bb669abdc8365846e76e0669350e6843c41f820d9ade8f0e0d0a16660a2a6f4e

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 08:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
Size 4.8MB
Sample260804-j9jgnsvene
SHA256 bb669abdc8365846e76e0669350e6843c41f820d9ade8f0e0d0a16660a2a6f4e
MD5 1057a5e0a6f3f5460fac39c0a266224c
SHA1 11fe29e120954d4777abda01798a096d899676f9
SHA512 dedf97e9d72519ee5802986a882586e11284e9c793367ff1b15bf8913bbf6bf0c42ef27d0ed4a9a049d74de2bae5761ba277b40d9f3261f33ad86144ed6b3168
SSDEEP 98304:loWa0offlGtRvqpJ8cq91X18O/K3iLdfg2KnVfvuAI2kHOBslgJTIZ5Bgp:loWl2fqRDcq91X18O/K3iLdfg2KnVfvF
TLSH
T1BF365B68B7F940E7F69A9174802B450BF3B4B8010537C74B46398B9F9FF72618D1AA2D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2864	elevation_service.exe
3684	elevation_service.exe
2992	maintenanceservice.exe
3352	OSE.EXE
2340	PerceptionSimulationService.exe
1548	perfhost.exe
5436	ReFsDedupSvc.exe
3676	SensorDataService.exe
5396	ssh-agent.exe
4212	AgentService.exe
1216	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\17d0a780763f1d8f.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\javaw.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
992	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b7254618eb23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a4d56f18eb23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000275d73d7ea23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000046eb6d8ea23dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
2864	elevation_service.exe
2864	elevation_service.exe
2864	elevation_service.exe
2864	elevation_service.exe
2864	elevation_service.exe
2864	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	4212	AgentService.exe
Token: SeBackupPrivilege	5436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5436	ReFsDedupSvc.exe
Token: 33	1216	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1216	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1216	SearchIndexer.exe
Token: SeDebugPrivilege	4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	2864	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4944 wrote to memory of 992	4944	2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe	89
PID 1216 wrote to memory of 1624	1216	SearchIndexer.exe	102
PID 1216 wrote to memory of 4752	1216	SearchIndexer.exe	103
PID 1216 wrote to memory of 2500	1216	SearchIndexer.exe	104
PID 1216 wrote to memory of 3004	1216	SearchIndexer.exe	105
PID 1216 wrote to memory of 3032	1216	SearchIndexer.exe	107
PID 1216 wrote to memory of 1676	1216	SearchIndexer.exe	108
PID 1216 wrote to memory of 2532	1216	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_1057a5e0a6f3f5460fac39c0a266224c_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c drvload x:\windows\inf\battery.inf
  2⤵
  - Executes a command shell one-liner
  PID:992

