8f02192ff4f1b57abea9baa7adb051f3628339cea31c698efaafe7dee02e5232

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 23:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
Size 2.7MB
Sample260804-28zflsab83
SHA256 8f02192ff4f1b57abea9baa7adb051f3628339cea31c698efaafe7dee02e5232
MD5 263dcf9955489855588e7d9c101f4ba2
SHA1 f473bf03f50262dfe469a9ab7c65c2dbe218abcc
SHA512 16e51dc0ec0bbc717e650a6e54af1bbab8027e4aec795f8c8782126c9bd2add5225050a9ae5f9611e39de6c89d2a1a32f6e9f31ec5c95db867a3e75a9fa02a60
SSDEEP 49152:eI5RlZPdWwBESyi8PYbgVla0cyehpQwAC/mKx8TFciNnw8jfqXvYMLprznyDSga9:ee7ZjTWeqMXEfqXvYCp3nyG
TLSH
T199D5AF12A6FC40F4D0A5E03AD75ACB5BE6B2B404173247CB0265CA2E1F37DD25FB9A25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1232	elevation_service.exe
2372	elevation_service.exe
2252	maintenanceservice.exe
5684	OSE.EXE
4592	PerceptionSimulationService.exe
2880	perfhost.exe
6084	ReFsDedupSvc.exe
5532	SensorDataService.exe
1856	ssh-agent.exe
4192	AgentService.exe
5096	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\56204abb05c2f27.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\java.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000724334656724dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb1e53a36724dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d8733a36724dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c197b606724dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ef7ac616724dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000022dfef5f6724dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f9114d606724dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1232	elevation_service.exe
1232	elevation_service.exe
1232	elevation_service.exe
1232	elevation_service.exe
1232	elevation_service.exe
1232	elevation_service.exe
1232	elevation_service.exe
2372	elevation_service.exe
2372	elevation_service.exe
2372	elevation_service.exe
2372	elevation_service.exe
2372	elevation_service.exe
2372	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4228	2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	4192	AgentService.exe
Token: SeBackupPrivilege	6084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6084	ReFsDedupSvc.exe
Token: 33	5096	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5096	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5096	SearchIndexer.exe
Token: SeDebugPrivilege	1232	elevation_service.exe
Token: SeDebugPrivilege	2372	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 5068	5096	SearchIndexer.exe	100
PID 5096 wrote to memory of 2924	5096	SearchIndexer.exe	101
PID 5096 wrote to memory of 3592	5096	SearchIndexer.exe	102
PID 5096 wrote to memory of 5016	5096	SearchIndexer.exe	103
PID 5096 wrote to memory of 3952	5096	SearchIndexer.exe	105
PID 5096 wrote to memory of 2160	5096	SearchIndexer.exe	106
PID 5096 wrote to memory of 5976	5096	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_263dcf9955489855588e7d9c101f4ba2_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4228

