17077798ab76ca9c7277f042ff00c676cd87202abddf8105570cb77934e9ecbc

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 03:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
Size 5.3MB
Sample260910-dhyvdsveqf
SHA256 17077798ab76ca9c7277f042ff00c676cd87202abddf8105570cb77934e9ecbc
MD5 bf3c229ac63d853c16b9dadeba0ee83b
SHA1 38b9c5e326588b1c07fd238724647f4e25bc70c1
SHA512 8102a593d7a8e085d6d07c7731dcca111a9114aaa8cc09523978c3f40cad7414b17a19ed1ad0b8cd739c4f433211fabe910129396522b1c62355f363cfc4ed79
SSDEEP 98304:dWlqNaZMkFwkVieZI80FLOAkGkzdnEVomFHKnPvix8EVy:TYZBFB0FLOyomFHKnPq
TLSH
T19346AF95DEAD80D8F866B1F9C951C22BE2B1BC555923831F1134329F5F33253EE4A23A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4804	elevation_service.exe
1176	elevation_service.exe
3272	maintenanceservice.exe
5156	OSE.EXE
120	PerceptionSimulationService.exe
4196	perfhost.exe
4588	ReFsDedupSvc.exe
5000	SensorDataService.exe
1348	ssh-agent.exe
2988	AgentService.exe
5592	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2cf29a75209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001408a2b4d040dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e98dbb5d040dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000594369b8d040dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000033ec7db4d040dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000232fb8f3d040dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000ef60e3b5d040dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac2f78b7d040dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000311e7bf3d040dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c7d1b3b4d040dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4804	elevation_service.exe
4804	elevation_service.exe
4804	elevation_service.exe
4804	elevation_service.exe
4804	elevation_service.exe
4804	elevation_service.exe
4804	elevation_service.exe
1176	elevation_service.exe
1176	elevation_service.exe
1176	elevation_service.exe
1176	elevation_service.exe
1176	elevation_service.exe
1176	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5260	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	2988	AgentService.exe
Token: SeBackupPrivilege	4588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4588	ReFsDedupSvc.exe
Token: 33	5592	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5592	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5592	SearchIndexer.exe
Token: SeBackupPrivilege	4588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4588	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4588	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4588	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4588	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4804	elevation_service.exe
Token: SeDebugPrivilege	1176	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5260	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
5260	2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5592 wrote to memory of 3224	5592	SearchIndexer.exe	99
PID 5592 wrote to memory of 2804	5592	SearchIndexer.exe	100
PID 5592 wrote to memory of 1888	5592	SearchIndexer.exe	101
PID 5592 wrote to memory of 4324	5592	SearchIndexer.exe	102
PID 5592 wrote to memory of 5404	5592	SearchIndexer.exe	106
PID 5592 wrote to memory of 1516	5592	SearchIndexer.exe	107
PID 5592 wrote to memory of 4380	5592	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_bf3c229ac63d853c16b9dadeba0ee83b_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5260