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2864

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3684

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2992

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3352

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2340

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1548

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5436

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3676

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5396

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4212

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1624
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4752
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2948 2964 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2500
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2904 2900 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3004
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3032
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2948 2964 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1676
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2904 2900 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7bf1d556cccda2ad04819c2a764914f7dbc318791413dcaea038ec012f30519c
MD5 b64b1cb6c83889d06961df7a7e886de5
SHA1 78975329d4925886f791aea055a57ea6b64c916c
SHA512 bd9b4ad5668ae0d5d2c52480d3bded60135c13f4c09bd34720f02ca085c5cbe7398663e6e66bd1978414f0682e793f9a93d934fad169e625ef921e939e553b28
SSDEEP 49152:yb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnPb5+Pl6bJTIZ5jdgp:U3q6mjB+slgJTIZ5Bgp
TLSH
T132D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 3f70f44496573b8579502d7b5152d3c9b3b2cd351016dd6e53f1d05ef4f4afd6
MD5 bc403cdf5059ba6f752a47bc32b63ff9
SHA1 1a1abe83c0ad5f92e3f3fc017ec131369e8f1c23
SHA512 3cf68e627d9d631b2a1f8fddb577b6608999fb5653df23e90e18ec240d2105c35f935ede339d55bd760992c6382a58adcfc1c7484b5d151b2ab3650d1b80c9d5
SSDEEP 24576:DXYfDtczAJmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:GtcVb5+Pl6bJTIZ5jdgp
TLSH
T1FA85F11967E508F9EC67823DC8E1C601EA73B85587A0E79B03B499265F333D86D3E742
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 1d792606310445e1cbc420bba88ad8d92bd7356403d284cc75d132b98061c077
MD5 2541fea8826ca91466fd86ff583af059
SHA1 22d1e84d0e96138c015b6b798c41f1c900aaf526
SHA512 93d1b1f4886898db8c89b0cb8b6366f7352f99faf0a51627d5d8c383c2528cecb8ed21bbcfcaa61be29a84cf685e8f02d2512432e22ddf6a105fe496cde8426a
SSDEEP 24576:Tt0Le5ji0hmxyrMwmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:TtPji0AI+b5+Pl6bJTIZ5jdgp
TLSH
T1E695AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1d85bacf89f0873af54791e58e650eab17d2777f92d32f7e494d813b9d4444f0
MD5 ef16e045068c19c9cce5fffc81316753
SHA1 6e89b0db09392ca5dbd3797f2cc3f1a97e4bfa4f
SHA512 4aa61ae36c373e045e63555161675ead95d78717ca643f150fba6ac15401bdefefc832ec7fc23040eb0f0fcdb79fa691fb8255c731075bebd2b1262531503cb1
SSDEEP 24576:5a7/ezSC6vUyD/aqgrvWj6q8wyuamb57GBiOl6a8JTth/RWZvR6wQQ92pN3:o/ezSC6vUzPv+HjyCb5+Pl6bJTIZ5jdw
TLSH
T186756C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5e66b12e99a7e1ed90b7dd98afb9f33c33a099066705b72c3be820416dbdb1c4
MD5 2e6c6aa4dba1442107dc265907906e54
SHA1 cfe5f2d90a2b61e7abd9070ce2b6ca2232c4d251
SHA512 365a0e7638b1b08c147d91fd6924c0c955b2de32b6143ac3e19eaaca46f6bc231abe998cac6148ae83e62f0ef4799161a562a75172465151b9f04882ea910f02
SSDEEP 24576:1VbqPb88hv/l+Bdmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:1VO88hXl+eb5+Pl6bJTIZ5jdgp
TLSH
T135559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 065af36f5208e147afe64859c88ff3b24fc8861332c04f07964c5a8c458e1f89
MD5 a6179854cc65e1604bef78cccf4ca1a0
SHA1 a2ec84950e632e684e49422523435631ed81163a
SHA512 c32c8ad189edbcc2be15f8b046708fdc9cf540ed2575801820bcaed200511d87643b35cdc56e164e24443a954d25389acc9e0d2afed4b512bf66b9f2aa15d09b
SSDEEP 24576:EFkmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Qb5+Pl6bJTIZ5jdgp
TLSH
T1F16523838B6930C5E5AB1739E9CDDF00F87AEF55CD866B76C5752C2BE034249B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 ca680676928ca60b7f6d2645909ede410b8d791a8f0c9cfe793a86ef1857a884
MD5 d4dd35e3b100f91cfe70ea5d115cb501
SHA1 7a7392c257911c2764b01cf0d9c073232a3417c9
SHA512 01bd2effc3c3fd379b20a4a9c8a5de9c3cbc7903696ea60ea52bb991def13930f946beade47b5db738a16dc1695b7ea5f652034d539404d60292501f957a1b06
SSDEEP 24576:qJIU1mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:qJIU4b5+Pl6bJTIZ5jdgp
TLSH
T14F85CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55E76815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1b4f4d69b408722d9957cb1b913810d1745e7b8a4bd00097106dc76feb633c2d
MD5 e7625249d8ee87d8521f68d192de8084
SHA1 942909cafe9ed62c78e184a99541f0eed467b220
SHA512 37665f6dee4d42af3fbd27c452c5ea54b466f942a08bbc381f8d9651a7ad4e0628c620b84d0de14ae7e208322db9d1020957eac242eadc0a6a5b94b1aca2ffda
SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THo:SQvGAdlCEL8c/WRNw5CRslgJTIZ5Bgp
TLSH
T1B9266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 75ef8fffb0dee7f0181aed6cf7e4de47aa6bfc89373a46d3d4f69ba2cc5c6606
MD5 9594be1b03453e949228b0f1fb90f57e
SHA1 80dad5d94b438107cf69e6fae30f93e1dfb797cd
SHA512 83d14bb6676ad5ff15988921a451a391a7b319f49fc13c3649986c698a8bf75897575f8e7b764b273d12ddeb48edef74d730fb8dcd534483c885fc471ce2c7d2
SSDEEP 24576:iOewsAjvmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Rljub5+Pl6bJTIZ5jdgp
TLSH
T14485E031FE74E036C2BB0DB65B65C716643DBA208F511AC3E3B84D9E99302D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4d3cc25a8d4f8ebd950c24b2a42e0f78875fad75d03c6f0cb031693e05d309e2
MD5 bc351c5a39606b63c4084b50fa07f7b7
SHA1 33be7643a1731eb96dba427aca9d3c12e008ce7e
SHA512 f0c63154048a0e15c89439b78039f03ea898968ab522d15cb1c1b73f0d81fff7429b45854db7d7974dcb1cbe1c7bc73a6a9b590d7908f73bc09ec083f7c5f141
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHssT6p:lUEtQevvqc2W1cpV20I32ss
TLSH
T1A7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9bb8de85a07e133d89afc9385871e275b471b9d3e8f39604f9e1b7ea9b50dda8
MD5 c4c929bcf1d6f1d5acce63ffd6497df0
SHA1 f200640bd3717ba411551e6ebbdb0cb7acd1a87e
SHA512 6d55742f111709f01138a79db63d85a0044164fd74ee435940c0cf00c174bc187d40effcea6c669b7b95ca1abc596f2b75861b17a80ee010629a7cc6d1bf626e
SSDEEP 49152:bCbRquA/m2yL5zQfFiV+XenmE3/zOb5+Pl6bJTIZ5jdgp:EoqtVjnmVslgJTIZ5Bgp
TLSH
T1C7D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4fa7868692ea75ef96fe6723cb536c8a25234519f7b297d945b54c1e61dd35e5
MD5 0864245df716aff40587eb287aad4f9e
SHA1 f8265c7322565ccac55b058038771d80191f7840
SHA512 8465f8126fd43a67393063db7af2ab34e6c9b868d71f375898b29f914bc546e4599d3b7e8b25ae7d632945a1a73d14a3c22e2d25662bdcc49f95c38602605fda
SSDEEP 24576:2AhGL6IFoiwtA5l7S53mmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:2AM5Foiq55b5+Pl6bJTIZ5jdgp
TLSH
T1A5359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 13b35902d2e94a292393da35f8ec745341861973f9899c74a3f7f26ffcbf7622
MD5 191564ae517847220c17ce6e857197e9
SHA1 3b3d7ca277904b166b2e1fc32b50b5eede5fccae
SHA512 6c25351b85c7291f2e029b3048a869be288a9d700ecd5ea2ab9076d08333848c954e6689800e52c2d58618f5c62a1990fa03f03295e8c084acf02dba58efbec1
SSDEEP 24576:QwuGOWrmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:QwNOdb5+Pl6bJTIZ5jdgp
TLSH
T18375F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 a5ca7cb3741fecee4c3a2603848ee102465dc3313579e557d660f70a001aa758
MD5 7da890c330272f86d096f9eaa59023b6
SHA1 06bfa63f1aca955bbff8cc7e05a0f300ba8b9079
SHA512 df9b94facad97678e5dc65b1fae0bfc09162bd503571076101d4dc07746640b7eb1f045468b1d79d5b2c527a60acef84abc80ff70be67965846a8e45beb45471
SSDEEP 24576:5ZuImb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Qb5+Pl6bJTIZ5jdgp
TLSH
T16B65128A17A830F9E1A7533DCCE58B00E772B8529B7653DF4674056AAF32BC52D36312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 bc327ebc384b2bceacd0d17fb682b62ea99be8c68c0bf053a4824df0ca3c880a
MD5 d9f39df4b1534e1f9bcaa01023b21dd1
SHA1 5dad09a449036569a775d426117e8e8156cbcb0e
SHA512 b22948f2c5f6399b551ba51c36b8a06f40e8dab19367a1db5182e4dfd5a4871b75b86fe199e42b8a8e3e1d59fab481df9130210c95e74a0ac9648aebfbfbb888
SSDEEP 98304:PQRQyi36YOcPDLvw2gAf+PN36slgJTIZ5Bgp:+QyiKanX+PNqsT6p
TLSH
T1F1666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0cb11561abd863d22f1d3daf42d4acfdee15b410b75b7f055536c52a603d235b
MD5 ebd32ee09a8a9ca4ffa8581d78319eeb
SHA1 c729b805ee82af11d201e528f097b7b3af1f2f9e
SHA512 5d33ff9b8440c79efd2b08b43bb84c334b0f23cc3c58baba22a86bcf3a8083250d4fd7f9339cea29d5f05a81aa112fddfdc72a163d862dce08bf2101bf7db0be
SSDEEP 98304:2QRQyi36YOcPDLvw2gAf+PN36slgJTIZ5Bgp:9QyiKanX+PNqsT6p
TLSH
T1A3666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d4c94864e7b0e307fc4a76ced9c89e70bb740489df6855506d8217a49e3c83aa
MD5 aa3375494f290d65de3758c301315cb1
SHA1 b9a6bd35b6b70e21b7dea4a082e49d5ab16fcb2d
SHA512 d5bde1d3f6bb1298e25342c7fa1bdeb136282006280e3b75287bb83f8391f4c1bd479d5965da6ba16e54fc3ba3914820826d0197cb01e03a9033c562553eb1d9
SSDEEP 49152:S68Qg55nhkeWu7PNU3/+b5+Pl6bJTIZ5jdgp:QthTRc/EslgJTIZ5Bgp
TLSH
T115B55933B2F60099C44DE1769F4A872196E27C71CFE1E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b785066df9ecd170c208839342156f04f7fdecc0180d6b3107e3ec9d1ad529da
MD5 13b54561b6977d5ef08e654cec6b596e
SHA1 8c0dbc35d5d8248dbf6cf2cc42d3ef7f89eaf44f
SHA512 2a003d2893ae6b96b4000a33f896767d07a4c75d217641411cd6b199c15df115e2acee142e29c7e18033b64aefc2f659967b0d0e77d223954f94cc94648ef4f4
SSDEEP 98304:Cy5112gYy5azzVvU69nLKnhZ3slgJTIZ5Bgp:LLIHRWhtsT6p
TLSH
T133167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 200ff23a93b165f126d001a423b3bf51a00dfcdd05f7472572d88550b9d60f8c
MD5 0f6a7d251a0c7346f2089e5d214637cc
SHA1 eb1494bc548746cb38bcdfdf24c71fb1900666e6