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1232

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2372

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2252

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5684

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4592

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2880

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6084

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5532

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1856

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4192

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5068
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2924
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3592
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2984 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5016
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3952
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2160
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2984 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 09309e4df2e98654a388d40701df22aa1c00b9503815fbb251d392f3afde2099
MD5 969880eff387b3552baf6cc777e04ff8
SHA1 d4db1a1fcd5cde07b3bacba10de073b85a707bef
SHA512 8233d7acd99e397d63393ed4c36ea1b05000f10c291244286a5878f193c0f60e80c42a0bf091acbdee9bd814850b16409a739080a4f706327d49ec93245c670a
SSDEEP 49152:eb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn2XvYMLprznyDSga9:g3q6HjBzXvYCp3nyG
TLSH
T1A0D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 e90fa79a7ed88ea96645da83e98b7f1274fbec11ce92f0407cf706bb2e69c1fc
MD5 ebe5384aeb038cb09efaa36df227c7c8
SHA1 9ef6c3b00d270585d2ee9fb9df278912362d2375
SHA512 d0092fc1062f32586fe5718909a35e0f1613af691abcdf183d43a95a2b38c203dbbc8d416be662c1d8450e66fcaa60bf19d03fdbbbf92ed4b6e19ac9c2f4fdb7
SSDEEP 24576:qXYfDtczAfX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:xtcMXvYMLprznyDSga9
TLSH
T18F850128B3A408F9ED27813DCCA28405EA3378954760E79B03E0996A5F777D86D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 52f43c89fa0616f303a1c1e39c5673d7ba213b5affe0861846fac828e8a4c9dc
MD5 5449088a2ae4f8e98987401d10a6dcc3
SHA1 af139e43512e9187f38e30944c60be28b939953a
SHA512 a3d74795be1a7a4cc4203134ef68fe655d4fadadc4799f1edcaf89b1e876dd71ae65389e6edf899b34f151e1051d49197a6628018232abb8fc6b319f1c39f1ce
SSDEEP 24576:A0Le5ji0hmxirMuX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:APji0AcRXvYMLprznyDSga9
TLSH
T1AA959E15F6788335D073C0B9C5D2A68EED72308657308ACB4286D77C7E6BAE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d98edef7d228e0b725415c7fb3479343043aa6633f23562a788d76f1ad403d75
MD5 58ee1a8a1f999bc125693dc454ece8c0
SHA1 f133098861c40af83f88a3592b4a19c835b96131
SHA512 0caa4f0db679b3f47b8254ec40f421761fe6195a78282f2109d0433ca2717fabba664dd6f837167673ae156e574bfd474ed12de9064fcdc123314b7f046ea566
SSDEEP 24576:ia7/ezSC6vUyD/aqgrvWE6q8wyucX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:F/ezSC6vUzPvxHjy9XvYMLprznyDSga9
TLSH
T129756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2c0bb0114a46eb64116931edfb0d2fa38a808703bfa8b895782e9ad2bf1acbc0
MD5 5b7bd34a67c80a5dd73b9811551a6290
SHA1 0cc6e35b8c1cf7215ffd826eab65bb74ec4ae989
SHA512 6e436eff12577092caaaafd08107ea1fd238002c02bfe33eb46d69204617d0c2497d444c11d57c3da9d640e5c68e1023fba78ac4e0fe0a844a7b115b9ca9abec
SSDEEP 24576:mVbqPb88hv/l+6DX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:mVO88hXl+6XvYMLprznyDSga9
TLSH
T1F0559E65F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 d36ce8b0af5d7d53e3ed3a4dbecb1d7386695e3c1246f7c6cc7b1d77e2de4fa4
MD5 116363905b46307f30e705a5a1ddcf71
SHA1 4f3f2eaba3ca51add2998014cf7d79138d1ba884
SHA512 65dede916ff53d8da1ae50ba0e2a5d69445149254cfed136c8c6f0aadfe0d62d9b18890cd4660a32afb9e021c7d720dca32232b4158532dae1d07d3dbf64b6f3
SSDEEP 24576:zRCX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:0XvYMLprznyDSga9
TLSH
T16C652314A63C69F7FF2B54364CF5480DA86F2EC44409AE2743D2BADE94FED38E446126
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 d7482a6d4f02181c053b719f00bd678da295a48f66acd25acbe1cf4d3cb444b8
MD5 92d407d158d90e894e6fc8c236fe95d1
SHA1 8b2fe7f8266da0c17e5fba863589d9520cfae80c
SHA512 ddf427d0f13e337e92bdd17340b4bb1a6299a15dc7bd809d866614bf1b37cc49a56a7673ab2996734efc7f942805a53cd2c4cb4fa0d92ca48c50f7a0314177ca
SSDEEP 24576:IJIU7X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:IJIU7XvYMLprznyDSga9
TLSH
T1FE85CF3BEE38FCE2C67E4C795A918600E77278704B12A3CBD165830EDE275E45D7A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 9915ac89da27684d9f82a9b3a3c6f92476055db141b1ad625009e93ba302dd2a
MD5 946d4792337dec78d8f7892f8ad9d500
SHA1 caeb7ae2f07eea1d1031bea37f4eaa8a632206f8
SHA512 9efe0f6d50f0ea39b9a6ab29647211dcf970c2209f80222ffdf1cb0b26b748e6b5fb8c1afd2c71d540011444d9496714519d6b5cb10cb56a2e5f898605bc240a
SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THV:eQvGAdlCEL8c/yRNw5CsXvYCp3nyG
TLSH
T132267C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 ee9420e1141912c5d5252f3e4d2ee8d7f2c1819a90665f62c01fc38b8c66c9a0
MD5 0e946c0fe20f32b5b2fcb67d5bf338d2
SHA1 ec53d4d622e1a1b1b2dced280af06cdee5214d9d
SHA512 863abd5ff827dccee69df5d49be2b6aa29a0484b3eef9ef3de99a0e9bfea12284a7a70d6917ef897d843184363d2681ddaa53fd3b7d58debb022f912cd10b183
SSDEEP 24576:wdewsAjhX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:AljhXvYMLprznyDSga9
TLSH
