a9e580c8f8cd39ab443b47b4c563734335ac8057da6006f4c62110ffbf521b40

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 13:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
Size 1.6MB
Sample260816-qeptjaydlh
SHA256 a9e580c8f8cd39ab443b47b4c563734335ac8057da6006f4c62110ffbf521b40
MD5 c059444f8717bee7d303682aa2223921
SHA1 f2a44c56fa8ede1c7ea78ce0110a9816bd82cb67
SHA512 0ebce2b54592c7a2d0dc404d5ed5cd793b38e00750b9126a8d5b4b083d8171ecff9c20fed599a0752610c76b1303770ffbf45ba4d9f2e53be6c3fc2bccb81d85
SSDEEP 24576:olwoldhiHBOPdOpO3ttGzhfAdajYTGq2bqTszxbFgDylSsJspIKJJYsGqelOqn0L:olwg/EzOIUpommMeTDdf2d0GMa8
TLSH
T1C975C056B7A041F9D17BD139CA564B22FA7278165B30D74F03A882AA1F273605F3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
252	elevation_service.exe
3104	elevation_service.exe
4116	maintenanceservice.exe
3412	OSE.EXE
1220	PerceptionSimulationService.exe
2276	perfhost.exe
3244	ReFsDedupSvc.exe
4576	SensorDataService.exe
5632	ssh-agent.exe
2296	AgentService.exe
4864	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\141c968a209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008eed56b2802ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fdc384f2802ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000035dd49b3802ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
252	elevation_service.exe
252	elevation_service.exe
252	elevation_service.exe
252	elevation_service.exe
252	elevation_service.exe
252	elevation_service.exe
252	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
Token: SeTakeOwnershipPrivilege	3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
Token: SeBackupPrivilege	3244	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3244	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3244	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3244	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3244	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3244	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3244	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3244	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3244	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3244	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2296	AgentService.exe
Token: 33	4864	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4864	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4864	SearchIndexer.exe
Token: SeDebugPrivilege	3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3936	2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	252	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 704	4864	SearchIndexer.exe	100
PID 4864 wrote to memory of 972	4864	SearchIndexer.exe	101
PID 4864 wrote to memory of 5076	4864	SearchIndexer.exe	102
PID 4864 wrote to memory of 2512	4864	SearchIndexer.exe	103
PID 4864 wrote to memory of 5068	4864	SearchIndexer.exe	105
PID 4864 wrote to memory of 5168	4864	SearchIndexer.exe	106
PID 4864 wrote to memory of 5464	4864	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_c059444f8717bee7d303682aa2223921_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3936