SHA512 cb79152b232ca4e3cea823141f7377034ba682e54ddd4ea34def571b9458577b503c816859bf62ca402dec6d221cd28cbbf45823f6ccce01e76d01fdd5a0bc7c
SSDEEP 49152:JB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glUb5+Pl6bJTIZ5jdgp:fu6JmIxd2dCslgJTIZ5Bgp
TLSH
T133D59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5fa161ce6adc4cd91bd4e4deaab0cafde71b7f6e5697bc6e7391c5dd1ce281f5
MD5 733eedb7733c0bb3ace1fb1bd49fec3b
SHA1 43a354490b7d3fee74c75518b8e52fdcbb00f155
SHA512 e7f5479fb493601e0a0a02b9ccdeb1d8a6543aef84fbe417607a6cee422d135694ff5d30f06fd71286ea7f10a0e198af55e6911cf291ad96db4056fbb44dad06
SSDEEP 49152:61hpsNoJpF1A67U44CwH7R4xYb5+Pl6bJTIZ5jdgp:6mifPqRVslgJTIZ5Bgp
TLSH
T113B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ca139bb6f2e228f8d986371d631691995f6420d9953b1d9d9951a2e511c9a9a8
MD5 3d76ba90cd32cc615f6a7fd96581f623
SHA1 04f0caab775e0a8bd25bc7aeea43c1793cc77bfa
SHA512 b698b40fbc24709bab6126a1a3d76c744f733965dcfbbd4f6c433f79f5bb638def23af57062cdd27baeb0f038843769978a4e5c70c1f7375dd4338277ab819e5
SSDEEP 49152:LSuZQIY0Be2KkRVtOnks6NMHq/b5+Pl6bJTIZ5jdgp:Z5dKqi61DslgJTIZ5Bgp
TLSH
T1FDC5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF065072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8b35e47e15e24c73abcc369bf72fd37b1c5f26eba3a05b9aa0e1317099ab4b5e
MD5 f9a4ec003b6a64741cb007985a586e74
SHA1 718c22c5030113f18075e76d4fdc9e15e085bfda
SHA512 cf2af145349be55c799ce4293a9288b7638c10ddb485a504d1952b71d02cb380f6246c90d7d3550e1cbf8ab192d87c683780d93f7f27a6646875f2e7192e9dcc
SSDEEP 49152:zhtSn8EApI0figjgiDn0AP5wEb5+Pl6bJTIZ5jdgp:yX2iWphpslgJTIZ5Bgp
TLSH
T1C495BE13F2D900E8D05ED178C7468632E962BC164B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 fc127843d1065598ea034e9d912252c808b55d240e9f662b8e44d545b1dddd2c
MD5 303b56471c3bbc5c55b174f9655fbc7e
SHA1 b53fefb38652a7347f0d789130c79417b3599fb0
SHA512 45d1eafc3aefb77cc3f66f5ef4913c036a2730b3716a816c739f23c7f443dec2757a659184b12d9c9744039d0cd07279ff31062c59681590f6003580e25fd4a9
SSDEEP 24576:D8mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:vb5+Pl6bJTIZ5jdgp
TLSH
T1A76523874A6B20CAE45B5739D9C8DB00F87EAF56DE8727B6C57D0827F131389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 1e87e78caa7ec4c48af00dc0105612ed4cd8484425a6f80290e3234e3b8b4c0a
MD5 c53a1cd60a68ecd268181834db060116
SHA1 30a85c9cc7905ef9324ec24cca6676f1c0115a32
SHA512 23a349b952283af39dd7ef5a9ca51bb9eb6a1c9fd72094f0314aadeb5e11bce7bffe732504b0e41676f195131a6655926f818cb389e53c9bbebf85c99fe55a06
SSDEEP 24576:3Tmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:ab5+Pl6bJTIZ5jdgp
TLSH
T1CE652387496B20CAE05B5739D9C8DB00F87EAF57EE8727B6C57D0827F131789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 8b6319718ea91e2c45d784756073c213095846ab1ed445299ea0af2f6936cf7b
MD5 86f0c1ed5752b250f9e9ee2f963c4dc6
SHA1 4ac6545fa82c3dab8c9cd2097b47f4ea0652196e
SHA512 0df1a0000d8c3b1ca99efca7d92cedfb3d469a7224c50116728904b3c952b6cd4433749b5eaa1e757ba02f618f8cbcec3cdbb01aa6c5048b1b4e7d6d408cea97
SSDEEP 24576:Vtmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:+b5+Pl6bJTIZ5jdgp
TLSH
T15E652342496B20CAE05B5739D9C9DB00F87EAF57EE8727B6C57D0827F131789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 bc918182a5bfb223576837ab134a096b635f8c8cd2f506b5df86c90bbe2cff5d
MD5 e6817550b13473d12756aa3d6a4b2a0a
SHA1 39c116405a22162d6f4e3693debcb9b9f5c6e1f9
SHA512 13467f53eb78323b29ae871135efdf927f584e3f6a1cf47f5555f942d5eeccbe5dc1c1243c799667a9eb913f0a6500e52dab990f7fdda37f9b5e0a13e3f26b7b
SSDEEP 24576:wmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:nb5+Pl6bJTIZ5jdgp
TLSH
T1956523424B6A20C5E4A79339C9D5D700F4BABE96DF5667FFC675082BA9313883C3134A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 0c01ed4d76049b74d1eed8b34e366783a638a341cd41929fb1e3f41b949424aa
MD5 97adfa01aa32bc7cda684fb9cbb794cc
SHA1 797a23d272ff23a2185eb828dfb92162b6405d9d
SHA512 ddc80a4c2fb15da9c3457d0d86e9f4b3bc1fed7033b976511e76639d8c54fa0029e442b9568e0260c3b458e2aba632e16c7a64b1069d6c832f13ee0bff2d2b8a
SSDEEP 24576:Bumb57GBiOl6a8JTth/RWZvR6wQQ92pN3:fb5+Pl6bJTIZ5jdgp
TLSH
T1B7652347496B20CAE45B5739D9C9DB00F87EAF57ED8727B6C57D0827F131389381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 6379deac0904beee712465fa0834ced5da7134861b109f7c58f13a3cdf29bd0d
MD5 9013da189307aed3ca894243c0462036
SHA1 910059df32b21e4fea84ac6ec2fda0d7aaf82a90
SHA512 2e0f15101c4d8863515211c1319b6c5106b682674b55ba8aeb30b8c4ec9eca8428e3fa1144c73c7e70e5000d625ac3db4ba5b7010706a0d37e84ed36330bb30f
SSDEEP 24576:6Hmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:bb5+Pl6bJTIZ5jdgp
TLSH
T17D6523874A6B20CAE05B5739D9C8DB00F87AAF57DE8727B6C57D0827F131789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 ba0843da6c9df63248ff0436f4edf386592323fa30f4cbbebf591570a4ff3098
MD5 4d3a92562e14ce20261ddacfe9cb0435
SHA1 91078f57f8b7e903fc802f58c236d557292faed7