T15485E030FE74E436C77B0CB21B76C70A582D7A604B511AC3E3E88E9E59746D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9c464d2d1d6060caf1acf5ba876c5193a6febd1c8b98af4ae6a0a48d70fcd5f2
MD5 a8051b9f833e28f0b0bb2ccc2eb7e1e5
SHA1 411e077e4e80e7eb008d020b6dec2ae8855798fc
SHA512 b91c0c3416806c17667a2bbfa26429eaa8c63fa08c0ded534cb50aaa24fe611c6a32ce0442a0f289b3e6746805a3120e28732deff554e15a930b0f33a33bfdbf
SSDEEP 196608:dUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHpTp3n:dUEtQevvqc2W1cpV2EI32xh
TLSH
T1E7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7d5b4d5fbd4bb8180e7f92dd13423bd2a69c152daf75550e83ad3f737c857fb7
MD5 73ca66056fa01916bfb3e42fbfc2ff7f
SHA1 5ec057b027a641d6abe43039d16c27b2a9fbd703
SHA512 e896968c5abb66178ace1f28ac6069c96f92fbb3054f7474f7044f497e73878a6053ba164ce0b3158d3c2d8227caf10a8dc4b76b09a2ea51889ec0c3477a01d7
SSDEEP 49152:BCbRquA/m2yL5zLfFiV+XenmE3/zBXvYMLprznyDSga9:uoq2VjnmoXvYCp3nyG
TLSH
T10DD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 74ea16054064e68720328d82794cc3a61f700b87d8076b9b1f2e895b925c2abe
MD5 11f6071c348df7d76ca4b56b3c75fa78
SHA1 89d75721b88a949ea22d4c4a2855c44c109d7330
SHA512 b8f6db25658e4540d92f4faf5f85ad0c46faa4dbf69bd951e34a53f6d5b3aeb85b58f56e7894dc359033ac5383dd2433e38f8dbe1f2626d78ff6dd1770d27449
SSDEEP 24576:XAhGLJIFoiwtA5l7S53IX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:XAMyFoiq54XvYMLprznyDSga9
TLSH
T1DF359D80E7F955D4F5B3AA7899B68170EA76BCAA5E31C20F2260D11F0E37E509D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 ae010a60fef854a1e5f090e5bf40f80351b2b9f417f0bb244baf1bea365b690e
MD5 801e0c70fb5efdea63533bf330ae58d6
SHA1 6a3464ee92e7d5a0bb1b3bf9eb99ffae20c2eb00
SHA512 2de582dd918bce46b3d4d0838ec912cef2d5e50bc58a87e53bf849ab39ca6cc0d0d77c17beb0acb39f9afc2f14c2f31d583da9de97de614ee9f4398e0771468b
SSDEEP 24576:LwuoOWdX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:LwDO0XvYMLprznyDSga9
TLSH
T1C285F10572A81CF9EA6781398997C536F7F3B8412A25DB1F03A0C65B6F37321AD1E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 8ad2732e8046b242cc958f91b741c8def77c220c5c8485e5ecd6962846633ec8
MD5 0cc622d0a179c12ece8f77b32cc37e4f
SHA1 936c0e32af9b33b58df761edd43c1e91abbebe27
SHA512 f156085d97057eda030c626fc14c1956a2cb4972b939584cd6ee64adc67aed273a99a30062237b4aa4443c52bf1abf7209d3a636ec6dae03873961b904eda9d2
SSDEEP 24576:yZuGX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:mXvYMLprznyDSga9
TLSH
T10875121932B830FAE667513DCCF14509E7763492173683CF126146AA5FBBEE56C3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 138a26d638467bbb85566f6faf09df96eaaa99dc32dd82d3ead5d1808076ff92
MD5 0848e3dda879002d2d3cf34451a7d860
SHA1 f9a0f5a485ef15887822fe2d14064ced54b84953
SHA512 d43d9533e3a32071b63ef88643f4d00626d0946fbf1e8ad82e8245cf2a71b3415c289ecace5b375f7fe9317bf8926fdba203364b3fc57d0639c3b33fc6bdda70
SSDEEP 98304:mQRQyi36YOcPQLvw2gAf+PN33XvYCp3nyG:NQyiKayX+PNnTp3n
TLSH
T1B2667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c87fb7908f3f3bcdfdf4488bdb6d9317e90badca9f751735a83ece07fbfd29e2
MD5 672f68487a8e1bcb2b2f154b03038a22
SHA1 bbb40f9de4f1e242383287f8e7b36d6d60a1036f
SHA512 748aa5e715a069b64a08666bc97138c471e22a9e2b6766d4fbb0f10443622b881e9f72d6368295bfa3786bc7455a06e97463ba16dbdf9ecb61ec3f0d8aea95e8
SSDEEP 98304:/QRQyi36YOcPQLvw2gAf+PN33XvYCp3nyG:OQyiKayX+PNnTp3n
TLSH
T168667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 08594bb23debbc74f72db07f43f6c116d086c54c0b029ba73a0d9cb3bddc6a60
MD5 50ed3a6db703e117ec29f4e3c8810f42
SHA1 b2cc73bb904d336769e684029da04d354b2d2159
SHA512 317f06387050fcdb5bf08f63fe851070abd056cf7d4b5dc470ddde9d15e45dc551c2cfb4dcd3491d6e64ea86dc87a7e18a82e666e06f00262caf842d93801942
SSDEEP 49152:868Qg55nhheWu7PNU3/RXvYMLprznyDSga9:2thWRc/RXvYCp3nyG
TLSH
T10CB55A33B2F600A9C44DE1769F46872196D27C758FE0E3DB8551720A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 53f35f22adedfb7c291513d5e7a8fa1874997a5f23b5f2f4c0ff4a3c301f80d1
MD5 05cad098a47a274c9ac563dada7c9ffc
SHA1 4276861e086c13ca01ddbb626f814446f12da43a
SHA512 050e4f5ec649525f12b8feb7f7f427830948bd53ae7fa224f766a4522bbf5a20db7931c16c4a3e38602f6427db83b567e34f822cec5f28d30f280db0c38b478f
SSDEEP 98304:by5112gYy5azzVvL69nLKnhZCXvYCp3nyG:2LIHmWhwTp3n
TLSH
T16A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 213c9c44cd6335cacf4448cbce478f02213ac25547a7a8d3e713a3356db91df4
MD5 21c451ac32162e8e3be959f5598abfca
SHA1 13c21fbee40dabeb75203b96051e0923718db759
SHA512 9630ccd249f9006e4f0914f4d703a2d49b3e8fde69f8f8cde1717809c1e399f7b2bd73c52ab4c9592f1987ba61aaae3f14c904bd98a072c8b46f08fb7855c6f7
SSDEEP 49152:CB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glPXvYMLprznyDSga9:wu6JmVxd2dPXvYCp3nyG
TLSH
T12ED59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b6d4fca2f934021f8bc84d07c12b6a65ce9ce856d6c7838d134b1ace2c366066
MD5 75f646386ca427bcbd996295062d09dd
SHA1 6badbee4f7abf83c724e92499e740b8e67513760
SHA512 9cd96317460486e73b0b80816776f8da59fe9ef434621493fee1eec346b01695b582fdd2c748ab8651e1960f3b3971900d4ab0a76359a9061537b47f4e5c4f69
SSDEEP 49152:/1hpsNoJpF1A6UU44CwH7R4xbXvYMLprznyDSga9:/mifPbRoXvYCp3nyG
TLSH
T19CB5BE13F29901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BFE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3e73b9dd06e8fa7e93dec4670cedf998e2035f7f9a0c5749da887f38c00ece70
MD5 ecba7654e6b4ed75a8468e80f9b64b3f
SHA1 cef8a40e94d34d4709ebd82d27e66828621869b0
