a1db3a723c5e5781d83bc921f81e1f647930fa06f9e7ec10180b94e4af6655b7

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 22:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-27_edb1d0d15006f532f1a8f9aebb40b807_icedid_njrat_vidar.exe
Size 2.8MB
Sample261027-2s3s4axtdv
SHA256 a1db3a723c5e5781d83bc921f81e1f647930fa06f9e7ec10180b94e4af6655b7
MD5 edb1d0d15006f532f1a8f9aebb40b807
SHA1 4655cd5982102d75c5302958a4f204922813feca
SHA512 b7d620e579c98de0ef009f6ade9237e6f864756611edc377fb9fb005319c7ac8ef31996d8e21f8733c86ac93df0d843e2228d685f5894a4a2d3c73692abdc7b7
SSDEEP 49152:F01i+Dmg27RnWGjCxwyMn6GVYCOEKNR18yLEDmg27RnWGj:m1i+D527BWGe/M6GiCOfj18iED527BWG
TLSH
T146D5236E769848E9D967C1BCC682D106E6337C561730DADB13A105BBAF736E04E3CB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2032	elevation_service.exe
3888	elevation_service.exe
4484	maintenanceservice.exe
976	OSE.EXE
5436	PerceptionSimulationService.exe
1308	perfhost.exe
4500	ReFsDedupSvc.exe
3824	SensorDataService.exe
3336	ssh-agent.exe
5556	AgentService.exe
5940	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 48 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-27_edb1d0d15006f532f1a8f9aebb40b807_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-27_edb1d0d15006f532f1a8f9aebb40b807_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-27_edb1d0d15006f532f1a8f9aebb40b807_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-27_edb1d0d15006f532f1a8f9aebb40b807_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\da921893612dd39a.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-27_edb1d0d15006f532f1a8f9aebb40b807_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-27_edb1d0d15006f532f1a8f9aebb40b807_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-27_edb1d0d15006f532f1a8f9aebb40b807_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-27_edb1d0d15006f532f1a8f9aebb40b807_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-27_edb1d0d15006f532f1a8f9aebb40b807_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-27_edb1d0d15006f532f1a8f9aebb40b807_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2952-0-0x0000000140000000-0x00000001402D2000-memory.dmp	upx
behavioral2/memory/2952-79-0x0000000140000000-0x00000001402D2000-memory.dmp	upx
behavioral2/files/0x000100000000931d-138.dat	upx
behavioral2/files/0x0001000000009b91-146.dat	upx
behavioral2/files/0x0001000000009cfd-145.dat	upx
behavioral2/files/0x0001000000009cd5-144.dat	upx
behavioral2/memory/2952-143-0x0000000140000000-0x00000001402D2000-memory.dmp	upx
behavioral2/files/0x000100000001b992-142.dat	upx
behavioral2/files/0x0001000000009951-141.dat	upx
behavioral2/files/0x0001000000009398-139.dat	upx
behavioral2/files/0x000100000001b992-388.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112109\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112109\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-27_edb1d0d15006f532f1a8f9aebb40b807_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000849cd2096666dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003b6b8bc96566dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000899112ca6566dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018d2b8c96566dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000003a871aca6566dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000177e36096666dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dd2ecfc86566dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e32b4bc96566dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a49845c96566dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000052e052c96566dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2032	elevation_service.exe
2032	elevation_service.exe
2032	elevation_service.exe
2032	elevation_service.exe
2032	elevation_service.exe
2032	elevation_service.exe
2032	elevation_service.exe
3888	elevation_service.exe
3888	elevation_service.exe
3888	elevation_service.exe
3888	elevation_service.exe
3888	elevation_service.exe
3888	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2952	2026-10-27_edb1d0d15006f532f1a8f9aebb40b807_icedid_njrat_vidar.exe
