 2ff352b48d82a29b1991c11c2665dfee2261aa66
SHA512 73d6589a9049b9faec889a212ad74fb82f809e4f4aa9d61fdaaff088a28634bce019c281a661139dca5a9989abf513cab8ce7c6970a9d560483c29f631fefb45
SSDEEP 12288:IeBNUbTVO86U0JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:IJIU0voKFLgYHJWwl24C15rDY
TLSH
T12C65CF3BEE28FCE2C67E8DB95A918600D77278304F5193CBD165830E9E235E45E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e443b0406d82ab91dfa740689b603e803b788d5eb01f765edffdf12c6c055f49
MD5 e1f57ea5d417839158db2fe36bf04825
SHA1 c2d9710b67b27040239f94d3b7d799134e684d19
SHA512 b436b8447c86151059fbb0c70e72c7a524ab65046460352c1ecc5858e2d4d037431583c1ed656657bc56157ac6ed1f7b77416d12b169e318e322f0b43fb7d384
SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THM:SQvGAdlCEL8c/DRNw5CBKYpfg
TLSH
T16D267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 f7a3c720297c1ea5d9d1562fcfe0603b9799093336b858836c0257ad5bda882e
MD5 c5ba91ef222be47758d50a594afa5a4e
SHA1 029e988bb748f63095b6938e89e98de270424db2
SHA512 7c633587abfbe409494ba860a40c63ab1e014e8cb19e42adc05ca9181cbcb927e3fe2a8c202e9e6e98c0e27a3e44c01479d65bfb9ee214b5a5df6a20dccd9f5e
SSDEEP 12288:pAwSfxL/2Dc3RDLLmt0LDQewsAjmJlARaGdf1IrOrNhyRfLz707YH7lk9wl225Ck:a0ewsAjmvoKFLgYHJWwl24C15rDY
TLSH
T13775E031FA74D036C77B0DB61B36D716543CBE204B911AC3E3A89E9E59702D2237AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 bf0f4c6ec796813358a233c8cd284769d86ab12177773ee3c5f14feac3d7c79c
MD5 a369d91b33fef84b1541b7de1e929538
SHA1 3ef86f3debe622872f8e23979991c0e6101a194b
SHA512 53b23fd4ee5198bcf8473dbf35eae94c1ee4c45817fbe54de810de795dfc9226ec90bb4f2d8d151bf47b0948084f02a23edf2c659131e80fafe2b00e2e407da4
SSDEEP 196608:2UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHGI:2UEtQevvqc2W1cpV2tI32h
TLSH
T167474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7487d08a080da397dcd2486aee370c462b98952dcd7f571f1d642602fb3f6532
MD5 34e0f5fbde46da9b0686c390992d3145
SHA1 e223f8e153b159e35451da7d9899e8afc06b02a8
SHA512 45492892e484f76eae18653d39a27fdacb1c89eac6abd861aa16cf0b06c8d0071de36d02472d24abbf2c9ae6e7ffe69912ec5946236d074ee23d3f4390ef0834
SSDEEP 49152:tCbRquA/m2yL5zTfFiV+XenmE3/zGQKKYpWwl1+NY:KoquVjnmNKYpfg
TLSH
T1B3D58D0976B8C2E4D1F6C77886A2C647F37178154B3497EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 aab87472e4c24c5c8037311f33c9bb2cdd37b014c29db89e69766028992437ba
MD5 8a4718694f40cf2dc96374535a97f3e4
SHA1 dbf8a17255f363417032619e59b2411bb41d1c59
SHA512 ab227500fd1ee12aac327c9a28c8cb3e9068d440cf31ddd1dfff2361bc668b24980ee2963e2b429c9b7d0a7cf3ba05b1ab9f8c371078dc7133c3db792999a9a0
SSDEEP 24576:XAhGL3IFoiwtA5l7S53JvoKFLgYHJWwl24C15rDY:XAMUFoiq55QKKYpWwl1+NY
TLSH
T17535AE81E7F945D4F5B3AAB899B69171EA76BCA65E30C20F2150D11F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 6763d0ac258c9b95a441e4aa94ff18ec8a5fd9be657a24abf24b3c69906e2114
MD5 bcb97d16d652552959f78f584d157a8a
SHA1 9ed13b903d13384cf6172e3115ebf42d4869cb80
SHA512 da354f1c5b48899803f8fd4a407fdf440154a456238081837338305bbcec0d90c508b63d8ef849baa68924d9b293fab0a060e75666e728ccbc580da5b69600c3
SSDEEP 12288:smw5HEjsChNVBFgl0WDm+CNJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb+:Jwu4OWSvoKFLgYHJWwl24C15rDY
TLSH
T1A865F14A72E90CF9EA678639C597C036E7B2BC012A65C71F5760C65B2F333616E2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 c31060b40b49bb52d58ba8dd3622da5390363557f07bdaaf99dc78c84a04b7c2
MD5 b361fe860e42c4ba2a0411a5ecc1db3e
SHA1 5181217bd7c8841725cc3754d6729047acc4f728
SHA512 ddb53f0c5df7ae6b0d421d3010ba96a2135129987fc69c3344cb179ebba9b9ebd85502e4bd28e1e6af37b6aec925bde0f8f2c38dfcc0cfa714c5ac7437e8e869
SSDEEP 12288:ZeZ1Iy2JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:cZurvoKFLgYHJWwl24C15rDY
