67c55f09ad22726dc7695d6ba3d1e0efcc3e7d8f33657017894db622e943f4d5

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
Size 1.2MB
Sample260731-mtltmsgh79
SHA256 67c55f09ad22726dc7695d6ba3d1e0efcc3e7d8f33657017894db622e943f4d5
MD5 f242d46d55401ac54510863ac30afca9
SHA1 4f7d34169d427bd9c0df4006392a609a6e729d8d
SHA512 39675a5a02c15d6a6fc5eb55b542bc8e4a8474e1872024b34a5b8b5f1e5fedd8fb4b74d8d766c4ae17ac8ab8fbd01182b20ba85288f6cbb80c5fd7ec4fa7ef59
SSDEEP 24576:e7FNF/AjsCoSDTbGKV5sqjnhMgeiCl7G0nehbGZpbD:4NF/M9GKV9Dmg27RnWGj
TLSH
T1C545AE291AA1F08CD63237B01989C53557796D3B3D11810EA6817FA63E73F3A1EEF612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4068	elevation_service.exe
1944	elevation_service.exe
2532	maintenanceservice.exe
1116	OSE.EXE
5432	PerceptionSimulationService.exe
1820	perfhost.exe
2424	ReFsDedupSvc.exe
236	SensorDataService.exe
4656	ssh-agent.exe
5748	AgentService.exe
2684	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ead3e6f9b05c2f27.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cca85213da20dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a89a90d3d920dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000011fdfdd3d920dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000870998d3d920dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a789fd3d920dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000040f7c0d3d920dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eca696d4d920dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000008a3a313da20dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c0db77d4d920dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cedb3313da20dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4068	elevation_service.exe
4068	elevation_service.exe
4068	elevation_service.exe
4068	elevation_service.exe
4068	elevation_service.exe
4068	elevation_service.exe
4068	elevation_service.exe
1944	elevation_service.exe
1944	elevation_service.exe
1944	elevation_service.exe
1944	elevation_service.exe
1944	elevation_service.exe
1944	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3788	2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	5748	AgentService.exe
Token: SeBackupPrivilege	2424	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2424	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2424	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2424	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2424	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2424	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2424	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2424	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2424	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2424	ReFsDedupSvc.exe
Token: 33	2684	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2684	SearchIndexer.exe
Token: SeDebugPrivilege	4068	elevation_service.exe
Token: SeDebugPrivilege	1944	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2968	2684	SearchIndexer.exe	100
PID 2684 wrote to memory of 1524	2684	SearchIndexer.exe	101
PID 2684 wrote to memory of 4516	2684	SearchIndexer.exe	102
PID 2684 wrote to memory of 2836	2684	SearchIndexer.exe	103
PID 2684 wrote to memory of 4564	2684	SearchIndexer.exe	105
PID 2684 wrote to memory of 4756	2684	SearchIndexer.exe	106
PID 2684 wrote to memory of 2384	2684	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_f242d46d55401ac54510863ac30afca9_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3788