Token: SeBackupPrivilege	4500	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4500	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4500	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4500	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4500	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4500	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4500	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4500	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4500	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4500	ReFsDedupSvc.exe
Token: SeTakeOwnershipPrivilege	2032	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5556	AgentService.exe
Token: 33	5940	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5940	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5940	SearchIndexer.exe
Token: SeDebugPrivilege	2032	elevation_service.exe
Token: SeDebugPrivilege	3888	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5940 wrote to memory of 5224	5940	SearchIndexer.exe	100
PID 5940 wrote to memory of 1492	5940	SearchIndexer.exe	101
PID 5940 wrote to memory of 2212	5940	SearchIndexer.exe	102
PID 5940 wrote to memory of 3204	5940	SearchIndexer.exe	103
PID 5940 wrote to memory of 2288	5940	SearchIndexer.exe	107
PID 5940 wrote to memory of 4704	5940	SearchIndexer.exe	108
PID 5940 wrote to memory of 4712	5940	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-10-27_edb1d0d15006f532f1a8f9aebb40b807_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-27_edb1d0d15006f532f1a8f9aebb40b807_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2952

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3888

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4484

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:976

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5436

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1308

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4500

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3824

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3336

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5556

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5940
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5224
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1492
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2212
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3204
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2288
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4704
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d0323bbe3cd67816dc6f474274a7483900df354711dc5b3498624075608e7c76
MD5 37b5bde427c725842f608f7a80c9519a
SHA1 42830dae55673add1e9e235da1b3b87f256ed1e6
SHA512 3171e37d4ae701f73aa88a1515aacb7b473ed51c3b04c53bc09e19f6d787fc8f86de452a454d453b73dbe9651eab4fd5802ec89b93152fc16d59eb31d4fa21f7
SSDEEP 49152:gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnEDmg27RnWGj:K3q6HjBDD527BWG
TLSH
T180D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.3MB
SHA256 02469bc970a8043e1deb4064086fc3a1fb61fa9552cece21f789439f11f34eaa
MD5 0ce95d96ce449024491cc461e1271a4a
SHA1 f213887bdf728ceeb31230934e8940c1c30e97bb
SHA512 d52e5863acea7a737befa84a2013cffbf7ab6216b8ba2f8a404ed56d735ff7acf5d726b982044a1f76bf72718567f8e57d8774caa76f9d2bc7e23ce1470ec078
SSDEEP 49152:uqcmDmg27RnWGjrxwyMn6GVYCOEKNR18yL:uQD527BWGf/M6GiCOfj18i
TLSH
T147B5127DA7A009F8ED67817CC9E2D416DA33789247A0EA5B03E49C665F332C81E3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.8MB
SHA256 70af129ded33f17052e4619a1b6b0bb74da7efa96e09e42c324b1a701cd5d759
MD5 24c2527cd61e983d31bc730d494dfa80
SHA1 1ff8add63db444c281fa68a4756105cfdcb617f1
SHA512 15974a496f101e229e6b2e65cda09c574270732a90c2934d58e692dcc8249c63dd7a37d05c0280425aa0bee0ba2bc35672458f9a8af06925ddcf118befb1c314
SSDEEP 49152:lqcmDmg27RnWGjrxwyMn6GVYCOEKNR18yLgDmg27RnWGj:lQD527BWGf/M6GiCOfj18igD527BWG
TLSH
T161D5227DA3A405E9ED678178C5E2D016DA337C924760EA4703E59CBA9F736C80E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 5b9da84fe3119b33cee84505e0b46542cc40cb6ef067577dd373b4f21882c779
MD5 fe5f00f58edbb40c09f341691404e195
SHA1 078e0a9c7446785723ba35eeddb7ee414fe5b2e6
SHA512 436104d2ccb42a4fdb8db87b82a6f70366b8883e40cf82755e4f0240980fb88989cc1b21db45d1f6fb5d47cab9edae4bdc4ee642bc4c01830934eb834c0a9da7