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:252

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3104

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4116

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3412

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1220

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2276

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3244

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4576

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5632

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2296

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:704
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:972
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2932 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5076
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2964 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2512
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5068
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2964 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5168
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2932 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f0aae29fd7e4a1b0a4eae8c6304056fac5589959dd398b5f0e8a200cca8bc19a
MD5 ec375a0078bdb2a70393be44d638ce09
SHA1 c05d10d2e690966ed7a914b6d800a5b25787fcd3
SHA512 9400d257cc48c97b888f73a2052d32da6336ed33dda18bf2ecd112b4ca9c0bc0d53702a689c77c3899bedbb642edd104f7ae527527c97fdbeae9571324128026
SSDEEP 49152:Tb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn/eTDdf2d0GMa8:x3q6sjB+WDhiI
TLSH
T16CD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 d9d9671f324396063c34a33ac2e8c0eea6ff336bbe0632805a52d8655008ed77
MD5 7ee1c33b992e31779398db506e6c7648
SHA1 8d50533e69a9eebf49591c2fc11724b302b4be6d
SHA512 17b789f84ef3f0ee3a305e8fa84d2ccd7e8bec35b7932385bf69db09a8e9ddf91ff61938285dd2df765bd3716de7c54c7fb58b058c60aff4dada7a40b56d4955
SSDEEP 12288:P1XLsswWkxy2lRq2czAif2q83DBC36KD22Fo6RkuALY5bQRAManQTHvu:tXYfDtczAieTDdf2uY5bQGMaQTPu
TLSH
T10E05012977D509F9ED67827CC8A2C511E632B85147A0E78B03E4993A1F333D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 7b7e349a38c678d5f1b47dd5b326a8898fd3d2c13b10900722da61232988ef60
MD5 53c6bb76b57c75be322d4f9b2287a882
SHA1 665ead155929dcc40546749e297c6ad6357497d0
SHA512 ef7e96ffa4f091648fc3cca42daf3389388bfbf8e5358ba540e0c0ae5ea6033ac886697f42049a6fc4ea0d2f8d6a9e179f10685f5ad6f5d9bb1ea5249f9fd66c
SSDEEP 24576:J0Le5ji0hmxxrMXeTDdf2uY5bQGMaQTPV:JPji0AjIeTDdf2d0GMa8
TLSH
T1B2359E16F6788331D073C0B9C5D2A69AE97130825B308ACB4286D77C7E67BE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 815f00ebd43ac8a8ad1568cd6364bfc7af70712156f08edddf1cb64f2f52326b
MD5 e330decda21e6d3604f0cd5692a14488
SHA1 320b5f743d5813d007f3f79a6d59262254f27ae8
SHA512 06c4cb7ef0f3d7260c3d1cae1b521fcb185ee9c3674de16aeef1f9c1ddf29855b3f0c2dbc1d3349a95e3ba59375437d3a1abb47463f5d758810e1c5ff9d7f856
SSDEEP 24576:na7/ezSC6vUyD/aqgrvWn6q8wyuReTDdf2uY5bQGMaQTPP:q/ezSC6vUzPveHjy8eTDdf2d0GMa8
TLSH
T1FD755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 485f8bdc32470e93921002beb29b562a8c3e5650ae84fe70210bbae57a1dc766
MD5 f7de6df4db37910215775a28e8b1b92d
SHA1 221aed8baa533004d1f13ec5cb300f9f2962c9bf
SHA512 23f9918a2eab23486ec6def7496a192100e8feeb8dd79171fa0c9024399df150ead246fc526044ec67d4090451431d725417ddc7d329438182690abcc4dcf054
SSDEEP 24576:5VbqPb88hv/l+YueTDdf2uY5bQGMaQTPO:5VO88hXl+ZeTDdf2d0GMa8
TLSH
T1F4559E66F5748331D073C0BAC5D3AA9AEE3234425B308ACB1246D76C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 9f6a3e1e12f500767f1229ebbf5917d1f606402031f4d5fdaae568f17fccfbb6
MD5 4ad3a37bb09ea1a9bf6d17c580f0a1dc
SHA1 9a4c454485928f8ac15b87a1a63ef6e260bdc22a
SHA512 a80402b86d6ea95fba8705f4f86aebd353fb9daf9ad543bb3d6cc8392ff6e05a0183efa958b81de52c0a0d0c855e56f62c49ef0f7716214fc2903616993532ff
SSDEEP 12288:FLzf2q83DBC36KD22Fo6RkuALY5bQRAManQTHvb:FLzeTDdf2uY5bQGMaQTPb
TLSH
T14DC4231B0B4DA2D1F3C7817135BFD9E272748D601AD0D6061AA5FE7EACB83D5D820A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 ff95e3cade435b55c8578f1d15961f2d280a43f699b8488c2ebb84876008699f
MD5 89af38e85ad171391c1fcf5fbcf3b7f3
SHA1 6539905e2f1c484bac61c1426f4f96d37f1f8a10
SHA512 1cdbc7fb91bfd592e203640e02655cb3d399be4df5e1184e27ab0c6a3601c521301348d82dd4ed2aabcb269510a8b3acdf1289b98df5435ba5c2faac6aa65136
SSDEEP 12288:VeBNUbTVO86UGf2q83DBC36KD22Fo6RkuALY5bQRAManQTHvX:VJIUGeTDdf2uY5bQGMaQTPX
TLSH
T13605CF3BAE28FCD2C27A8DB85691C640E77278704B61A3CBD175C20EDE236E15E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b13f0a81a2774521a7a11d20958aef1411c9d03f6dbaf8055b10945a9801cffb
MD5 915624b3ea02c736610093c44eb67e6e
SHA1 d2657b433a7c392addb39d98d3ee8d71f6393ec3
SHA512 12a871a0fd86045fe3463a204b8c6a38443c0bd71e8208af59e7c2f2b3629f1bcd6f473d15359d2cd97829db661df68016e3939568b0283584e4fe7287fe71b4
