2147f4b3c8900add7faaa7facbebeb44333a0063f3c9b6e5f4776c964d03f4be

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 14:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
Size 3.3MB
Sample260809-rcplesygqc
SHA256 2147f4b3c8900add7faaa7facbebeb44333a0063f3c9b6e5f4776c964d03f4be
MD5 8fc6b44ad61302998121bb1cc5cf60e2
SHA1 95ceb19c1a622519363c30db840ac1cb71e7fce3
SHA512 a2daf6d06ca5fb090407804007ec219b25f72473b7aa4e9e8e84d8502fa1299d2119cc667ab8d9a8a7e24f2702f64f85ff356d6da189c531490492cde5338eb6
SSDEEP 98304:uxps2TacJFqJVOFDiZmLlGgIZ+SuIsrGGMnI:9LcJFFDiZmcgIZHF
TLSH
T1FCF5015BAB6801F5D837D235C5A29A46E3F13C2E2A70838B02E1762F7F379914D79721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4740	elevation_service.exe
4808	elevation_service.exe
3576	maintenanceservice.exe
3952	OSE.EXE
5288	PerceptionSimulationService.exe
4112	perfhost.exe
4428	ReFsDedupSvc.exe
4680	SensorDataService.exe
5716	ssh-agent.exe
1680	AgentService.exe
3956	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\69f3b1ff957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaws.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb711cd80728dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cfbeafd90728dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cbffcbd70728dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000410f08d70728dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001678ddd80728dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c01f321a0828dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
4740	elevation_service.exe
4740	elevation_service.exe
4740	elevation_service.exe
4740	elevation_service.exe
4740	elevation_service.exe
4740	elevation_service.exe
4740	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
Token: SeDebugPrivilege	5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
Token: SeBackupPrivilege	4428	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4428	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4428	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4428	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4428	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4428	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4428	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4428	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4428	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4428	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1680	AgentService.exe
Token: 33	3956	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3956	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3956	SearchIndexer.exe
Token: SeDebugPrivilege	5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
Token: SeDebugPrivilege	5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
Token: SeDebugPrivilege	5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
Token: SeDebugPrivilege	5068	2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
Token: SeDebugPrivilege	4740	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 4920	3956	SearchIndexer.exe	99
PID 3956 wrote to memory of 1052	3956	SearchIndexer.exe	100
PID 3956 wrote to memory of 4348	3956	SearchIndexer.exe	101
PID 3956 wrote to memory of 5040	3956	SearchIndexer.exe	102
PID 3956 wrote to memory of 5232	3956	SearchIndexer.exe	105
PID 3956 wrote to memory of 1704	3956	SearchIndexer.exe	106
PID 3956 wrote to memory of 4996	3956	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_8fc6b44ad61302998121bb1cc5cf60e2_icedid_njrat_remcos_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5068