SSDEEP 24576:ZXYfDtczAzsqjnhMgeiCl7G0nehbGZpbD:ctcmDmg27RnWGj
TLSH
T1AF750129A3D408F9ED67817CC9A2C506EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.3MB
SHA256 fdc8c53ff7325a1a4e762772ff84240ea7d75dd7e26e5e30ac9c9a5b05446883
MD5 bc5a9d99c3286771828a63e38a76566d
SHA1 9a33c68e72d98d66b54d586ac567bdfcc5dd2094
SHA512 5a801c642e78b11f597d5aa99c9b70e948da6640278f455ebcf63468561ec4825fbc9cc7b8c87928c0cef81826736353cc35118045f9a891b21b28f544c072f5
SSDEEP 49152:ctcmDmg27RnWGjrxwyMn6GVYCOEKNR18yL:cLD527BWGf/M6GiCOfj18i
TLSH
T15DB5127DA7A009F8ED67817CC9E2D416DA33789147A0EA9B03E49C665F332C81E3DB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 1f0970974999df1000ea7202e8175782eca317390699bf7560dd68d16f079ec9
MD5 ea1ba99c159ff6ffdb0d89eb6ecefc5b
SHA1 82eb3b145b232aa3134adca422b67c02cfdc2514
SHA512 a3dd70472deb69f4eb50938b165cc3db6f6d57fed5ab9aa63bd0e9e23242bf0040dd7d9981f0241dd39f48481640299597be30f6e65aad6705e10d02581f0f85
SSDEEP 24576:m0Le5ji0hmx2rMjsqjnhMgeiCl7G0nehbGZpbD:mPji0AYuDmg27RnWGj
TLSH
T1E9959E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 12fc2ec9dacab3046be375caf826cadc14b6d062c1c2cac53a1c36fc6533c8ff
MD5 437d7751c04cd5df5071fe3029876de5
SHA1 3fa996887184e592fc236d66f1bb2e4f4dbb5b6b
SHA512 0e1ae46102335d7d05649fdcf28a1ce2d24b4df9a4078b5c182be0ca3bdf8a22be175dd32f34530cbaeb4ad724d8b6a08a59df0b28cdcb24f0897098a60aa25a
SSDEEP 24576:xa7/ezSC6vUyD/aqgrvWE6q8wyuJsqjnhMgeiCl7G0nehbGZpbD:w/ezSC6vUzPvxHjyaDmg27RnWGj
TLSH
T1BD755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 37fae6e91db9329ef8c77c01fb6029a6f8f9d7fc5f00b0c542e4ee9aadfab02c
MD5 dc4c99fddb918bd6a8ef06f1d757aca1
SHA1 2327ad79a68c627dce99ec71e5a81862f49b56ac
SHA512 1e074a039557f8e6ffbb48386ff182c827c40929fe2eb5090295c43031d21863df9702baac36b5b2b286a6751eb5faf575879acd81b7db54542d17e47885e8c1
SSDEEP 24576:iVbqPb88hv/l+6MsqjnhMgeiCl7G0nehbGZpbD:iVO88hXl+TDmg27RnWGj
TLSH
T1E6559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 f38435b09c16f6d5256d668f36da68921de645a1e76024da253aa1e689d01cea
MD5 cf230d381b5b471f4942e582a1dc3c1d
SHA1 096e9034812c797a001a49ce143a590e5da114ee
SHA512 bd9af19e8db049fb4817d49e73903b8d9c79d98f02ba461391db5acd48df464616d5ac3e447f5775df47a848076b9cd3335bb6f13754e995a44e9e80681d0e41
SSDEEP 12288:JAnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JAnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C65523BF875C50CAEB7608B5C2E9F11EAC137E56982008436A637DFDE6B5458CB39423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 b8ab4c5d57d32f361c253da46a4fad30d7cd5450ff749a816c4a0280d3309e64
MD5 f20f450795ac6eca1b915d60345cc4fd
SHA1 0561ed9fdc944ee7a75304e31c08a4446691ad69
SHA512 9b6c16ed11e268596a52738d2725d79a647ff73c20443f45d4006b92ea6d016e67f8f73a5c05ff0338128c337950fcb79eecebd8ff318f6c694793f03cab865a
SSDEEP 12288:6eBNUbTVO86U0Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:6JIU0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C875CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6f759468245de4a6d21a3fb23bfdcf017c496eb65905a041a799c995cea16468
MD5 0a2cbbab8c7e702a589aa0114e6f74df
SHA1 a4bd0dd01e28f4442fd5715167d70ca0a93819f3
SHA512 71a8a3e6dcb75db7a49f9ac6ba431facfb84e20f6ff8d65f03afd05431a3e3c85b6f03ed618006396622579efcfbbde76a4815eaaaacba0d88d062a06c955858
SSDEEP 49152:IQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THb:IQvGAdlCEL8c/yRNw5CdD527BWG
TLSH
T1DC266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 0c5b412a765bde0d7d17e219fb0615cd43d21e7555ec1c7040262adc1ad2985f
MD5 c93a354bea11a9c564f5fb2a1a66daa5
SHA1 8f3e5a9da0e326e3eaec553e11da1aa20b69830e
SHA512 abd13cac14f3df5cbe64165e82c948511a18cfb829d1e9d4819798b9f9e54e47b6a47f03233afca191d3d20cf5b5ec55519b2e729af1acbcfafaf29d297ef813
SSDEEP 12288:tAwSfxL/2Dc3kDLLmt0LDQewsAjqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:e5ewsAjqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13C75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e151ff24dd47faf45ccc9e604ee4502ed5434bca99eb0ce9aee076ef7be1e3d3
MD5 640a4655809426638aa310e227b5d61b
SHA1 551bb449b32320c704852fd00769b96d46553429
SHA512 6310cb6af13f99ce7bec87023c0eaf803485cf4bc908c76fa3850e9923d348ac6e9814f5e336579f81740619466a464ff0ebc8abe9a380fa7cd56cba243bb71b
SSDEEP 196608:mUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHmVQBWG:mUEtQevvqc2W1cpV2EI325B