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4804

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1176

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3272

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5156

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:120

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4196

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4588

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5000

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1348

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2988

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5592
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3224
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2804
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2916 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1888
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2964 2868 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4324
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5404
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2964 2868 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1516
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2916 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f5aeb85cb47d1037c90f3f7ab27998930e7de154d3f35ba2cbfe93c47d476cf3
MD5 2a1aec5522149533878cfd3bc93d4c61
SHA1 5dc307a19fcc7064002eb822719949720a6160d2
SHA512 64dec760016e7a5051a2c9c577458bf975d3c5b78a44d140f90658c586c18b9849fb72046203e1cc6af6ba89c21e0f952b59bf93e7a64e41cecee4843058f13c
SSDEEP 49152:Rb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnex4x8EVep:X3q6mjBdix8EVy
TLSH
T171D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 062e0f9860373869ced7b193bba6af5135cf4e61da9a00a7c79d8e3bdcebb354
MD5 f998ed5149a46007711001c2152903d0
SHA1 c5cbcc2bf5bbdf7f4fa448cc637f48d3ab231e83
SHA512 b0deb97b73764455c09219f42a8ea1391e1c27b2e68e9b8762aef5c170108f97a52e6c77f980fbe8b78c1d6709b95f90cf32ad82d15742e46621fe3660e1e457
SSDEEP 12288:O1XLsswWkxy2lRq2czAe+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:8XYfDtczAeyxknw4FYnshx8OfVe247
TLSH
T17175F12877D508F9EC6B8139CDB28112E633B8554770E39B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 de007b47e8c3539cd76792e5411cce5d5304a530fef6cf56c82cc22caa195076
MD5 c70c6a2ca6418bd27998b2c8d92a3f63
SHA1 37d3f35e342e9dabecae1fe180fd8f8f91335bd2
SHA512 6aae96105936a1c72482612a0ea61e59648fe9bd8d3bc7c55039d3240029a792e05b6e66a6a49d283851f87b6ff7fc7d22cb5919b2e2bab8f4e07c2ca8878092
SSDEEP 24576:70Le5ji0hmxSrMDyxknw4FYnshx8OfVe247:7Pji0AoXx4x8EVep
TLSH
T1FC95AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 802a301d723982dc8b67405f07832b6305078c6ca97d7c44e81421df4ff1dd81
MD5 a7ad7e21215a37678dd515e6812c4e8c
SHA1 e621f4a990a5f22e7a6567326480d4090bbcd6e6
SHA512 e8b0571419056da4b34431a3c82c11033843db7663959ce05fe9c524dcbeb90a2b009db52173f3e0120ca5bf9e43a897897eaee1fe41085a19b085b7beadd7b8
SSDEEP 24576:Na7/ezSC6vUyD/aqgrvWj6q8wyudyxknw4FYnshx8OfVe247:E/ezSC6vUzPv+Hjybx4x8EVep
TLSH
T15A756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2e1eac7b89927cc0c97158733e073a6e53e67e2d9bef73867a11f0bae91c7606
MD5 83fce141dec6f4e1f569e19e1ab67ba7
SHA1 f8bd68b51db5d1e438e4027daf8f8c1ed34fad28
SHA512 836d126114a84b57c65b4b798bb9b55eaf88c90017d6dde6628e555100074a04cba418410839bb0d9b0661132b2781603315f5f959c673e173deff492a2df159
SSDEEP 24576:hVbqPb88hv/l+Byyxknw4FYnshx8OfVe247:hVO88hXl+3x4x8EVep
TLSH
T15D559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 54aaf974834f790ad4a3f173286199f914b51d589b0abb14a1b3965c133eca14
MD5 7e7d44b3389ba6de5ca9770a725b79f7
SHA1 968b8fa0617e24f45d8136fac28af20af2749789
SHA512 7d27976c91c2df4dbf1cc56c62484c8904e52c3cbc2e51be41b8879192000530ea5335cfe0212b404bc4c84ff8040a3e0c8a596028cfd2292fd301f7b5ecc937
SSDEEP 12288:faH+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:faHyxknw4FYnshx8OfVe247
TLSH
T15C6523BCABDDE4E1F65E14331A7572222605FDA4DAB4C11BCB78B54EE0B0C50D06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 17ecf56490993498ca0ed8c6268560a6ee3971a78500598d13786ac20042cfda
MD5 520af57cf2b5eb61be9d6d1102123f8f
SHA1 e88886c86394f226818eb24dc28a6e2ec779d2eb
SHA512 02fb605b42e296e3be843850d64a8971dafdb6167b88c4d9fda0fe6f098c6c6cbaed5cbdd267c22255fee9395cc1d037eabaf52f688f46816b25b09f6928f04a
SSDEEP 12288:ReBNUbTVO86Ua+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:RJIUayxknw4FYnshx8OfVe247
TLSH
T1F675CF7BEE28FCE2C27E5DB95B918200A76274704F6193CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 24cf29ef4c217461a3a243be5973ec0f71c6c78a0130a49772fffe3e93b3e8bd
MD5 3dfaeab7f643c56d41e7224ff371f896
SHA1 724800fe348600b47cf8a5cbdc4771d66183f882
SHA512 d4c511e492f655120db186f1b4c5d154f44895f814207ed9f8e155df68a0abbc65fd0586badde0555980692d3c6cbc7693016c863af099d71d2000081df0f22b
SSDEEP 49152:wQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THV:wQvGAdlCEL8c/WRNw5CYix8EVy