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4740

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4808

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3576

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3952

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5288

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4112

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4428

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4680

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5716

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1680

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4920
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1052
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4348
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5040
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5232
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1704
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 be17f015a38652589b919c1e839d2afd2d254fd9f28b8a412dc89d3bda7ed7fc
MD5 9b757025b3a0b0f04c63a64876c248e1
SHA1 f7b95e0a34e1b9d80f89b83becb801b53ba2aa1c
SHA512 ba1e5d492753b6416c6cb03fa8b799ffe6537811c8a416f8f576708d5449978dc81e2338ec6de08fcb78ad148708f5f4f7d4a17f920030c9d711c9adc6699ce3
SSDEEP 49152:kb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnCt7Uv+MnIIC:e3q6HjBRGGMnI
TLSH
T111D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 ade3def09c9d8f8e56d493243a564c7c74f80e71d50f3dd3a3e32bf8f010e7b4
MD5 25a3b657b3234b3da35082d6222bb991
SHA1 f0bf8e282779d017e3631c04e4dbccc442453958
SHA512 1c1621d77c899a926d65dd9f0c5c41245f6c4bc122a7676d9570c25cf01fe71b227bf9e8cc56ead6e8f099a40f31ce9fd177c1bf6343affca001ba39a8de03e4
SSDEEP 24576:6XYfDtczAY+Ys7Uv+ahF8MlMPuuICiJS:htcgt7Uv+MnIIC
TLSH
T1EC650128A7D408F9EDA7823CC8B28116E6737C914760E7CB03E495765F236D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 487b1b25da50ca3c2fb16b578b93c48263805c2fc29188af7e07b3921146b572
MD5 ff263ae2db09f3403e9f2d1a698e68f0
SHA1 b351ad0b6983ef278ea57325a1ac8c4fda50cfb2
SHA512 7486f7cd743c3f7691502e21a313df3089ce38dacfa507f1e1307ee71641f4855b99c05ba6be8023db3b9e7e04b3e92119366e4cdde83243a7c506ae9f3bf17c
SSDEEP 24576:/0Le5ji0hmxirMz+Ys7Uv+ahF8MlMPuuICiJS:/Pji0Acft7Uv+MnIIC
TLSH
T16485AE16F6748335D073C0B9C5D2A69EE97230825B308ACB4286D77C7F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 83a5e39613f616204236a62c958f00a47764fedbbccc0bbb20e3a23629d2001a
MD5 8b98ecb02d80dcc279da507ff8225b7a
SHA1 c2dac225162ae182fcb37276ebd63b387cafa66e
SHA512 ffc246ed2f7dcf0fd3a02d099f6d2981aa166708b6aebf422f6a6dd3c3ed1e0360c082327532e561a51de1b10bc410c4767d480096d9abd7fc95bc0db53f68ec
SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWE6q8wyu9+Ys7Uv+ahF8MlMPuuICiJS:D/ezSC6vUzPvxHjyjt7Uv+MnIIC
TLSH
T155755D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 48665c1964ceb965f371e8ffad5999d944e5d3d93b8e503d295ea8eaec974d58
MD5 09a3058679a09541ed677c146066f7a3
SHA1 44f2543e586f54d38c959338655fbb5b9b502428
SHA512 225d96ab17b71dd86a90d4f2dd553b54ce5c74470ac5d76165aa6af507b10181b45b1220cd11e7c422990d935558068567cf08cfd1f1576c81437322df826cb5
SSDEEP 24576:VVbqPb88hv/l+60+Ys7Uv+ahF8MlMPuuICiJS:VVO88hXl+ut7Uv+MnIIC
TLSH
T1C755AE66F6748331D073C0BAC4D39A9AEE7234425B318ACB0246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e1c4530767d37e70a2116ffff01e7a0881f19a4ee0944072ec6cb972fb6e5a35
MD5 f64eefc781c4d40938b05e61be681988
SHA1 b1d97aa739931a660b0bc1187d73c1e92ef92697
SHA512 c9298a222ee9734ae4506a5b2dfa135e7cad2e3936ce7e6e4da7424918485be8e160b2025d8865e6c66a73e0b44f643e3ff88dc96ace6d38370a823808940ad9
SSDEEP 12288:/RUep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:/Rv+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1BD452361CB0414EAEBE96230B5B9819B71F2BDB0596316C348E07163EE7D893DC67383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 7c6923f5aa85b2b66207778242137dd09ce76ba15686b4216ce955ef30f8a837
MD5 83fe30706b531ea336babe29634328b3
SHA1 5cdc88d7927b76ea73ea02003574ca03c69645f8
SHA512 913cf993155ca4dbc89f9e0371278bab626888ed2128f701989212a274335aa5a54fdfdf0d26911323034524248125fe0ebfd7f7375681fd0cddd1a51abf21bd
SSDEEP 12288:seBNUbTVO86Uxep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:sJIU8+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T14265CF3BEE28FCE2C27E9D7856918240E7B278704F6293CBD164820EDE275E15D7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b47dc45edc2e27358bf9e32a610c4df2ab16ab7fcf0eb1417767d6e1d2e93e57
MD5 52b9188759f74d9f96ed50a71b4b18a8
SHA1 f7443a34563b79674c07ab07019ce1860ba8e629
SHA512 575e7b0f2d6e2e990c901a65efd70ac57329783ceab1cec5ae65413db1bbdd24259a8314e9978a49611c702e59dc3e844a03ac25afba01eb14ca70ea96605ef8
SSDEEP 49152:lQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH/:lQvGAdlCEL8c/yRNw5CAGGMnI
TLSH
T1C4266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 f86bb5cb91c86c44f03ce74833b7248b828dc8fd08ec9fcf11233d9cacbff5b2
MD5 e51020fec7623be7e1138b819711d06c
SHA1 558670889e2d6efd7ba375707be1ff01ce2fbfbe
SHA512 bcd66bf87a136da04d6db9b49345476394b2159371e19f393413272e85d98c3c8486f93fbda9186c40cc9b7c8e4ac6f6780e2c5288f3ab9e16230581699490ad