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH7:nQvGAdlCEL8c/DRNw5CBWDhiI
TLSH
T1E4267D656BF880F5E0A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 7d6d74fe9649eb56b441f92b9acac2f5c24653e095c7f4eefcc49689af1603b5
MD5 447d1aab13f23a8a50d00359a61ee306
SHA1 6950369993feb63df63e82b860800ae44a1f2b2c
SHA512 f6e3435c0efc8ab11f70b511d189aac9c163dec6a59c43c39fbba577224c5c29519f52223bd27282ae88954d8bc49342d7c66654490db04e850725590b3ed1fa
SSDEEP 12288:KAwSfxL/2Dc3RDLLmt0LDQewsAj4f2q83DBC36KD22Fo6RkuALY5bQRAManQTHvb:f0ewsAj4eTDdf2uY5bQGMaQTPb
TLSH
T15715E031FE75E032D3BB0DB21B36C716247C69204B911AC3E3A89E9E59742D26736E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e7beb11f5897820bcd59f56b8400659be53d54ef5d8f825bafa4cd8694895878
MD5 911b86f2aa6600ddfe5bdb5dfce0e121
SHA1 cbc81264caa017f5b28a6d9592ed34812a30bc4d
SHA512 fad8cdbdc5ab0acd6acf0a11ceaed03b9b8b5a273b42f91a8a300094fbbd3a6c9846bb1f0a5b816c82dbef038b4b543bf05e246ef2decb4624e464ca629ba248
SSDEEP 196608:rUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHAW9iI:rUEtQevvqc2W1cpV2tI32A0
TLSH
T16A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 438d436a43315d7b967dcc882266f96f969ddf5be5f3c616c587f00071638f55
MD5 8e4ef901fa2f475ca7114fa069891424
SHA1 929ce317b5cb3cffb12f782c30a7016592447636
SHA512 88e822a32ab14a00813a2dbaabc996aa0e5497254785ec848da7301c18e1314417c6c1fb7df8fa07f290347be3910d5e997d79a3c017c4dce6e342a002b724a9
SSDEEP 49152:3CbRquA/m2yL5zLfFiV+XenmE3/zYeTDdf2d0GMa8:goq2VjnmVWDhiI
TLSH
T125D57D0976B8C2E4D1F6C77896A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 1e55bc92a4b16848d5b127cc35c6b21fe3fce99fb93b2043fe0e78a136fa59aa
MD5 9669756cc661ed03b8e4e608358eb4bd
SHA1 ba36f22bfd3d876131e992f4d38b64e9493f20b4
SHA512 fead5a3acb635bf5e0063301933ca11f4027edb86dd543665f16144ee19e8c308b26a313a9fd6127ce50b9359d3cf67c8a4f7a6fcb59f3eb2ba5f208c95a7bf7
SSDEEP 24576:BAhGL3IFoiwtA5l7S531eTDdf2uY5bQGMaQTPX:BAMUFoiq5FeTDdf2d0GMa8
TLSH
T13C359D81EBF955D4F5F3AAB899B69171EA76BCA55E30C20F2160D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 45f31879df92bf7141f1d0ad90ae2b5e5abe065d3daf2245cb91895eb341001e
MD5 d1fa36b9b1ee41074fe664f7252c3e12
SHA1 79bbe79d22880e3be1a0fa715bcbe65c09c5bcc3
SHA512 4ebc98c16062ed49ff8ec4c840b5bc4fe7429a31650f0d77c6b90458b8c9ebce242dbc3bdb70fa54aae352c8442127ad4a1265f88f834ba1516d55b6cf92dd24
SSDEEP 12288:amw5HEjsChNVBFgl0WDm+Cxf2q83DBC36KD22Fo6RkuALY5bQRAManQTHvM:zwu4OWceTDdf2uY5bQGMaQTPM
TLSH
T1CD05014A37A81CF9E6A781388597C136F7F2BC112A60D71F1760C65B6F37361AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 69a6f1f94417ea2828b4e83819b221b5f143d4b905c5f9a2e991ac1ab236bafa
MD5 5e12b9ab139aae49ac40443672b2294f
SHA1 485caea07d549418987ce5f73e3d1b23bd10fec1
SHA512 30b706841ade87e2316071274b31fc8ebc4bd7954e4b10927861a51aea0b990d584733d64d9a163440cb34cae6653d875796901a93119ec435ba234b74c3f0ed
SSDEEP 12288:GeZ1Iyof2q83DBC36KD22Fo6RkuALY5bQRAManQTHvZ:bZuveTDdf2uY5bQGMaQTPZ
TLSH
T186E4124B279871F5E393823899E68645F371786227B083CF1664866A6F73BC19D34B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d4dc1356ba37dc65319be11d8b5be04321e4f460a468bd88150b5d3b7b287fe1
MD5 073d5d09613ea38c834126d8e94f4ba8
SHA1 d5975f9b2fddd3f20736ae6d9097052335a15cbb
SHA512 1e45925dd67fbf8097cef4577449bad6247576bfcd0eac1514af462e1066a617342c31adb44c89cac1c5a24af7c492d6b4438759c9aedb29fec04313ef11bbdd
SSDEEP 49152:5j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UH:AQRQyi36YOcPbLvw2gAf+PN36WDhiI
TLSH
T140667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 98adeaefb6322ee8cfa77a59cb361ccddb271307b64e1149f08c645e9f5c66be
MD5 b7f481984061daa44184229256634f5c
SHA1 adb7db374eba76389beacaa5224cbb013927e426
SHA512 525d4ceb05523a67ffde1d8462bfbe75a0fe10d527a04983e6dbeb73492356f57db6504bdff03c169dec4fe1d45d9b7f0718940eb15cd088ba79ed112d2b55be
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UH:oQRQyi36YOcPbLvw2gAf+PN36WDhiI
TLSH
T113667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 fb3ff904c39a32787dacd355cd997af186c75d5264c4b54289f1bc515bd22b49
MD5 2601980716c26a148b1a2e51d0e9626b
SHA1 83659cf3e9f28b6d9dcb1ff187d636dc24bce9cf
SHA512 a3f774d77420f579be8cd10abdbb75f430caa7bb21dc4a066c995226113aaf221f796880a9b1a95f882f2806f9193568960d6796ec49961032c3324dd5015d0a
SSDEEP 49152:Q68Qg55nhceWu7PNU3/IeTDdf2d0GMa8:KthLRc/IWDhiI
TLSH
T159B54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0bdbdc00208f261226fd71c84c3a68d6a58f9398c65870e939f11d58737427cf
MD5 6e86b6fa51f56d59f288889d16fba7ab
SHA1 1f70f28c4d1c6407297195ff6c60bf5dcace96df
SHA512 73312425e5fb45235daaec74e62c77493d41066bd18510f1979145abe63b981986dd22774dbcbc9ee5a55f656db22ad74add75a92f1ce4d23577a04cd863a166
SSDEEP 49152:Y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99B:Vy5112gYy5azzVvt69nLKnhZzWDhiI
TLSH