TLSH
T17D267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 b3644c9d040262da911e76f08e83ff5d74764a8fd21e228fd3c03fabade181c6
MD5 9c2d30c53eb20cea219f20970e23ba12
SHA1 a3ea4b158751dd3c060ea81f4eb0fdde360a5a7a
SHA512 57364c727a9150449d62e91b3b5a67ee4082070f03413fbbdf6a2f9aba84bb72fb5e02604a65d6e7d67196d8e22060833caa9a3b4041e8f6c83fe0307d6184a6
SSDEEP 12288:iAwSfxL/2Dc3zDLLmt0LDQewsAjM+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:n+ewsAjMyxknw4FYnshx8OfVe247
TLSH
T14585E030FE75E032C27F0DB21B36D716142DB9604B611AC3E3E89E9E99705D2637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 51cf565911c2348e28778162726416dc1a9b0d36a23bc6906816f49c10fbb4eb
MD5 68787a729140177787c3f2945947cc45
SHA1 3cd917665038c7f41f69b7d8be1656a75a6e1d50
SHA512 def619e0b649a662dbe1d78e036ea8be42700a3a39e022776d1f5632687cc0ff60a9f95a11a017748254aec0c90425d21861b90ddf4c9a4ede0cd9c25a95012f
SSDEEP 196608:KUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH6:KUEtQevvqc2W1cpV20I32
TLSH
T166474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 7ced94f5126cb5c63f6e2bb55100c47d5308ecb1f232ee6eeb48e540ecaba8a3
MD5 63d6617ebbd0e8c123fbd67d77d9f23a
SHA1 e4ec327293f6c019eae680de5c3f0ba6ee6c8cde
SHA512 6a6bfa8bc10bf4aecc85ccf005ab57ecb5d1766854cc9bef8fc9a40c3b884190e01ef046cb6c06f3334421b2bc938c6c7d7cd733398958445fd7a66eadaa2be8
SSDEEP 49152:hCbRquA/m2yL5zLfFiV+XenmE3/zHx4x8EVep:Ooq2Vjnmsix8EVy
TLSH
T15AD58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4cc6a2dfd49682468cfde3f67454ff265add60178e5f582e6a794b40803e4b4b
MD5 5e635b31a010eaf27a4d1eebe4159222
SHA1 155aaa10773eba5fe54131cde38a18ded8378729
SHA512 60652927ec6b0af3ba6cdd4c7ca59e7af007df3b8318b1e2d6af9b9a321cbc489e8211950512b3962e684f5715d21b8677f66d576cdaf31b6bff5219b835b1e2
SSDEEP 24576:GAhGL6IFoiwtA5l7S53Jyxknw4FYnshx8OfVe247:GAM5Foiq58x4x8EVep
TLSH
T1F135AE80EBF955D4F5B3AA7899B69171EA76BCA65E30C20F1260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 8480c95fc8b34c4f01f5afd9b920f9bc7d1c83fc568284f8b0ccd3255b9f25e0
MD5 0fad82b1f5cf7a46f572a12c0ab8bd4b
SHA1 6fdc814916640ede0deaa108996341a219289e17
SHA512 a7bb6e996d732b25691ab7e4c20cb410e82c40ee485ada0ff3e4b4dd6ed972baef151b75453098ffbdcc024b619697c8402f25a95d5e2295d4be5e2f9a4acbda
SSDEEP 12288:Pmw5HEjsChNrBFgl0WDm+C9+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:uwumOWYyxknw4FYnshx8OfVe247
TLSH
T1E675F14977E81CF9E96741398697D136F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 db6520f83451b511c30b95a352e24e8bfb67e3382965ace09852a1af45028864
MD5 00c94834abcbefbe257bdfe5540b8e32
SHA1 7e075554a113e5723b395284f45e9e4d99054b25
SHA512 f0dcafa3534cd89abdfdd20c4514fff5ee798806f578b919c21c43c8a0f4004be3afee9b603c92303ba4b29b46758a4c71b78bf796392b282a92cb5acf1a25cb
SSDEEP 12288:hvZ1Iyc+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:9ZuLyxknw4FYnshx8OfVe247
TLSH
T1DD6512AC33E870F1E1A7113A89F15206E762B4A2677183CF4768625EAE71DD09D3D723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 05d47b5139d05c616267fce71010e0274556b01e64f222c4c814c95831be5efe
MD5 643d06131e39469e4717b74347be40aa
SHA1 21c11e8004331669f11d4c4932bf3e4fec096d34
SHA512 31dffe563d5b0daa83b38e12e007a7b4f344e6654385c3a273c270ac884003393a79ba26341d8402709f061742b96ebe69af3a8ad6041e9193211162c2854a25
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UB:oQRQyi36YOcPDLvw2gAf+PN3Zix8EVy
TLSH
T100667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a0f3a7d1e778507ab3fcbb72e349a37c2b7e36c93e7700adae9198c48a996a73
MD5 1f64986bad318adb27cd408f278bf9a0
SHA1 7a9b52758343b042d59eb3408a67ad2f804c24dd
SHA512 573e9894f2be1906a5e74a60b4e16a7ed834aa4bf000ff857c388f6287212238241c1a332835caf95e935067ece97fd98315a9f6d61ef3a39f9229e0b7364feb
SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23UB:iQRQyi36YOcPDLvw2gAf+PN3Zix8EVy
TLSH
T129667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 bd2181d0794d7740fcc5b676c499726d29d7a250f8c70035ff08d15790037f88
MD5 546052da1f558b02e2494ecf02aa4ff5
SHA1 e2d4e2836742ccab65bfd99ced8edc39d2ca22e3
SHA512 14d332489cd1e13e680d5e08e9c4953b3bdcf30d695a3a34482e3b1eb8dc036dc5b5771c17270b900362e1a337c431de652ba79efa8673f16c5ed68fa71a4ab6
SSDEEP 24576:NwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL07yxknw4FYnshx8Z:p68Qg55nhkeWu7PNU3/Xx4x8EVep
TLSH
T1CDB55A33B2F600A9C44DE1769F4A973196D17C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d364d210bb7ffe3cfcd6f1901012e68fdfe749832ca8be02022d1e3b11f33c5d
MD5 c480df82d159f575c34958469275942b
SHA1 f93f140eafcb41af6987e6a70300ff8789fff834
SHA512 2164df54d3c2795719060b9a30eb88737cc0800783bdbabc7dd75d1bfaac6782785edafd6f282c32321c862a6c813137364b72117ee1e81de79b05fc322b0722
SSDEEP 49152:s3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99v:Jy5112gYy5azzVvU69nLKnhZSix8EVy
TLSH
T102167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 dece3059889b85a7f468eeaf841f08ec3e121b3d53204c6af2fe271f94734d6d
MD5 b36a7f5da440191e6a450609bd12b0d6