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4068

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1944

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2532

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1116

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5432

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1820

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2424

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:236

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4656

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5748

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2968
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1524
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2840 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4516
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2836
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4564
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2840 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4756
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2908 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ab79fc8c9bbb358067feb1dc473aa3f6ed33e9e07fb4bab95f86b998f8496c16
MD5 ba3753bc7647f3045f647ddb0f99a86e
SHA1 47a5074d955ddca5cec1661b546a7f7a5d2bbc67
SHA512 74fd332c1e0ca88e29a1d256a59c7b50496e85cfea9b716f071bda2c647cbc8b6950f152feab2404a7b49aad4360b26775a6cad616919825b333ca7694b18ff3
SSDEEP 49152:xb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnODmg27RnWGj:33q6sjBxD527BWG
TLSH
T1CDD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 261ed2cd37306b3ed9f60d69b946ea1eec50640270d14d31bf8c52c11098acda
MD5 81aa07f8d12ac0b43e7731e923e688c0
SHA1 69738d5b3fa1dfd6bb71fffb90462baaf57f58d1
SHA512 2bd231f653a31b03a5df63e248867975332b4130656f2a250720bb088843106e3e4f7e71294a8e1648ee26b9bfd655844b4b302cc2733bab7af487ffa4683a2e
SSDEEP 24576:ZXYfDtczAxsqjnhMgeiCl7G0nehbGZpbD:ctcQDmg27RnWGj
TLSH
T16D650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 cb1910a204b138138ed3c98830c41fc57e88a4788731b72348c2c4f0c9d68ec6
MD5 710d861d9a941b90e9cbaaab0f350a4b
SHA1 478dd664113fd0f637402e98db374da2896ad58f
SHA512 bde883e221d930cc809d5d8f5297b07eed94404812a490dc8487f9d12dfe4dfe96c7f33c7d6391a3b870e8d1bd3eae29d1d7a8a62f9b4018467dce51562d2364
SSDEEP 24576:s0Le5ji0hmxxrMSsqjnhMgeiCl7G0nehbGZpbD:sPji0AjTDmg27RnWGj
TLSH
T167859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1f6b7d5d5c569a66adac48ac432d3813ad601d24525d6a6767b1bbfa911d94e7
MD5 6c88831113f704acb890ba6c0b85c72b
SHA1 96ba4ba1f6479ea4d6e8d4bb126ddc0ca2322fe8
SHA512 6fa6bdf770a3379061db9da381a55de0bcd86d61f6389640ce7a4cf695b37a5b58f3f13db7ba315c63f730fd8e27f111ffb8f442a2876e218a930a2fd04c8a27
SSDEEP 24576:wa7/ezSC6vUyD/aqgrvWn6q8wyuEsqjnhMgeiCl7G0nehbGZpbD:n/ezSC6vUzPveHjyXDmg27RnWGj
TLSH
T14F755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 cf17b612f1a5960bd6f0a773b604a48cc0f4be9affde29d27be231ca9f2da4d5
MD5 b05a62dbe6d9e77a6b49ba4a10d8ce10
SHA1 55ffa242e0cc73cf035afb388f1cad1f333b3c58
SHA512 df6ce81cf3dafabc49dc8ea2366d08199feb27f481c9519c656c541e1d764d9003091149637e108cb5603f63757b0ba3684366e7c27d47884d71a6508d9e9580
SSDEEP 24576:aVbqPb88hv/l+YdsqjnhMgeiCl7G0nehbGZpbD:aVO88hXl+YDmg27RnWGj
TLSH
T1F4559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 01dec0684613cf3c8978f7d24446b08518f3c61583b1f9c90b641584a2905c1b
MD5 90d80c3beb5ee2e35fdcc6595726eea0
SHA1 de990484a6b107946bd1e99d20aea6b420acbd28
SHA512 91fbc19a1aed135a44474ee68e7c227ed34d3ec09dad02ea7e9ff387696d0a1dd02c1dad8092d40cb2f64bb3d62c216506a19d7f441267d1ee85347016a3cee6
SSDEEP 12288:GLOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GLOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1234523BE824C11CAEA7608B5C3E9F51EAC133E5698201C536AA37DFEE5B5454CB3D423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 86970b5db1030735b19a052e11b08b0362e9db1d08dacc89bd3ae3d7c4ec1c84
MD5 64885612128fa27673d0e18ae217daad
SHA1 3e7474ec137ab4dd606e7e062b59995cd8a85a7a
SHA512 8b7720d15bdfe7116a2ff3cbca696dd9543ebc6528a792d2068a9d4f0b51c5c5dcbde582f1cbef0ccac4c13810804bb7c0a3c4d22bfcb7d2f2db284bdc2a7b40
SSDEEP 12288:NeBNUbTVO86UVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:NJIUVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17E65CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 78b9fdb5f25207a493c133ea3122950d413d842b75adc2d9e1b282b5fee932f9
MD5 0524ffb6da37a5079a558422373f5c52
SHA1 d47f31be72f7ac58c2093126c2dd88cdb5c948d0
SHA512 95f9434b50791161e56595fe633cd53fddb822a4a65f95e2f50a6b20b36bb92f333ba59a99d3e118808a6304b7f354b5bf08c0a91d40d45e71d372c7c9949dc9
SSDEEP 49152:LQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THM:LQvGAdlCEL8c/DRNw5CwD527BWG
TLSH
T1AF266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 1125cb7b9f1f941f399d786a4858dad12e1a93dfde58170ab36e906ec6f33b70