T182167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1574c76d4f16eaf6c0b4444674c61f93d7320b59b7cb4e9e6665d5876a9cd2de
MD5 88681525c89914653305b85206a2bd70
SHA1 5e75cddf916ca38e382cd9fc2ac61ab40ee6d64f
SHA512 8d32728931fbde3cbb07f56a39b988483cd44da547483737b07f8ebfb9bf84bafefa1cd2a02717b436a252d6f695302ad518353b59b338e1cba2736dec022c6b
SSDEEP 49152:CB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glyeTDdf2d0GMa8:wu6Jmdxd2dyWDhiI
TLSH
T185D59D13F1DA01E8D05AD478974A9233FA62BC490B34B6DF0A9073562E77EE4AB3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 baab957dc62ac3d3df652480cbb1dda7a043045e431d59cc8ddc768aed57e64e
MD5 76f9e2bc08c42e465c20ec2c605b6dda
SHA1 ed8abc6274b1ec085566e51fab882e0c425d4ea4
SHA512 53fac470a5a78ad82512f37d05b55640564bdb52e0a9165adab0ff5cf9573d1de0358b21e1c4a1ebac4e0897831d78b7dcf1190a79bec830d251154e9553338a
SSDEEP 49152:W1hpsNoJpF1A63U44CwH7R4xmeTDdf2d0GMa8:WmifPWRVWDhiI
TLSH
T127B5BE13F2D901E8D05EC178875A9232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c786b921b79729dec2804fe29f3a65e26d5018b991869de629056a0ec26a059e
MD5 991d21f77f1edd1f62a7b741394158fd
SHA1 51826dad96dbcb06256e99b2220646301e3b1394
SHA512 e5027f0ce51f072524bcae8aa819a6d688cd652dcd245b9dbcce5567192e87e0dfd24d0c2539d7a4509586edf5e435a3e29b8997c7e658bb6e4fe09daf4b8cb4
SSDEEP 49152:sSuZQIY0Be2KcRVtOnks6NMHqveTDdf2d0GMa8:O5dKii61vWDhiI
TLSH
T16DC5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7fa32039d98044784884a597a684d1b3191f54cf91618f58ca1b3418ec1da5a6
MD5 96cd78c122fd3415a882b2185d6568c4
SHA1 641393125e56427e7732a732a2d9c16467070809
SHA512 a0f3232315a68160f0ae0ae1c131e20f5526dcdf9f04ecd5c53bd8bd6cebf4632ca0d4d2890de7643a0a99527959c6344e7e24b188170e60cc306edbb0256959
SSDEEP 49152:thtSn8EApI0fig3giDn0AP5wieTDdf2d0GMa8:8X2imphJWDhiI
TLSH
T1C395BE13F2D900E8D05ED178C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 a39e310a2bda480b0da68f022c91656345fc005379f5fc78ef91c2703c25b450
MD5 e4e0b016bf9e8720e2a843d375abc847
SHA1 29ac9f848f59ca6a61522dad00b857d20b4dd69c
SHA512 8574c1bebc8f89da80d2d65af3b8552d2c273091b9603d901974f9bf636ef60458c281747eaaf9029e19d9a54e36cfe33cf339bcd55657d312e50930a7447ac7
SSDEEP 12288:Trf2q83DBC36KD22Fo6RkuALY5bQRAManQTHv8:TreTDdf2uY5bQGMaQTP8
TLSH
T115C4230B1D4FA2D1F38281B1656FD5E1B17889657BC0D2073BA9E93AAEF93D1D810D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 7f22ae964f80ade99ba218dae4b8042bcd9b627e30236e979079ab0a8e730dc3
MD5 4cedae58d716c7fdb2e9e109b9b3bc9f
SHA1 74445d56d5286658bf500f0c3b6f9c8d47f5c46c
SHA512 bcbd60fb636ca2994472eb0d43f4a667269992da3c01ee9bac1c56673f1722325f0fd17201a1223d987a43d321a8f603db3d2f0dcd6c500a56fa26025b02c744
SSDEEP 12288:qEf2q83DBC36KD22Fo6RkuALY5bQRAManQTHvk:qEeTDdf2uY5bQGMaQTPk
TLSH
T15EC4230B1D4F92D1F3828170266FD5E1B1788A557BD0D2072BA9ED3AAEF53D4D810D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 8908ce56c231daedfd47be31eef601d7de004aeacd0d13749cb5042e6d941b92
MD5 c0744a13bbf1d2a25d8759e2c9f5458a
SHA1 5390ba3ab8d7d7d1f3d2d566d06f46cbe0353771
SHA512 531d5d7e3713632fa71173d1880ae66cf241835e2a453bc392fd3e20f1d86d84207ca46524e8572985d53bfcd87471b408b5729a98bf51dabe67755cb38df815
SSDEEP 12288:8+f2q83DBC36KD22Fo6RkuALY5bQRAManQTHvk:8+eTDdf2uY5bQGMaQTPk
TLSH
T173C4230B1D4FA2C1F38281B1266FD5E1B17889557BC0D2072FA9E93AAEF93D4D810D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 99d74f6547305c7f99284eb36ba406b92a0ea476e426795ea43ac83780fee3f3
MD5 5bbb02d9514847929375c84bd927cebb
SHA1 73e8a79774a5bd8b543e8eb07b78e9e68f696d08
SHA512 77dae32c533ae47d3fa9ffa266b3050d910598374dd7871dabfc486443cdd82b0c7417fcc953689512130a17782eb7acdbb273a05210f5808b58fd07e1c83ceb
SSDEEP 12288:iVVf2q83DBC36KD22Fo6RkuALY5bQRAManQTHvK:seTDdf2uY5bQGMaQTPK
TLSH
T181D423072B5E52D1F392C27495BB95A1F2B4BDA06BA0D38F2B515D2A5EB13D0DC30F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 1558561762e91ecbfc74407591b13d32a95b4d9adc6e1fa469ca2bc4a90e316b
MD5 065734e0c5b63eb9133be1b3285f554a
SHA1 fd1ef24bab968508e201044441c18256474907df
SHA512 7d02621e8289f6e217f2617a1d362eb865a66d6463c92db1f34f76cad5d4810bc784a64baf8731746c4350fa7bf45913f3babcfd4b514166558b60aa1b9837ef
SSDEEP 12288:89f2q83DBC36KD22Fo6RkuALY5bQRAManQTHvp:89eTDdf2uY5bQGMaQTPp
TLSH
T165C4230B1D4F92D1F38281B0666FD5E1B17889657BC0D2072BA9ED3AAEF93D4D910D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 b32006374d3a5f0eeb89105b2f5129f580acdfd2af3383afed2d2e2d6b2e36fc
MD5 384a385c90d7a99a182e1977e86fa785
SHA1 55bf21cfdc2806d9da9453f2a560cd3e85639ac2
SHA512 420bd6a18c28e487e4a6fb3f90282df51077f0514fd87444a869f61a615d56da51e118b65cf1b12ce2dc70607c5def9c144875ea6f5e5e9a570dbd494efc070e
SSDEEP 12288:owf2q83DBC36KD22Fo6RkuALY5bQRAManQTHvp:oweTDdf2uY5bQGMaQTPp
TLSH
T119C4230B1D4F92D1F38281B0666FD5E5B1788E657BD0D2072BA9E93AAEF53D0D810D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 db46ff95a822104b85c8dd5696a6f987a542c9d10a0a561b1e7048a458a75bea