SHA512 b0d8674508ebdee56af51e265e3f24ae6164780d0cf42a5f263ee92976959d604d362235f803952f0bca8962fd290e59b8e3daa310d82bbec79298d83b005695
SSDEEP 49152:RSuZQIY0Be2KRRVtOnks6NMHqGXvYMLprznyDSga9:/5dKTi61GXvYCp3nyG
TLSH
T124C5BF03F2E941E8E0BED6748B659236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 770b5cd6daa6a475ad6173f27a679150363d62601796ba4d149a2c6ac25edcd0
MD5 a469b69d2f560207cfa80389b3693914
SHA1 26a35d56c587d7459ad665fa2c6a521657874db1
SHA512 3f2a994ce5acd58fe031a34e1a0f95cdd34edb473f09c23986e418bea17a3b8faf6737e496d943218e06fd19b5aa46d9dfff78704f348e028a2cd9d6ec6a96f7
SSDEEP 49152:+htSn8EApI0figngiDn0AP5wfXvYMLprznyDSga9:fX2iyphUXvYCp3nyG
TLSH
T17295BE13F2D900E8D05ED178C7568632E962BC150B39AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 a9283e28dba49bfaa138cbf30859d147ca770bab3e6895d5a234cfdb4e3b658b
MD5 7312103e4201525ca95ce545899d1505
SHA1 aab6c5dc360e74708299642e2349ccddbed59b2b
SHA512 c14a181a56a61f59a9ab9d27c8a4796b85787f0c8d82bc2be95e9b838c5e36777382b7ac975cf7646cebc0dc0fb311fcc09570ff66da1039de394c795d5cac57
SSDEEP 12288:H6LD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:H6X7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1BF652314B43D69FBFF1650368CF0440DE86F3ACA840A5A2B6393A59FA5FFE797446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 f3b179d0ae52c554efe2e227dabc3dae9170cff9968a762ed78c8f9ea267ce5b
MD5 31f5e0a9ad0ce089ffcfaaf9f38de354
SHA1 37bd9da3e8669a54dd137687819bbb50e38ccdaf
SHA512 7774f44cc05cc27337bae03e12703f3a063993d82ebc0f3e38e531d3d4977db5e45f256d995c95cbbbefd2448b6044701d3ab2ed0fbd058cd8c17f3ffb03b3f8
SSDEEP 12288:nlLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:nlX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1BE652314B43D69FBFF1650368CF0440DE86F3ACA440A9A2B6393A59FA5FFE797446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 2762da4d349315c07b797be5b8e56f7126fc5b35e3c94149e8bac0d2749f394c
MD5 4ac24d6ee06f8047774592f8f59c12cb
SHA1 e5b4c50556f2e5712a6c9f5bc62441a199b83eaa
SHA512 26f0e89d94faeaada5d2d2c44888269fbaab10e3ab781071c087225d81f9e166020fcd1fc2ee52eec36a68ba15081f0b842a94828996ad5da59cc7fbeeab08cc
SSDEEP 12288:czLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:czX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T110652314B43D69FBFF1650368CF1040DE86F3ACA440A9A2B53D3A59EA5FFE797446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 4d9269f60e7d27bd36fd472d91cad35c5d16ea86c4224dff0c60e870be2e8577
MD5 ede9323987a560936ace6f188b1060c9
SHA1 c00c28831392a45f4a1ad39555b1fc4ae490a3a6
SHA512 3992d47ac7245e41cc22104d8b292e3124c615259c701c91bdddc4e1a20f1a2dcc712c4f3cc84cf4d9742acc141462cb2a8e7cd95b08e8f4a3ac7647b7a88b71
SSDEEP 12288:dVoLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:gX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T116652304763D15F7FE26903ACCF14409E4BE7DC586269BAF4382099E5EFEBB86805224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 e5d9b6cf8ec0cb931956562408374ca6ff07b5e206340696efd7211deb53d698
MD5 b52cd4e46ae5a1f90f7cef77d8c44288
SHA1 55a5ebf64b87a22f68c7f867751072e15369ee88
SHA512 fc17eb6ac6f55d65a2f15a3f47b160d2032fad1ddd816979ce2a5bea718e96548a2aaa5ed372b7ed137e15549a427d23a788a43f16a24f1fb8c92e91682d379b
SSDEEP 12288:0QLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:0QX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1E6652314B43D69FBFF1A50368CF1040DE86F3ACA440A9A2B53D3959EA5FFE797446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 f38cf3552a7d2356b78275093ddf29f8a56bd7331bd9185b618e28906cdfa4ce
MD5 c8d7146f7f969142252b66513083a2ed
SHA1 a69dff93998e6476b94620dac72a0d07c9105657
SHA512 65e644a640e19d3f022d98980be19feb80d6e4e5f7ceba6defeeb184c1eed6aed7d3529626095045f8e95d2786e03cf0712e454d99af105136361b27c5236678
SSDEEP 12288:l5LD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:l5X7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T145652314B43D69FBFF1A50368CF0440DE86F3ACA440A9A2B6393959FA5FFE797446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 0f43132339d372710014faf71ffdc376e2a561e2e9604569c7a658f5e1a49d9e
MD5 e752fac54a94c88e81a0f73359887955
SHA1 903d50a43009c803d5805ca175b9c0922dcab6c3
SHA512 4e6ce8e4dd1d9471caecec46c12f6d8da2403b32df74bbd0499fc9b796adf95c54ab2645a56199d662a9648e8cef692e83755fe6d2510178806c989f23bc7d4a
SSDEEP 12288:YNLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:YNX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T175652314B53D5AFBFF1650368CF4440CE86F3ACA840A9A2B6393959FA5FFE397446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 1d5ce29c720ff42b056552706b4f8c1851fed39a16fae89c58eb5ebfc6f7cc3f
MD5 266b5133c4493aec884c26371c2f0946
SHA1 c36cee29e6f8161c8a6b71b1de85245e6aaf7419
SHA512 792c59cfb1f10a04eeec2e3996ea53a5cc4224b4d8ae8656508e15dfbd727bbe3dd0b69f366595f4c5b6ad56082ece90df84bc2c7bf245392da629e595b1016a
SSDEEP 24576:GZMSzFVSOFX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:GZMSzfJXvYMLprznyDSga9
TLSH
T11B850154B3601CF9ED27813ECC65890AD6B27C5A0B60CA1F03E4366B5F777A11C2EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 44f3a4afaafb7003a4a99bd12dcd02858996fc88f5262fc4b657f0d9f0119826
MD5 6682df506d06dcd8f17135815f060ed1
SHA1 055cd3d37596f9c2ca3afceafbe8d4a0d36e7e4d
SHA512 2dd84b710c339e1651d3c44f49661131bd6e9076bc0cc93f9a4c302f6b4b328c1277ff010a9b4bd2f42c9858b250126a160594a57ce4910e92a803687b1f0645