TLSH
T13055124A32E860F4EAA7467CD9E55506C372BC1627B443CF512162AF2E73ED52E3D322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 bb6e949a861bc3369365b8dcb65c6a7554c6401b09605275283c711bc491f75e
MD5 a3bae6de402fa2f62ec322420154b1d9
SHA1 f442894862dd412566bb6aeeffa5375554c37c98
SHA512 5e1eba20e9692c50e34e5ce8405912aa488ee8bf9563a2bd8582fa419969b558bff799b4d4f8e95267b9bcbb5903bd69084b3bfddc4945868e7efeb23e1b7c30
SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UQ:4QRQyi36YOcPbLvw2gAf+PN3UKYpfg
TLSH
T11B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 1c1fd9ebbde351730aac581a8617ed35533aa68c0480d57284ad01756bc685c5
MD5 025c947b67f9defa51a7762d6a71fa31
SHA1 3cc05e80d8de72144a4f3fd56cbece4c5fe55a82
SHA512 ae6b100510bbe0443bac824d91f67def425fa02920de250b364bf11ff814b79669771436f88bebea449ff92cbbbf92f29c5d01417710c73021d291af4897b900
SSDEEP 49152:dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UQ:0QRQyi36YOcPbLvw2gAf+PN3UKYpfg
TLSH
T118667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 dac5d721ba1e8d85ad2cf8a97f69e9037418d35c55d521013cc9073df3361943
MD5 17b17e9a8547b38cecb089a5f71e68d1
SHA1 925a4b9ca27af594d94cccb3c252fad211393fdd
SHA512 3b8c7f50699201c36635ce1bb44308e881df453b9d9fe0261e2f1a6caff3bb3461a225144bc286853b8fd49752e47c3297566aef967ac1cb043f5b981038b571
SSDEEP 49152:J68Qg55nhceWu7PNU3/WQKKYpWwl1+NY:XthLRc/+KYpfg
TLSH
T10CB55A33B2F600A9C44DE1769F4A872196D17C758FE0E3DB8511721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3ebc0789d47508f047da9575234db4da524f6dc56375686644f9db5f697d9441
MD5 78b8e2dc927a28dc221e312addf01d22
SHA1 b640e126e7d34424dfdcf6f544807eb949f10679
SHA512 2d8da6d2775fdb9df04871bc3dd8d5269567f065c7f99d148533b28b0d86b67d62c7835ac3798bf82c11901c5099f29e33c94aacad3020c5b46d5dc0fd68fe8a
SSDEEP 49152:c3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk996:Zy5112gYy5azzVvt69nLKnhZnKYpfg
TLSH
T154167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6b7d4e7aba667096039fb6f425a0886353e7af2aed769b5a265d685ca65247dc
MD5 664fd60bb1bd61df5a04bea88cd4a575
SHA1 0812f35685f1839dbe71ecb1235942ace3872d44
SHA512 bc720463758acd48a5dc7be1eff45e039a4c4eba07d51b0fdb02acdbedf810c2c9059826c284e237a2de14abc3d2c0558f47faf984d79ccbd5cb72f7aa4edf00
SSDEEP 49152:IB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gloQKKYpWwl1+NY:Cu6Jmdxd2d8KYpfg
TLSH
T1F3D59E13F1DA01E8D06ED578974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d6843cf7b0e82fe8302f8a14ee705c3cc401a7a19e5eec9757a3c8f580be8993
MD5 6b5635b6f7455af1b9cdc3a35d47fcec
SHA1 dcfa5033436135304dbdf295081b8d4c4994e04f
SHA512 852b965c67023415166100feb79c20545cd4878470810afb2edeef8177eb0d891d0c7380b9811b71e91faef52e6789e4f92e585b1a335ea91cb7d89f4a30bb69
SSDEEP 49152:I1hpsNoJpF1A63U44CwH7R4xUQKKYpWwl1+NY:ImifPWRNKYpfg
TLSH
T1FCB5AE13F2D901E8D05ED17887569232EA62BC460B34A6DF0A90B7961F7BFE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 7fedf5e2e9b9bf42e0cde88f8ba69ed7897807383ea42b8965f515fdc5d6b568
MD5 d9a9b881bb359985f65608e96a77ef35
SHA1 1e64425195af64cfd4022cbcd64824c7947088de
SHA512 94992c33b5e0ca40a74483d238d79a4b3e17a7826a8523a01ab4e47d9cb43fb71dac597a41a36ab1520b262cc97100a23aa604ea3ccaa9516b259aac5a630b56
SSDEEP 49152:zSuZQIY0Be2KcRVtOnks6NMHqrQKKYpWwl1+NY:x5dKii617KYpfg
TLSH
T10CC5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 17d777e17e31cda7eea917ae267dd60d8b19fd8b8cd40441ece728c614fe22a9
MD5 e56fda7503eec8a6232f144ab59eded1
SHA1 2ae4a9f18b422ab6d7035ef5f852b583024abd52
SHA512 25abf627510036457399539e13c70aad4175203b9ed69d6b31d66dee72dbff9993d870890e31f60a9def47edc36c2333a3c72d850405cd1ccf7a2cdd5b59e363
SSDEEP 49152:WhtSn8EApI0fig3giDn0AP5w4QKKYpWwl1+NY:3X2imphZKYpfg