MD5 d7cacaf8c7f7657219de6f2bfab366ea
SHA1 8e7b449e7c38528354ea8eb2763ad354f681736a
SHA512 31dabdc223fff254aa43162e0187922d57043c6f914478ed58d640119aa2f3d603b012a47bd1a0dedbd980d01d06766847bed79da279f651b306dc64a4f85431
SSDEEP 12288:CAwSfxL/2Dc3RDLLmt0LDQewsAj/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:H0ewsAj/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14475E031FA74E036C37B0DB20B76D71A582D7A204F6119C3E3E89D9E99702D1277AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 aff59b4bd150dbab8f8b34f29ebaeb7fc7f86fe1f5171335e92072316a858ae6
MD5 8bddb2b951a00eb68eb5751d64f9b969
SHA1 3f37668eee227fdb14aaeed5152ef691662b6d3b
SHA512 44f90dcdc3010840bf3a48efa23144adbe5de6c465bbc16a63c52d6c95c6c969a3294a8649cfd1dfb942baf4b41d7a611edb42e7d1b0bd7ea9b77b26a4be4be6
SSDEEP 196608:OUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHbVQBWG:OUEtQevvqc2W1cpV2tI32yB
TLSH
T1C4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 0607189b7b7478b08a69e292b58fbbcecda60bb2766e121a54f2a68c73f093c4
MD5 5296b5837ae648b5bff9c705ec40982e
SHA1 58faa76e6aca3b8cf9fea1911c5376fbe6de7b08
SHA512 bdb2f66a719052bb60ae459c23d3af0dca715ade3c2d00260a1a19a92b1aaa3a4fa8796d0b069e7db615f7f792f8d2da05a253e4d958ec252199300e34ba0e9e
SSDEEP 49152:jCbRquA/m2yL5zTfFiV+XenmE3/zDDmg27RnWGj:coquVjnm0D527BWG
TLSH
T151D58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3ffc93ed971b0e2314f409524abb969c84bb8b99ea3b02af20078dc29c477e65
MD5 57297e86e0001be74dfd7ab7ccbbe2b6
SHA1 5c357b595ba254c6b5a12049dece9987b9bcd9dd
SHA512 3f3153465aa6c626e419eada8ff2bf57bb7a3ba1a3cf636f10ec36bf5ba3c3d832fd2ad27495c28bc3a2f521d6f920ca5a828540b6943b848f4ce570b051e19b
SSDEEP 24576:NAhGL3IFoiwtA5l7S53osqjnhMgeiCl7G0nehbGZpbD:NAMUFoiq5EDmg27RnWGj
TLSH
T18A359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 2334f0b521579281e32e6214a8020b3f66d1748757a0a985d38bf8ed73b72a65
MD5 1cd2f464e1f28d29377f88de73dce2b2
SHA1 f5b1572059d8502b23b4fb33d2f955abea63c69e
SHA512 5aa3a9cf4e75953acb5e6cae92fad307564a4594ae477e10b61794aea7c96676ff55b3f220d0790c89ed57fdc827721960dcc3b765dce1517c92d90380e8c2dc
SSDEEP 12288:Dmw5HEjsChNVBFgl0WDm+CkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Cwu4OWzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12F65F14A72A81CF9E9674539C697D136F7B3BC122A20DB1F1760C65B6F33250AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 8b4d856748ad1b2ec737b3f3c1509401d096310432d1ddbc313ecad2cfa0e59a
MD5 129c81a8a799f0510cf444e23d7ac6e1
SHA1 e5881e64545b4918b736bc457abe446c65e38798
SHA512 ebcd6b79581189149be1cb029f3fc663b22c0431028b73fc68a641bf267f509c39eb3c334874c30295c27730f8f9a9f762330e50adf6385fc266d31b95068451
SSDEEP 12288:6eZ1IyPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XZuKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1515512AE239820FAE1674178C6E5D609E7333C62673043CF166655BA6F73AC44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e22ab289145eef920fafb90b0da389ca2a62739bc770a57c884c52b1a42a28f6
MD5 d166e48c0cb5d0fdd83190a394dd0eb5
SHA1 02d46f9886108cb58fbb1be0b11ab800b3cbb84b
SHA512 f3431edf7ad75ff31178bc74af14b82310f69ba45ec27e901a4aa03bcaecaf1c39866baa4cbfc01bcdff5205c54c52661dc168ca8e2a8a0f1c15d0bbf6b08cfe
SSDEEP 98304:CQRQyi36YOcPbLvw2gAf+PN3tD527BWG:ZQyiKa/X+PNdVQBWG
TLSH
T1F7667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d5fb69c5766004c75ff4a72078c5659a0da7ef5f4ed388c7041eb6a984cc2f9d
MD5 522387ff3b5266b346f0974961589128
SHA1 2363ef2edbd22bb8e1d4a86661734fd0b2eaf82c
SHA512 dbde21e7ff10deaf13f31b70ba93a805de30b78a9a8cf418395d8eec27dd3489a0ef1dd45b78dd5e487092d54937f5a949135425b5febb7806c0abffa9fb90ea
SSDEEP 98304:WQRQyi36YOcPbLvw2gAf+PN3tD527BWG:dQyiKa/X+PNdVQBWG
TLSH
T162667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2a19f37c4066e7eaddc09ed1bd18845537857893a0a6564a1111e60bd677a0c4
MD5 9536cc8c912bddfd09a6a79137a7e786
SHA1 413c967fc901b0810800753a1899f7ca9ed4d408
SHA512 312377ab4dfe443735faf8e972075b27fcefadccb492f3696093bc6999dab8f3696816a0e204328cb180ab069f720b06ddcf3f5f2bbed13239ae787f1ec01d51
SSDEEP 24576:vwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL06sqjnhMgeiCl7Ge:368Qg55nhceWu7PNU3/TDmg27RnWGj
TLSH
T13AB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b00535d546300af75fc60319887b358b67a29d91f8250be6c67c7b3065da0f38
MD5 4ae312b5f2ab3825ecce278b417f081b
SHA1 12370b9052605403a3b8ba37312152a5ff8af7ce
SHA512 a0538fa4d17a448b1846c7782f42cedd82ae77191961f31fdc639cd888f18bf97ebcaa8320ac5d871cd0b63ab3be2a65f9c15e81a198dab202332c829c0e7762
SSDEEP 98304:9y5112gYy5azzVvt69nLKnhZiD527BWG:gLIHEWhsVQBWG
TLSH
T159167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3631e2503792acd9a4b5a80846065ad69f7e27c4d3700d8a685ad2e34f5895d8
MD5 a5665b8eebdb09dabdafff33a7563328
SHA1 49c4185c48df12b6f5c64d558af8255d3d1a0705