SSDEEP 12288:+AwSfxL/2Dc34DLLmt0LDQewsAj3ep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:jdewsAjm+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T19975E031FE74E036C7BB0DB21B36C716147D79604B621AC3E3E88A9E99341D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 dba57ef8dae069f9e0bb0d0b58a2a9d1dd06f95703df9eac0aed90f52cc2c18b
MD5 72b6a193dc5c5672596632ed47f7e1d1
SHA1 a84eaf02a6babe961216539a1fd08ea6a50b004f
SHA512 62eed0da2414ca914b588a68ae9e339528e40d9efa9e1d605f0cc10011b4ab07c9bc384efa777322e6853259b4c3c847c049e97ef370640199bb8bd924cbeb8b
SSDEEP 196608:fUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHW:fUEtQevvqc2W1cpV2EI32W
TLSH
T1B0474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c5383144c693d94bf965326c667031ce9ec44b0a84bd5990d285b164b06e872d
MD5 5b7b9787662e562ce2747960a055f22f
SHA1 905ae48a2c113073922e5d537b8ea94210b5dfc6
SHA512 a49b8924327cdd9694559beb56903aaf6b91a05a7ef689b502c2318ba7a509501db3cc60f678fda29a12ee3a85ade2b7add67bb9e23abfc619c61f73126084ae
SSDEEP 49152:7CbRquA/m2yL5zifFiV+XenmE3/zPt7Uv+MnIIC:koqHVjnmUGGMnI
TLSH
T16DD58E0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 53a0a100c4ce21e31c3fbdd9d58015fe83f3498a2c3996f9b5bf108aa7edf446
MD5 d71259ce5f2684f7b2ee96f0037f044b
SHA1 e7fa535e8159f231466dcf8ee387caf85369bd2f
SHA512 970e160ef0ef505552a7fa609219229c10225ffccb45a41f8fc5aa6fba390b98e546ff9705915a1ecb7dffa336bf504d09f68f7bb7d0fdec3245457802de721f
SSDEEP 24576:cAhGLJIFoiwtA5l7S53R+Ys7Uv+ahF8MlMPuuICiJS:cAMyFoiq5kt7Uv+MnIIC
TLSH
T1BB359D81E7F955D4F5F3AA7899B68171EAB6BCA65E31C20F2160D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 504bbc305e7b679c84ee55fca7c04e1b2bfb3fa0d9518a73187c075adbcafe8d
MD5 6f5e8781b0d221d3baafe32c0a5949e1
SHA1 8fa8e45d2ffd971e769886e29d21be30a8cb4766
SHA512 64d56b63b226fe6e25d21f6d05295f08a9a21cd49236c9a3857c962f1526fcd032420db816346cc31ac961a8e5280ab2e38f8dcfd361714f10ab089c90e51d7d
SSDEEP 12288:smw5HEjsChNVBFgl0WDm+Cuep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:JwuoOW6+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T18365F14577A40CF9EAA79238C597C136F7F2BC112A21D71F07A0C6576F37261AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9a4360d004bb55b12394fa7b14f31865c5c076c1ed955cbe01f35dc63a9a1ef2
MD5 7073433c5560901f0a0014c58b74bf33
SHA1 0ab69b3ec21587f77cfc7aecde5c6f25ca4983b3
SHA512 a719a8da7a31f51155d19e1027978e4c1cee94e9cd5e20b52b8c23748e9b918db9346b02d3d37233cfe2bd84be2b4057dc0aa8f4c69e947c3f299544d9c12957
SSDEEP 12288:KBZ1Iynep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:EZub+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T134551255639420F9E6E75238D9F5824AE3B278A2673343CF15A04266AF37CC25D3A723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 4c7f1053b9336ae96e2790c2d635df381f852b62644de8e64dc125a525ddff0c
MD5 3111d477177de834b11351e1e976ae0b
SHA1 d8a3c8ac01dca7359f3a7980ffff0583344745f3
SHA512 64bdae214c8d5e8d5f0c6568dbed87067b1349909b5f4d677675300b03b577765130004e93a94e3094b5eadbd9aaa9d7ce51c9c59377a2ff4bc917d2d3e1b6aa
SSDEEP 49152:fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UT:uQRQyi36YOcPQLvw2gAf+PN3tGGMnI
TLSH
T1EB667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 08d3a3210e9b7ee304ecb24881a62d1c66a4ad94a262f03d4268fa2caadb822e
MD5 adcc55e13c775a79b28bc8de38a3bc71
SHA1 4743c356c76c79f59dba7db3feed9e038ac80869
SHA512 9c9651cd56e5ab8bb05fdbcb05553c776716eaf771ef11604dd1ecdd061b9c1b1932052a3741da31dab6bad16595f6f74240408ba2e427f1c00875fe36a4911a
SSDEEP 49152:ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UT:tQRQyi36YOcPQLvw2gAf+PN3tGGMnI
TLSH
T1EB667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d9f9f49d7ad0e7802f78f33e265bdd48ce21b528e7b1f970b82819a916f327b0
MD5 db98201d60be565caed7e95767a0af08
SHA1 68c512e0182bbccb7ce3afb831ccb8d82ae94a01
SHA512 7e2a6003f102880f2f85d5da30a0c488b5c4962963946b34d59a2f5a74ecfb039e63cc456a76630edb43a3d893dd6b0b8b46048b687a6dc6d2c9da4028e70ce3
SSDEEP 24576:IwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0L+Ys7Uv+ahF8MlW:O68Qg55nhheWu7PNU3/ft7Uv+MnIIC
TLSH
T168B55A33B2F200A9C44DE1769F4A872196E17C718FE1E3DB855172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d9a2bcc7d0db7f1b696a85853b49a641d284dd59dbb9328943b512fd74626568
MD5 b42b6833d77fb571d32184ab1d705b88
SHA1 f71d9a19a4af25d77334f09438295a7dc104cb8d
SHA512 90954810e785667efd49e170dfd46885226c2da8ead3f38b0ed2953328488738dc0dfbb7949e7cf88fa463b98143e926867c38bce422b093c17505c2a492d8ca
SSDEEP 49152:a3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99R:Ly5112gYy5azzVvL69nLKnhZ2GGMnI
TLSH
T157167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3ba415b1c4df09e54e68c87e54e5cbc566cfaa9c7ee23ac6e05793dd88119403
MD5 d56e096f48a719c0755e53db620eef0b
SHA1 4829cc7afc850bf5a94a9dbff589e8b9e8607c16
SHA512 f114986cc5c24b6c5f972387dc6b287d866e1b9206d96ed20c52b4fe886932bf219efde202ed011d844e3879dc56acb318205db2af1171578daf12374d0758da
SSDEEP 49152:/B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gllt7Uv+MnIIC:Bu6JmVxd2dlGGMnI
TLSH
T145D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 dac5ebec4927adf1d6c976aedeab3f6dfbf6c687bb0712e53a2074cd0d9f0264
MD5 e45f5e475e31b0a5d466f6e40b660026
SHA1 79695eff5360ab21c1471ad13c2d1cff74f25a33
SHA512 fc5f8e180520e5fae5b7fc915ecf881194cd3b0a2f491ba536a1315ec2aa8261f2149729bbaea211e752f1ed851b7e1d9c6f3a0df943692ce68f7fefc9e983c0
SSDEEP 49152:c1hpsNoJpF1A6UU44CwH7R4xZt7Uv+MnIIC:cmifPbRUGGMnI
TLSH