TLSH
T1C995BE13F2D901E8D05ED178C7568632E972BC160B38AAEF0A50B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 093c248917a32678a626a837640b09e456ebbf68d74a2966a092459d71421603
MD5 8feb2f22d0459aecfe882ac863541d74
SHA1 0daa6db9a3d3ea9db89d74445891c1f036b85be6
SHA512 8a721bc87cd7b061ef720e409919ba1acdc4347c53d5f6f197cb74449235f4f2b939121f5792911f37419e6074167dd4595750139cc720067698ac186aa927c7
SSDEEP 12288:gvJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:gvvoKFLgYHJWwl24C15rDY
TLSH
T1DF45234B74EE81F4EF054AF5EAD66047C1349F0AB8C8066BE512756F28B3EE8271D19C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 adb3a260df1677e48f759c0673246f93ab4f8b749abdd8870eb8ba710f1e55bb
MD5 0a1190b4f42ab05dc2480e8828878cb0
SHA1 9ce4b17fe34542ed4c7d29e6adbdbe84b6af2587
SHA512 f7851f9d82076d217b782c371fa6c0595f649d2d774e2b004fe98b516000a198f9e568eb4ffe5a47f3b2010407f16dd71050a519d9595aff7d5f1f139788f36e
SSDEEP 12288:paJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:pavoKFLgYHJWwl24C15rDY
TLSH
T15A45234B74EE81F4EF054AF5AAD56047C0349F0A78C846ABE512756F28B3FE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 3a314439a1915dad56838c27730837f1ab1bcc0c49d18866ee4c6b658f1b5703
MD5 9c732adcd7d779222651916cf29b244f
SHA1 b752792ead7c59e3fa4e4c34456fea978151bc17
SHA512 ebcee0a526d48b2cdd01b68e47af1ccd2f81ce174b5ce9759078dec0299add94367612ed2e0915effb2942fa4e9ca451e1bd59127daaf096ef9efb031288a071
SSDEEP 12288:fsJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:fsvoKFLgYHJWwl24C15rDY
TLSH
T13445234B74EF81F4EF054AF5AAD66047C0349F0AB8C8469BE512756F28B3EE8271D19C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 97cfe3da97e95b5c9b5573254ab50cdb49e48c017e4051bd0f8d4a57678c25f8
MD5 2cc1761686376ef13a1869999b54d402
SHA1 6195a1baf55123daf224b972b714be2e2c1e47ad
SHA512 741ad19bc2b8bca7b99bb0df049a90002d00c3d9d7a8b59423bd0ca5c4386da02895106dc99a00fc50e89ef2e8bac962460f90b0ff1eef5decebed2a0a07979a
SSDEEP 12288:nVpJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:fvoKFLgYHJWwl24C15rDY
TLSH
T12145230732EE41E0EE16C6B9D9A65003C271BE59A5A4479FD601356F1CB3BE83B3C668
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 1b73b36137ceaf20d17eb60faff409b1e7c95e88f1d74ab96735c3ae47a7411d
MD5 33f4a5def790e273b017be32328de9ff
SHA1 3a7631533ee77771f0a968d0c6080b048ede4dd3
SHA512 2fe4f76abba2dbf2bae84075a69f6be686d34819b81a576311380778d705464e85ae5786a8eee255c3d0cb7d25a7f2a4dbe525430eeecbba22c68fed6b60c997
SSDEEP 12288:nxJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:nxvoKFLgYHJWwl24C15rDY
TLSH
T16C45234B74EF81F4EF054AF5AAD66047C0349F0A78C8469BE512756F28B3EE8271D19C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 93570a5607e98666ab0fb393c295b8a3e2d51a9b4f6922190f3ab8e52cf14b97
MD5 c40045676f6cfd7c71d8f0c522dea73a
SHA1 2b227216a0f59a9f40256a7c918d6a06ae497b6a
SHA512 89b363ef6a5ca0ca827bd304891a9eae74458a7e0ce5dca593109402180e8e06c2335f1129cdc9ef9a56b7048ece2a69238598148221c7ab159d05da2e180cf3
SSDEEP 12288:s+JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:s+voKFLgYHJWwl24C15rDY
TLSH
T1DA45234B74EE81F4EF054AF5AAD56047C0349F0AB8C8466BE512756F28B3FE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 d46b370435764dbc449ff67a076feabeaab8806f4c15c345150bbc268a06be96
MD5 92bf6c778a164fd03db708c06e12b68c
SHA1 fabcca31db850fbf8f7db4313236191df7dd6e39
SHA512 8b371826a9715c224d4fd95b64a1bf586ea1921173d925478ed6515b98f96393dc1d1e2b765dd1920cc59d3b766a625488f71942159db318192cf514b1b85bb9
SSDEEP 12288:jCJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:jCvoKFLgYHJWwl24C15rDY
TLSH
T1C245230B74EE81F4EF054AF5AA956047C1349F0AB8C8465BE512B56F28B3EE8371D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 a9fe0abf891993bed14f6153055145af8eec7b02d4c529c54f2c3971192de9e0