SHA512 73fbf31b15d3e91875e0c292604558e2333ea26253cbda2ca736cddfba4e162a1bf0b4db0fdbe3730dd7dd9b0684f0205236d0ba51370f91eb9c736107a7e68b
SSDEEP 49152:FB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl1Dmg27RnWGj:ru6Jmdxd2d1D527BWG
TLSH
T148D59D13F1DA01E8D06ED478974A9233F962BC490B34B6EF0A9072562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0533aba1386c8f49d079219356730975939b4191819ab58b2779fc9b0a0ef37f
MD5 c57b5f4ccfbae9f7147575150a6dd5eb
SHA1 cd1e619b187b1e068ef1c2056d0fe20429bdc619
SHA512 6bd889e3614f2354b7c182592e7cc6d6c23caf5e1bdf5ec9e8e16042d68ab608923fc530eaf49046fc0de557c838abe63e37c5274d7bac3e16be152dc5fdeff6
SSDEEP 49152:P1hpsNoJpF1A63U44CwH7R4xpDmg27RnWGj:PmifPWR0D527BWG
TLSH
T18BB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 373a148f748ed499c14c541a5ea9afc1704be932592b6be580145c54b8d6c18d
MD5 1e88177d110bceee40dded8eb8c9a421
SHA1 a0a7f33e8b24fe840fbcc7b25f240fd6938cb967
SHA512 a05356ea1c5189f5916e0414fc78721444fd6a8ef4ce4695c69202558fab9d675540aa9a6585d1e23316cd7bd0868597d669cf9b40ba09d105707a02f649c0f6
SSDEEP 49152:aSuZQIY0Be2KcRVtOnks6NMHqeDmg27RnWGj:E5dKii61eD527BWG
TLSH
T135C5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2459b07c55705b9f3d1db9a54fdef830658fd454a4f8504a699200ef1acb4681
MD5 4b3ba404ec90f9ff873e45eff061cb95
SHA1 54758f50c43fb1c76a8796907e8fc19c0eb68500
SHA512 299b1ccab810cd66ac89c996655ef3d908a93266318be0559d902c423c9289878e2d0936254939cb8cdac915bfaf76fadae94bc7c46125a3b50e2a66ff01ab01
SSDEEP 49152:7htSn8EApI0fig3giDn0AP5wFDmg27RnWGj:aX2imphoD527BWG
TLSH
T1AE95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 76765d598dc37910dd119413affb2e1d485796e6ef9c958338921d8e44fd2f1d
MD5 34c07a0e96fab46dba408e13d771ad4d
SHA1 2b6a4fbd7b485e198a191fba93782bf35cd77f8f
SHA512 46b318c1cecaf184c98f81ef799e91fdeaed43657182a3f430b01fcc7eac7caa009cb7ed306b06018a6fd15019fb2f0a3a6db667c5133ee938d4019bdbc07eef
SSDEEP 12288:7GXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7GsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D44523AE915C01CAE52648F5C3E5F14EEC173E57E92004937A9B78BEFBB14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 ecdfb3788854af067a8d1877f2eeadf28d224664b483f3f43181a093c9d5cfb6
MD5 2712d697148f8d758ee7723b8b9befe8
SHA1 9f276b004c3bb3673fb750072af78fc68ce89c0f
SHA512 dba93a9cd26950d94deca4a2df174c9ae0717a21381274b2166504a28b865d40047125c168b217000be70db6f8a8f676df1b46be1740736c855c8e03a1e59344
SSDEEP 12288:hbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FB4523BE915C01CAE52644B5C3E5F15EEC173E57E92004837AAB78BEFBB14584B3C826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 a530fe3738c77e7780115cd3d88f42331bb5500011276a8e9437f1dac43e0294
MD5 ddc4a721c1badcf2a10886d652076996
SHA1 e32bdcb274d6454381299bba3648ad05c167f1be
SHA512 b7f5caafa49c5e75e477b8f4b2c52e9530f2737e6edb0ee07e88722d47df5b261da8bfdd6a5a8445ca0b3387576ed6e57bf3f028e26382563e8e3795f1d3368e
SSDEEP 12288:QNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1284523BE915C01CAE52648B5C3E6E15EEC173E57E9200483BA9B78BDFBB14584B3C422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 6a0f264bee8ff35608c621d66ab93af1a23505926a391a752f6a66a25bec423d
MD5 84519fdc51d739267b88bc682e37d735
SHA1 5c5d54b28ce926c323782272a65ffcb95be976c6
SHA512 b0289923d548f5496fb9f00e085e81d72dd4cb2dbb4d400e5e51e2769d695ea08e5e0cb85529907f673f17e1dc387cb70b56de8e868e8f95e18048193f391779
SSDEEP 12288:OVIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AF45236E535C01C6E83285B4C2E6E11DF8237D56EB3015DB6B5328BE9FB16944F3CA22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 a10398942431c517f190d54918ebc740fc16576205af221aded3998445439b2f
MD5 671c3897ce4a6ec4dd97864410395545
SHA1 14790a76b2f8597d7300b7011d155f1221ecd7e7
SHA512 79d6f01884f6080ef9c4a2b7ac66721d95d44b7c1969f8ef4bdc3ec8f5f9e48ead7f91382b91a8d99f8b51c3f6a3db3fb9b243cd2da66901f056f06d91bd23c7
SSDEEP 12288:CQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F54523BE915C01CAE52648B5C3E6E15EFC173E57E9200483BA9B78BDFBB14584B3C422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 d308afef50f1a3198d27fd3e79b6447cfc26a4bca011dc2445c48c28adf9e3ed
MD5 6ff09f0bce3f8e582602f7fe8f37d524
SHA1 3a0bc792b1079bb401c376d4591a628b7d8342e9
SHA512 b90d32e1911bb57c4a1b0b2c8e218ab40f304b1e41dbff264bd12c08a5be3a1e68c1425d56cf9530b135f867f4d836f1c1228c76e177da1882ff625146511f91
SSDEEP 12288:XXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XXsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1624523BE915C01CAE52648B5C3E5F15EEC173E57E92004837A9B78BEFBB14584B3C826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 95e48db2755d9c4a75358884f9351d8042f2a99e19ef50b121b3326968e8f024
MD5 0d35b40648da8fcde86c3bdd79fd6e3b
SHA1 c6f8f78650627c47826c5ff34c6ccc5383444818
SHA512 28c0d8707b331b9b2329a53095a71ad1d849316ef08f82bf517919329a94a4e656badb041fe4bb45ada3a60c46c0d1f34c78a50cd6a3bd562c959824d31e77fe