SHA1 3ddb9cf7912598986918a49c1c1ff23787db968a
SHA512 aa609d1a161aa9863e1a24434d6ed39d5ea05570e19a1e6d0b8e972135db0b0affbae5b38db7b7517b67d7874bc349623d4dd80b9065aa230bcabdbc2ea3b25f
SSDEEP 49152:eB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glBx4x8EVep:Mu6JmIxd2dBix8EVy
TLSH
T1C2D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9bd7634172d2464e17bf0d1349de9a9825d3e0e186de2f570e7026c2304c75d9
MD5 4f38925d19e5964010f9c9a984166c0d
SHA1 30767fdd698a0d21e7e1730806ec777434c4c57c
SHA512 77ffc1d9be72d803a34ae8e54854f8e6bb6ba959c9540e47198aa14ee4e94bb50cbc00a58b40667ed16db169f09193ea162795fe4ebada3f4c4ba566588c301e
SSDEEP 49152:r1hpsNoJpF1A67U44CwH7R4xVx4x8EVep:rmifPqRsix8EVy
TLSH
T1B8B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3b19533571e2f4bef2dd87966a9134c89e9adb7a64ae52fbfc0418901bfb4253
MD5 acc9a2487eebf500c83ad0d90a47ac90
SHA1 43d9f060fd4ba6a1d3b1f81eda5047213583c4d6
SHA512 832e56449f9e5266068902ef4c42972786b7ba2de558632c87caf34e4fd21f024a4e720e1ca44e168a5fc8f1db50a63f99a931b9b103a79f19a09ef1b9e02ad7
SSDEEP 49152:zSuZQIY0Be2KkRVtOnks6NMHqux4x8EVep:x5dKqi61uix8EVy
TLSH
T1DDC5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 74919bfe0b40be342213205527062639601c45092b16187ddacde8d9c552bd0a
MD5 21903e25a63052b82aacf2845258820f
SHA1 db12f9e2a488e7c9a47908f3cceaf77e708ff6c0
SHA512 fc3c89d321329e2c8f017eaa22e3af9428c6abb5765e3aa861f9f98240327892dba76328bd2defb69da14043e94c6bc853b014ac97b5119ea91a56464a15588c
SSDEEP 49152:KhtSn8EApI0figjgiDn0AP5wRx4x8EVep:rX2iWphQix8EVy
TLSH
T14595BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 b7b1bbfbd89800fe519529d74869288cb72337b93073adfd1321607092a87b16
MD5 7deaaf5c66bca90716a1301babb25a00
SHA1 a61dd7b4eefbc538601c34c2bd1432e45856d9ec
SHA512 9ca4e1e68dc2a9126a66b04fa6cc87a9d2cd18d4b3b33f008a567b636f6c2f8755300cdd5901904b15968efa28bee0f7aa4fea28131ebcabfb8ad5becbf86348
SSDEEP 12288:EP+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:EPyxknw4FYnshx8OfVe247
TLSH
T1CD65237CBBDEE5E2F50D11734A7133666609B5A5EAB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 1f45cc1b53c33d7632d71c795298456a7ec28909256f0790c20ebc3be7e35be0
MD5 7cb02711c49ba92008148021cca90063
SHA1 7f3c1bbb2891aee3651e51624968292927cef371
SHA512 cb3239dd27cf5bc5d18c8e1cba93e175f58d2a8b51cb805039299990c870ce668e8e6820e4bb8a5376a771aa91f9a1cfa11196a3fa025ade26d7ffd075565b5e
SSDEEP 12288:Ww+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Wwyxknw4FYnshx8OfVe247
TLSH
T10565237CBBDEE5E2E50D10730A7173666609B5A5EBB1811BCB7CB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 8df71586844c4b15a3e4b286c25dde0210a5f1d3b7dfeb07cc7fae2fc857a34f
MD5 813a535344b012f0204206014228a8c5
SHA1 4443edb7411891d16b112091a49c6cf0563a5df5
SHA512 b3728ee20b495174699a80575dcc2b5ce8d8998fc16603fc5606b7638ecb5439ce57a5db74b1ff2a2547d17fef8c19fb00b1d14b12b1f7a5eec4692d444cc38d
SSDEEP 12288:Ei+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Eiyxknw4FYnshx8OfVe247
TLSH
T18565237CBBDFE5E2E50D10730A7133666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 3162ea0b5ce79015b74e089866f03f09b2000f56e50792315659648c64c8e2ed
MD5 46fcbc4429b584b87757cc40ec913bfc
SHA1 56fec94aa471fb9d0a3f11674000c49160ceba80
SHA512 629d65d517905e38d98af8ef56ef15cee55c9125d9afe843c38c157639cf14221e16859f948dbf640cc41fb74117577dc484a9e8a9f775bb67fb0f0d2f80b8ac
SSDEEP 12288:zVp+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Tyxknw4FYnshx8OfVe247
TLSH
T19E65237C7BEE90D1E45A51738A716222B365B8E4E731C25FCB24750EEDB0890A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 8894d37c37bd77e55b01c362c8c264d92710212909428b183473816cd19031bb
MD5 7a4ca32d177c5a8fb63135c6ec4989d0
SHA1 2e7618590bf13da9b378ea22378d78854c0f6e98
SHA512 0b48146964dc52b6abc13a8fa47365dec6d494c70580c984dbcdee8ec71c1a4e4eee5b100fc88fedc4cb0077145d15c4fb569e4cf7ba925172655dfff299a4a4
SSDEEP 12288:/h+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:/hyxknw4FYnshx8OfVe247
TLSH
T10E65237CBBDEE5E2F50D10734A7133666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 a7a97093bf383e039a75ad21005e00781f26e1e5c501c35ad138e7d4d258b80e
MD5 a974dc4c767e874fc71bb867521b16d3
SHA1 7f976e3e6cbc9d67fe1d4bae187b6d9977d74967
SHA512 327e7ac839239aa63613207164bddac780020b7995532a58b8c4c663deaabd2a9e1721bfa6ad89d03d37eb32a245050980d75e41266326d0416366393d0373f8
SSDEEP 12288:I0+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:I0yxknw4FYnshx8OfVe247
TLSH
T17C65237CBBDEE5E2F50D11730A7173666609B5A5EAB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 03953104da95def25d07a80a0d63d3c04597aba42caa52ad89c73b97ea69b212
MD5 a441f34333dc93bd95085a4e2c93c804
SHA1 630957f694f7b3062d7376e71f26e2e9dda9b078
SHA512 18281475411cee06d3fbd038c1ddb5f7e8e1be0537d5a6ff27af5a68f55568f0d6a362392cbe3b59e7fb3c264a28a41ca639f69d3d8fa5c66d0cd493120dceb2
SSDEEP 12288:II+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:IIyxknw4FYnshx8OfVe247
TLSH