MD5 e5e2a62f778341cf0b38ab905dc41970
SHA1 9bafe242339a69f6b74c0b26b992397eb35b34af
SHA512 88afd9256ee854bab944923fb69c75fe3f5a15357c3ed27581f236d17a533bd5534a0705317351b2e229363de405346246a8fa854e3f10a3938267b331da507d
SSDEEP 12288:siZwbVzzFEoS2cPvy6JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:PZMRzFVSO6voKFLgYHJWwl24C15rDY
TLSH
T1CE65029573A408F4ED67823ECD558806D2B27C1A0BA0C61F53A4366B1F737E11D3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 320feb2243498b37f8bc3adcfc2289b0741891525f0357b4e30f619aed2edc59
MD5 7d4d6f87c432671b37996dd71bba3374
SHA1 307c24c55a1e2b8bdae0ce55041a9d5047508882
SHA512 ed633b2d9939e13e07d809d9c8b2b6c444e1095b2d6b58bb6736e759befc8b6126561bcd051f758b6511fd254d7247771410c88df6626401df2fd252a8c0bc19
SSDEEP 12288:j7JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:j7voKFLgYHJWwl24C15rDY
TLSH
T1E345234B74EE81F4EF054AF9AAD66047C0349F0E78C8469BE512756F28B3EE8271D19C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 106735df857673ddbf399271e0f22d9fdbddf435f2c68bdb41447b5cee44d1ec
MD5 809ed6f1e546ee753ed95b4965ab01f8
SHA1 bb72623214a144cfd3a919660f30eb4f928b9cb6
SHA512 45c9e82311c53133b16eb646356a7a1732520a022d89290daeb1cdd2e3824e654af9544093e3c6b2a62fa0b191694da6058053b88abd6d1d8d92ff881c095aab
SSDEEP 12288:UnJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:UnvoKFLgYHJWwl24C15rDY
TLSH
T1B545234B74EE81F4EF054AF9AAD56047C0349F0EB8C84697E512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 eb42affece2c96d47465eac2ecc8fbf775c9a542ff7f53279bd8d7cde4a78999
MD5 b30d974570231b4a390e6e9ba31005f2
SHA1 58bad245e43dc9c80ac60f52810e6fd54c632ea5
SHA512 c1f49934c07860e337d4da46d18fbc78f3e3dd99fbaba2fcfcdae6f6cec7b4e0ddb93ea0a586b6c77d3e70e88745ac3c0ceee5892e76b7184316f98a0e06482b
SSDEEP 12288:ayPz5L82JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:Hzy2voKFLgYHJWwl24C15rDY
TLSH
T12255120773A520F8D6268279C9A21902E371BC3657648BAF5760577B2E337E05F3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 96bffc8d2caaf76d7057f2f6cc96967b82deba3b8e5a9d948230e7f394366c1a
MD5 37bddf8964f2ce41cc8d85dc52d2cb99
SHA1 68f56c3da88c37f412a63c2ac5170aeab31d7cb6
SHA512 9bde44e12a75d24e29cb7f71527bd61ae2799728ed3d36624953a06c9d5ae3fbd1b16213cccf2644be0131e8fedeed726a019aea18ac900ba1b8bbc2b341cdeb
SSDEEP 12288:Q7JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:Q7voKFLgYHJWwl24C15rDY
TLSH
T1CF45234B74EE81F4EF054AF9AAD66047C0349F0E78C84697E512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 6483ed70c73bf2752e4f2902bb079c91f9141bf046f2320b6698e0994f86b19f
MD5 de63d6e400f413cc99da1bacab204b3e
SHA1 b19c6a3777bda63c1d763f3d4dfd882cc7eb440a
SHA512 bf1821470389080404550756802ef83619dd6f930c1ea10d1801f72e0fa328a9137f0b318fe2f3228cb279f979bd7ba25e470e46249f53f7b6af5a8bf37dd1bf
SSDEEP 12288:E7JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:E7voKFLgYHJWwl24C15rDY
TLSH
T19245234B74EE81F4EF054AF9AAD66047C0349F0E78C84697E512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 843676a38373fa7d2c49a06e266656680f7048de6f14b4a659956aca2fda8b88
MD5 0b4e54dcf7c330072d96b867a802dce4
SHA1 cde60c0abf88996f042daf28446f40cecc9ab2ff
SHA512 ea82801615b990d68c67eb3bbd7670e3949cb91d6601776b845bab54d6aeb9d8dc6b992d62408b09eaf26d3c5935f054ea15be82665a56b12974cdf066223a74
SSDEEP 12288:nyPz5L82JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:Kzy2voKFLgYHJWwl24C15rDY
TLSH
T16155120773A520F8D6268279C9A21902E371BC3657648BAF5760577B2E337E05F3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 3e384dd232b55e7cfd4898cc0a513057ff47fa64c0e375f07416a03c6edc0f17
MD5 4d15f3db3aa1d7d2006df51564c7c2c2