TLSH
T11F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a28d08dd10655202b47e1d7d180fcc32a32213bad1fd8251326b6d605d3e1701
MD5 ebbb5337316f67ea34cfa50ee65b70dd
SHA1 05e689325367842b23a7a9387a2740eb45123cec
SHA512 cd954865d06f1eeb3e8ef1b30a421ea4669572433c200cef91e8e92ef5035a5c3bcbcd4b3a8f107dc5a13e21ef4361d5eecd0405cb5a74528c6ba0e7d10c8b7d
SSDEEP 49152:4CbRquA/m2yL5zQfFiV+XenmE3/zeDmg27RnWGj:xoqtVjnmpD527BWG
TLSH
T1D0D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ba3e75101e480b7678af43969f4c0c7d090f202d407bf51c77be1eadd9afb82f
MD5 f04328b92ec3c0ff4a225cf0dcc2827e
SHA1 6b715842b83291e3e358d802bcbc892da3ff1bab
SHA512 809d4478eb077cd408a5982d7ec3065bea574a7c4b409196e899bee86a45cf16423339d643f1c111f151c2213bd1de33ddc489f78b89233f1fa90b825d18f2e3
SSDEEP 24576:ZAhGLJIFoiwtA5l7S53VsqjnhMgeiCl7G0nehbGZpbD:ZAMyFoiq55Dmg27RnWGj
TLSH
T1F9359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 208fc4772903a24ae6412c4d3798082cf5fb73ac528617a63e3a5512d71be6d2
MD5 2f350c5f243d513f0a0862aef94f2621
SHA1 ef02cbca3f6737f737f0526317e9c3aa3a3b758c
SHA512 d8069bcb3eed90928fff8c78848e3bf0fdfa7313415350ecf5ecd0e01adcdf335fedeb8e1f1719c79209427ed6d0770fff3453f54eb445fbd1d2e72c3d196385
SSDEEP 12288:Nmw5HEjsChNWBFgl0WDm+CSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:owunOWlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CA75F14A76A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 7de3573bac6e4d7f2aa808768920df0c465da2373cc394f747033e29a5326916
MD5 2f512b5cc426dede87c60a740136529d
SHA1 03a2eae84471bc57f73d92dee95610d9a652a1fa
SHA512 5383227ecb886c4c15b479037a6973f1707213688bca358798a6af34806c2421b13bc2b8812f8a56b1f30cb321b2b8b871d53dfb6724253c0c70134f372d43e1
SSDEEP 12288:2GZ1Iy6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XZuLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19B6512AE239820FAE163417CC5E5D609E7333C56673003CF16665AAA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2768f578a21ddbbbac9d12d45466df6f82b8baedf32d4091572bf5288fa0e065
MD5 80f1cab85bf9edfbe7034a6b09a94c4d
SHA1 5a37aec2857b7ed705b039bdc8a68f755499d7b2
SHA512 b0714182aa0d842eb42597845967d8683e114bbb1fc7c89a90f6dadb861df61aa6b814f4f89b2e48c558729c7c3156ae3ac30c629d346c6de2e88e40cb5c1b93
SSDEEP 98304:7QRQyi36YOcPQLvw2gAf+PN38D527BWG:KQyiKayX+PNsVQBWG
TLSH
T13A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c0db5d40c0dd2474d663ae8a5f88982be86affcb61eda7c7151e3211230d60cb
MD5 a6642d0cd22cb821eea62677bb8ade7f
SHA1 f8c01098ea684f3950b7732b6f8442dba1a8308d
SHA512 acafde97b34677cc922e708daf4adc3833bab5668f0a7c8289abe95883541ca472cd1a3706bb3c6021f132b46cd4ab6b13ddb0268d4f26934c85fef14492b3c6
SSDEEP 98304:eQRQyi36YOcPQLvw2gAf+PN38D527BWG:FQyiKayX+PNsVQBWG
TLSH
T142667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 356e5ada825c60ccd0d711a4913f57156bc8474bc44e1e0bc6be9a4e6465e553
MD5 32f35b40d9be86688ea3a0a7224442ca
SHA1 4c6f656a52bc27b88fa35331dd668de839706634
SHA512 18f57335f2dee209b6ffec9e4924c36d858f0518bdeede13c4cf5976bebbc317e4476c8823bb2c6da84b0bbdd243133c349eb1fc315254325242a630a80bc077
SSDEEP 24576:jwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL07sqjnhMgeiCl7Ge:b68Qg55nhheWu7PNU3/uDmg27RnWGj
TLSH
T133B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9bb5927004ea9d77869b477251aafacff0fd86c8f45d1ced2ed0920d2468150a
MD5 65b3d6a71a23a22035640d3d3a625849
SHA1 9a063271721527779b2a4491c6f3ccd38d73caa5
SHA512 7370f912b40b5e7e06c09e0c5a4477de2fb65019428f16e6454a19889ba7c2cbe565825bf364b6926fe5c416c8ede613b8c67e8673d637bc0204f794766e3fbd
SSDEEP 98304:cy5112gYy5azzVvL69nLKnhZ7D527BWG:dLIHmWhxVQBWG
TLSH
T109167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a55e80a9c316f1c1bf0d63ca687a4b85cc8b61b230551fe48bd4171e3d466a7c
MD5 2c62da4fbbaa7513345e9def1c7ca4af
SHA1 363a3489bac72c4aa89d9f0467cfab8cf46a354a
SHA512 95409776000cdb58ca699d983e063c12bf0f479355dd73815f1a4255570d2ca8d05431b1673e82a02b06956308afe176c1668bad08dc165c450afe5b61c885e6
SSDEEP 49152:uB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glnDmg27RnWGj:8u6JmVxd2dnD527BWG
TLSH
T143D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a96a5e4eb90e177c06e714e97a58948f1d15d0e3b49e1858d7daad6f9b5c7b21
MD5 c455b64b471d26cca0f4a71904fb53e4