SSDEEP 12288:UjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E94523BE915C01CAE52644B5C3E5F11DAC173E6BE9200483BA6B78BEF7B14584B3C827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 c1c797368b2cd6874e0b6096e5f1ebbf4373aafab2d462590812d952076ceec5
MD5 c8314c5ffcbc7c9862bbd3dda503639a
SHA1 c4b7f14e96b2cf85f0a013d26abe96fa8a40c797
SHA512 247e351efddf385f3749568178a2e4cf3df383e2ec327383b1174c0e3e12623665c2129720b9ab4a47ca20f2f130c187d7a7140d54d09dd540d895a7345040d6
SSDEEP 24576:KZMRzFVSO7sqjnhMgeiCl7G0nehbGZpbD:KZMRzf7Dmg27RnWGj
TLSH
T1936501A9B35418F8EC63813EC965D90AD5B27C1A0B70C61F13A5366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 5e03ffe8155370f52b847fc98e4b87e57d39cdffec9301fc45dc99f4a69050a8
MD5 50c30cd5a9b9d51bd7ec5af84fd51f92
SHA1 6e4325c086c1423b4710335eb6a72815028e9e5a
SHA512 99c614d0ef8d2039ff0e9fcb6c3beae84aabc56c265a3ad8d0f23be7a1c12b691db7404c3e59c2015a875c9d9ba2edc9f7ca98c6a02f745ee6e4970b0ea05ee2
SSDEEP 12288:aaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1154523BE915C01CAE52648B5C3E5F15DEC173E5BE9200483BA9B78BDFBB14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f86eca1232150f22aeb08614be984df8769c106bcd7b2407b36b8c31f5b7af79
MD5 1e089b0c035d5d0b99f700cbcdfbcd06
SHA1 fa839b28c5e65105907344f2089f0c617b6ddc8f
SHA512 748cb8586b3a96306c4853012c821c35d4ab9495f6c5871676f013609e2f7f76788d54c3f0e240158aa11684542afe7803f052a8b27d00590888f3c6f2e0c8df
SSDEEP 12288:0eXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0esqjnhMgeiCl7G0nehbGZpbD
TLSH
T1474523BE915C01CAE52644B5C3E5E15EAC173E5BE9200483BA5B78BEFBB14584B3C827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 9445d6af71b5d36b93994562f31a83a2cbfd81e82e44a7f0e8add54d9ffd5178
MD5 86e885545a45d1739edd5a5c698b5ec1
SHA1 4198f76b6e2b32545d8f1720d14ab86aa8a0bff7
SHA512 a2e81eab69fe06bbdd5a622a00204615e1dcd2ad3885ed31a6ef023784c9a21845508e72434850800fd079a8b5dd126ce1e6cd5e04592c3edc1e119c352e04d6
SSDEEP 12288:GyPz5L8PXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7zyPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10755125B73A530F9D1378178C5A29A06F7327C3247204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 2ef598029b37c91a28051b844867f3513e9a01cfd24796e23f8f6d4d0d189e0b
MD5 d888e23413703a314eee9fb00ce5256c
SHA1 271f457efa5d09ae668c41abcb9b4b9dbf412792
SHA512 464b3c4de0407dcf19fbfd29c7d4b62c84671f9e7ec90696f61b92dcc78d6ae5d858ad6ab61430cd6ed5bf6d0b44b87376e4c7fab7136acf7056d4346ef7e717
SSDEEP 12288:faXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1294523BE915C01CAE52648B5C3E6F15DEC173E5BE9200483BA9B78BDFBB14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 5d04f45b24144b25bdfb95919bd1d6c3d47bd7b2c7a37ce6d1845cfea431aee0
MD5 de217e4c910e8b35f2a2660e579cce80
SHA1 7c41be027c0e914ccbb3eef1326fec3b2cfb8a8e
SHA512 d4b7e5ce382875c550e8f4c8398be011f492277dc21d953b5358b10d3d9a895eadd99fc73bf7f45dd63295ea8c42de576e25d97fe6d25155c3dd13557c241ae6
SSDEEP 12288:DaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1814523BE915C01CAE52648B5C3E5F15DEC173E6BE9200483BA9B78BDFBB14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 6959dd0b46321fc75b51ee877c1a15fb5fd4b295a7b9639d870fcf9d98348881
MD5 2f05bc5f57b7c7f781e4b49797978df5
SHA1 cf466e049a54bbf94804366cdb951d8a3c2738ea
SHA512 43829298f04802315f566e5d090d51f5318999a3c0dc9717f44fe4e479dd4498a694f9dfbc2f872b39270197b1332c1b826f629bcf5da464aecdd2b49e053d5e
SSDEEP 12288:AyPz5L8PXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xzyPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10855125B73A530F9D1378178C5A29A06F7327C324B204A9F17A5167A6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 b97d85c3a5d19ae679e581424c1c882921603439ed2b1b294663e0378f5e95c5
MD5 bfbe24dd1e6d5a100887770ada471a3b
SHA1 f366fa962d08cb64eef4073220fc27da69ab79d4
SHA512 b284576e3ef97b02b4f0cb20f1d796054e66ff573b72691fe030daa75b76b7769d0f0b6142b2ae6be00450884a3b05423eeef94d551bb9c46b0bc65465329fc5
SSDEEP 24576:kTDaLl3z0zD9sqjnhMgeiCl7G0nehbGZpbD:kTuLljgDmg27RnWGj
TLSH
T1EF6501A9B35018F8EC67813EC965D90AD5B27C5A0B70CA5F13A4366B5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 4eb79aa464c16e6bdfa5837dbb18d9849a6ae8199f0aab9a1e832d01e2a3f67f
MD5 983417e6297d0402a23efbad923e48a1
SHA1 4d1f7dfa160808fe4c129ef320b20a92bafc11c1
SHA512 f5f44dcbd0f275616f447b01b447f3bfb45be46fab7e0da7f1b28d11a7fb3c812591f8abd70ec7e9368551abb8354d11ecdd75accc630a11691f511e25d34a53
SSDEEP 24576:u3vd9CHKy7GZJsqjnhMgeiCl7G0nehbGZpbD:wvd9CHKya7Dmg27RnWGj
TLSH
T11275CF90F3E810E8F0B79A35C9769511D9767C5A5B30DE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 d3e68e896c1c8edb70f6456f0ee1e9221037d381d9b4196d5ea3733ea6b266b4
MD5 1da8d73b24020c47d2068fddc6ffc92b
SHA1 8b4ea7d60d0221a9b2e4fb642235821a95237fa2
SHA512 9129a8ff02e811593647a283114da92fe9e9e0710400ac4d500ad1d746fd434e35ca5f8e9ec24a543f1ddc0501a5811098e5a32f80d5c0b150017cbc5785854f