T193B5BE13F29900E8D06DD17887569232EA72BC460B35B6DF0A90B7961F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2d1015d78ee58aecca345adaeb54c8a12a380651f11c03e5c229bc0660850985
MD5 3b84e8eb881efa1f8323eb7a58f1f6a3
SHA1 69778b627703292465a232e5e6b998737ecccc07
SHA512 e465a7c8a04f1a18300579430c60dfbe49aecde22efc175e1e77b755a89d0ddf2d58c4fbb126e172096c3ab02d650162e0dcbf05f255192d1e1e6866adb6026d
SSDEEP 49152:3SuZQIY0Be2KRRVtOnks6NMHqSt7Uv+MnIIC:t5dKTi61SGGMnI
TLSH
T1C8C5BE13F2E940E8E0BEE67487769232EA72BC464B34A6DF064072551E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 71102ccd43980dd70f173e85190a2715042b7201d79725f2cbcc8eaafc4fe9e9
MD5 faf111dbd98ea1ebab306b55268b4f4a
SHA1 8002ab974e20c51802e47c7f76bbaee4e70a01e9
SHA512 9854f4fb2267be0f378efc9e27416f89c8e01639984b10053ada44ad7bbb2b46bc8cc0542a7394dd1e38167b13c578e9a18ef8a6018e07ebcb9c05042be1c91e
SSDEEP 49152:MhtSn8EApI0figngiDn0AP5w1t7Uv+MnIIC:tX2iyphoGGMnI
TLSH
T12195BE13F2D900E8D05ED178C7568632E972BC160B35AAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 190174ba32c4772cec47aabf097524b8be0873651a1aff558024ecff1cb5112a
MD5 8a17a2d6524f0b071d162d86f026873c
SHA1 1afee37f7d7ae2e5909264c594c0ba9bb549dcdb
SHA512 a80e5727a5fe0bd646a53213eaac5cb06f5c88ee3a15e3c3851442ed4e3f093a05b5ba0667e831ee118d0a85ca8883fc3f49be7ebd7cacb6df5ce993a573cf39
SSDEEP 12288:ucep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:uX+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T157452351DB0500EAE7D86370A1B582DF70F57EE5AA6312C368E46123EF7EC935C23686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 34e26eb2400aabd13052b47473fad3fb90ba7e4a6f4a61ffa8c91e2797fbc886
MD5 ce3b49050bc66a7eca51d887e2e60a96
SHA1 cb9eaef8196893447497b024cce001966de9ba6b
SHA512 10389dc91289f5fd90e9f58b9b3e32aa61a56aaf0e21fc070f89b65c1524e6d9a45a4c744d98cd0ec128e46c9ada38d1d3275e9225eb8a958d865caa26b433a9
SSDEEP 12288:p7ep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:pS+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T15F452361DB0504EAE7D86270A1B582DF70F57EB5AA6312C358E46023EF7EC935C23687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 bf90966b60a35abe22f3e9e203e44f283510c3a8b427c0d77bb25b01750514d1
MD5 bbadf4b3506b337ed76591f4b3afd750
SHA1 39af0bf4515a027908ae9c74303cd3818eed1f40
SHA512 43eff0cf92e1e30efaf8d2b88ca219dcd7c341604ea14bb4a32f011945e151b9966daa41bfa3c9c7d7b93d04861826805800be3ccbd4099a7066bf1d65e99a52
SSDEEP 12288:L5ep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:Lk+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T180452351DB0504EAE7D86270A1B582DB70F57EF5AA6312C398E46023EF7EC935C236C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 014c7c58677a87ff7bda1218ab2f906a6eb6099454032b55ae6960ebcff0f873
MD5 68faae9d44ebf0261ed937e31e39deff
SHA1 5314447609150b823f9dfe1691575d5f083cca4f
SHA512 42fd0db9bec0a4eec19b9ac25dc16c74b408373394b4e8b5f6cc31fc2b8d37badda3f6f0d6eb9a58717615048cedb3a7e0fcf843b508f16ae3a08c03e721b209
SSDEEP 12288:sVqep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:I+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T15C452351971500EAEAE5E334D5B6819BF1F1BDE09B3313CB999011639F7A8D19C33B82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 adc4a302546f4626f659a5f25738bcd4b1525af721b0a2f9da92e2ab4a723ad6
MD5 d0333cfa532caeed2cb12e192aba69d8
SHA1 faba19c533c4976f7fa67ffb5db2a6c8e2d76b23
SHA512 5231a5a464c60a5c5cd6a1dcd7571f7757e68aecdaeee12461732248b4f77002ac139fe6ae965647b2a0d065812a8f76854cb24cc342d4a7afd8c2d3ab564df8
SSDEEP 12288:wiep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:wJ+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T178452351DB0500EAE7D86270A1B582DB70F57EE5AA6312C398E46023EF7E8935C276C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 74dcbd17ca75df7b84b5b42de694d402eb7e1b909c5963ac86eee07b463e112a
MD5 fb119d635fd844f657ffeeab7ad90005
SHA1 989d1a103daefc7d61309ee1b0991f0e3b3bd552
SHA512 d98f36d7135beea0912ade6da7a3770eb36f98411d22b7fdb87753fdd29220ac42122ee9143f3d83fa2219888e91faff53e8f7381ff9519df8425bd5c2f7f013
SSDEEP 12288:Qfep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:QO+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T129452361DB0500EAE7D86270A1B582DF70F57EB5AA6312C358E46023EF7EC935C27687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 a489fbe985759a1a3e28f1b8e71965b6da71935c85cf848a705e2c98e0c7f620
MD5 88a64124664b391805e44c44b1366b77
SHA1 4f7b0a67882ad7cfa455037d1b96f3bc7ba79d59
SHA512 9419a68088ab3051a499ea1c5f5d87ea407f0feab6200585307ee7b80d252e28da1fe7937b2dab5b6cd171abf688e5268858844a1ca06901474e1b3027a0b034
SSDEEP 12288:hzep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:hq+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1B0452361DB0504EAE7D85270A1B582DF60F57EF5AA6313C3A8E45023EF7E8935C23687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 e47bab259ed01108fb3f7aabf3c17f098444e94d300d2a17913a4a5cef8292bc
MD5 80b91732f1eedc8b2c5676b377f5d6d0
SHA1 6fbfe5ac3dd8fd151c3c244b7781311a1d8d0179
SHA512 b8cdf45e6abf5686225dd66c5149cbe15ee04fe0c8562d31b7de9e8ecb7aa1e64ed0719317b934280cebe1f4f02d3274f19e8d262e30b343b77cf1c8000e0997
SSDEEP 24576:EZMSzFVSOy+Ys7Uv+ahF8MlMPuuICiJS:EZMSzf3t7Uv+MnIIC
TLSH
T13A6501A5B35018F8EDA7823EC9658906D2F27C690B70C64F03E436675F376A11C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 93bc7f10acbc9639ec70b721468a976a83e5dc21b64a1c3d9b407752519a3c97