MD5 c416e063933477e9b600f18aefd2c94b
SHA1 489a22f2bdbb46f41211947d2bafe52abdb6fc73
SHA512 6a24ffac3988f0bd05e248ad5ee7139ffc36dbb1d6228cef8e7092726120dbf5537b85b4000ec244e536e73e60bfc73592273651d94fa69bb7b8c095ed5754d2
SSDEEP 12288:Psf2q83DBC36KD22Fo6RkuALY5bQRAManQTHvY:PseTDdf2uY5bQGMaQTPY
TLSH
T171C4230B1D4F92D1F38281B0666FD5E5B1788A557AD0D2072BA9E93ABEF93D0D810D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 1ae77c0e08a13c0c12adae5041ba8a64fefeec099135e9afa0a66336deb082d5
MD5 c081f0f91bf32965498971dc30895208
SHA1 94bb43ecc328d609788b98c331d62596ef404af0
SHA512 41bc7e42aa1301f3b5492fa0304c6aaf44a6ed6e16ef87c481026917ce96a44a9df1d961ea323661d4f56919d1456be023967a90aad8a6e8a713589d41c345b6
SSDEEP 12288:ciZwbVzzFEoS2cPvykf2q83DBC36KD22Fo6RkuALY5bQRAManQTHv+:/ZMRzFVSOkeTDdf2uY5bQGMaQTP+
TLSH
T1F9050195739018F4EDA3813EC9668956E2B2BC590BA0C60F13E4362B5F733A15C3DF66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 a27e7a2a351ed80794344024a11e4fede2fb839f5db3cbf4eb22749369225d07
MD5 921ce2fd2dc75d28326b1af9f828c3b4
SHA1 9a5b6fbe71a5e7a9946729b0dba2726caf87e6d4
SHA512 8376d1c613360853e251baeed710142ba90f98c50ede914f34059d1f103ffdc0a7ce9913280bfba9e11a9c8c2e5e86d337ef13bb4dba6ac46de7bbefe808a97d
SSDEEP 12288:Nff2q83DBC36KD22Fo6RkuALY5bQRAManQTHvR:NfeTDdf2uY5bQGMaQTPR
TLSH
T131C4230B1D4F92D1F38281B0626FD5E1B1788A557BC0D2472BA9ED3AADF93D4D810D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 b4697289d85048bcc55ba0f794430a03f1b6ec14f006e70ed0e3e00e48176141
MD5 263621f03e58403fca977aa488b13f90
SHA1 47476ec4a45a5c35c8dd92692da028468caa2934
SHA512 87e2a9ee92c798f1bd4de08476cde2ed6fc063d0f65611132c6d72a2bba1042fc84fe7c3f4162a32e9917d5eae88826e128e31195638314059d892632a1878ca
SSDEEP 12288:mjf2q83DBC36KD22Fo6RkuALY5bQRAManQTHvR:mjeTDdf2uY5bQGMaQTPR
TLSH
T1DDC4230B1D4E92D1F38281B0266FD5E5B1788A557AC0D2472FA9ED3ABEF93D1D810D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 d80af8872a41fd7dc1a60ab67d3cec95aa5ff57adffd584f4bb66a80c6f7b8a2
MD5 ae3f78487400e493dc253c559d57d022
SHA1 03246fa02baedc3405b2ce18b6aa29744fd7220e
SHA512 4d67f16980aad8696fafccff9cb012a94cdc4ac56d7a51044f9e9cf87e4bd2a39d9ba24b369531a12ecbfe1996dc283d934e102731b4b57590f02e9839254965
SSDEEP 12288:KyPz5L8of2q83DBC36KD22Fo6RkuALY5bQRAManQTHv4:XzyoeTDdf2uY5bQGMaQTP4
TLSH
T1A4F4120737A530F9E267823489A75A52F371B83217608A9F17A4477A2F773D09D3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 6718cdf7a1a884129f64877fd4b315be5d88e8ab3fb63307f15f07f6468cdb9f
MD5 a4897e1fa950d02785234383a10537f3
SHA1 75ae458cde3eafa4119d64f54b3bc6aa71ad5e39
SHA512 e03a7a56bf6ab2a6d4d9dd243e96342ab693147b07cffdc82bdbd7629b903aff1fa910233305f4b44f62557ba3dbfa7f38598cb1071f89ae2a2c8f8f7eb44d8d
SSDEEP 12288:gff2q83DBC36KD22Fo6RkuALY5bQRAManQTHvy:gfeTDdf2uY5bQGMaQTPy
TLSH
T13AC4230B1D4FA2D1F3828170666FD5E1B17889557BC0D2472BA9ED3AAEF93D4D810D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 4d8d9f34cdfe0a1898d93d2f1d0e52a4d6f12b9608f84208b7207bb80c5ee58c
MD5 6b135377674da3b667fbc6c3d51dc8f9
SHA1 27a472cea4743571056a93b0ac1d07c02914dd38
SHA512 ada12a80276e074f21f9459285483b01d8f0343362a1137ce7aa74ab856dfe818a8fe4c52a1cb36c157c10099e3daa1e36f7c4397e9638156c2df5c5c4bccf51
SSDEEP 12288:uff2q83DBC36KD22Fo6RkuALY5bQRAManQTHvy:ufeTDdf2uY5bQGMaQTPy
TLSH
T160C4230B1D4FA2D1F3828170266FD5E5B17889657AC0D2472BA9ED3AADF93D4D810D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 b052aa8d7bff88c6657dee2c96fb3b654d87dff05cb089d4c8023d68fc3630bd
MD5 756bd783102a10a618527f54d14c0a0e
SHA1 a587f8ecd250626d3776fec95cc30f63b56a8b06
SHA512 aa4943bfffdab69cc98d2e165a3536c530c19a88dc083f9c89182e49d771e3c29be657dadcc6c28667f016cbc0a6ff6f0ed153ea23b88a951cc99d6ca3fb05a9
SSDEEP 12288:zyPz5L8of2q83DBC36KD22Fo6RkuALY5bQRAManQTHvq:+zyoeTDdf2uY5bQGMaQTPq
TLSH
T1F4F4120737A530F9E267823489A75A52F371B83217608A9F17A4477A2F773D09D3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 77e50343a14729cd3db81f40707bcb557228e2b38b99394796692da434cc2e0a
MD5 10270f086edd26204879d842f6e028f4
SHA1 9d4081f4cdc8c68261d043773df0026fd0c63dd7
SHA512 b98688d6bc4cd494be03097db36048a6382c3c48796c0956e281144bb5b52e2e794e00daf24b3dce098a675efcbc0f5a3761b61437a352774f2574c3bae1be17
SSDEEP 12288:LCd9CWYoaLHF3z0z04PDvhOf2q83DBC36KD22Fo6RkuALY5bQRAManQTHv2:mTDaLl3z0zDOeTDdf2uY5bQGMaQTP2
TLSH
T138050195B35018F4EDA7813EC9668916E2B27C5A0BA0C60F03E4366B5F733A15C3DF66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 52981d02fc725f1babc7b010a4c9c56884460037a4b1a3debed9b37d89ad23ba
MD5 dc9c7b9380cbc99081e4501967e06ea7
SHA1 d50b4a763fbbdb38927b574835cc149c4cef1c45
SHA512 3cb01391a5187b8b61df8e63c1c385aea8a3fc364298ba006773302c6f4516523165ff3c8236623c367ea60a5e347faec62f2dae2600ee9b177849a651b09162
SSDEEP 12288:+i4e7KRdTfgwCHKy7GLbbdIv5f2q83DBC36KD22Fo6RkuALY5bQRAManQTHv5:+3vd9CHKy7GZaeTDdf2uY5bQGMaQTP5