SHA512 52b051bed75d468cc696988c261465f564e4594808b47b8c29a366907f6168d0c00ff0be5074e024ecfba037d3c47c5306871ef7a22e5c3a4627799d1fe18f4f
SSDEEP 24576:z7mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Ob5+Pl6bJTIZ5jdgp
TLSH
T17E6523878A6B20CAE05B5379D9C8DB00F87EAF57DD8727B6C67D4827F131349381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 09cda6f5a3931efa1266f3848aa6082bdad3028da8fa83be121357930f16df26
MD5 f4f2a8c7f3d8ecf5445897cee509708c
SHA1 c8b2d05d70226d82196582a9088fb9db75f7b26a
SHA512 77f788dbb9874166581eefc1194700cb255dcdce705e267935938822178b08528a5bc6f0724363748afd3a70fadb0ec97951963401f5977672fde2a4e01839d9
SSDEEP 24576:eZMazFVSOzmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:eZMazf2b5+Pl6bJTIZ5jdgp
TLSH
T12285F195B35018F8EC67823ECD958A05E5B2BC5A4B60C65F43B836275F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 43aaab2d08e93867800ce612be6b08c8221e9e48187a93e4ea79f41121eaca3a
MD5 575dbfd3912ed207826e7344490161da
SHA1 3cdd2cf9d36642e3bf9b4205084574d1baa988bf
SHA512 1993ff95ff59ad342785ce4a0c59ac7de767e3c685ad6e3a06d3568b5636555a1ab59062a4ae371b6a88b08b3ff77b2497b93c16beb16a3177f477c0e9c3d43f
SSDEEP 24576:v4mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Hb5+Pl6bJTIZ5jdgp
TLSH
T13D6523874A6B20CAE45B5739D9C8DB00F87EAF97ED8727B6C57D0827F131749381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 7b4852889f58ee1f66a2695f8a66854a31bcaaf8319518c76840c4525bab9817
MD5 ddf24f66512a8557b05f61ca58938769
SHA1 519218ee25ccc0337b3d0d74550fcc909b31dd01
SHA512 d90bf0cd578ebf95c0859235146601b69b2b4926d6e2470502af0103680cb5863265f3f0682454a8e26eeea58bbacd2e5107f8deadc092923135b328666d2d01
SSDEEP 24576:GUmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Gb5+Pl6bJTIZ5jdgp
TLSH
T1C56523874A6B20CAE45B5739D9C8DB00F87EAF97ED8727B6C57D0827F131349385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 1723645ec5296fb2e0650949b3494173ffee442f40c42eb58d508245a0f97bab
MD5 dac645de096205b8fa40091520ae1e45
SHA1 52a72f37f365c14976369076e29ca8ca01f7a202
SHA512 7e9409c8bfaaf7956fc371a34345ea74f6d133135d4707634762d22ad344e209ffc530c25964d6978da60277f53e97ed53558eaf85fd48c45843409e947689ca
SSDEEP 24576:pzyfmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:p9b5+Pl6bJTIZ5jdgp
TLSH
T15875024767A630F9D0679239C8D25B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 8aea9a6e75045c9e9db6b040e3dc6031eef2e0b3e22c2a1fbd73d1499648758b
MD5 248a32d18d1f6e5555f90a69147e2dc1
SHA1 6e92e39ffe0fe9d4e24d1e1eb82db8c3dd57b863
SHA512 6480b6aaaf4974d1b3fe72910d4a972a46adf20677577acdabb235a5495c351f6ee83e9a5d651de43a69117c8ddd724ed8c62619f917dce112d1a61f8f69cc83
SSDEEP 24576:m4mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:2b5+Pl6bJTIZ5jdgp
TLSH
T11D652387496B20CAE45B5739D9C8DB00F87EAF97ED8727B6C57D0827F131789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 cb31540d8afe589ed73bb9a9316f2b4c54ec4f51b7a94b409051e7435332cf7f
MD5 aee55bbf9ad7ea778757e1e66057295a
SHA1 f2fedb33ecb6dc5f61b3ab2cd09efe2b119d2c7e
SHA512 5a735df5a6eac5bbd26c012ef6420e7bb394b1ab464b07693cc9af29e5a6a057e572f9ee2b5f2171f51b8c2a93c575413f53057b288506e4da1c30cfb9a588f8
SSDEEP 24576:z4mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Lb5+Pl6bJTIZ5jdgp
TLSH
T1B4652387896B20CAE45B5739D9C8DB00F87EAF97ED8727B6C57D0827F131749381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 21c31bc3b31ce49c9eb6c3c375da6eb5127c20eb46ee4bd7034c52b1fbfad516
MD5 7e2aadd3417b8b89d8f6da5ca8502bd5
SHA1 bfdb9d8171c401b4521605e3f388a9f01efa138d
SHA512 4322f9774b56057ab97b92565efaa58f55ea27424e3083c31b510de05ea8d73657555d1607c1b7c38491e45f9da536cdd83dd2c2347ad102277c1d67d00a84de
SSDEEP 24576:Pzyfmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:P9b5+Pl6bJTIZ5jdgp
TLSH
T18475024767A630F9D0679239C8D25B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 a100ddaabd9f066a54afeb60322ea573055db26e126feec8d3bb8dee2b22b381
MD5 431f4a512a3d2729eb62de5752548801
SHA1 562deb72f48ad1447904a01bdc33b3ea35a9e9af
SHA512 f24496265b1c374f3d5c636fe73ac994135f64e8efa0d94125dd65ad9f256e1e3d950731a32bc286697c6ab72a8667acbecce5a7114f713c2d3aa98c95bdcbbc
SSDEEP 24576:+T/aLl3z0zD9mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:+TiLljFb5+Pl6bJTIZ5jdgp
TLSH
T13C85F195B35018F8EC67823ECD958A05E5B27C5A4B60C65F43B8362B5F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 8aed0444ddf1250525707b82a68ac5b6052fe681ffe83f62ec0d0b7d70b0beaa
MD5 c20ec3ac459717270ff77217fff510c8
SHA1 7f12de5105fd69e402ef9256bc4d8e44464673be
SHA512 9474e736398df0e631145106ca13f881faace5d60c914ad9cb77a28fbdf368987345b33bcbfa84660ad006d72156b0ac74582cc7f6eb5766ec047144f143dd9d
SSDEEP 24576:23Ud9CHKy7GZBmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:YUd9CHKya2b5+Pl6bJTIZ5jdgp
TLSH
T13C95CF90F3E410E8F0B79A35CDA68611D9B67C5A5B21DE8F03A8251A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 3775585b27691dfc53d204fc213a2b93647c22ec84fb328c3530536e7e9a3fe5