T1FB65237CBBDBE5E2E50D10730A7173666609B5A5EAB1811BCB7DB00EF1B0C64A02D963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 4ab3fc97073d2700790b4904c13d6cb4c6c2cb48754db26c966a59d98e6c48c7
MD5 0c5edd614d426d969eb6402eefc3bed0
SHA1 1eabc11a56a7f23c3959728c88f188a44ed485b2
SHA512 717234771b4727b94c50e38c7e16d5eff4b871090102caef11e07a52010170af30b273dcac776b9d0ef734ad9573b42554239b50ca88b69244c76a2e625a43a5
SSDEEP 12288:MiZwbyzzFEoS2cPvyQ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:vZMqzFVSOQyxknw4FYnshx8OfVe247
TLSH
T1347501A8B39018F4EC67413ECD659916D6B27C594B70C21F43B8362B5F736A01C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 5b74994600ce85012b368f40ab13b1c94d3888c4997d1a425c696794591e726a
MD5 f0bcf963c084c9c8869d54ee3e09b0c0
SHA1 7a4c44a5dfa173e205926fa7a045980037fc732c
SHA512 0c65f55d8f14f312e7a18da491c14df8cf8b8b23c37e0b60cec258ad5df81146c827af816c166462cc561f7b6b4c6c4c1e628162b6eaf9e5557193cc4e551608
SSDEEP 12288:8b+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:8byxknw4FYnshx8OfVe247
TLSH
T1296523BCBBDEE5E2F50D10730A7173666609B5A5EAB1811BCB7DB00EF4B0C54902E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 ca8546d9b65017daddcd9b913d55d87196581fcf67aded1b44dfe4eea232457e
MD5 37f1242683d6497c6ff1b8fc3b470a14
SHA1 087b9dd01b4770ada15682d1388e7e121000945e
SHA512 e0af6081acc2ca7907201367800a006436e54bcec9df9cc1c8108dd30f8fbae8002471eaf21da33b4e10c24cb064ef6996332bc1cda09b8164866433c4ae817f
SSDEEP 12288:8X+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:8Xyxknw4FYnshx8OfVe247
TLSH
T13B65237CBBDAE5E2F50D10730B7173666609B6A5EAB1811BCB7DB00EF1B0C54A01E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 6804e3d6f32b42d73d04ae5ddc42aa604adf089eefb8d4303669cb8cd8df8779
MD5 2b529087dcb4b7c2321d35891707ee2f
SHA1 9f65c9b6d187650f172629f63c9c02e5a452d7cb
SHA512 2e1f54a97ec9af5ba8f7414a6dcc314a88e75da133dffa8fd931b4f1d303b3f19efbd3a3e7b23aa93025c7313444f54fec2256c442acd3db14384ceb596eff0d
SSDEEP 12288:ryPz5L8c+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Gzycyxknw4FYnshx8OfVe247
TLSH
T1E575125B73E530F5E13A523689621612F372B8724B3086AF47A4537E6E325E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 70eafe67cf564c2e8fe05354305592f6c8f90d2a56a276fede43289a90066404
MD5 c7c1b0526f63a2034cd9b936a8c93fc5
SHA1 da153cddc855a5778131ee4e51b89009e3aea332
SHA512 7659137b95d39e1f02b3174e90ff4be065ddca8b327f666757324364e2bf348cfa52758ed6c47e8680c04f79765145f08bc29b223b716b49172757325aaef6fb
SSDEEP 12288:tb+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:tbyxknw4FYnshx8OfVe247
TLSH
T1DA65237CBBDEE5E2F50D10730A7133666609B5A5EAB1811BCB7DB00EF0B0C54902E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 373b6d418dfb2b8bde39020bdcaff039b75942f9a20ae623b1e69529db8d77d5
MD5 12f6c0c61dbc948701a0194f4db05520
SHA1 a266704bd920b32eb53b88e18967dc091c224449
SHA512 ef1f0d1b4d4ba26a364da98c1e662f05bc17baba8d0d21ba0645fee0e07261fabc7474fa375566ce091b5b6d7c51888116692d238b073d63b31e7e0384ab211d
SSDEEP 12288:Xb+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Xbyxknw4FYnshx8OfVe247
TLSH
T1256523BCBBDEE5E2F50D10730A7173666609B5A5EAB1811BCB7DB00EF4B0C54902E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 95dcaa9d91cffaea373d5d0bcc16ee3c8816f9ce1b13a2eb6a59ea6c7011e5d1
MD5 c44c54f994d4207b47fb7cd4718598da
SHA1 c5429cdce9b2fb7a61a9dd137a8aef49159b8ae9
SHA512 3422abf11f7c3e8e57577e0d031148292e2251eb4752c59f76c9d635dd7ce2e579f5fdff06293963673c806ea0f6645914cb8ef7baba49165450116cdd5ce3fe
SSDEEP 12288:IyPz5L8c+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Jzycyxknw4FYnshx8OfVe247
TLSH
T10E75125B73E530F5E13A523689621602F372B8724B3086AF47A4537E6E725E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 a83a3c4a672b6ebfa14ea5a09b3614d5217c0a7cce0c25ecd0c520a542cdf1f7
MD5 f65d2067633872195aadf0ebecc4f186
SHA1 d7e40839c1c5588088ae75d6ded76ab43a07f7c1
SHA512 b93524572f56dc0d3d254d81d9ba12afd62a4c47550b04f5e322351ff6fb5932bf4574c2565e6e700c4d5d31e8a08fcb2b1c45143909ac0828280afcde001119
SSDEEP 24576:OTPaLl3z0zDSyxknw4FYnshx8OfVe247:OTSLljIx4x8EVep
TLSH
T1387501A8B39058F4EC67413FC9659516D2B27C6A4770C21F43B8362B9F336A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 44320b6a442b8dfa2b2c4482873fd61a24528417f6926b8d01664688207e20bb
MD5 8bd601421950f831a702cec1f7d0031e
SHA1 5c991331bb4848e00fcf9af207fb36e27c764c3a
SHA512 cbb1886cef1e2b8fb5ddd2f0cbcfb154ef1101810d412f156d50f9f0885c3c86594a97c51c082a3d88edb0005f142f982376656667c9d50ef4f1069abd7f11ae
SSDEEP 24576:730d9CHKy7GZGyxknw4FYnshx8OfVe247:b0d9CHKyafx4x8EVep
TLSH
T14795DF90F3E410E4F0B79A358D765512DA767C9A5B31CA8F03A8661A1F33AD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 1a9dca6ff5411d4abf22ba5f788689e561a0118318e307bf8d7017e2635a5d2a
MD5 7c5a7ec56b4425aad69299b645be324f
SHA1 9e08d55eb710f0cec2fc238c624b9b224fbdc882
SHA512 37e3c847de0973e969740b99cc9f170b88f696f95d94cdc4c87c04e0c7bfcd320007a2c20e1678f747bc6f8f0c868e0c2a6cfbfcaf49c4edb0816d4ef9abb19b