TLSH
T17D25CF91F3E810E4F1B7CA3589769511DAB67C5A1B70DA8F03A4661A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 9138b2f68dd950a96e25644f9dae03867e4cc66b02ef4c2e2f564520185e8952
MD5 9936ad3ca3711f5997f2bd0bf4c91e57
SHA1 6b6b60555c46b56733be0b82699f2889dd9ae673
SHA512 0de4e3b76da09ad19da58f87d8fa12e01385442aab618d47a1c4b7cd536364e5c856c833893627ea83b2f436d99f1c7ed95b6093320a6da4e7f41b287d2aa709
SSDEEP 12288:kef2q83DBC36KD22Fo6RkuALY5bQRAManQTHvR:keeTDdf2uY5bQGMaQTPR
TLSH
T19CC4230B1D4F92D1F38281B0666FD5E1B17889657BC0D2072BA9ED3AAEF93D4D810D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 7b1d73962c9e7db4ce15625de0e8554687d651aa954676659be13b39c1f27123
MD5 c3ab138f67fc4e01700a9105aab05904
SHA1 a96e56662c9407afbed1a6b34de522d48007e01a
SHA512 e9d687986ab7cad24b2e402ee7d851fe432df1662b0df98e8310cb9d0766d569bf3ff2ca2cfc960d9c87c4984ec3df1952c459b9f84e639e25b9ceb85ed62697
SSDEEP 12288:xIf2q83DBC36KD22Fo6RkuALY5bQRAManQTHvz:xIeTDdf2uY5bQGMaQTPz
TLSH
T175C4231B1D4E92D1F38281B1256FD6E1B1788A557AD0D2072BA9ED3AAEF93D0D810D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 f6b8a9de2106d6cdf3e465766557c9403178c7e6aefa1c947dd97e54d78b2449
MD5 7528232d050af107ca38466b5d527521
SHA1 275c057629fd7431ff8ceba1be70e09b5a2a62e5
SHA512 f638fec0318b60008813dc8948180f120c3447c8a5fbcbcd2cdedc360959f8d21f67c1fbda08991b8498b6f6704aa237279ddd8b1ef0dabc35a1a406898fbd5c
SSDEEP 12288:D5f2q83DBC36KD22Fo6RkuALY5bQRAManQTHvv:D5eTDdf2uY5bQGMaQTPv
TLSH
T1D9C4230B1D4F92D1F3828170226FD5E1B1788A557BC0D2072BA9ED3AAEF93D4D810D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 b6f9c48e9eb87a26e329f7d7a94a4dd9cbad6bfb3ea235fd4b9d0aeea0b94f9a
MD5 c88d123c9402dfdada166f8d34aef5ca
SHA1 5abea757f764aa3c49cbaac93634246d08fdad5b
SHA512 e244752a6176ebae189a8ba8c4be583c8679f106b20710acad25c1c193e647740d7b0a52bf2f1914bd2db249b2c4b2690d09c54f1971962b54d8660f86218f00
SSDEEP 12288:wff2q83DBC36KD22Fo6RkuALY5bQRAManQTHvE:wfeTDdf2uY5bQGMaQTPE
TLSH
T122C4230B1D4FA2D1F38281B1266FD5E1B1788A557AC0D2472FA9ED3AADF93D4D810D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 11191ffb73a5eff14e490b3f32120a4115731a0dcaa2ddf0f4d9c4a3e5dd054b
MD5 b1638f2db51dd574eb6eeda52a476c41
SHA1 ab39276f82668349633e604f13782ca66a8e07d3
SHA512 25db032286b3e217dd992b473077be645f886e9d9fd211170273e6356ff4b7a438bafffc49d57b3d1e1e9fc522dec0b67a691398dc2a546e2dedd271cdc69e85
SSDEEP 12288:Pef2q83DBC36KD22Fo6RkuALY5bQRAManQTHv4:PeeTDdf2uY5bQGMaQTP4
TLSH
T109C4230B1D4FA2D1F38281B1656FD6E1B17889657BC0D2072FA9E93AADF93D4D810D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 8c2670a1da9369ef8131662dbcabce692893a7eb4bd6b660bdbd2ce476611c4f
MD5 244409c636794b2f3bad91c4e4d8f9e4
SHA1 e4a1fbc715ea75d73a9bf8d6005b73068e42b3d6
SHA512 40166acc4c46f54b6081ff508889d0a500adc8bf33ffe7b902f8e57cb4e2effce4ce4b5d5e1248c05ac677ccbc2bb54fb88005f799e42d598f71cddf3ffee13f
SSDEEP 12288:wnf2q83DBC36KD22Fo6RkuALY5bQRAManQTHvE:wneTDdf2uY5bQGMaQTPE
TLSH
T1F3C4230B1D4F92C1F38281B1666FD5E1B1788E557AC0D2072BA9ED2AAEF93D5C810D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 43b4cb6551abdb98db76c210321b1edc3970d6caa7a00d7e4093c7eafec7a418
MD5 fb967440480ebd8805007a061dc2317b
SHA1 8c88ae71f827dcc6fb1d6422e58ddb31a4c57ea8
SHA512 146f79b424cb2bbcb30bcadc5d7ee9cfc7adfd5493de2ec2d05889b576854a1bb4c4b7f62d803daade1907d9e7d8c06317e33d76a7c9af2c32d2fe4146b7858e
SSDEEP 12288:T9f2q83DBC36KD22Fo6RkuALY5bQRAManQTHv4:T9eTDdf2uY5bQGMaQTP4
TLSH
T1F1C4230B1D4FA2D1F38281B0666FD5E1B17889657BC0D2472BA9ED3AADF93D4D810D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 f58ebc51431753f7420c01b1354158959824471ec7ada9a280406af02950e85a
MD5 dcd6e16af18492a525aab8032df0ff38
SHA1 26dddb4f5b192a067f73467c50d296dbc77087b7
SHA512 512f37d6b71bdec023f235b687d51c1b463ee1b052e4d1c1f02af84beaf04b13ff5fdbfb1693641494e989fe6b74ee4c18e78ce44fbbb38872b3df9953f57ee9
SSDEEP 24576:WfwvUk9RX6wkyAITeTDdf2uY5bQGMaQTPW:eMnYITeTDdf2d0GMa8
TLSH
T1B235D029EBDC44E1E1B7923C99B7460AF2B178691B31C2CF029A536D0E37ED49D39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 680afbdc618d59867618d5ee12762d955c21b6c1ebe6eaabb4a21783d650bb2f
MD5 9dcdc31f9b6722297e77054d40bb20f7
SHA1 992eb53e70e7ecf64e076e95d68f4f5096f6696f
SHA512 e5c2c19ae8e79523a04ef854a81ee98c2854e15e61c1f92284f41027fa3e684d93f84d47d4d946082dbb2f58749c01e8c174e0a12c70b5e52eada304b41f38e2
SSDEEP 49152:YYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0CeTDdf2d0GMa8:PySzPaWDhiI
TLSH
T105066C56A1A841D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 fb23fa5313417975c499efe2908e537c1b650993971a1a3d2149fb91faecd008
MD5 10f73a01babe6ccd430486aaf414855e
SHA1 1e0674565c3ea2aca07d43a603aa9b9a55b0e725
SHA512 6cf86fe85436e70c7adf0726702b47bca26cc3e9169c7c7cfc0e3c8de5b51bde013bf0b413e121207a087b159ee3173d7a2e6a07a593036dd468e17725fc7101