SHA1 d423e30519e0b778b6cc68a748260f8478683127
SHA512 aca7518e619d9ecc532f2e3c6cf7663c79f117e1f90e60cea55da1e8ea505ffdf537cbd8f430249c69e8b20bca3b6d170ff714170d6bfae2258512a29cb70f4c
SSDEEP 24576:6TDaLl3z0zDcvoKFLgYHJWwl24C15rDY:6TuLljtQKKYpWwl1+NY
TLSH
T1CF650295B3A008F8ED67867ECD558806C2B27C1A07A0C65F53A4366B1F337E11D3EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 60c44e666d9b325e38fdd3f20d3a15f9c3e634378f0f90cfddbe0ae0d5b392da
MD5 52db41c185534480c6efe973a55a2ef3
SHA1 d5966f0f7dc653400d970c1010406171aab41f4f
SHA512 e1d75eee0d0ebda35d35c1f22e32a38ac5700dcd748c7c20353f9bc2dbda58c166b4af94557522efac6e75158a8f081f9344eb175833e10aea5caf2072108dbc
SSDEEP 24576:W3vd9CHKy7GZwvoKFLgYHJWwl24C15rDY:4vd9CHKyaOQKKYpWwl1+NY
TLSH
T1B775CF91F3E810E4F1B79A35C9765512CA767C5A1B60CE8F03A4265A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 a22a4ac0045c37249b91691d89720bc245421d241f952cbc9c26a27c1d228671
MD5 5fcc0011c99f3eda191c080646e0e1d5
SHA1 08e92262275b06762c67e031fca92e8a82f9068d
SHA512 83b6b33885fc046772084d076f5ffd5a8f745496185f24f6a6f0f98452d899213d7e8c4ce8a43378628b2a033def38265ad6dedfd82e62a52e5c1247dec8a963
SSDEEP 12288:qMJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:qMvoKFLgYHJWwl24C15rDY
TLSH
T1C945234B74EF81F4EF054AF5AAD66047C0349F0A78C8466BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 518be3e6bcf9226cf7254f245f11540c8edcb111e775be75e23d9b5cc0d035bb
MD5 4f44c27ba1e7b78ea46f22698de4d636
SHA1 5519b5b1cb878d53eb209923c4a153c3dfc828b0
SHA512 4bd9b85280fc7c68f4bc2131e4ca5337957e510d002af93fd09e0a7905ce0403cd07a0116a5a9fd023b75af866c7a65f0a9b20e2aa012276abab2b1ca2832b94
SSDEEP 12288:GWJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:GWvoKFLgYHJWwl24C15rDY
TLSH
T1FC45234B70FE81F4EF094AF9AAD65047C1349F0AB8C8465BE512756F28B3EE8271D16C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 1509c4ad67581b709a60639d47545e2621fd79399496596fa245e0afd6f1955e
MD5 6baa7c4cbb9c903f54d566da0a69e50c
SHA1 dd94fd5c7cffefab842c1f15b3695378fb74a4e1
SHA512 c2aeabe871e2b3032c20b8b89c18fc061bc6d801fe21b25ada3df246b463c888b56b3dbe0ef810381ec39b29e953788e7a1cb24276b7277b8f3270d10ef0f0cb
SSDEEP 12288:p1JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:p1voKFLgYHJWwl24C15rDY
TLSH
T17F45234B74EF81F4EF054AF9AAD66047C0349F0A78C8465BE512756F28B3EE8271D1AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 0e425689288ec55d53338c157cd5194ee65a272f4a76ce825b654bc39a45f64e
MD5 e9f7cd3fc2cad1fd27e045062c1b271f
SHA1 3decaf3740f5ac57158798fb7fc6dc116abf4a6d
SHA512 56782e1ad1d1d7b390bd3a01c208ebf5f2c50d1139bdbc4d5b54f93796bc32ecba96fb1418dbb061e6c4b908f3b2132de1cf5ce316c69d0add5f49c71feebacf
SSDEEP 12288:I7JlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:I7voKFLgYHJWwl24C15rDY
TLSH
T18845234B74EF81F4EF054AF9AAD66047C0349F0A78C8469BE512756F28B3EE8271D19C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 28870d2a175488d166796d45508689abb3976018823b6e90b9002a8ce84b59ca
MD5 273daeb514d1b26047f5f19d23506ae4
SHA1 6ebb096de03c550dcba1d4304e116501797b18fc
SHA512 2d3e6c38033232977c665a650bc366fb9f1c10e571f3248485682f39c595357caa63a7dc5edd4f7e95c2163b74389cf137e8d035e419e34d4591364a91ea3030
SSDEEP 12288:WMJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:WMvoKFLgYHJWwl24C15rDY
TLSH
T16F45234B74EF81F4EF054AF9AAD66047C0349F0A78C8466BE512756F28B3EE8271D19C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 5b4ebcfdafac48db4e30364e62e4351e6b45473c73cf7b1ef0e692c953461ceb
MD5 1ad3920cc3a3647151734e37cdc6dae3
SHA1 aed1d65d39f12c2aac8e8bbda10d93e5db6934fd
SHA512 e17a920150d4e3ed5a4db42c827961a9b7642f8a060c34e909e9619128d2443318eb76ef5321e8e5a239736b81d1b624e5b0e9e90142972ce175e0a11272e8f4