SSDEEP 12288:ctXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ctsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E54523BE915C01CAE52648B5C3E6F15DEC173E57E9200483BA9B78BDFBB14584B3C422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f246ae051ea98207b44f0c1dad7f07bdd69f17294d87944a97763ac5a6528435
MD5 5aba4ddad771ee5e0819ae0c5edb0f81
SHA1 52ab2e68210cad11aebc4d5a0958831091195eae
SHA512 a75ecbc6a2495fe4de6e25a389d5fd59eb8fe8456d3a65d6879a369c1ccade5c413ce182a871c294127792e8e781f5f494f4ef6c7b03559a75b0e6b988b8b36b
SSDEEP 12288:YvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1194523BE915C01DAE52644F5C3EAE11DAC173E57E9200883BB9778BEEBB14584B3C423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 c6de93719cc980ea696760ee4f8a3f2cec5ed0aacea70912f478f87aa2fbad0d
MD5 c55437a7877016af04b3fbbeb981db79
SHA1 8203725330b4d150f1fc4056ec78a3848b39067e
SHA512 f0825b36b43946c2131b1c44b61d0a08e3bae639086a9ebac67dd84d374db8dc00ad32cf7c15648243856c9983999759a0b75d8c9f627c511a9da77f64910f96
SSDEEP 12288:bMXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bMsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1354523BE915C01CAE52648B5C3E5F15DEC173E5BE9200483BA9B78BDFBB18584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 8e7ddf4323483f83ecfe8e319a14702a8567bfcf97de54a89daa8ffb9cc43ffa
MD5 e212dda86e0fc71abb0e3e33e188e72a
SHA1 9a625e0e9d728d3ccb4c7f41fa33e2dc8ff3ccd2
SHA512 8ee88de09138af50156cea0738cfd286bd0341ccc1b97431e1cc552be0aec4469a196e367eaa518380bc811029711ea122e4ad6c4b2e38bef567c12fdf0492bc
SSDEEP 12288:WaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1004523BE915C01CAE52648B5C3E6F15DEC173E5BE9200483BA9B78BDFBB14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 69c9b318cbfdc820b0358aeacc8e6618cedaf51cfc51b46a84b23460854f41ea
MD5 9281fe59442acfccd7377b97d6396a25
SHA1 cf18982e8e32261df5dd40f0b953ccda9878cc4c
SHA512 3b7306f40e1f8d762c27e6c466548006a487d2c7554f425e5be321b028ccf1581bc71b5539ae7c7d732d53ce196dc44e1a20c5cb633770449db4856718f54999
SSDEEP 12288:+tXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+tsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A34523BE915C01CAE52648B5C3E6E15DEC173E57E9200483BA9B78BDFBB14584B3C826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 882190d78a6ccf2e715b48fb1237d464660d7900423ac8e52c81895d30455396
MD5 d292ccd2a640257ea414a5b0840dc8ed
SHA1 622d477296991b0a1d481cf275d86904aeda18e3
SHA512 f106cb92b39e21ccec911425b2c35918e9737d32b29942d3c824f441b956ca40cfbb206a38ab68f825beba3907e6ec0041dfcc933b20546783bd314c7bdca76a
SSDEEP 12288:oCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1044523BE955C01CAE52648F5C3E5E11EEC173E57E9200483BA5778BEFBB14584B3C826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 d093c8129b97ef420696b83c0dba1bc991032161a9278b40ae777d3dcd5320bb
MD5 391910d2c37d0881b5dee2cfea53b753
SHA1 dab394f51ff957d6e18fb8a5dd929608a2f08d91
SHA512 f424fcb36fe73326680eb37253c89d3b5ece845368cc8156db1078418831edf4a6256e3b7f77e0211d171c751465be17b65f045232faa5ba731700bb3c8790cf
SSDEEP 12288:6QXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6QsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1044523BE915C01CAE52648B5C3E6F15EEC173E57E9200483BA9B78BDFBB14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 f524450667cbffc4250fe9afa424e01d718ed3f9d7af38a242b5d75e94e1e542
MD5 45caa54141e10391124469e4426a3976
SHA1 4629a355ba0a9a465002e60db7f8005a1b2f4e7e
SHA512 7283d0ce8ae6080d5f05d450a439ce96ea90ce47446275faefedefa7753691677f14f063060954cbf88a5b6fc711637f2e059e24fd745d0b59bba7f794032897
SSDEEP 12288:RlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C14523BE955C01CAE52648F5C3E5E11EEC173E57E9200483BA5B78BEFBB14584B3C826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 6bad84a0504254642ac0f2a8dc431c0a6833b39ce1ff96b3fc7a5cf2ab94cb8f
MD5 b76e585620b12d9d11689c6e99a21820
SHA1 025d7137ecee6e7cf1a7740a1651d52c4740746c
SHA512 301e05f11ce58e836584ce20ef5ea6cc8939e3c3037fd793f44e436a6e2fb4cee53407f643396105eca4b50741b70aec2980720b762a4d5c3c6bbcc8b9bd48dd
SSDEEP 12288:XQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12A4523BE915C01CAE52648B5C3E6E15DEC173E57E9200483BA9B78BDFBB14584B3C826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 952d0bb5014da38845cc9a813d9e08d9be91b0a61386f932733ba9f391958fe7
MD5 7bbc2deb2b5079f930d665cdf348f832
SHA1 89fa84b3dc560ed16196b2da6222f5f0595df9fc
SHA512 80785bcdc7a4b9c035358e219dc84ffc53bfce6ff55638f19e491330a07563e1dd549548b338efbab3cb9ed39188ace4c6f1a1bfef590a5a01249fc34cd09b33
SSDEEP 24576:IfwvUk9RX6wkyAIusqjnhMgeiCl7G0nehbGZpbD:cMnYICDmg27RnWGj
TLSH
T1D785DF29EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b7f4a3b2b8f1fe163b1ae85f75152240ff36ff21dc4421bb1f79452d1823851b
MD5 3006e955aa45dbf7d21ff0015e9f4768
SHA1 b8a8fc64e1b51c4a1c36a16dad7973bca63db49e