SSDEEP 24576:T47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYUeTDdf2uY5bQGMaQTPi:T47JUQjTirIhCnDHUPfF/yeTDdf2d0Gc
TLSH
T1D865AE1EA3EC01E5E1BA827885158A5AEA71742D1F31CACF1270837D6F63ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 7b58dc103e38affd1608e21084b7fe698c2ed5abd8897015e87cf746ae62fa85
MD5 7e8390a80eb7a8b1fa56c3eac6afdfee
SHA1 755f41734eb34e391106deda3405e50eedbfb573
SHA512 4f5b4adb81aa9af8ef422c378d2d5e3516fb0659be8301a0f5754dca42e0a3c50e523d0c4593efb0eb9e811056c0a826af245a158f94c8294a2d9443640b6380
SSDEEP 12288:Wbsfvf2q83DBC36KD22Fo6RkuALY5bQRAManQTHvi:9veTDdf2uY5bQGMaQTPi
TLSH
T163E4F00AD29802E4D2AE9275C7568A81B3337C2597E0D3CB17D0F93E1F766909DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 7f6d7a20efc5588b3b43d27da1861e389a1bd80636f2def47f546585c14e5600
MD5 2b35825b2ee3cd5382e372a947344cb8
SHA1 54e11f3d36236b056f4fdeda9efa93e813554bc5
SHA512 10d1d4eb42ec2e90e87642a156cb476cbe335b35533bf575287c1b4dc1feaf8a6a79db61a6c1cbd060dd5627e3981aab56a56fca6b7368f0c8f6e90e8a98333b
SSDEEP 12288:kLrknU3fA/q4pX4DBQptfLtARMlxWEjoYPs:8r6UPbvCbDtARMlEE3
TLSH
T1D7351700766AC75FC6A940321E72D5CCAB707C41EE05AF0773C9873FD576669BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 4aba3b69283d7bb476837103b8934421098855f590d8f9ee8bf060b8ff9dd2b5
MD5 3fb45d020f31e35d7ca12900fe534b08
SHA1 dbc82c3e92dc2129560fc971132ed079dff11f6d
SHA512 8eea8f99542615a20c96f93cbe653aedbe1e64c3c5e1c00c9196be5b65c889b05e5ef71f7daba5f43c6281795b886e63dc8c577ce09836e1bab3c6af2f6ab229
SSDEEP 6144:cVAWZNbX9pjF7sqbUavCcwcSLVj5MYR1tMxLHMgffVpoy5DlWWPqp0On1RgjBR1U:cV5jFRbUbQf9poMLo0kRgjG+kehZI
TLSH
T16A55F9815037A38FD1F76032072A5F8CBB64EC16B7496F2773C8453AD86A725A0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 b581829ea07f2de7c6599024989fd2a501db578e414e6e8751b1eae204094625
MD5 c92a79b08a66d8e2c5be89fa3ac36837
SHA1 ea283eed6ac675df615ba2235322145d3206ab02
SHA512 1d945b59249d704e0b91ac3ed28febe36c34d27615a1e60217b4faad2486553dd4b2a6cae1e9fae3ed7ed8934a920e0f8d6155be5dfe1b1136e05050e2eadd30
SSDEEP 12288:+F73f2q83DBC36KD22Fo6RkuALY5bQRAManQTHvG:K3eTDdf2uY5bQGMaQTPG
TLSH
T134D423175B4EA281F3A68270256FD571723CAA742FC0C1C77A55AA6AADB47C0DD30F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 d678a18fb96346cb3dbffac5cfe032ceecb427acf17b1095310b6058b6d8108d
MD5 b7b46056f997ba88e8f93781ac36282b
SHA1 e25928373fab15674d7713b644d0e25123cc2fd7
SHA512 33a11f2bf7b1b31238521a91ee3cfeb5b1298fd1d5da78538b896fc270f42e66e36600e62467f0365c33dfb0fc3182226ab275155dcefda94a2c3dde3b8c376e
SSDEEP 24576:Ngb6bmBIi49WNNFpg1rSvFv7bYReTDdf2uY5bQGMaQTPQ:Ngb4mBIBhGFUeTDdf2d0GMa8
TLSH
T14665AE1E22EC02F5E1F6D2B89DAA4417D6B278160731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 ae2a4bd6a491447bdc7314f00a9cc68a6463893b67e02e3ba7245de1517de834
MD5 898f05eb9d8889a8e1cea84b0f406347
SHA1 9c3bfa9e45841662154c49acb1ce04483605eddd
SHA512 fe67872fc0624ffb9deeef25fd3456a91df93a3ff7937f95c50740074b927f01028941a023b2271f359034b3b51608f6b01d6ed3457b08c1a0b39a5e9478f593
SSDEEP 24576:cG88u8FpJqH1bzria7/mkeTDdf2uY5bQGMaQTPW:f7ZFPqVea7/ZeTDdf2d0GMa8
TLSH
T12235F16676E501F0D477D1388A8646A3F6B1B4250360EBDF07A88B561F23BE54B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 4e9159ff5f021a66588d9a9b2421ca23f7fd68ef29c1699f3aa0da6a8b2f0e8e
MD5 0fda10753bd93f5495bde98ca6733970
SHA1 a9435fd291b2217b9f691fbae476ca69c52e98f5
SHA512 d864c66f1ede54551bebdd2baf517b81e5b36cf1814ffc0d8e851c06adb875559680036acda43127af0fd29e6d460d6b99b390b68e362e321d2f982ee33cac44
SSDEEP 49152:cBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjweTDdf2d0GMa8:/G05lO43bbWDhiI
TLSH
T195D5BF6E62EC11F9D1BBD17CDAC6460BEBB23415033456CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 66867b6cd7bb52a72a5894ae7d38c3e3c36482caba1a1c4e312ce66d6a9307b9
MD5 e9b4c1299682ab87029d19e5ab5ffe5a
SHA1 8dd173237cf26414d270d29c76e44d225dbb7545
SHA512 1ba79b9d277d4fb953513a368d1f56efdcca51596cc3f111b448b8587cdee4a5a45a35e07525f0100428fbef08217be72c813571b2e3243038f5420a0f9845be
SSDEEP 24576:Tfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnCeTDdf2uY5bQGMaQTPq:ra5POZ3BJt2pasx2+mIeTDdf2d0GMa8
TLSH
T1D765AF5EA6FC01D5E1B9D17DC583861AF5B1342153319BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b87a5bd0d5b426d45573673f85e3bf8336e5505d5267800517ef13dd58751409
MD5 841e18f86324a225a54e64639b435079
SHA1 43f26cc75dcd8f033e917c46ad267f44faa71e7e
SHA512 bf177e132a72a607de1553cc83e757796396bb2ea3280a0f0872d7096fafd81d9758f7235b3706e613a7646992012e6e8a9b9ab2b183f2d5fa0accacb90d1cd7
SSDEEP 24576:CNcwHdjbyQ4nLC18lb/EOjowL7Fk8eTDdf2uY5bQGMaQTPJ:CNc/zEOVHF5eTDdf2d0GMa8
TLSH
T1E4857B1623E901E4F1BBE1BE897B9546FAB17865173086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 5bc63d52f2aea55ad8791c36067c493c240cf7aa9582fe6957b9309c7fd5a065
MD5 0803d8d172871b8b42eb1c383cbe9911