SSDEEP 12288:hC+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:hCyxknw4FYnshx8OfVe247
TLSH
T17A65237CBBDEE5E2F50D10734A7133666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 18d107e9ebbf90ff1946111052fc4448a797ff8506413ff6114cd2c1adb16213
MD5 03faef948b7a9224bac9d16a32b81787
SHA1 7c40d44db145c0641b4ab92f18b00693a5d9cae1
SHA512 994301b1d937a87fb737b95b2744eec032486a3425cc5d36261c0cf65c3e3758e4e2a89f12265750f56d01ed15d25235bbddaf16417a3f6709ee8e891c69f0b5
SSDEEP 12288:O8+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:O8yxknw4FYnshx8OfVe247
TLSH
T18C6523BCBBDAE5E2F50D10730A7173627609B5A5EAB1811BCB7DB00EF5B0C54A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 9c8e6b1a8016c2bcc16f5211fd4c32d8300f27862d166cc146bfaf1b4e87fdeb
MD5 952e78fab104734b0bab05c8f32c0434
SHA1 8d7c84e850a6dc360d4c013bb70d2f88bc359b31
SHA512 c1eb7062a9149cc46671cc9282635e4e988571f156dfb2db2d6578721f9118cb347257202f36c4c2f779b31bb7de7d6ee03eb8c5036997a5343b304066adcc3a
SSDEEP 12288:pV+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:pVyxknw4FYnshx8OfVe247
TLSH
T1FF6523BCBBDEE5E2E50D10730A7173666609B5A5EAB1811BCB7DB00EF4B0C54A02D563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 5a4bb06080685c1bb6ff6f2538d0da2d7f124caf490f9634082e093041df6562
MD5 68cb4d3a192f535f372a1d12a4ea1917
SHA1 b67895732709832100825cc4ff1e6915a3c943df
SHA512 6f8d88971e4227a50e38f2c66574e1b7e9005d90795acac9ce7f106fdc99038aab4bc350c2a3b7680d73df0a3929dd7e4f2aca203032109cc34d0f3e06872c6c
SSDEEP 12288:hb+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:hbyxknw4FYnshx8OfVe247
TLSH
T1E46523BCBBDEE5E2F50D10730A7173666609B5A5EAB1811BCB7DB00EF4B0C54902E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 34509cb23a54e44516d4093ff8a08334f04abccc2da37c5ba8d0f1ebdc0090d3
MD5 402af7f11e5f7534122848cb46c5df41
SHA1 17396dc958f28aa8fd4f2b992d15d03f98d74bfa
SHA512 6fc6abd3046158c05283e89ff880b2763cbf669d8b12a3bd74b2c1f3801503f6c4239b23b444cf5ba6e7966202b7ecf736144da91a021d603787d0be0aa9c401
SSDEEP 12288:qC+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:qCyxknw4FYnshx8OfVe247
TLSH
T16165237CBBDEE5E2F50D10730A7133666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 0a5895f9f7a725ddf54204b593941894ab8eb4c1861218825b0bdc16060bdb73
MD5 9ea7f1b2262b81597a621c1d79a3352f
SHA1 1dabaa4b649e3b8b77d8d630130b7431f17c317d
SHA512 a74fa8e1c64bd5af47f995b793bf1686f87030ee334b0c5a3cae9d3dac0c6b09f8bb98d28852fcdd96b698cf6de22b1906825b4fdb8bab359e843d16e4756b97
SSDEEP 12288:oz+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ozyxknw4FYnshx8OfVe247
TLSH
T14865237CBBDEE5E2E50D10734B7133626609B5A5EAB2811BCB7DB10EF5B0C54902E923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 d8af0095c0fe19f7dd006900b4ce7c1e7d6b2785f350d9c44cab0c72e0e5624c
MD5 3957aca7a17ede1220563dee347a7c4e
SHA1 40f30875a43bcec37f538f9cdb9c77b6bd06ac00
SHA512 463c2158ff376ab9314a980766c6bdf5e7220207c1857f39def54120ffdd7b3b0a42d18a6d41ef5ad39e0a07b5d161fbf5e2e9270ea34807bc568def6bc51011
SSDEEP 12288:9h+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:9hyxknw4FYnshx8OfVe247
TLSH
T1D865237CBBDFE5E2E50D10734A7133666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 83c1c5bf2b7b9eafdd95f6d43f5add8e323708b7dfe0ede72c57430c09ba112c
MD5 8e65743464cb6aec67901eeda3c4b5cc
SHA1 1c6e9a6df266fa8798407f7bcf8a4d85fe7b0321
SHA512 9a3886761f3940e6b2f30e45e65e92d207474d2ed51711b48e38dc1246e3be7999872a53e67a60db9c79fd6666e07dcfd6872b920684f25d850f7f9f19b6a67c
SSDEEP 12288:Nq+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Nqyxknw4FYnshx8OfVe247
TLSH
T1F965237CBBDBE5E2E50D10730B7133626A09B5A5EAB2811BCB7DB10EF5B0C54901E923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.4MB
SHA256 f78988c1a6c5dd6739585c3c64207298ca3f2132b4a8c4cf8001ee85683dea6a
MD5 9ed566a6f315e6ea27fdad10b137e9c8
SHA1 293f19b6c00138fdc00a2038e36dec04ea5e60bb
SHA512 a741c16c38503ffe6c89e0d689baff07d1237cb53ec0d112835940adf6d9ee2b130b482b420226bc909fa842722ee7b7f4323a53f27b6bdf99cfbd057f518127
SSDEEP 12288:ph+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:phyxknw4FYnshx8OfVe247
TLSH
T1B965237CBBDFE5E2E50D10734A7133666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 3665b8cd89b4b57baa43b4e0d25d412149513f3596e91110f5b235a0a6adbb4a
MD5 600c616f0d604c9df57381e22a4cfd22
SHA1 8627a7c9df37e03c50fa1f5c6a794fbd85d279f9
SHA512 7111dc9e93f9327c61c75fd4d9f83add2ff9a85fb8403abdf2507fc8d9cf6b30a4f6d64f4db56e0edd3aff07b74d22e1d01113a8b3db62648f4429777dabe41b
SSDEEP 24576:vfwvgk9RX6wkyAInyxknw4FYnshx8OfVe247:NMnYIyx4x8EVep
TLSH
T1DB95CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b647e6f96324fb3fe261ecd41e5476d03f74bfdb8f4b28ba1a2f11bd8c85d27e
MD5 fca4ea0a4cb09cbb32ecd1d97ed3311c
SHA1 e92fde9e08cb16fa883d141219a23e4bbb16eebc
SHA512 4588b8c7546dd91269ae8cba3f471ac71f4c8e2fa31a6351348399dba203a4d0194369732d3a9e5642961bc8544311334ab198441b7729ffdaca2edd717b1282
SSDEEP 49152:YYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0xx4x8EVep:XySzP5ix8EVy
TLSH