SHA1 da3f9958fd69612a7323f92dc81c253467466e7d
SHA512 0e3efbab5f9789e84822488ca74fd1f6944aed8cb2aa3d38e3211391569b152b72e5e295e7324437c75dedb1fc5034b99e06f9ecbd63928a34f0362a230d0050
SSDEEP 49152:H1hpsNoJpF1A6UU44CwH7R4xwDmg27RnWGj:HmifPbRpD527BWG
TLSH
T198B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ac1f036a20d37c301669d5026965ea22f19eb3d73b4a9848c6b8b893c54837ce
MD5 0f5c0a197ca827a025ebc10223b23f16
SHA1 eff96ba01792fc3aff77c89cb71c03aa21ecdcf0
SHA512 459b36e04978520c0051d5eebb9595c54f36969ff8ff19b3f4d52d6d237a93102987c9ebe4754665f5ae4f400905d883da47df1900c77cb60c826e971a7b573b
SSDEEP 49152:WSuZQIY0Be2KRRVtOnks6NMHq/Dmg27RnWGj:45dKTi61/D527BWG
TLSH
T121C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 cb39c33f13ee0d02a0f1512e5fc5352a027f9db9e0e088839317965049bb69e8
MD5 58da490761d63231bd40791c3ef2e26f
SHA1 9aac84cc8913c91b5550da6035fe626090bdd74a
SHA512 774f1648b79d790c75fadc5a9c2f5f359a12a6802f7e0d365eb384da8e0b7f40ef553114b88b889d469f099a3cc89ce21319c5ab04a9586c9629241b8a30e39d
SSDEEP 49152:lhtSn8EApI0figngiDn0AP5wkDmg27RnWGj:UX2iyphFD527BWG
TLSH
T1F195BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 b1f5c07d9ef6b23c6680048ff861224e9cfc457c6cb8f087a3a43c21f696eb43
MD5 0fd36e1095b0cc71f5f85dabe7f1ecfb
SHA1 cb6be83ddce67482d85946abcc28a97517f4e186
SHA512 3c380607fcf3b4ef1b2eb2af4ebeb2102994740dafc98fea5cd1ec059f86b329bd24309fe3218373d81e5d61049747bd576bf99b163f24f2fbad5a2df64f5fda
SSDEEP 12288:ovXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ovsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1765523BE965C41CAE52644B5C3E9F10DAC073E5BE92004937A5B7CBEFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 be1c337928c37986d59ed239096aa9ebed4fbbbf9c0bc70e2302ee048f2d0d95
MD5 5b239ab41c1801c43f88be67c2967c1e
SHA1 2a5abf62b6f5d94b9d18c02227563803ec9d2840
SHA512 43923a790a07d6c2dafa7e7a283ef1ab98dadd61064e35f4981990cb0a4a6a31462bf7705773bf8d0a203d04b376a02d77a614115abda6343740c5ad1635456c
SSDEEP 12288:GuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1715523BE965C41CAE52644B5C3E9F14DEC073E5BE92004937A9B7CBAF7B24584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 44bb8ef54f95b226ed6a53939ff837776ae129b9cfaf9eb33c91ebae11870ba4
MD5 e47df7c49d543bc38654ae3e346823bc
SHA1 de89abf5fe5e78e6f182039d9a7c1af00ea95028
SHA512 9df16093f15707a8df88137d828fb816312e01e419680891d6d7aa3afb6a4f26630b0f86bb661fe26d7e7a90e5af84ee1da4743d00a4f047a7ea5f6d1d7812f6
SSDEEP 12288:p8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:p8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FE5523BE965C41CAE52644B5C3E9F14DEC173E5BE9200483BA5B7CBDFBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 904531da61adf23a6a702cde404096e42b4063ee2d6c64b2658e4697d180b378
MD5 3d3c8b5af1acacd9cc2fbdbc369c7b91
SHA1 67916338a9e544ddf9a371691a6d3d1c46af6c62
SHA512 86af486e4762cf9ac80b6ba92d2c63466d70ef5d6802d0cd1488dd6b2be497519387d4c52573573d6aa8e28bc862ceb4c4d71e9191cbb5d5a6c9d302209e3433
SSDEEP 12288:WV1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:isqjnhMgeiCl7G0nehbGZpbD
TLSH
T14A55236F575C00CAD83285B4C2E5E11DE8237D56EB3005DB6B532CEEAFB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 341bfc9d7d565069f1e2d4e16687a6129c06b30ae61e74e49cdfc60ad733bf12
MD5 06f5d3d4c300b96580f3ae256b2f6838
SHA1 2d3811e3befaa506e7a6241ddcdf58e981e72d29
SHA512 0824745a11686dc209229f9e3b0f5adb99cbaa9b91334245b349f54c4c3c8fe3922be3dbdc75272f0d97ce2c76c689f62254c57ccbd1c87d1ee555aa567a651d
SSDEEP 12288:itXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:itsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1195523BE965C41CAE52604B5C3E9F14DEC173E5BE92004837A9B7CBDFBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 59db6816619c6f10ef4aaa06092470a3bfa463e891fa185aa9260cb7380e4c7c
MD5 207f39e1cec1fddc58981a3b6bccd088
SHA1 d6e6cc8f071ffab20eb613147caedc7f9ca567c6
SHA512 7555d866b8a270641e5d7773b6ff056c87b3a71188f74c4b480850cd30775e7317d101ebee8b93a93622ef2db5fe990dd970c9335ac13370d67e42e09a3703c6
SSDEEP 12288:YyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:YysqjnhMgeiCl7G0nehbGZpbD
TLSH
T16A5523BE965C41CBE52644B5C3E9F14DAC073E5BE92004837A9B7CBAF7B24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 87fa5146cadd980b3e615790059356a020e5bdab2b5dfd3fc7452b20a272374f