SHA1 755bb23aff98d45a6ba3bf8d062c51674e9ce1d2
SHA512 df6b15f7fdf9afc0321ffc4f2a8ccac9c154e4964bcff4d5cce8771ebac773a82e72f4ff2b845e531823b22f0ee9e7b48197e4b9f0d485457471fdce61939a90
SSDEEP 24576:ETkNvNnaFeYhJNtmZBm2eTDdf2uY5bQGMaQTPo:ETMwBtOm2eTDdf2d0GMa8
TLSH
T1F855AF2EBAB846E4E1FAC6B48D238512F6727461173293CB5390C13F1E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 6702d1baee6d4e2dbe1715afcfc1f1142ab73e1684449b209ffa2a34fbb69ed6
MD5 c794fe93088f5d3f7471a887081b49c8
SHA1 4e855aaf093387534bf8c098068ee62378cb2a01
SHA512 5e6392933450a8572c7b611f0af53242847aaaf18517b81de8114519c8e49297c3184858698c3787279fb6f2d0f0540380bdb09713ce079a617867ff414781f4
SSDEEP 12288:QHvUrBFrEjwaQgf2q83DBC36KD22Fo6RkuALY5bQRAManQTHvw:QPUr+NQgeTDdf2uY5bQGMaQTPw
TLSH
T18405F12F22AD18E5E776E17C85868619F371B4621711D2CF02E0817E5F77AE8BC39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 abba6543860909a3eedb71f348338ba7417623739bc5922d9fbf2b1bee3e3e62
MD5 19f152cc474d96931d474c12a2a73b86
SHA1 c587413c1eed008fe0a4f4e0f1dd5674cdab0119
SHA512 97f0be80ea54f13b29bda8bb2bd6e3a18003ee0ead2f29f015399d047ae300a4c578a741ba19f1ae6613998abd86247f2af35234c85fc2682975dde41d490cbc
SSDEEP 24576:8D3FHshBIYQgALeTDdf2uY5bQGMaQTPW:8DVHeBIAALeTDdf2d0GMa8
TLSH
T1AA25E13EEA5D00E4E57BC1BC96638A06E77138A9032156CB06D4C1BA5F6BFE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/252-21-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/252-22-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/252-15-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/252-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1220-67-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1220-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1220-308-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1220-73-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/2276-77-0x00000000008F0000-0x0000000000957000-memory.dmp

Download

memory/2276-309-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2276-84-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2276-82-0x00000000008F0000-0x0000000000957000-memory.dmp

Download

memory/2296-126-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2296-134-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2296-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2296-132-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/2296-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3104-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3104-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3104-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3104-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3104-148-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3244-329-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3244-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3244-94-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3244-88-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3244-95-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3244-327-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/3412-293-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3412-55-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3412-61-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3412-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3936-7-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/3936-87-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/3936-1-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/3936-0-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/3936-8-0x0000000002150000-0x00000000021B0000-memory.dmp

Download

memory/4116-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4116-46-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/4116-50-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/4116-40-0x0000000001B20000-0x0000000001B80000-memory.dmp

Download

memory/4116-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4576-108-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4576-314-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4576-102-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4576-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4576-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4576-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4864-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4864-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4864-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4864-149-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5632-115-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/5632-312-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5632-114-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5632-121-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download