MD5 e9e891b5e395dfe6102011bcff7b33b2
SHA1 a41768b695a70c662ff7aaa07e6daa07982ab58c
SHA512 621ad66f2b682bcf18c2b788acb3da2e087241d4c0713b529c9b27d2304c8f3f90007f3b72fa4107d3520007498839edd8a1c7fa95b73cbda09693d4db0531dd
SSDEEP 24576:yNmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Hb5+Pl6bJTIZ5jdgp
TLSH
T14E652386896B20CAE05B5739D9C9DB00F87EAF57DD8727B6C57D0827F131389381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 5f104a15334eada2b405b25c8f2c8fc4908bb7b6134d5b1cbb20e34816eac828
MD5 6c9072473bf1e81487083750faa17f0f
SHA1 597f624d909f9e94f44b97aac57a0f98d80f2410
SHA512 2a4ef6f8afa849ac6e405da55057d1fb952e07e357557e51270927a928fbecd188b9073f2160c50535aa2ea89c9a9e138ab2895e321e94162e9e1eca55762af3
SSDEEP 24576:t/mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Mb5+Pl6bJTIZ5jdgp
TLSH
T1F66523864E6A20CAE05B5379D9C9DB00F87EAF56DD8727B6C67D0827F235349381220F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 69428e6fd0de848f26cadc4c4d4104a7019f37c484af8373cb34f0fd16cdf828
MD5 e2f69863d1f987bed283135807de70ec
SHA1 02b1ba73e00352b05033a4262520471f8ce4b44c
SHA512 7819ec21271e5a616d9e9f36fe0b750032a51a5e467f8bfb35d43418a1ab3bdea44a26058be7ad662772f6ab33e631cb455aeba92fc5092d2273dfb813da3608
SSDEEP 24576:Himb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Nb5+Pl6bJTIZ5jdgp
TLSH
T14C652387496B20CAE45B5739D9C8DB00F87AAF97ED8727B6C57D0827F131789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 16fdf15f06c6a116f0d2a75523d4c563dff2be4e282994aee68295eb5070bb43
MD5 06bc933a2f67f4522acd2b49158218f6
SHA1 30c94bd7fe4f256f5f30a1b3d4927eb3f65e963c
SHA512 b6f032eba10f4c1133669dfa86e8f2c408dea3585ee86ea076ecd8c9d8e5b3ae29453e38594cb776e46e7efb614c1d820aae61c42ae5237ab4d760bc05e88f70
SSDEEP 24576:z4mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Lb5+Pl6bJTIZ5jdgp
TLSH
T133652387496B20CAE45B5739D9C8DB00F87EAF57ED8727B6C57D0827F131749381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 af885cac7e3c41fd22404fa0c16734a06c85a75ed243dfab8ce72df52b03c5b5
MD5 3bea3e8246ca0470a2afbbd661cbd09d
SHA1 2ecb93840fc03b14af42e699a9ab990c7a884960
SHA512 ffad3822dc4cff8c15a5b62c212c70fb0b668d9925cd397bc08dcab10642ddcbd6054681b467daa95bf6d37b10ae59eba7cd4dc511f45c0abd78d921eaaa9dbf
SSDEEP 24576:oNmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Nb5+Pl6bJTIZ5jdgp
TLSH
T11A652386896B20CAE05B5739D9C9DB00F87EAF97DD8727B6C57D0827F131789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 a4f65f988135c321a9b717f58bd9056aba012f72e57d057d49458ee6e5f65aa4
MD5 b55daa34f77925fff8cb470a7478d5fe
SHA1 e770e5ffc00e242459992fe7c73f8afc38195c3d
SHA512 07cb15d725ddf24560ea4e738a4bfd679827a0df71c5c3ce31e2742795b4b736c12f2374186384b055dae545874d720069abe72dc36595e66fa1e82b1f307a51
SSDEEP 24576:kAmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Qb5+Pl6bJTIZ5jdgp
TLSH
T1F56523864D6B20CAE45B5779D9C9DB00F87EAF96ED8727B6C57D0827F231349381220E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 e85738429b47b04d9bd7fcf16d5b0ae734026e07955bb13b11339d512433bc25
MD5 721414ab3a87de3db941a535ec9c3a60
SHA1 37df044f8e3fa34c72d6bf6e09ced863738465ea
SHA512 0fb0e472a4be7971f28da07423db6dd70d044c2cfd35f39fba29c4412bff681b5d2ded127f4960afae3ce59c1d02a530b629780998efc99d470d8cb0067708ea
SSDEEP 24576:fumb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Jb5+Pl6bJTIZ5jdgp
TLSH
T144652386896B20CAE05B5739D9C9DB00F87EAF57DD8727B6C57D0827F131389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 93aa08819ad215dbb72ae4a03459ee3b2cec339eb362a5b87fdbbee8ef7da973
MD5 1cfafce1bd8e9c882999359d42caf568
SHA1 1c0631fc39afcbc705f4f17e0eb16c81ce8bf468
SHA512 9ccc3503090bcf754f0ab9b1a81eee244a2ecfc188430e7ae6f1416d335be8dd6b021929cff3e87992de39dac43c3362f10137d5623ea0d1c9b4dc19367c9478
SSDEEP 24576:tfwvhk9RX6wkyAIEmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:aMnYITb5+Pl6bJTIZ5jdgp
TLSH
T10195CF29EBDC04D5E0B7923C89E7460AF6B178595B31C6CF02AA536E0E33ED46D3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9ee9aefe6aa93df3d50024a56a9f4dfc3a573973357cf2a45733bd04c1cabdb7
MD5 0935ea483d927a95f529fa43f30e7386
SHA1 9da1c7757782058ddecde1bb36044d755262655b
SHA512 88e65fbeaf2797022c8bfa75e56d0128d0d5c59618a80ba61407e18ca49c1bdd70e55977cf8b24067cf25ec9ff8ed49c3b63fee6d79038c039e0867b8253bd7a
SSDEEP 49152:RYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0kb5+Pl6bJTIZs:oySzPaslgJTIZ5Bgp
TLSH
T128066C96A16801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d6c1be55c2e147e026c6c27600c4b48fd30ff65748e491f1a976593a9a7062d1
MD5 653843cb8336067a70d9f5fcf8bbe906
SHA1 83dbf3e9c13098f2e25c43480e1143602e0b17af
SHA512 a2ba0d4288fbfccb1f5e3e12e6ce5d306e3dba4e7cf4f63905d149db7b1ed89efe65ab9ae67c7394437d3629c19e5a36a62ae5ec435a0496b297248cd99e6dc2
SSDEEP 24576:W47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYjmb57GBiOl6a8JTth/RWZvR6wQQ92X:W47JUQjqirIhCnDHUPfF/Ub5+Pl6bJTl