SHA512 4f0e47964010052251fa45963dca94385c9196c6cd47379867c07200342f16abe136edf2273e8f729812861c20a4995dabd00e54bdcfa59e651d1ce3fcbb31dc
SSDEEP 49152:GYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0lDmg27RnWGj:FySzPND527BWG
TLSH
T122066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e18701ba213025e2f6bdc65014a075e947e4f187e628fe575cd82448fd85259e
MD5 c9987a8a47fe705efe4a56d2517cacc9
SHA1 65d59d000f5ad80d613a9a8e09a951c2bfc49375
SHA512 81ab9a1d463a21a35d1322af85ff702d71e8756064c3f143e78228fb396a97aa08f657b156287ff0526078f211dd231c713ee40e6a33036928994130e6899391
SSDEEP 24576:J47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYLsqjnhMgeiCl7G0nehbGZpbD:J47JUQjTirIhCnDHUPfF/1Dmg27RnWGj
TLSH
T15365AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 067b73c7b2625a56e001a80cc5d1f8ff5209a98b50990f7f6be88d987c3b1d30
MD5 967e0b33595a369afeda704403ff4103
SHA1 a5ac5ef20a25c3c1f1384e38ff3c39ed4e5c5a7b
SHA512 188d50a896177b08e6018ca8bd363c0a2752ba896ee85e3f5884224a1b5658e9ca209121fc024cc4877374e59c141df790106cdad09b3b1519f2dd5f67938383
SSDEEP 12288:EbsfKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7KsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15155015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 0cd74564fcc970d3da2bd43b5ae107bad9ca9187171b342088f164e7ad70e4bf
MD5 0af6bb0cae1b685183a9a208ededfa69
SHA1 590f0d0e32e251a910c7fcf9674b63537013c02f
SHA512 f22819d92de8ae7860c77035663a86eb9953a7cff68f7f5e6e0c3cb500f2e74d7149c3f946aeafde486489bd973707b889b656d33ea8c1ce88d11e3dc992c8d1
SSDEEP 6144:kusBC2naxSwiEAi0SoJCvotMx7zBkU3fZkkLhZnSRahsI14I1tSnUKxss1FJIqi2:k7YXAKcU3fFLhUaSUKmqiv49H32aGg
TLSH
T167351750766AD75FC6A940321E33D1CDAB707C41EE05AF0373C98B3F9576668BAB2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 6ba94a510ab6bb332defa1ff326950d07f1385dcc98edf5f9166b6354ddde876
MD5 67fa8f5e0982a9dbe6092c1bc57850db
SHA1 c9eddebab2769a8ed6f6b4e182fd79e3323e4b8d
SHA512 ef5e052bcc4f33f0395cd776f241b28b6b6bc0ce804b24944385e6b6a396d2c64152c83c52cef66d7dd699e8d71c99b5b064daf950695068d41f5b9489faf8d4
SSDEEP 6144:odspqFGhePH8QfdWbWsT04I1TnhZGVEC3tMxVC3tMx9E61A+aSNWaEwX8YkLyo:odspqIUWb2qE0yo
TLSH
T15F65E881513BE2CFC1F76032072A5B4CBBA4EC16B7055F26B3C9453AD82A765A4F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 d5c06782116473cc49a0ccb2281a687ecd3302ebbd2fa03b5e170a76f8cf2f05
MD5 26366d8c04124e4f62b3e13b7a3a97fd
SHA1 7c8ac9e6c75940add738423d5a032e0f35464478
SHA512 efddf6fde2483bb9e2e0ad9de2283f148e06f2d3c4635270032dab08d23579517d95e2328a5d6ba38ac83159f1fc3a168ec626e48b41dc39b28384a5bcb1816d
SSDEEP 12288:s07yXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RysqjnhMgeiCl7G0nehbGZpbD
TLSH
T17845237A834C118AE43605B482EAE12DB81B7E669F1044C3BA5779FDF6B18C48F3C917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9ceca1d4d95730eae4e28e101de8dbadb6a5ed2289ff465c525b2122cfeb10ef
MD5 b90c3d420f5c1189038f3b8672964966
SHA1 df6c632523343b4fa51def717e7b461bc8a95325
SHA512 dae481a97c3568fffb19688cbec430f044835ac4f5ae68e3e41018cd9cc20cbec4aaf7b8b18f32818094f011b331cfa36c3431855c4e2ce45ebecaea69089328
SSDEEP 24576:Ogb6bmBIi49WNNFpg1rSvFv7bYEsqjnhMgeiCl7G0nehbGZpbD:Ogb4mBIBhGF/Dmg27RnWGj
TLSH
T15D659E1E22EC02E5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 d981dd81f99440ad61fc49e492ce5691f4f6645c0a4f0cfefa53d5726be8aa5f
MD5 db1da490c63aa8024e07fcad1e1112fc
SHA1 171b056452ed8fe04e9f39d5a05d84cd210ba8ba
SHA512 7f4a9efdaf4a23345ff772861aaeefa3468187e61ebdb2ceb9a32a3c05fc36b6734d88076629df019f3e3dc1b85142f98f81a96bdc730c04af97ce2249c5e098
SSDEEP 24576:YG88u8FpJqH1bzria7/m7sqjnhMgeiCl7G0nehbGZpbD:b7ZFPqVea7/YDmg27RnWGj
TLSH
T1B185F16577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 4efbcbff760b08dc20db0f4b70726d48e022d038b61aa34d89c7549094b3fe15
MD5 8ac086b672f0229732215798121acf86
SHA1 4922983539bc3e6bf38b087e0252bae767b73552
SHA512 67ca98246cf413bd4e6eb69d4d7ec5d18e2823ddd809b9318e0fd94c169be08de78f82dfef174575a7d45da892c3b8c57b91468cf0cce752725368a331bc95a4
SSDEEP 12288:yHvUrBFrEjwaQnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:yPUr+NQnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D265F12F62AC18E5E676A17DC682C70DF6727862071192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f5aedda802960094017894986b7528e325231c152ce783887663bc828ecc1f33
MD5 2b0041874995ca3485dde2532a1ab20d
SHA1 1999110ec8b0384dc0bc4dfb21040d6577296a8b
SHA512 b88641a69b5187a2341a9877cb09b9318691ba20bd20e310ac70d619cbdea81464afb18fcdc579fb54902ab29e7d13e0767d286dce2e8a935b0dfd6f0ea96880
SSDEEP 49152:/BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjrDmg27RnWGj:wG05lO43baD527BWG
TLSH
T1A1D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d0203f571387b65b8b07e1a55fd1c14f249c2c30a7abb5bef7f0f76651322376
MD5 44859ca795a3ac38f3265ff79ba667ac
SHA1 6a92b4b2c0847e7aa3ac9376a2edb65fb5136427