SSDEEP 12288:DWLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:DWX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T117652314B43D69FBFF1650368CF0440CE86F3ACA440AAA6B53D3999EA5FFE397446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 77beeb0076d26767bd6ac98cd555203ef7b97509cadc1b9d3cafeaa92b2d9969
MD5 3f130ca6a5e5494d1beb25e6d7ec91ba
SHA1 35b0e5109cc5eacdc680844120f093787d4c091c
SHA512 f694c1aeb4cf9aa60905212211dfdd135be61f9522911bd5cc7cbeefaae7462c23dd5feb2a2660beeac7e1f6f4d3d0335b32f72f857165edae08e35e35c18bc9
SSDEEP 12288:eSLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:eSX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T197652314B43D59FBFF1650368CF0440DE86F3ACA840AAA6B5393999FA5FFE397446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 b07b94eb67e7b4daa9b7cacb8100bfcfbaf858ba1053d8f8c25a4afaca7866d6
MD5 64a6bc00b69990e7823a03234c5992df
SHA1 f17d38698ec12dad9cd8d51bd9aa4fcaca512367
SHA512 f62299bea242e0a34c659810ba814a881107cee989276c68c515a70303ef74829582c687ff4e7b736a638a0ea116acb831786132a44f929c94aa01cdb8f267b7
SSDEEP 24576:czyxX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:cUXvYMLprznyDSga9
TLSH
T178750207737530F9E6379139CCA10905F776787647249BAF13A047BB2E7B6A0AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 4dfae3ca35906d4833a7df6f485d301345f3199587c0dec8181963867d67f574
MD5 cfa891cbc33faacda99b057dc48d3025
SHA1 ba92624430c2a63aaaa6f4bba7e4c674695fa54f
SHA512 2c0cb7e415e60a7a3c58aca8a3b915b962eead4b07492a0efffa1d3107f92a3d0a6d9cf2e7af1ae01b57ceddcc3a11003c6c03ef183f6d0f970f55bd1b7e639c
SSDEEP 12288:OWLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:OWX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T168652314B43D69FBFF1650368CF0440CE86F3ACA440AAA6B53D3999EA5FFE797446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 1a54d20c638c8a4daf435783b002b87c344be46cf51d082c8781838652faa3e8
MD5 931c754847ca31ab85fe00fc5ed8eacd
SHA1 c8ff078ebe0694e5ad20e3a4f0f7326e7dd0010e
SHA512 369a17fafc8d27fa8469a7f03a2dd9f8b3ab6b45fdb1bf6d8c593b2294ceafb585e48e99f701801121875570d29c83ad9800a14cda0bdb3ea05207abead1a709
SSDEEP 12288:EWLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:EWX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1E6652314B43D69FBFF1650368CF0440DE86F3ACA440AAA6B53D3999EA5FFE397446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 557fbc66d46b9556a57e738cc96549c14cde6f9f308b43af793883efcc15733d
MD5 87259f46811dbd4ff56ff7653ba85ba0
SHA1 11eb7c2739458a3f0ad5a0801227cde6044910e9
SHA512 5c7fc0e83a050dea2315fbedde3551d7878ccf369666970a4ae28365efb44e7a0a1d91c6ffea31ef9c99af99539b66c1e9b70133623b844a7456a3546e818158
SSDEEP 24576:DzyxX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:DUXvYMLprznyDSga9
TLSH
T17D750207737530F9E6379139CCA10905F776787607249BAF13A047BB2E7B6A0AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 87c15b62095ff4a820f02b42e7a7726863eca23db77d3826a522eb327183267c
MD5 1f93dbb8c702391dc533d2fcd2eedac7
SHA1 a69421bfe09feb7f70da2480ae999c03eeeb9df1
SHA512 98ade7b82859dc389a69f63165e7f1e09a9b859a27db40cdb176e7e179a4dfb8ed6c7fd4b71878c87b360003c419bc3823f17010a5493d2bb20562bfb6fbd28a
SSDEEP 24576:rTHaLl3z0zDjX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:rT6LljcXvYMLprznyDSga9
TLSH
T1CF850164B3601CF9ED27813ECC65890AD6B27C5A0760CA1F03E4366B5F777A11C2EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 6eafcab91e63e9c72a2e3c996c798c3418ce561a3e7e1b2341102a21f6e8c0df
MD5 e438974f511bcec75f281d03199c5898
SHA1 45b3449a31c7551d2fdfb0539b158c1d54a1b433
SHA512 c4248acaefc6b514ff6cde052bc94cac378ac405f36ad2ddbce3e0804dd7a94dec26a4c3d0a0659450157c57c8a7fb22f796897f99ee3023207f113f9a37b520
SSDEEP 24576:W37d9CHKy7GZXX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:47d9CHKyaJXvYMLprznyDSga9
TLSH
T16095CF90F3E814E9F1779A358C764501DAB67C9A1B21DE8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 37ab8b3acdfdaddcff1c36bb4e6a72c82134090e7feaae5d98d7fc6cc00e50f5
MD5 757b786a7449bc1efd45bc4b61a8a8b7
SHA1 79c1cf54ad53c1a37c3f9abf8bc9ca45b496e2f7
SHA512 570fd72c3374e9531bee220d7c731df11a4d5dde93d81c020e27377cb0f798da1f7e8aaceec1c5e38a0b483ce9031f01cbc4645e9a9b55376e6bea4be2a0d175
SSDEEP 12288:8TLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:8TX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T143652314B43D69FBFF1A50368CF0440DE86F3ACA440AAA2B53D3959EA5FFE797446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 f3a023c9b79d69c0def85b47ff30d0d28991691bbe6a30acc28e2e3f1918689c
MD5 fc2eb0ca95e8eeac29b7e9d72fabbf17
SHA1 a1f8a5f56300346f9d251f477c4c068ef9d97b60
SHA512 efe6837778ebd87c221421a4e25e44825f6bc5fb7a20704866b54ca0ebc3c6a8780c9505405f598d9b6088f80db68210d80ccbc517c51271a1e031c0eaa2eedd
SSDEEP 12288:3RLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:3RX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T145652314B43D69FBFF1A50768CF4440CE85F3ACA840A9A2B63D3999FA5FFD396446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 aeedd7673fd3bd3628c2dd95e6358839909b0ea71ba9f92d2cb70aa7dd9b8c25
MD5 9c45becf24a315748840c58ba8c0bf85
SHA1 5eca19d9688601f981b0918cb0e4dda2cef4074a
SHA512 025c2dd956a6bd0adf76a80ccd46c34f852ffc7a943b474f67c9c182e1f121380916f83a05eabd5f9b14d8f3a665eeb49673f8c78d13d25737de29a2a606de59
SSDEEP 12288:AkLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:AkX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T176652314B43D69FBFF1650368CF0440CE86F3ACA440AAA2B53D3959EA5FFE797446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 ae02e5479e21ce08b669288bcf053faf5c94fcb4079515c0e2abfb54ffe8af03