TLSH
T13B65AE1EA3EC01D5E1BA923885558A1AEA71782E5F32CACF1270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 1c1d13e62ce574ee02c0705f3ffa3d6c79ce39efe49773b8b864f6b31dfbb730
MD5 cebef181e3ddcb72bc0c8b96f1f64a81
SHA1 8d4a6af46467fff1d08b0deb696bc25ceed9749a
SHA512 24ad120731b0124c1835c79a3cecab999cdd783b0ff0d963bb215136d6da941782baa0ce3e47c732e7d0bfc704de53027bb25dffc3bf1cfa3c409b62e1449332
SSDEEP 24576:kImb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Ib5+Pl6bJTIZ5jdgp
TLSH
T16E75F14AC29811D9D06F6279CB858A00F7377D658BE1A3DB86E0F43E1F366846DE6703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 6905c8550490c1e16636a8a581c80ef419d2684b6869c79dcc34cfcc3ea770e0
MD5 f59068022bd3c8a7be9674648256d891
SHA1 077c838ad00ccbc6dd79171b468214be487ad0b4
SHA512 baa9d40314481f2a953d84c03cdae295df8cf1b88fd07376e9d8e5326c253afaf1ec9e2d0c5b898075a9d07c1f455b9e69d71dbf9a2b0632e99eb71a92894bfc
SSDEEP 12288:pv+RIU3fg2euDJLyyKSOuF96Pk/KovMzHfLeDckF0/ToV:pGeUPHePy/OdP+KUMzHfL+fF0/Ti
TLSH
T1C8352750B62AC75FC6A940325E32D5CCA7707D05EE45AF0773C8873FC576668BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 43ad12a4ce31c5cc9669f0d8ae03fe50addac335560965a4ca95a4860d2d9d9b
MD5 5fdb38060c8da266a644f42ead45aa7f
SHA1 1d26dea3d36eebc071ccd83c0b0facf4831ed55a
SHA512 3b0e87d65689db3a98f97e0639c54cdace0ac7e92c6a1f1fa0c40070a0c61b6dfb4d539d6e621e64ef521ce7f24126d99daee6d10c106d984b56021197f090d0
SSDEEP 6144:+uvstFitmx2zzBEz+za+r+/LJ8JvJnQY00l5YA7VO6hMytMxHMytMxkvPYsMh4SB:+7FEdEymc4LeV6IdCojJQHBx+r
TLSH
T1D9751B815137E28FD5FB507203295B8CB7B4EC06BB456F22B3D84539D82AA25A4FD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 56417e267adee382fe39fe8ad0816b08dcc10155bd1bfa4ebd8ccfd0532e5df6
MD5 b56e8ff8b9c0b1be4eb05605d58075d7
SHA1 62e181e7b7b396ea9b3cf1eb7362366622bbc8a2
SHA512 deac2ce03f3d0ad4562fd34c8a551083164317165b1386228428632967167ff4dba731b89825a0be52ced6cd83916b693ee4f38c4c2b6f793c86b0e4713027c9
SSDEEP 24576:rQmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:rHb5+Pl6bJTIZ5jdgp
TLSH
T1A26522428B6A6086E4BB5738D8CDD710B83EBF65CF8566E7C579142AF1316C87C7220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9043e234103985a4f16f12ac5a7d2db18aa4168a9a3c9064adb191ca0be3c9ac
MD5 636b29a0d0283e271f73e12379aed9c7
SHA1 243518be7bbfc31a1f1136d85bbfed51ca384d4c
SHA512 ec458e805d702676818880ab2269234fa907fd367357d27dcf9f2e22393b2bfc3510ff84a53e860349d2a2d2b1460eada828c66b81c4d254de316e08752a22eb
SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bYamb57GBiOl6a8JTth/RWZvR6wQQ92pN3:Qgb4mBIBhGF6b5+Pl6bJTIZ5jdgp
TLSH
T178659E1E22EC02F5E0FAD2B8DDAA4417D6B278164731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 fb6d69a316430d870730f7340765b00b607f4352d09d0ed68ab71ee4187f7987
MD5 85228285817fe1d209f0a75a348fa895
SHA1 a06472e4c85b39e31222c88854fdb21e76342d25
SHA512 4124e4271cf3d83b8a984412b9623e65fa7546e1a2ee929cc0d6e902ec0e87f265f908189b210e34a1196417439330ae6c9a11bcebd7e6fb405bd059d146150b
SSDEEP 24576:wG88u8FpJqH1ozria7/mzmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:j7ZFPqVXa7/Nb5+Pl6bJTIZ5jdgp
TLSH
T1A495F16567E101F0D47BD138C9868663F6B2B8250364EFEF06AC8A561F23BD51B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 7a219bc032793373540f689be84bc0f90489c24977e1c486c390c1eab2e22237
MD5 9195a3fc9074e31334c9af21f49b89a1
SHA1 a7b3d3d6dd5b65a0515753f4df81e32ef6416018
SHA512 bf811621a93df9379c2a020bfbf0fc7526220edb65ef6632b6518145aad2a2164f7f9da68325914983051f5efa1b9b76aacf84ae4dbeab0969c158e6f74c773c
SSDEEP 24576:WPUr+NQ3mb57GBiOl6a8JTth/RWZvR6wQQ92pN3:WJQ2b5+Pl6bJTIZ5jdgp
TLSH
T14975E11F26AD18D5E67AA17DC9C68709F672B862471292DF02E0813E5F23ED87C3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7ee882abb4738069e160ff4448952eeeedaac93a408c7abc0e6c43eb2e03afcc
MD5 e4421c9aaf00db36a14e127d70e15aa8
SHA1 449bed3fe6be65a9bb5d11b1c37d1b1e7bf0d06c
SHA512 89042f4b66244a6583e07f8d2956421c80e0a6aebdd86083d853965088c2181b322c51b1c367aac76c56d6cd45d1116b7d48923630d71e44dae089a181ea73ce
SSDEEP 49152:hBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjGb5+Pl6bJTIZ5jdgp:CG05lO43bPslgJTIZ5Bgp
TLSH
T144D5C06E62EC11F9D0BBD17CD9C6860BEBB23815032556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c8306e41a5ab61effbcba48f3275835fe77500cfc3fb94e1bfe24202a310d727
MD5 a1d674ab737f5bae415c2ae3efbf1b75
SHA1 08108a41a35fcfa2ba210a54a53784db92a8cccb
SHA512 96a018b3bceec402942a6c71b449454c70f121d2bb8e583e8a7267b67f9bba09841ea896a3eb4525be73f0ecd726f940e3c13cb94e882b09853817a1913f9058
SSDEEP 24576:Ffa5POZ3dpyWVM50JicR2hG0lasx2+47eidnpmb57GBiOl6a8JTth/RWZvR6wQQ4:Fa5POZ3lJt2pasx2+m+b5+Pl6bJTIZ5G
TLSH
T1E265AF5EA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3804dd0c1f52a216c7567d0b740c82e3cfea89cdb8bd93b1314632813ef290f4
MD5 ce6706da858c05b62d08fbe7fc77ae1a
SHA1 6b63b43b9382036943e1c36b8235028149754fb7