SSDEEP 12288:2DJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:2DvoKFLgYHJWwl24C15rDY
TLSH
T11345234B74EE81F4EF054AF9EAD65047C0349F0AB8C8469BE512756F28B3EE8271D16C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 3feac02a8a4ba30738121ef3f64b379b4e49105f2fc11947200c7b430cf7c505
MD5 72f2a55158fa7d4bc8baadc29f7d2bca
SHA1 fe78c40d2cefc166fd50f68058500e7aa83f19df
SHA512 a9e376c08ec8f9181d818f8d59813b39d73645bcdb62fae999a396d183ed1f03bb70fb1e96a96867c4947af8633505fae6cf795723bfa9597d42594954cc6164
SSDEEP 12288:JxJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:JxvoKFLgYHJWwl24C15rDY
TLSH
T11F45234B74EF81F4EF054AF5AAD66047C0349F0A78C8466BE512756F28B3EE8271D19C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 6689fc586e8f3e3855d6d6abce58c1c0950ee1dfad12f8f3aaa2167de91e9006
MD5 854c9a2db9e457a4472b9db9247759f0
SHA1 b79eb8166b286e676bbe7557c63fa5553d15ba62
SHA512 0c030390127f323a2b8f4fd00f7851d55be8c4ac8455e0a0f3196284e0d73a989df7342ebfffccbe56fd18bedc806a69702830a4f910bdfd2e203cbfa981c8db
SSDEEP 12288:HEJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:HEvoKFLgYHJWwl24C15rDY
TLSH
T1CC45234B74EF81F4EF054AF9AAD65047C0349F0AB8C8466BE512756F28B3EE8271D16C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 499f0e11ba56cc40d052fffc5a9b3efe9ba7c3ff2ee0f6c5d7d8e02e721eba7b
MD5 c7fcec79fb88e2b07dc5a812fcdaa6dc
SHA1 70f397c28be13e92c5035a9a387ce19159cad356
SHA512 d40491142f54c3268d7b404a8b6a6dc6f4763350e296b7efa2bd3b83f9c7a65d281fc9b2b5d667d865212277f9455f028c1c1cd478e203b2f896a611d5994c54
SSDEEP 24576:5fwvUk9RX6wkyAI3voKFLgYHJWwl24C15rDY:TMnYI3QKKYpWwl1+NY
TLSH
T15385D029EBDC44E5E177923C99B7460AF2B178591B31C2CF125A53AE0E33ED46E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 f9007ef5df0d81d1701dfe333afacf9e6470bd1e24a8f2ccc2c70ec38465b725
MD5 7cd9ef98e74ae588133d8317c9ff4e3e
SHA1 ef393188ce580786205a43e8f43c4690ab95f55d
SHA512 94aeb2275d7d6c61225604e6ff4c178cdbca432e34d18e7af7c0fa339db5cd3589f206809c98461d4682eea478ea25486a7d63f07220b5a5d5a5b45783455b55
SSDEEP 49152:MYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0YQKKYpWwl1+NY:rySzP0KYpfg
TLSH
T16F066C57A1A801D5C1B9C1B98F1BCC1BFA7134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 fa32bcac6b7ff5ab3147e23643e21bd21d7d205d47e769d670af2183f4cd921a
MD5 3a77bd563bf009349e910c3f6ff83710
SHA1 71886d4e54b181ef2f00a41fd5b17119568f2160
SHA512 ae514a128c55ebace53f86db0b669620a1e573814c079baa12c6a45174bede92793f020c34b955366615a3738e8d38c3866e028a7779945b02e6e4e3fd8957c6
SSDEEP 24576:547Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYKvoKFLgYHJWwl24C15rDY:547JUQjTirIhCnDHUPfF/oQKKYpWwl1T
TLSH
T1B765AE1EA3EC01E5E1BA927885154A1AEA71782E1F31CACF1270937D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 5b8803507c41236fe2bd098d9abd659daab58e67c6696a1c7c1f6bb125940de8
MD5 ccf97a0d291acc733fb15598932f46d5
SHA1 153fccd12370bb54b57b8c8957d807f881aff8cd
SHA512 ee1a577286c07b713784e73de10dc5bc049771cab4ec4bb3084f32d0811f258279d3f249c7bd86e1b7d5bceec8b6c3af28dcc4302296e8f0376c43e2f2d48a0b
SSDEEP 12288:UbsfrJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:LrvoKFLgYHJWwl24C15rDY
TLSH
T14455F10AE29802E8D56E5279CB965541F3337C2597E0C3CB92C0F53E1F76AD46EEA603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 65fb189785732bc456b8ed0e34953ee16cac0cf07ff512cd726360ac931ed862
MD5 5c3efe0c01b765ebecc0e44e92729333
SHA1 d2d0d1d083c7a04b2993ae811f16b447582759e4
SHA512 22b0bcc483e63c8a04797c9eef767caed105db4206606a927773f88e4e3c071f9f9b420c7338ef143e44405e027b7478e52090b0dd6498ba3a2a2880223ba2c5
SSDEEP 12288:t07zJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:GzvoKFLgYHJWwl24C15rDY
TLSH