MD5 cf696d6eadb16402d36cd474b0c3d2b3
SHA1 72d11ca1f1a5f0eb312a36dcff9e2fd2ecb9d195
SHA512 f986b59f96acb2ff50c7280fcc64dce0f2efcbd0104796ae86837da25528b33a01ae3cdfc3c46162c249b34a399f79afcb8ea465f18b890e6b97d8155491d343
SSDEEP 12288:jWLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:jWX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T165652314B43D69FBFF1650368CF0480CE86F3ACA440AAA6B53D3959EA5FFE7D6446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 fe3d3d8b7ac36310a7874979aab5c495137e18fe0012d03be1579430b622ecc2
MD5 537bead6a7cb37909a637386f0369c6a
SHA1 534543659ad6d15aba2e14974f0e9acf0894af90
SHA512 4764b81a35f67c5783753736959993817946e951b6a9adfabb784291cccbf36d9877ea1b3f375164f8697fa81da7173c48f5ba609b4a6252068ab05fdde36223
SSDEEP 12288:KTLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:KTX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T157652314B43D69FBFF1650368CF0440DE86F3ACA440A9A2B53D3A59EA5FFE797446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 342a45f3448e6e7acc9049903656289fe5f0d0bc092e8ae122d038f0c9ddf791
MD5 9000e1d0953a8dd2437d91258e99d761
SHA1 32e5a63f9cfb7f3f7224711c49378ceea6205a03
SHA512 607330e48f5552fc02fcdb1d70004edbea840a54f76bf97f16cbfe52ad33e12b9dfa8a05e3fff4570fab1459b4f0ae06f76d088d5758d557f990fb9fbb829954
SSDEEP 12288:veLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:veX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T16A652314B43D59FBFF1650768CF0440DE86F3ACA440AAA2B5393959FA6FFE397446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 1ca0cb9bdd64e061d5f5a1ea1957d6d6cf0bec6787f62a311cb8a20c3f3eb730
MD5 c4483940390e19865ad5237318849de5
SHA1 cb04c317857ab5a3cefce3d8c8bdcca5ecec16eb
SHA512 c81a0b316fc08d5ccafbad46d975b51cd251340c60eb63b9e39a7d3375ec2b49336645607ca3231e0e83eb83bc3a2c50ea7b3c6e0fa9cea9a15e373711888c1e
SSDEEP 12288:nQLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:nQX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T157652314B43D69FBFF1650368CF1040DE86F3ACA440AAA2B53D3959EA5FFE797446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 02bc3cab8c4a472923ffc568a5a9fbd56f573cf3b6f8ecab8b841fdc1a06e44d
MD5 adc83f98c68341e8f74a5a94a2632341
SHA1 73e840b386613db3a3e63c38b52e0693aeb84b75
SHA512 e6a4271afdc0f6fa708285f5e79c6afeb416f5e2ab65704a62112df25750088130172bc23f3ff72387d9ce8fe0f7f9e8341b45fea115002898ab27036c30b61b
SSDEEP 12288:TLLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:TLX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1F3652314B43D59FBFF1650768CF0440DE86F3ACA440AAA2B5393999FA6FFE397446024
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 fb8008a7c65d59b75e8430447779c4827900f6ad5259785fc47b0cc6ad720607
MD5 7fc47bfb98c9843ae8cffb9e120b3383
SHA1 4d7e031a03dd39707aea86f16b1e72d1271c2306
SHA512 573f7ed7339c4ad1ee58b15b7dafc65649df3c2b3e9967eb7031a313012efe877805e227dbfa62260007f52164b3db836edc5bdc16fa007997148626e862dd4b
SSDEEP 24576:Zfwvok9RX6wkyAIiX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:/MnYIiXvYMLprznyDSga9
TLSH
T1AE95CF29EBDC44E5E177913C89B3460AF6B178591B31C6CF029A53AE0E37ED46D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8be3d209b4606baf472cdab7ad863ceb8d44550ab057bbce430ce27e42f3177f
MD5 d5a7497f8d72456a856f023400dd70aa
SHA1 f5c435284dc703cd6fb1251718e02f7c11408000
SHA512 31a892e7f436e23aa9cb514510a2ff781636ea2192b59a3ca302c4436aa31dc81e07b499120cce6d6409698214e375330f2c024770d6385699d5f83bfbe78442
SSDEEP 49152:LYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0/XvYMLprznyDK:vySzPXXvYCp3nyG
TLSH
T19D067C56A16801D5C1B9C1B98F1BCC1BFAB134490335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7cab55980bf6ba4b319933cb10e41f4624816515a203495c5512e2dcb6464ca5
MD5 509c74af4e30251655a76a3f9f431e07
SHA1 9d585575e8f65a392920445e33e0887718e392f0
SHA512 0be783c67b3c83ae42bfbaa687ffef79aa63089a78a662d3a52904613709331e577dae412d9c9c8dde83f164bf04cacea38180d28f80d3b3db8029290e082a36
SSDEEP 24576:A47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYVX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:A47JUQj1irIhCnDHUPfF/PXvYMLprznj
TLSH
T1EB65AE1DA3EC01E5E1BA923885154A1AEA71742E1F31CACF12B0837D6F67ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 149f4b95380bea7567242344139f6a1cae52d5b9a0c7fc8a2fac7d51d7c0b19c
MD5 d4a3f9bcb7195998fe668718cea40ddd
SHA1 df2d58f0cb976e7e4d24f3e16c6035177edab8ce
SHA512 6f0d938ac37df71c5123e00d592d64d1e779d4a99773d38e9e813be3d8bde00cab03addb0911fe324f00d2580307b2d341c3c14dc9ef805f81a23db6704f7d53
SSDEEP 12288:aNsfGLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj:TGX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T1C575F109E26812E9D52E6139CB914A05F7373C6583E1D3CB53D0F57E1FBAAA46CDA203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 f670b0ef4395546e6c06f0872f5c60b07d7a9a7364582efac88452ecd385bcb8
MD5 522ccdfcedefb81673f429019fd5ac36
SHA1 f903ff1e984c49bb26c33130206b79b6e0858682
SHA512 77582d484f773b5722f0c199c516a5e9b39e8969c2801012de15eacf899cc8b522c537b6249230082df67c58a3508cc1b88b818070c3e0810c6cb5bd5795e173
SSDEEP 12288:3aZwCCKdU3fu4wgHJsJV4HWhTQGPaF+rB33c8:34jCyUPu0sJV4WsiakrBc
TLSH
T118452840766AD75FC6A940321E32D1CCAB707D11EE05AF0373C98B3F9576669BAF2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 3420fbf1e51c0fe7abd318a38e40be957bf7d674b7c52ad77d539b56b8e2dc67
MD5 96077bcc50f586e7797e9aa941c313cb