SHA512 985eff8cd89bd9a1acb5bc8b63480725dc55e8bdf9422b9c82c756f3a9dfffa07cc257f4fb7c2409cdde1cf158780577f61e08514caa2a41da93ad5134c73fd0
SSDEEP 24576:0NcwHdjbyQ4nLC18lb/EOjowL7FkLmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:0Nc/zEOVHFtb5+Pl6bJTIZ5jdgp
TLSH
T124858C1623E901E4F1BBE1BE89679646FA717865573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e808ace9438b085e40c58d043b9cc7e75985039c7311995fd5956d4df85fae6c
MD5 f941d5daa7c02b3b34f47161ac333a53
SHA1 67dc0fbac693445fcf034b90cd4d2254e5815cfb
SHA512 86b23f49dd8558faf7579b05890b03843424a8d7998d84f43487fc1e48143d5ce074fdc6805baea18957945273099de7999424b5276543da398886182a0c3f55
SSDEEP 24576:pzkNvNnaFeYhJNtmZBmlmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:pzMwBtOmob5+Pl6bJTIZ5jdgp
TLSH
T1C455AF6EAAB805E4D1FEC6B5CD238512FA727861073253CB8290C13F5E279D89D76F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 e0112abeaa37b52cd46332fd5ec07d18ad5f1e45f63e477ed078b790e7cefe92
MD5 84bd738c30c9945d3e89d727f0b6dd49
SHA1 66025765509c9080247b70a170cc5fe7d949d9ac
SHA512 baa229afb99f705d65e7487f61e4a8e5b243a7fbfb0bf0eb38ca4a1c5951d11b28a6c53024f6e439d7034fc41657d37816b308dcdac029d20aa61514b797ef64
SSDEEP 24576:XD3FHshBIYQgAcmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:XDVHeBIAArb5+Pl6bJTIZ5jdgp
TLSH
T11285E17ED75D00E4E47BD27CDA938A06E67138A9472266DB02D481B65F2BFE43D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1216-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1216-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1216-314-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1216-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1548-82-0x0000000000970000-0x00000000009D7000-memory.dmp

Download

memory/1548-77-0x0000000000970000-0x00000000009D7000-memory.dmp

Download

memory/1548-308-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/1548-107-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/2340-72-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/2340-66-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2340-307-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/2340-73-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2864-13-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/2864-22-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/2864-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2864-109-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2992-45-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/2992-39-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/2992-38-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/2992-50-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/2992-48-0x00000000015E0000-0x0000000001640000-memory.dmp

Download

memory/3004-325-0x000001B80A580000-0x000001B80A74A000-memory.dmp

Download

memory/3352-59-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/3352-53-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3352-60-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/3352-292-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/3676-103-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3676-97-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3676-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3676-310-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/3676-108-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3684-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3684-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3684-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3684-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3684-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4212-132-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4212-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4212-137-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4212-126-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4212-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4944-6-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/4944-64-0x0000000140000000-0x00000001404CD000-memory.dmp

Download

memory/4944-0-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/4944-8-0x0000000140000000-0x00000001404CD000-memory.dmp

Download

memory/5396-313-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/5396-113-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5396-120-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/5396-119-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/5436-110-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5436-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5436-86-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5436-326-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5436-92-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5436-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download