T1EF066C96A1A841D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 53a54bf542b17f6a11f57e24ee999075ba7085dc29e1147a678165814d198542
MD5 f8624066447d8c3b025b821b545f787d
SHA1 02f4569fe5bed4ce8bf34553e37c2103e41a0a88
SHA512 53a602062c07642c775279f4c6f64ad20b9e528a0eaacac9b2b4b8c2354862b75e894e7cc2ba7a7137a9d56667bad09769183af9f954411397d68f1278928544
SSDEEP 24576:S47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYgyxknw4FYnshx8OfVe247:S47JUQjqirIhCnDHUPfF/Bx4x8EVep
TLSH
T1B565AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 608f94c6b9996125a3440cc5a760c4ea621dd2a9c4c0ab1da71a2ebdb0c0bb74
MD5 bb0a5cb2f069ccf06fdacb68400148c5
SHA1 a5469e233c88a6bb28e7e1866fd7b249f240b38b
SHA512 820844e719446999d3d2712b7c5eecc16ddd7a4bf676d358df65d55b89d46db454819b48a479c64cd04d5001ded982ede025aa91fdcc52722318836daeda93da
SSDEEP 12288:70sfL+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:fLyxknw4FYnshx8OfVe247
TLSH
T1EB750128E29852E4D06E2276CB625641B3237C6597F1D3CB93E0F53E1F719909DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 783e7539910f55053e789e2f21063d8c6fd49e0d22d7257a6a88d07b4c7653fe
MD5 1ffe2f7483c9ac1b42255cbba5019d79
SHA1 436a7543713d6e240475ae12a4966024624848e9
SHA512 c179f4afcdea7221f983fd29c3eae6fe46c472b9e010876d30d85a671821fddc73f83ae0f1377c4e5c30da0186c8ca4a9aba19a5c53b776fedc62c5b543a2c3b
SSDEEP 12288:eyk/U3f310RjGcFwWUdb+4OrmOV8NhoT4kwaRMGG:eyuUPuRqcFwxdbfOrmOGfoT43aRMGG
TLSH
T178351741766BC75FC6A944325E36D6CCA7703D41EE04AB0373C8873FD576668BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 6b45507ecc68572d3e7f7bc4f4381249f78554a03c1d56170ff82551d6f18fe7
MD5 99d5519deb2eff9c653979d5f0bceebc
SHA1 5e8254a1ca992a65f81c2691c22d890d6d348664
SHA512 89d7942aa13eecd2fc61a0a7bef4ec91d9071a397d08ff1659574e290e83d10b447bea9b950011936d7c526dede49245e88dad2a22a0114ea7ea70fa0be58ecb
SSDEEP 12288:lyHbpb0bOkv8uBVKgivSlgZgNn3ziBQR3bkeNd:lQV4Kkv8dubN
TLSH
T10C6509815537E38FD5F76032036A5B4CB768EC16B7496F22B388453AC866B21B1B93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 40b2ca7dcb9fd52bb597b57c037bb5f0a3b408359985d71ed43f5bef3431be41
MD5 c6c7170acd4d2e4b23068cf505c44089
SHA1 69bfbae39589c305388f551277b0b1ded3d8ba8e
SHA512 7bd49c3da1b4c14a28a2d9eb5ba8c5b515a830ed078f6c64ed3d36db1fcfd4d7f233e6153778722ee760b212ba487a8411adf18dcef19e9fe817aadff5d17777
SSDEEP 12288:+R7j+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Wjyxknw4FYnshx8OfVe247
TLSH
T15565237CA7DEE8D2F46D11730A76A221360AB5B49B70C0DBD728B14EE4B0CD0987DA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 fc3c5ec6a869f8db7cfd196cfe3fddc25bc69e13bceee67019cc7257acfd4572
MD5 4878473b67cde0255a5b643453be7021
SHA1 e9343560355ac7b5c0e19e29c739dcde7c437e7f
SHA512 a0c2f6191592567d944f8465007d2cb1b66de95f3d3948ef2adb37982cffe7728a9d9db42f4bbded325b80563d4cc6cf4d918b49852b096ed5a1c78e68b5659c
SSDEEP 24576:Xgb6bmBIi49WNNFpg1rSvFv7bYdyxknw4FYnshx8OfVe247:Xgb4mBIBhGFjx4x8EVep
TLSH
T17165AE1E22EC02F5E0F9D2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 b01ade5d7d5b486dd332571ebb8bc07424563b5429392888205f03207dcba206
MD5 705139fa6c60186dac85e873f491cdb7
SHA1 9241f0b330707e1bf319ab5ea17af7e233445f00
SHA512 ee484fd332e5ffaf2df084d4a9dcb44d5870963513bba5a915efe4ee27774ff7e95087ad299568832d634e985ff5c9939daf22cc58a56790c3d502bba5f71796
SSDEEP 24576:xG88u8FpJqH1Izria7/mQyxknw4FYnshx8OfVe247:U7ZFPqV3a7/Ax4x8EVep
TLSH
T12195F16977E101F0D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4da903b1e2a06ee8dc9aca0eba322821a4cc6aea3cf18e9cb0b2688501509171
MD5 ec0a4d383896395348c4262777cba5c3
SHA1 965b1dea9f82bdc79dfdd27da591dc8fc0b9ee89
SHA512 63f884aa5c23610f8a42e3abf80e556a268c9c18df1dc8303793fc6ad0a44de62511104543464a254d98784aa1d42f2c531bdabedd3798f4e000e197bd4fd484
SSDEEP 49152:NBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjPx4x8EVep:WG05lO43bKix8EVy
TLSH
T10AD5CF6E62EC11F9D0BBD17CDAC6460BEBB23425033556CB02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ca7570dd2997d58b78a39d965c5cf76679671c0bbcf03ba65f58530f858bef62
MD5 99d00029e9be69d351f4afc54be44870
SHA1 175b6105b433128c5578aa939083bb86421732d9
SHA512 16f0731d7106cdffa796550f14ed119a31762a086b77ce304cface29c95c4b160cfbf7d94790dcf6fd06fb3e8ca192d026d46884d5a7d5150dbdab45f2adf766
SSDEEP 24576:gfa5POZ3dpyWVM50JicR2hG0lasx2+47eidn+yxknw4FYnshx8OfVe247:Ya5POZ3lJt2pasx2+mXx4x8EVep
TLSH
T17665AF5DA6FC01D5E5B9D17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 8eeaae92bc4b137151ddbae2eca304996126cc117f5691a027b53d8f4159ec95
MD5 adcf445838365a5fb74546ae64054503
SHA1 bd65b73ca187d0fe7f589e4f2cbec678d2f923ad
SHA512 78f990c9a6af3707f868805eb7cb9b08dc29ece3a1ba5bad4e8a6afa33f7fe6676f9c400b7c4ed5178d0cccd61da3429718c19f7b2234e566f32e5282c9bea4d
SSDEEP 24576:ENcwHdjbyQ4nLC18lb/EOjowL7Fk4yxknw4FYnshx8OfVe247:ENc/zEOVHFgx4x8EVep
TLSH
T1C8857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1e2acb612ff3b4765212926e3a0a9133b34e9ad5f013c3b9fc3c3aea0b7ecbc9
MD5 816c621c4d40087a3f38a30c1a5df8d6