SHA1 d19c0533ac55963de258c167737d81d1b7cd6be2
SHA512 c39ebae5229bd18cedf0852a427a4e71037d37452b11abdcd733f3d9cb210d94d6bd0860485a28ee526042fc67163cc0ccfe679c2ed3fd9bd859f2e132c5e8db
SSDEEP 6144:6/5NVwNhN8xKDbvPEhXDYPwJaAEnj7MnkC3tMxnFimu12VkTC3tMxHcV0ZeQZGzU:6/5NViT8Gv8hXDYPwJaZLVkhGZUxj
TLSH
T10265EA815537A2CFD1FB603203265F8CB764EC16B7456F26B3C8443AD82AB65B4B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 db670e5ad8567a51da0df7d69d6400f88ce7b69915919b91eb8a9c065127b60c
MD5 0016ef302b1849047bd0648f0cab117d
SHA1 a72a2b42c5a72c7f88ce29c21506d89036ccad29
SHA512 47152c0660661492b47e71cc8986c007897375e30c4b5e5dac240829e03ae2f0eaed88c46f31c35bdb4afc0d34a7a9c74ad4f4f13070fa3adb342c644a95533d
SSDEEP 12288:VF7OLD7bHVKMQ4O4vSjNsyMLpRNO2FLzTGT/SRel8lkEoiqAj+:DOX7bHsMQ4/O6yMLprOInyT/Swl8Mi9
TLSH
T141652310B63C6DBBFF3A50354CF5840CA81F3AD44B0495E7A38266DEA4FEEE8AC52115
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d4659e8162f9fa86b53929d72603effb98b309aaa74d0b797eb441e969258c81
MD5 288ba589619d9dbf78481548298f2218
SHA1 843e3a36e3f39f45295d4ceb8d3d54d080228fd9
SHA512 42770a973d9a5c16c8e367f35c1227e57e57d1cd9fe79e993aa54b3921dcf23dc49329951b4f5c9bf33d812dc8576822f9a360c942bccdb1557e824535a8786b
SSDEEP 24576:Agb6bmBIi49WNNFpg1rSvFv7bYcX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:Agb4mBIBhGFVXvYMLprznyDSga9
TLSH
T16165AE1E22EC02F5E1FAD2B8CDA64417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 7dd6d91a85994fb93a07e4e7fe0f6d1c8dc048de3af3e6d5fcb2e6430e1afc31
MD5 22f950825bce851cd2b6eb2f6890a993
SHA1 a7f97e769deef6f92929ddfe91e447d1f42d6beb
SHA512 1c03d9ef348c999cc1bb88d2e46b1f3bfc59b6fd1fd72397073ffecfd6b7b71280fccdd04d9ea15e915204424d617144f312bdb8382121ee3676052565ceb687
SSDEEP 24576:TG88u8FpJqH1bzria7/mFX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:i7ZFPqVea7/EXvYMLprznyDSga9
TLSH
T1C295012576E501F1E47BD13889824667F6B2B4250324EFDF07A88B561F23AE50B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 54ec15b74bf9fdceae4f5ff7c6df4b82fe2a9b481fae51aa2f79582524380c02
MD5 42058c88cbcb74eec8b6265fa8311905
SHA1 529393e8e9a8783ec415b625b16195d6baeddc25
SHA512 5e618166dab440360ffb61cc3db8e66d4f322fee5d05d163e16a4d36e93c27096ee8cba2195eee8dfdf39cc138198aab574517472a7de6370851be30931ad7d4
SSDEEP 24576:4PUr+NQJX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:4JQJXvYMLprznyDSga9
TLSH
T1AB85E12E62AC18E5F676A17D8982860DF77274620712D2DF02E1817E5F67EE8BC3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8932f8922b1a8e1f95ad86b253e7e4a77d3a70a6ff4c3510e5c8881dfec235eb
MD5 cf6f1907a3faa9f3d5f75fd60c49f23a
SHA1 e636eca90b3f8815450a2f0c0b5e02b19626c77e
SHA512 4ec33486afabe3a77b415b434306ec4f39bdb52cfaa3175d4c261d51d59c2eb1bfbd8cdea41fef198e562ec2ab08db6b4c040f302e58dbe312f314f97b7b74cf
SSDEEP 49152:TBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj5XvYMLprznyDSga9:8G05lO43bKXvYCp3nyG
TLSH
T13BD5CF6A62FC11F9D1BBD17CC9C64A0BEBB23415032556CF02A486A91F27FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b81de8985e20bde766e233fc583955437ff2d73d5ea7bf625aa4f2a93e393816
MD5 06cb81ba7400a325f22911612150284a
SHA1 39f374a08967e3d7a4d646cda4b504567b1af3ca
SHA512 557be5379f0e6820e3a02013c2085a5bcc67c43a311ba8ac8e9b0ae93b31432ac0232a2b64166c1ea736efc6f2ba27f395c3ca51a27b6177af1a7c980ce310d4
SSDEEP 24576:xfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn/X7bHsMQ4/O6yMLprOInyT/Swl8B:Ra5POZ3+Jt2pasx2+mRXvYMLprznyDSz
TLSH
T1AF65AF5EA6FC01D5E579D17DC583460AF5B1346253329BCB022182BE3F2BEE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 43d78ba58ba9a81e22ef123a3d394a7c7a4cc6f886d4566e198615af4bc7c9be
MD5 c98272e13698ffa8909e685a89b76b3d
SHA1 19e347eb7c4e6d7b73f3d76ce06da34797b7f715
SHA512 c08184c9ad8455dd254617a269f39d220ed4629782d4865a5d1d1461cb36eff129d28fb38a96b617993ecdf2a946aba47c03581a21708631fe4625000cc89453
SSDEEP 24576:KNcwHdjbyQ4nLC18lb/EOjowL7Fk9X7bHsMQ4/O6yMLprOInyT/Swl8Mi9:KNc/zEOVHFkXvYMLprznyDSga9
TLSH
T13A857B1622E901E4F5BBE1BE89779546FA71786513308ACF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 10f360c616ff012420c7b57a7039ed69a44474e68e070821863b923de029147f
MD5 6bc6490ae6bbd85251bbc3296d71ddfa
SHA1 308437fbad24becce5d81ad4d5dc93c684210922
SHA512 63b28cd8846dff05db4a96bbcf28800e4bd4563c9831594778bd083eb4a52de9aba86bc909181db1e881b40d7804bede5c273e95247c6a3750e4196f20916a67
SSDEEP 24576:T8kNvNnaFeYhJNtmZBmLX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:T8MwBtOmLXvYMLprznyDSga9
TLSH
T15555AF2EB6B846E4E1BEC675CD238512EA727461073293CB5390C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 827edc26472df2efff9141bb2a39c7cbba2420ed815f99ac4b5ae93680601fcf
MD5 774e0cca8b268cb060f4b718a53f52b5
SHA1 cde345d69e1f64befeb09c1ab9c8461c4ea8f038
SHA512 0ff7cefee07c070ac86d6e3000d855a907c5e0e7f715f87424f4afc955c6528aec39f883f91008ecbf245a66f9d5f95c4a9aedea527d735d47f63ad56ea5eb99
SSDEEP 24576:/D3FHshBIYQgAaX7bHsMQ4/O6yMLprOInyT/Swl8Mi9:/DVHeBIAAaXvYMLprznyDSga9
TLSH
T1AA95E13DE66C04E5E57BD17CCAA38906E67138A9032256DB02D0C1BA5F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1232-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1232-21-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/1232-15-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/1232-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1856-119-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/1856-311-0x0000000140000000-0x00000001402FD000-memory.dmp