MD5 8432369a276d1f78d8c4b71c83cf6c12
SHA1 0b7a4b6d2b5b17a08abe9ba8375d7a900b9a629d
SHA512 46bc7b28f067c2610eca18f9b51f75e7cac161ea2d766f0c11da5347475bdc4a1ea8e075ad53a7630f3569d3a59baab7ddd9af8ce51a621797acba4548274688
SSDEEP 12288:GYep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:Gr+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T12B452351DB0504EAE7D85270A1B582DF60F57EF5AA6313C398E46023EF7EC935C27682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 d526673e011a6f55ca4f40211956ed663203b4ea97b811d0a395757d2ad1f623
MD5 764dc78bcbb5c77348137c0bfa4d7125
SHA1 c7697c96042a8ae6cb06202ef1827203d39fa4ce
SHA512 397a919e76044b20cb141344f72f7fb4354b48fe554d341c78dec9e522ccbf9fa2d28d2f41717290ba24eb03e3efed8ab680309cc7c31a75001de588619cd2a0
SSDEEP 12288:XEep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:X/+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T123452361DB0500EAE7D86270A1B582DF60F5BEB5AA6313C358E45023EF7EC935C27683
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 771f0ead816e4e3d6b913ee30930980a674ba7ce6c8172c56a1507fb2e858139
MD5 bd3d8f41cc9da35520be2d7c6e95a712
SHA1 5d46de885444b6b5404e5f11e01ef9d716c5615a
SHA512 96803780e7cc4546514d214f77779aaebb499da5846f77e56f74a929b0da596728c1aab883abffb637f53f50d2c67fc71a0d349cdd06094e8d84c9ae46902498
SSDEEP 12288:IyPz5L8nep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:Jzy2+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1F5550217B7A130F9D2B69234C8A20646F3B2B87247218BDF17A002776F275D19D3BB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 bd5dfec77f64d22b488d88d6c18fb56d04ae7a045e8867fe28f3e7310b5f1382
MD5 39cd2d017a368d4cff9a17439f044a06
SHA1 801c72403454daecf9e6c71bc17b9bdd78fd72ec
SHA512 396e3668e72dd66b36d7a2fdd76ad7d8b8c415b728cf55f6ab5b25509648e30b0eb3c343e1db598b53d93e6e1e2558ae28f7258bec3881103905941aeede361f
SSDEEP 12288:wYep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:wr+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1B6452361DB0500EAE7D85270A1B582DF60F57EF5AA6313C398E46023EF7EC935C27686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 448230b6f8364a7af8e8a92dfa60216dac129895c3eb8f4b91c5b8a866ff2a05
MD5 33f5349bb88682d9e44135f11419ddf1
SHA1 d5c64bc7616c57af60cd21fd09efb109643541f3
SHA512 0d4e61daf897c74e1a1ec351060187c37ec4778591a55486a6c33147be7f65d59e6de89c1f17ae10ba587285c3d09564bbe48df4862927207c1fb704df021a77
SSDEEP 12288:+Yep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:+r+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T119452361DB0500EAE7D86270A1B582DF70F57EF5AA6312C398E45023EF7EC935C27686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 c9764198685fdbaae26357df0fa126422615249ff74c2eddd1732be3e63314f7
MD5 9c71e6a3cdf23c2849208232f0a0411a
SHA1 3ffe80b5d9446e02c0f04a183c531bb68f1acc19
SHA512 beb15c2c90f69ddde8203a7708c7e0bc3865826a3a087d18733d941039f2988047f2ec085623891282ed54327812fdcb861f1be10933e2047567a4412215386c
SSDEEP 12288:MyPz5L8nep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:Vzy2+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T115550217B7A130F9D1B69234C8A20646F3B2B87247218BDF17A002776F275D19D3BB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 6a89f4aed6c3047126b3834f06f846e63235c57338cc4884a574638d832e079c
MD5 2e372d0c6fab60847c6df428522d59f7
SHA1 cbfb63f195585eb33a9c50c67da89b31ed64e099
SHA512 dd65210c8393212463131af50969f48494e7965c6f31167480c18b95a77d054abdc264fb90cc7c64149b4f65b9c977da4c00709f976f6c5a35b93b4ed8c8c67a
SSDEEP 24576:STHaLl3z0zDU+Ys7Uv+ahF8MlMPuuICiJS:ST6Lljwt7Uv+MnIIC
TLSH
T1746501A4B35018F8EDA7823EC9658906D2F27C6A0770C65F03E436675F372A15C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 8f911f23b0791d2b04097cf0d9d667396cd5f584718d919efa67590f177a41ac
MD5 725ac4cc7cd6a3c071246ae3b79ed938
SHA1 4585136a237da8e717d36418db2df5d8b87bda25
SHA512 355fcf3a485f2869a8bda14445eb08ba2f82b8d96968b71c45334debd2a1813e135c8e85f57579a7a623737758e6e79189258de358ddc5ec543c688a4b1d782e
SSDEEP 24576:V37d9CHKy7GZg+Ys7Uv+ahF8MlMPuuICiJS:17d9CHKya3t7Uv+MnIIC
TLSH
T11575CF90F3E414E8F1B79A35C9764512DAB67C991B31DE8F03A4261A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 8ec3e50ce31f58094505f2e17637be2979e6cf16151c9bf6388b492356cbb1c3
MD5 e1a33952885d426c6e0068187a623d9f
SHA1 0d7db0dfcc7003a8b11397192e74aa2e3154cb5a
SHA512 1b7421d7d340226ca1e63725d58bd41cbc2a2d65389bbfb815d05e4d99aeb378cf2ce9486acd23d6e2b8094f399d3e365748fe4f81690402a2ba269ef4553185
SSDEEP 12288:aZep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:aE+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1E1452361DB0500EAE7D86270A1B582DB70F57EF5AA6312C358E46023EF7EC935C276C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 7ee8d3c3c1b31489a854d2935b16c2dacd7e8c22151418cbf73dcebd187082b1
MD5 984ebe27945d1839826dd22341624a01
SHA1 6f2dbce337c3d62a0a649a0c5c97b2e67b4d1641
SHA512 ad86a6e76fbdb1a17782be4575be710ad39ec1d3528353d7b867dced922c6bb7f75f528f2c20bd69ec3d88bad5e8693f1f71f0bd085fd96810dc7bd62c503dc6
SSDEEP 12288:RHep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:RW+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T116452361DB0504FAE7D85270A1B582DB70F57EA5AA6313C368E45023EF7EC939C23687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 7bf84881496696312fe92814714983b8fc10e82f6a7a6f1bf623783750476a58