SHA512 e9a5f085f71abc6a1a7347918a778b752bf134d405634e19434e6b42e8fc2a9e7825365bedacd6367565a05d4f8b4f95201896b0310e469c8d76533ac808c67c
SSDEEP 24576:wfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnRsqjnhMgeiCl7G0nehbGZpbD:Ia5POZ3BJt2pasx2+mTDmg27RnWGj
TLSH
T1BC65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c79544f5ab8aa78e8a1cf95bca98c24839926b6ee6930c5aad8786f54b060820
MD5 24e421e70bf3fb93e0b73b4d80b53222
SHA1 151483c7f7e9851ac8892eb0fba01aeae7d083bc
SHA512 6cf865cf008c0785214e2c2042f06a539ee5473af131934de777a9527b810989818666b1d57a7ecaf760c5cd62899028e4c8a7e4f87f315fbf266da3babca5f6
SSDEEP 24576:oNcwHdjbyQ4nLC18lb/EOjowL7FkTsqjnhMgeiCl7G0nehbGZpbD:oNc/zEOVHF4Dmg27RnWGj
TLSH
T14F857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1c264698b5e6ce20593646f3e4a923d4893518009c289681a9b50c3f32767779
MD5 ad8c8ad1328e343de78d3ddae0600e03
SHA1 e08927b9d0cb7f112a1ec124cb6c7c2459f57f47
SHA512 e409e1b400ae49a90f2f1af2a67c7191488bd954f0212f6c441dfaa33a92c6a2fba977e49a20e4daffb6b053dfbd4cf73ff4e94b5732e60786ecccc438f9dfec
SSDEEP 24576:ZTkNvNnaFeYhJNtmZBmlsqjnhMgeiCl7G0nehbGZpbD:ZTMwBtOmZDmg27RnWGj
TLSH
T1BA55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 02084fda30b87842d913a575c6dcca733f6519af515ee535e7fa208e2fec09aa
MD5 5e6641b7be1d6811f161c2218cca7477
SHA1 9927a540d7fe51b3cc47df1b1225de82d5ee82aa
SHA512 94afae415b705d7abb99f8a298a8ab0bf402c5e8629473e18e8613aad87f8f5a5ef49963672d1228eceedc552f4c3499af766b61747deb12081c5a3271aa5ef5
SSDEEP 24576:bD3FHshBIYQgAmsqjnhMgeiCl7G0nehbGZpbD:bDVHeBIAAqDmg27RnWGj
TLSH
T12575E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/236-358-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/236-360-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/236-101-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/236-95-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1116-226-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1116-52-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1116-60-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1116-51-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1820-78-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1820-308-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1944-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1944-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1944-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1944-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1944-106-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2424-89-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2424-375-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2424-344-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2424-83-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2424-82-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2424-374-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2532-58-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/2532-46-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/2532-45-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2532-62-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2532-39-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/2684-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2684-362-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2684-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2684-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3788-77-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3788-1-0x0000000002830000-0x0000000002890000-memory.dmp

Download

memory/3788-292-0x0000000002830000-0x0000000002890000-memory.dmp

Download

memory/3788-290-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3788-0-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3788-9-0x0000000002830000-0x0000000002890000-memory.dmp

Download

memory/4068-81-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4068-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4068-23-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4068-14-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4656-114-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4656-117-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4656-108-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4656-361-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5432-273-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5432-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5432-73-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5432-68-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5748-120-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5748-131-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5748-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5748-126-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5748-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download