MD5 75c752eb82068d77e3a91da3e1055c0f
SHA1 91e8ed49a44f558af57c9d6acecfa3049ddd5749
SHA512 e44ce473bdfc92fd0fd09ebd0a945082d42548504a5412639eab0e078f9c9aecf2f57c5d2370b9ffedfa29cb1d35759af265ea664606533c8daa23335a13c150
SSDEEP 12288:emXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:emsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11E5523BE965C41CAE62604B5C3E9F15DAC173E5BE92004837A5B7CBEF7B24584B38423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 304b562fcb23863fc3f1e8cc8527f802ab9d5f8fc797883dd51751811edb6b2b
MD5 c5124258a00109f9b9c20fd180a58ff9
SHA1 24a9d509b80cf76cec01a6fff4db24b80f813ece
SHA512 3410e5c5b02732ceab0bc50e8986519ef056d79edfee9c3d160368b776bfb77568cc6441bdc1783534cea261edfda9a7118c5adb9808f78c9746151d80d8e6f1
SSDEEP 24576:VZM2zFVSOOsqjnhMgeiCl7G0nehbGZpbD:VZM2zfGDmg27RnWGj
TLSH
T1607501A9B39418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 9ca78927ce9f02fd785f6f029229f79aad40113e96c18235705d589f50e3e6cb
MD5 fa15adf287e463a404aa66d93018be7f
SHA1 a509155d40a7ac46fc38b4ad9270427df021311a
SHA512 245067d2add66bd34fd393c60b4ca2bcd2e059b7a37a33b8a212780c80d3b280632c08332e9f4c7852e26e575b9c89bee5c4e05a013c1924a652a67d3a916ee7
SSDEEP 12288:PbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16D5523BF965C41CAE52604B5C3E9F14DAC173E5BE9200483BA5B7CBDFBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 9592c9ac61dc0181e788b1ab18a789afec6acf61aebf9f6960c25cf63b172661
MD5 48834c78b1d7508071f0bb386f545b18
SHA1 b7ef1ac3e09adda40c714766ffa0540ad4bb089e
SHA512 eb41ac1440477f44646bb193a0e5d815118f205d2c602d0bc3b7dbef03d41d3028801f14dc4bf60f751e8d427a06c524bd597062d15e4446028e9b5d285816bb
SSDEEP 12288:k3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:k3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1655523BF965C41CAE62604B5C3E9E14DAC173E5BE92004837A5B7CBEFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 3fde031f11a702a2a8e71cb43ffd2c52e8b9589041fd51eef385da097f608467
MD5 54d9f593d480095d849adb66f67f5ecd
SHA1 b509591d52277ec6f3bf0388fb40f7bf8a077d24
SHA512 3b8ab83bdc5fdaf17e1b73732277c0f376b17be3bf3075585bdae527fb2b5c1492ca393f0a0ccf57502ec066b5d148a9f12bdb7a95303b2c75a493c6b952b988
SSDEEP 12288:ZyPz5L86Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Yzy6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CC65125B73A530F9D1368178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 68937e4d1a63904a48e9cc64568a9f2a979ec5e3da388ac6f433ac73618644e7
MD5 ff716620b43dee71d0db1e1c5bc66a23
SHA1 fab80b921d76c3cd2bbf3b15045ea60125c46d07
SHA512 f4fd893336fef26a3378993c6860f01f52c280cd7d69b2860b5b259e77823430712732c5e865c3addd5c98232bc007e7eace629eec847d443497c162bfbfe850
SSDEEP 12288:dbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19A5523BF965C41CAE52604B5C3E9E14DEC173E5BE9200483BA5B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 9380bdd00b059944a6b92dfcd525afa871dae862dc6236082ed544d62a9b2a62
MD5 4218c7d7f675e95acb480e4b2aad3325
SHA1 edb159b4604a9e62668c0351da06c6fe856232af
SHA512 7ae23b40d303012f19e9f4d7db6aac176b199236e9d4bfa62a8050420ca2c396b6147f52aa7a12d53b400089c1f09b8f2e0cae24f560de4856292d021f207484
SSDEEP 12288:kbXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kbsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BE5523BF965C41CAE52604B5C3E9F14DAC173E5BE9200483BA5B7CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 431abe6ae86dbf8351889fb96f0f8c183c6cfc335504eda32731423ca689d84b
MD5 766afd016a4986037fc578bbabb643dc
SHA1 850e6cb06f79a2ca14a65627db145d36d91f2ee3
SHA512 589af927979ed74eb0eaae51dd987b59abc684c866e0d2a6ab1607f8ec6a9d33bb2bbb5818f9b458ee672f938e5d44b430e383aaa72fea188b1ebc13c43a54b7
SSDEEP 12288:FyPz5L86Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Mzy6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D365125B73A530F9D1368178C5A29A06F7337C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 2bc53db2de61f93a21c156da16477b5d973ca6ee2dd8efaf5420e2fc3b2f852e
MD5 261e967fcdd27f1ef328e027cbe7e827
SHA1 75ca4bf2f4fa741d78b944afea8437c44443f7ed
SHA512 42d9820c24689b30efcc07a84bcb5baf81858e96e59fd0343f2818a0581bdc7b8916f198d230f2eab862c269b924bd93d846594951fa11820087d2f3874e5f23
SSDEEP 24576:oTDaLl3z0zDssqjnhMgeiCl7G0nehbGZpbD:oTuLljNDmg27RnWGj
TLSH