MD5 a090885ceeaa7480646f22b31aa96b2e
SHA1 01866c680631c3fdaac4c6223fdb6f7375d23346
SHA512 054de61a289c1f50703456b21f84e5f8634a5ba6f2036ecbd16668802d96b1698b01138e6fcb365b6d315d1caeee4a59a78e45284918044f6302ba120873c4a9
SSDEEP 12288:1Gep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:11+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T123452361DB0500EAE7D86270A1B582DF70F57EE5AA6312C398E45023EF7EC935C27687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 ec6c35272416a8248d0e194475c1d2de3f11a7a650a8eecfd27101c0978bdba3
MD5 aa720084cd7817e972919db62e255085
SHA1 085cef163336977e5dc1eb320eed1a6911777352
SHA512 37384343e0d43b45cd73cdbf7d89a1b0d172338cb836cf77483052018c43990156361572500843d2450bfc51abdfb7227ebafe69196cca3f7387e5cfb3418550
SSDEEP 12288:uYep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:ur+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1E6452361DB0504EAE7D86270A1B582DF60F57EE5AA6313C398E45023EF7EC935C27682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 01dcc6b1585d3c7cc7e220b4eebbcc36a00de637e1b1ce8a94afa6b5196c53c4
MD5 874bee12ca03381e7b3c1543336eb305
SHA1 9b4784c9be3c74b541c5bae8249800ecded92a7e
SHA512 88e009ece02ddec9bd5f64449b039acbd2a0178ce8ef374b8ddabb73a38a0d60043914467157adab89e7f3d85bd3dbf366fb5cf793ec9319849fe3aedb7d86df
SSDEEP 12288:lZep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:lE+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T138452351DB0510EAE7D86270A1B582DB70F57EF5AA6312C358E46023EF7EC935C236C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 205e8765f81b5ffecea07ee6b4f431a7b8fce1b6e8cb489daf3792eda67d78d3
MD5 dfeb3d41fb96655deed251fc40817cd9
SHA1 3b3556a1a6338b162c530b480adc2c25e6b55384
SHA512 1a68b51731a19b3379d5900abc6fb9c4d9678f142f10bc58df213bb8d3bbe4946ef5eddcc240869d6a0c69ec5c6f91b9c8fc0c6068b9c7630a6e05bec4e068e7
SSDEEP 12288:PQep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:Pj+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T177452361DB0500EEE7D85270A1B582DB60F57EF5AA6313C398E45123EF7E8935C23687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 a7f947822f0c96e30b58d3ab79fed65ad39be38be527745bd1ee68d9a8cb1806
MD5 650ac4a37378c41e451e239a523591e1
SHA1 173e30080e2a6f390af68000478dcc44392e4385
SHA512 1392ab856e6885e99db0b41c78d57aa639a6c4689bc1533d21da6f2d61a93660b177936e062cd8ca1a8790825d8899e016063c021d6e35a32bd2ef449ddbed0b
SSDEEP 12288:Ciep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:CJ+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T113452351DB0500EAE7D86270A1B582DB70F57EF5AA6312C398E46023EF7EC935C276C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 d7826407b1cf2f4bdfa726beb180ea2c467b0c0be3bb7c92a174d507318952f8
MD5 f41d7a291011718c97ec076a568b4389
SHA1 93280be4610880cef23aedeaa17afc382c7198eb
SHA512 92d80b1466763884b39aee83b69ba613fefa8fe9df18d110e821099acbbec1c53ae4a4f662d6d3c0bc0c80592d7fb492b21086a71ec5e29f7e161af6eeaa7dad
SSDEEP 24576:pfwvok9RX6wkyAIP+Ys7Uv+ahF8MlMPuuICiJS:PMnYIWt7Uv+MnIIC
TLSH
T1A285D029EBDC04E5E1B7923C99B7460AF2B178691B31C2CF029A536E0E37ED45D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 fcbf86ee2e67d02f1b60f4ffafb5c69fe35b2f548b45f1cbf76356b744fb81d5
MD5 4aced90e59827a37505ae75ca8eb05a2
SHA1 dbd60fb1451f3d8b681cdf7a3ec3a646ced97e8e
SHA512 bee487040bbe4bb88ec62bc550ab30355aae6f17fc521c1d166e128d145584844d35bcb5796f972748112a190d529cfa6e879eb3048570fe3a10f65bfcecdc2d
SSDEEP 49152:uYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Vt7Uv+MnIIC:gySzPNGGMnI
TLSH
T128067C96A16801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5b0aee64ae4445add42db1a45c651fbb284a4a303cbef147b3b563b6487555d1
MD5 f0a7cfc060691c399bbdbf33fa41a5e2
SHA1 392d4999bb0d3e545c3d8d324376ad48400b7615
SHA512 15f496931338eb46ac52eae94199777bb34bef060da5106772dbc115fc54ed91d35d946e8f0b6e16734e90b7b1ad6615e1f156e6660c674792b9960a29de767c
SSDEEP 24576:z47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYC+Ys7Uv+ahF8MlMPuuICiJS:z47JUQj1irIhCnDHUPfF/lt7Uv+MnIIC
TLSH
T12665AE1DA3EC01E5E1BA927885154A5AEA71782D1F32CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 79d5fe2589578d480c732a841d39c68e129eb63a1fa5e464570beef6bd01959c
MD5 b440332d201acfed23c54f4c85cbf42b
SHA1 e0ae65212b889f4cb8502d19e9516c652a51bb34
SHA512 0d17fe52b145b3fa8d4f964e45887a47cbc291f379f1ca042ace6966bb7febb7186374d07186365fba9f6c6c5138960973841367264ad9d84dfdd361302629b0
SSDEEP 12288:ANsfoep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:hb+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T11F550119D25801E8C1AE6235C7668682B3737C6587F2D3CB56D0F13E1F7A8909DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 e966618ff866006068d56c7461c871f198c0ac6c3964a0638911bbd9f6b17f86
MD5 905d8ac53aa72ec51f005503c7cc7e67
SHA1 99c93482b2ddc051d17b58ae430d955153b5acea
SHA512 f9deb4ef71a10cd5af2c43382daa8300a9668003ee3990f32eca857912ff6cbf9c9d70567838958aac793103a761084df40aac78afc52cfeb8c6ebc2e16e92a8
SSDEEP 12288:wMBDRU3fqkeG0hsY3NsLx6pYh9IOI1sq+PtxP44RMZH:wMlRUPqpsCsLxcQ9Ij1sJPtV44RM
TLSH
T1C6453941766BC75FC5A940325E32C5CCA7707C41EE45AA0373C88B3FD576A68BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 8e06b7cc971c61b330edc3a12ef72104de521d93cd489616e918cd8e227e3123
MD5 ccd922a558268f18f26c6f121fb4306e