T14845230772EE85E0FF394AF469AA90128125EF195F8485D7F40176AF2872ED82F3D21D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 15be215a986df3d51e8e7b381e9c7d5312bbc357b5a46c3ec4fd6f3687174353
MD5 db912a92dccfc98a0f183fb196f9e98b
SHA1 bbffa8a483ee69a7ebb75e212776581c55146d1f
SHA512 cb95d8e3b822888e1259a23e58d77df6500e705b0231e618c54f24db1220b7b9ebb81586fbc2a6813b227d9f450abdcae1728bc6c7970e42fcce58148536b945
SSDEEP 24576:Agb6bmBIi49WNNFpg1rSvFv7bYtvoKFLgYHJWwl24C15rDY:Agb4mBIBhGFKQKKYpWwl1+NY
TLSH
T11A65AE1E22EC02F5E1FAD2B8DDAA4417D6B278160731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 2adb8deecbc6167d0be26e002ecb70363e4ba9c53128f6cc6567511e88002dc2
MD5 6657bda5a17e184203173e10abef8903
SHA1 8b97b740f20d3c95b6a01fe1df2935db1da9031b
SHA512 2a24227cded6449a95351a696431c8e9cb316db340bc08f9e8ee28dc58889885565379183c1129ce174f12cf5897ad2896632dbd63365a374dfb0dd1c3f68ccf
SSDEEP 24576:iG88u8FpJqH1bzria7/m6voKFLgYHJWwl24C15rDY:57ZFPqVea7/VQKKYpWwl1+NY
TLSH
T15085016576E501F0D47BD13889864663F6B2B8250364EFDF07A88B561F23BE50B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 ba22e8c10c05d4ec90c439b52f511e96626bb155bdf1ece72fef2abe47b70545
MD5 78e84b3772dc16ec838c999b1e883ab8
SHA1 dc227beb0ad4f807721ff059bcaff95ba2ffa7c2
SHA512 ba67fc29490e43543a3e5e99d60ac209fb26f2c4c09107a46d5bf0ead2292217d6e08b09a76f298e9c236c9eff85a513e9c8f4e4987523f3e318379985efd614
SSDEEP 12288:iHvUrBFrEjwaQOJlARaGdf1IrOrNhyRfLz707YH7lk9wl225CnPkKb5rdRYd:iPUr+NQOvoKFLgYHJWwl24C15rDY
TLSH
T14165F11F32ED18E4E67AE17D89828609E371B8621751D2CF02A1917F1E63EE87D3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 d79fbddf2db91b79af482852403dfc65849c4db2b62fdcc324c9f2e1ee2a96fd
MD5 12bb09e5544bd1390987e99407a1bdbb
SHA1 f6466fb79ec36c602dd769909a0c01abac33ff8d
SHA512 cd69ff65750bfd6d58a5e8ea2026339a06c497a8b5adb01476e41f97225da14bd83647f74493481e0e1d6338de77d0f45998b3c01a76c831e593f19040e9cc69
SSDEEP 49152:LBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj+QKKYpWwl1+NY:UG05lO43b/KYpfg
TLSH
T1F7D5CF6E62EC11F9D1BBC17CDAC6460BEBB23815032556CF02A486A91F27FF4667E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a061c2f8745d4c684fe6eed2a831bca9910abf8bac4bd14be562409ad2563b55
MD5 26e96ea9180b3dffa5e2b78c7e8445d6
SHA1 1ab5c2ecc95efe49d3c2c3b62a9ba618ae148e23
SHA512 131875055f2371b6dbf6326ec6910c083ab985ba99479c089f4b5bf9b90801273e9a5e3204f72c454b84d0da14209955f5e28aacc26fcdd4ded6f39ee662fe73
SSDEEP 24576:1fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnYvoKFLgYHJWwl24C15rDY:Va5POZ3BJt2pasx2+mWQKKYpWwl1+NY
TLSH
T11365BF5EA2FC01D5D579D17DC583861AE5B1382653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b2ed334ebc39f64d3d478afaa72541c7ec8bf5395e300569756e33920dde011b
MD5 43ecb0321b518d8a510611cd75700212
SHA1 445515442c8fe91f50a9a72765da3f717549d77c
SHA512 0bd49dc671376584f0c1b68bb4576cc6cee1277654b53e48cc6c3ed22ac8ad586cafb5c7e38737621e6fc4e8908d5999cbcd3f37768b2881c3ce4247216859ae
SSDEEP 24576:NNcwHdjbyQ4nLC18lb/EOjowL7FkyvoKFLgYHJWwl24C15rDY:NNc/zEOVHF1QKKYpWwl1+NY
TLSH
T11C857B1622E901E4F5BBE1BE89779546FA71786913308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ed10657743fa6035984653e44f611f2efdae3fce78d0532f6653a3f02a53a646
MD5 3e763f68a05eaa9b8430181dab2a62ef
SHA1 63a54becfcef6f660f3cf53bde81b0dc37214dc8
SHA512 9ab2cd3c2c84145a60f9e67ba846e8c7a2a04841113692439773e9d1ecd8c50d1777a9aaa3c014186cf30a37d6875bed0d33b594aac263b2951b12937987b4ff
SSDEEP 24576:TTkNvNnaFeYhJNtmZBmEvoKFLgYHJWwl24C15rDY:TTMwBtOmEQKKYpWwl1+NY
TLSH
T1E055AF2EB6F846E4D1FAC6B5CD238512E6727861173253CB9290C13F0E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 032a2b6de77c3059f36b402d3fd6827b520c33ef0fe897a47c20d18ed5012992
MD5 9dd8750ee47627a1fe566ebf15ce2c34