T1FD7501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 e639f4a6367be1b74f0456a4a86d9c2163d0761f702c9d16f1b7869bdd6f9594
MD5 97ea727f3b647ac5d22ca05b44476388
SHA1 61da1a02ed01ceb688d2a0da0d49304a070caa92
SHA512 c83fee3f1edb9be34556b7ce44f6625ee25362da1a8faced25e5472ce14935da194401d0f847f9f970d1ba1fafe8b5bdd220a23f73e7330207da1517c2c72776
SSDEEP 24576:S34d9CHKy7GZgsqjnhMgeiCl7G0nehbGZpbD:04d9CHKyaGDmg27RnWGj
TLSH
T1AD85CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 82043aa1f5eac41cb4c58480ee49833a5429298c3241b279f660324969e4d2a1
MD5 7dd18c7726eedf9d3f306628645f01ef
SHA1 ac47bb95323f4a8d69a975d25b8f769e494fca7c
SHA512 cd06c36b7f1a9bb0551e3075d368ca9de22302b8d30b4138ae1b8c820e311b1057ad7da8f3571ae8ed3af8d91361b623f4eab1a3c39c74b791f162a70a9a3432
SSDEEP 12288:CcXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E85523BE965C41CAE52604B5C3E9F14DEC173E5BE92004937A9B7CBDFBB24584B38422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 bc40e6195b6bba922eddd62345b50914e8296aba1b9a7b67f598d93fa8cc89a6
MD5 4be5e9386f4eb3c5f9b28b8b2e219a99
SHA1 8122d61d0cc908d7acbacc6c6604f9f1671e6b32
SHA512 cbb75daf085ac42f49c986f6ad828af7259db6cfe3cec69aaa715179fc2e9d07672374953e10caf48416ca1e4da5b41bc436eae42790187d9465d7e589560de1
SSDEEP 12288:FaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BF5523BE965C41CAE52644F5C3E9E10DAC073E5BE92004937B977CBEEBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 bc6574f98e077fc1d195bfd27a6d002b850e986d9936cc72ea1df8fef99d9b7d
MD5 1b5bd71dacdb161b763a05f2e64e0dca
SHA1 a5d66a5758eda54b8fb474c989168fa232919a89
SHA512 3d961e5a5f096600ed67bee995dd81da0764064e6cd9c5858304f6ec1d19cb6704827c75043e67acbe9be3e5cf59f1640bc138d8506276d8afaf5b17fe5822c0
SSDEEP 49152:SYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0EDmg27RnWGj:MySzPcD527BWG
TLSH
T19E066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7330833c63107ae5f6316d582483202e9bb358b6279a8497279a3bd4f0afa05c
MD5 689b7d5523207253e5a1e4f424bac59b
SHA1 f3df0a202d57e4519c845f51386016578421e372
SHA512 5a614e2d16eca1cb41c64fce3f03ad9208b1d2f1e6edbcd12439bc8be1cea995df6cf30c927b2f042b01dfae2687f5d6ba911012044d5747ce08559cada135c5
SSDEEP 24576:i47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYesqjnhMgeiCl7G0nehbGZpbD:i47JUQj1irIhCnDHUPfF/UDmg27RnWGj
TLSH
T1FD65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 9ee06e27cbe966b565cf7d54c991c302a4e6721d937f3645659e1f002f8bd346
MD5 4348ca56f38bfba106ad1cc50b2df0ea
SHA1 059db9a2e8d8a90f2ffa327f346013def64f29c9
SHA512 015a27453b422df7b5357d5ad9c54ec4a99f80ee631bb73f580ef6eeff82af0c71e132b13f291a93cbda8a5c2c4bd3f36b1f9ec2f0eb50fc7a0837d892ab5667
SSDEEP 12288:1MsfLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1LsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BA65011AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 9f0c288b67efcd6b0808009b4e6b322c59097e607d16db96d6628186c7ee073b
MD5 79b75d37b2d220da16b67c0f675f01c3
SHA1 b7395580ea5eea1fd5deaf4996580fed4e5851b5
SHA512 2e740c16fee8085512f0ccba9002a366e1d1240aadc2b7e7aa946f5ea68263dbe31e470ddf768a615044bc9bd51570014099aecf4a598f3f45a5add269730071
SSDEEP 12288:eS0W5CU3fvBguCFV0INPqY/WkkmQSaucqI:ewcUPRCNNPqY/WrmQSaRq
TLSH
T18B351740762ACB4FC66940321E77D6CCAB707D41EE44AF0773C9873FD576658BAA2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 d81b839b64335983fa8d1bdb87bfae3b14cab423ddd526e93254903f5e185ab3
MD5 408663edff2c3990762a613be2f75c44
SHA1 2b0c0998cefa42440ff9e22c37fdfa9b13f5c6ca
SHA512 6d5e86605bf2454dd4ab2806194064166bad72f2f4d0d11f28d81faa2c1400f71d9151f732ed4343fae004736989b6f23fe5f5b0b398730383f5505489fef7e9
SSDEEP 6144:LdV+lbTvc6mwmWCmPmtGA2C7vF9yzeTcYkI18JI1EKm69QID0FSCbnWtMxJnWtMW:LLO5f7Cg+V2QPyzeTc/KRX0FSCjm76fO
TLSH
T1DB65F9416137E78FC1BB2031072A5B8CA7A4EC57B7456F26B3C9453AD82AB51B0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 40b9d366009f31166a460b5ebd7cb783b52155d71e566d8be9c1c639582ff0e1
MD5 8a88937b9026ce4c14483607ad41e590
SHA1 1505d4a147c735ab87f3b2209f373410b1bc7b97
SHA512 38ed985baf31ccb18bd64f1db8aec4ae913832eba258db2fff62b5dd989cf2c6a51c30d1ddd31363f97dc132aa486a221acdb13710118767f41bcc6be648dd01
SSDEEP 12288:ZZ7gXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3gsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B855237B935C518AF93605B482EAE12D680B7E669F1044C3BA4778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 abb7d7525581eaa6deabe3c8d1e6f4c124a9861d0bf8c6e12c79fb7eea6cf0d3