SHA1 e6d01d573d6d52f81224710ff1d4c010ece60629
SHA512 0b3c0d8d06b91a4e428e44300ef01e7b3509fde044e0d144cb042d16b870a4a5e07ebfa9ad408ff45db4f82a877a1985a67ca0b5b2f0e3032320bf077e9c5c2e
SSDEEP 12288:HyTZALhi3wvVs0k9WQ2EUq6fXF96KjBxDjnLeXAJvNlj:HyTZALY3IVs0k9WQ2EUqMX3BhjqWvf
TLSH
T1C465FA81A537A3CFD5FB503207299B4C7B64EC0277456F26B3C8453AD82AA25B4F83D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 19e9c668d9c72ca9d0c33721f88e035a492540353510bf8f146d12909ef6cc29
MD5 02e2afdd95297f0bad5c5b29366f7168
SHA1 41be41e2c5d4813599809a8b943c2eac61c88611
SHA512 437ab2c29be43d083d4e6b47a63a9d72cb0642a9305c01b0b0a66c7c60d3acb614eb024205496a9d20ac56c0ae07dba22080861f7c8a98746e4443eb2a14c043
SSDEEP 12288:Iz7gep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:2T+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T1D3452361D709149AFAF863706179C16A31BABEB45F2342C3A8906163EE7DCC29C73747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e87d812890d2e2356a1cfcad4d7aef250d744b27b40a7438c5bfd59bdd68584f
MD5 3c46da7b35c7955f7d8b6812b1ab3e03
SHA1 495fb887f0686bab3bd3556dfe1f603ab73ff79f
SHA512 aef66861b69d07e88a17f51ec28340c4ccdf99df92e024870ca178fdc403cef9e23d1bedfaba405abc0a1ce4b910af2e9c0fb0996b7e89781791064d1db24040
SSDEEP 24576:2gb6bmBIi49WNNFpg1rSvFv7bY9+Ys7Uv+ahF8MlMPuuICiJS:2gb4mBIBhGFbt7Uv+MnIIC
TLSH
T16665AE1E22E802F5E1F9E2B8DDAA4417D6B278160732D2DF1151423D2F3BDE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 9d7c28576efd509ba81b2745163a6a23fc9bd713a233eb8762fbb0f45ca48f1f
MD5 abd6a2b594db1798f41406aa258da384
SHA1 884d7cbd025c8388e5a257dacca3987666cf397b
SHA512 7b0aab866853b66c68887c3da985e98aecb3783338768a6a64d3a5b7016110b1eef413429a944e6d3aefdd40b0d27c6303f380b0fc72121fefcf9a907f06c054
SSDEEP 24576:pG88u8FpJqH1bzria7/my+Ys7Uv+ahF8MlMPuuICiJS:87ZFPqVea7/Yt7Uv+MnIIC
TLSH
T1B8850165B7E101F1D4BBD13889964663F6B2B8250361EBDF06A88B511F23AD14F3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 55884b21b771b1878501e3c6a71a65174fc6c5270a7e9e9979f04b8a7575a4be
MD5 4cda66f228b1666669bd455c98a04211
SHA1 6bcb4e650d5b39ab5dca6efe1936edbfe9b607c6
SHA512 d61b63810def950a683660f5ff8e89822907af3894c6b9065567496d3e511984536ba1634c0649164dacfb05907cac77ee33621e128d8485d495e14758a1ad71
SSDEEP 49152:MBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjnt7Uv+MnIIC:vG05lO43b+GGMnI
TLSH
T184D5C06E62EC11F9D1BBC17CD9C6460BEBB23825033556CB02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 89ecfea620731e4949bcad6d4c63c04b0947a3c8b850445bc0833c264a24e57d
MD5 b23718351cac971b442114b8e9797bee
SHA1 6f90bf91868bbe49ba5bf813fd63aa780df54c62
SHA512 0403f64538caafee113b21e841e1338783330b5056c3494ac594743f3cd4c565567876f096baa006cb5c37093b752ac233dbec8fa5b32f801107050df7350c5d
SSDEEP 24576:Sfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn4+Ys7Uv+ahF8MlMPuuICiJS:6a5POZ3+Jt2pasx2+mft7Uv+MnIIC
TLSH
T18565AF5EA6FC01D5D5B9D17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c0ebdc1ec9a07927a3b16bcb7cefe9f7f378143dce392c15a66adafe81a8db4e
MD5 4a71498ab684c1226d31a6126814456e
SHA1 f04cbb9434f0a19dffa90a2b5cd39ce2d6fa4582
SHA512 3812a30c8a854cab20d89093a65ad44c268126390505ac8eb09551a41241ac0486d88d214bee6ff2a29d44e8497a867fb62bb5a02bb64a9de11233681d2a927b
SSDEEP 24576:6NcwHdjbyQ4nLC18lb/EOjowL7Fka+Ys7Uv+ahF8MlMPuuICiJS:6Nc/zEOVHF4t7Uv+MnIIC
TLSH
T190858B2623E901E4F5BBE1BE89779546FAB17865533086CF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0a1ba48b3c08e5729f3841778d59c92e237f7bf840e3a3414a275a9a9a9f4ecb
MD5 8e04a1548b85c5e6e34470b2f70bcb3c
SHA1 cebc4041b7c90243d90d0986cda313378407ce91
SHA512 01e4d4203b22d97e68ea0eb5214614e9d99072e94f26ff89bc124f75d6e0d565e30255d22659a4ed88f29eaa49205f0abbbd64681d6af432a49e1f8682f6bda2
SSDEEP 24576:88kNvNnaFeYhJNtmZBmM+Ys7Uv+ahF8MlMPuuICiJS:88MwBtOmJt7Uv+MnIIC
TLSH
T1DD55AF6EBAB806E4D1FEC6B4CD238512E6727861073253CB5290C13F4E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 4cdf15e3efc486711b2a992b7f992e9449ca96993172d3d2fc710421ad3799c1
MD5 573a82445530ad6eeea9ea501cfe116a
SHA1 5f0308a75289569e2b34ac1693989d57fd5ec277
SHA512 028b254fb2aaa333f35348d9afc4abca3fa4b8778145aca582733295b3fdd167d7b3efdc12e02459bd4ffcfcb24dfb242e472fba6e1ba1602268c13bf421d87b
SSDEEP 12288:AHvUrBFrEjwaQPep+YBVts7WZv+Uth00mJMlMJRXeuICQVJS8E:APUr+NQe+Ys7Uv+ahF8MlMPuuICiJS
TLSH
T12465E12F62AD18E5E676E17C8592831DF371B862171292CF02E0817E5F67DD8BC3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 fda5b5b6ac15d5a2a9963335a0d6f93e585eeaa757341432a24172946e0ea00f
MD5 45fb00ae4f6518c0d2d9ba5cd31dd616
SHA1 b9a1a921e95fae9fdcc86c4d11cf542bda75978b
SHA512 00a28ecbb0ba2008049fcfd29fdd7ff3b07965816e78e0212ffe854d7f667babd686b31884c7fec72a9c69e9ac9f3049a8a349db4ac0d0dd234275c675ef32e1
SSDEEP 24576:sD3FHshBIYQgA3+Ys7Uv+ahF8MlMPuuICiJS:sDVHeBIAAOt7Uv+MnIIC
TLSH
T19575E17DE75C04E4E57AD2BCD6638606E3B138A9033266CB01D481B65F6BEE46D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1680-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1680-127-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1680-133-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1680-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1680-138-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/3576-52-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3576-50-0x0000000001E20000-0x0000000001E80000-memory.dmp