SHA1 2a9df6e360b7267af8d08aa152de39a1f00649e4
SHA512 0edbdcf604a2922a98785ffebc1ac1df0dd1e8a58f9ebdd83e6d19a7799f17412dc8f6775ec3afc922745af9c893340eb6d027987fb5eaa602ae8ab6eb5ae195
SSDEEP 24576:QD3FHshBIYQgAPvoKFLgYHJWwl24C15rDY:QDVHeBIAAPQKKYpWwl1+NY
TLSH
T13775E17EE69D04E4E57BD1BCDAA38506E37138A9032156DB029091BA1F6BEE43D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/400-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/400-61-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/400-55-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/400-287-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1240-7-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/1240-318-0x0000000140000000-0x00000001404A7000-memory.dmp

Download

memory/1240-6-0x0000000140000000-0x00000001404A7000-memory.dmp

Download

memory/1240-8-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/1240-311-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/1240-0-0x0000000001FA0000-0x0000000002000000-memory.dmp

Download

memory/1240-99-0x0000000140000000-0x00000001404A7000-memory.dmp

Download

memory/1860-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1860-304-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1860-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1860-95-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1860-89-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1936-103-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2028-100-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2028-72-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2028-66-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2532-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2532-307-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2532-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2532-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3420-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3420-21-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3420-22-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3420-105-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3420-14-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4156-125-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4156-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4156-127-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4156-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4156-119-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/4216-50-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/4216-40-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/4216-52-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4216-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4216-46-0x0000000001B60000-0x0000000001BC0000-memory.dmp

Download

memory/4640-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4640-135-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4640-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4640-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5316-78-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5316-84-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5316-101-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5316-302-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5316-373-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5316-375-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6048-108-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/6048-106-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6048-303-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/6048-114-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download