SHA1 2a9a2e5a7885e2241fb2697b201c3aec50b4e333
SHA512 53b2c8ab709b54817eb246ef63e5cf54c78975e6ed02eada07629c94d1be4a0916294f64061de45825716084617edb8e2ef701363e6ff962b17229c9626947c2
SSDEEP 24576:+zkNvNnaFeYhJNtmZBmqyxknw4FYnshx8OfVe247:+zMwBtOmFx4x8EVep
TLSH
T1EA55AF6EBAF846E4D1FEC6B58D238112E6727461073293CB8390C13E5E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 c86c1718b18bc04c483c361fe75f476b263f516de640a6d95697552751d5799b
MD5 bb520ec30864be9d5279c2f6d760737f
SHA1 da73f052086972d8c2ba74d10a2141cecae48114
SHA512 bf1fdbea42992c7cdd6b64d7efc5375632373875653ad816035a7e48cda84666776c976b3c8f27ce01c1fe08896048f8661097f3f7951325e26a88957b08847b
SSDEEP 12288:1HvUrBFrEjwaQE+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:1PUr+NQEyxknw4FYnshx8OfVe247
TLSH
T1A875F12E22ED18E5E67AA17D89924319F771B4621712D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 af2cef3b6a1c240f6187b34539c19e11fc911c009a1b86acb960c3fe3e19172e
MD5 e6b8eeb444cafdc3b3315b024567eaba
SHA1 a71b51030cb15b081866799e1420a3684e8aaa03
SHA512 72482d4780a6fe3c41f8c065542dd76ee22b27ff4a9cbbfb0bf394945308038b87457c68b073864cf0681e04c8b4b0e752d6816662623c967ff87ddc5e2e0d97
SSDEEP 24576:hD3FHshBIYQgAvyxknw4FYnshx8OfVe247:hDVHeBIAAax4x8EVep
TLSH
T1DE85E17DEB9C04E4E47AD1BC8A638606E77138A9033256CB02D491BA5F67EE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/120-69-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/120-71-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/120-298-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/120-77-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/1176-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1176-129-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1176-37-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1176-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1176-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1348-119-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1348-125-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1348-117-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/1348-376-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/2988-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2988-138-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2988-140-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2988-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3272-43-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/3272-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3272-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3272-62-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3272-64-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/4196-313-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/4196-82-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/4196-83-0x00000000009B0000-0x0000000000A16000-memory.dmp

Download

memory/4196-88-0x00000000009B0000-0x0000000000A16000-memory.dmp

Download

memory/4588-99-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4588-93-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4588-391-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4588-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4588-389-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4588-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4804-19-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4804-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4804-27-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4804-26-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5000-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5000-320-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5000-112-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5000-106-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5000-377-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5000-374-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5156-281-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/5156-55-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5156-65-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5156-54-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/5260-336-0x0000000140000000-0x000000014055F000-memory.dmp

Download

memory/5260-81-0x0000000140000000-0x000000014055F000-memory.dmp

Download

memory/5260-6-0x0000000140000000-0x000000014055F000-memory.dmp

Download

memory/5260-0-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/5260-319-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/5260-7-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/5260-8-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/5592-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5592-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5592-378-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5592-154-0x00000000006A0000-0x0000000000700000-memory.dmp

Download