Download

memory/3576-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/3576-46-0x0000000001E20000-0x0000000001E80000-memory.dmp

Download

memory/3576-40-0x0000000001E20000-0x0000000001E80000-memory.dmp

Download

memory/3952-54-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3952-61-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3952-60-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3952-292-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3956-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3956-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3956-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3956-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3956-316-0x0000000003050000-0x00000000032EE000-memory.dmp

Download

memory/4112-78-0x0000000000A40000-0x0000000000AA7000-memory.dmp

Download

memory/4112-77-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4112-83-0x0000000000A40000-0x0000000000AA7000-memory.dmp

Download

memory/4112-309-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4428-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4428-329-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4428-95-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4428-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4428-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4428-89-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4680-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4680-313-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4680-101-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4680-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4680-107-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/4680-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4740-15-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/4740-23-0x0000000000DF0000-0x0000000000E50000-memory.dmp

Download

memory/4740-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4740-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4808-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4808-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4808-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4808-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4808-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5068-1-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/5068-0-0x0000000140000000-0x000000014034D000-memory.dmp

Download

memory/5068-9-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/5068-7-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/5068-87-0x0000000140000000-0x000000014034D000-memory.dmp

Download

memory/5288-308-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5288-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5288-73-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/5288-67-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/5716-115-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/5716-121-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/5716-113-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5716-312-0x0000000140000000-0x000000014027D000-memory.dmp

Download