Download

memory/1856-113-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/1856-122-0x0000000140000000-0x00000001402FD000-memory.dmp

Download

memory/2252-51-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/2252-39-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/2252-45-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/2252-38-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/2252-49-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/2372-140-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2372-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2372-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2372-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2880-82-0x0000000000AA0000-0x0000000000B07000-memory.dmp

Download

memory/2880-305-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/2880-76-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/2880-77-0x0000000000AA0000-0x0000000000B07000-memory.dmp

Download

memory/4192-131-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4192-136-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4192-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4192-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4192-125-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4228-0-0x0000000140000000-0x00000001402B5000-memory.dmp

Download

memory/4228-1-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/4228-9-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/4228-325-0x0000000140000000-0x00000001402B5000-memory.dmp

Download

memory/4228-86-0x0000000140000000-0x00000001402B5000-memory.dmp

Download

memory/4228-316-0x0000000002160000-0x00000000021C0000-memory.dmp

Download

memory/4592-66-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4592-72-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4592-64-0x0000000140000000-0x000000014028A000-memory.dmp

Download

memory/4592-283-0x0000000140000000-0x000000014028A000-memory.dmp

Download

memory/5016-378-0x0000018708C20000-0x0000018708EAB000-memory.dmp

Download

memory/5096-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5096-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5096-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5096-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5532-106-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5532-312-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5532-100-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5532-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5532-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5532-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5684-235-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/5684-53-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5684-59-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5684-61-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/6084-87-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/6084-94-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/6084-381-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/6084-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6084-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6084-93-0x0000000140000000-0x00000001402C9000-memory.dmp

Download