MD5 b706a408833b9c94a511806b46b95f82
SHA1 dfe31522b129904a3cfbd2ccce8e432a64b515df
SHA512 e3d561c4ef4c267ad306f43c38c1f6f42fc6ca7bca3b3886a112ddddfb4d51cf0de3c5f6df064e2aa5492c2bf985392b9ddc08f46546a90dde74717c53de9d8f
SSDEEP 24576:Zgb6bmBIi49WNNFpg1rSvFv7bYJsqjnhMgeiCl7G0nehbGZpbDK:Zgb4mBIBhGFyDmg27RnWGj
TLSH
T1C6659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 2.0MB
SHA256 06f5df78c8b14308773915203cd621d4c33d935b17c501eea69793ff79568114
MD5 552b5a88a1ddae2d0d043b9c7f05892c
SHA1 460380e9cb8859e9a571397f3b7b82bd7d3fedf6
SHA512 204520fc3ca5c62cdd649cfdf91dd61dec293ecbd7d44cedd9ec5b5d4a8aca964bf13dca41f17039b2a9d94d77a8c7cd022d415d0629e2647ea84b462ee84c20
SSDEEP 49152:F8MwBtOmbDmg27RnWGjWxwyMn6GVYCOEKNR18yL:OFzD527BWGS/M6GiCOfj18i
TLSH
T18BA5E16EB6B846E4D1FEC5B4CE238112EA727461173293CB5290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 832KB
SHA256 33bbb1bed3e123cc982f6e0859c319fe339c6589e4871a76e6ae471f8073c35f
MD5 918cb377e0b03f9ea19ce15a655669db
SHA1 33605d528fe35783f702146d6a20904af1c1d25e
SHA512 8174aa43ffc5cd79af132d4ba8f9b7c1063e6a222c4e181784f41a6441ebca2d778d0a9c3b0e82c59454d74bc69e05d5cbd8f32970c8347e42a84896af105c36
SSDEEP 24576:zGCXoBy8xwyXjo7nagR7CGVYCqq0EKNR1rg7uLA7:zG9xwyMn6GVYCOEKNR18yL
TLSH
T1DD0523BDA4716694D9B6C1B8C5E22463A73170F167A9ADFF00D05CB28B649D03E78E4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 129c9c3c6d7f6dadd8b2c8af063e2524ac2916d60f5aac18e92e82466181ccd8
MD5 c71b56be9c073c86219d7bb898ab86e8
SHA1 578a2b6b696f31040a36d5332baabcf246648616
SHA512 e3dfb1cf07bc90222c065248885f3fec82c2b6da4beef3ce9995fba0cc5f3c374613014334d313f926813f087d2451858658400a7747070490cf825b1c13f0dd
SSDEEP 24576:yG88u8FpJqH1wzria7/mOsqjnhMgeiCl7G0nehbGZpbD:p7ZFPqVPa7/1Dmg27RnWGj
TLSH
T14B95F16577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 5d5c6852f23905aa1bd9990c5fa01ede1a6f8c375886bca012c30b8f5e2802c6
MD5 1955f8f7284e7a445d12401eb8d3796c
SHA1 59299c6a3bef27f34840330e9e32f357a1c0ed99
SHA512 60c9d73a8e84b27de88b5dcf4f625462fa790c31defa55ca5f0a1d05d648a8e5671ba72f8cd45c9e67b34cfd52adcc06e55c8bc1af48ef903b4c70bcb77558df
SSDEEP 12288:qHvUrBFrEjwaQJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:qPUr+NQJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B975F12F22AC18E5E676A17DC582C70DF6727862171192CF02E1817E5F63DE8AD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e2fd1f5def68716d57f380064d4c479be34f864a2086c1a51e23de8b1b6feed8
MD5 f207cb15cd506a481534d35dee9a6937
SHA1 6b60dccf691d80effa178bf671a4c7166110636c
SHA512 c87829fe4f165ab4ea56ff14e3bc2a06dabb65d97a10ee72fc32379057404efd8c9a9f2d15536a4da93fad09cf3f566bdada7f9ecf74b2a255d688e2ad3bcdde
SSDEEP 49152:sBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj9Dmg27RnWGj:PG05lO43bQD527BWG
TLSH
T10FD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 573980a75556c20d64e610b332c29ce3ddfcf043914a940f63e4269fb90ceaaa
MD5 c3ddb81822ef7100bb4ad2a33f391039
SHA1 8159476d610dbe242e62713fe51e525f3cdc9101
SHA512 605b37c5e9d1cabba4f9df9be902e55f88209956223788997da6511a56b0b0569a9f91d145fd1e2e753ddcc959e19676bce498e2564fb114203dc116de2a437f
SSDEEP 24576:nfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnYsqjnhMgeiCl7G0nehbGZpbD:fa5POZ3+Jt2pasx2+muDmg27RnWGj
TLSH
T10F65BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f067770d5b056ca09c79161c4856866866ce6d42c726fd0ff28a7a917fa4e30a
MD5 fca8619fcd5b400651f28c4533a0dee7
SHA1 463b7ea9234adcf4a86f9aee92cc87ae7c553504
SHA512 17444b5b18a859b9798a94c031e26627aa5fd540d7bd86155cebe47c9c8099c17135dc178507828b1312aa39355e8da6952afbc9ff3bcb33d46013544cd8b977
SSDEEP 24576:sNcwHdjbyQ4nLC18lb/EOjowL7FkWsqjnhMgeiCl7G0nehbGZpbD:sNc/zEOVHFVDmg27RnWGj
TLSH
T157857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 ad97e78d436b595970708d1d58060ffda7c420576daa141808f99507cd3ae482
MD5 0b1f246be8ab2fff0d9171a468873f95
SHA1 d0a5336a8be9a3f6e5def9b0833df1f09962329d
SHA512 f18ff85291808fe01dce8a446941e1ab5155fa0a18b6ad5e28021f9de3cb79f59fb8b4627c8f57c769489c2fe80135b766bdc52f6b1fcbf113714436ffd32f5a
SSDEEP 24576:U6DI0oBy8xwyXjo7nagR7CGVYCqq0EKNR1rg7uLA7:U6DINxwyMn6GVYCOEKNR18yL
TLSH
T1662502AD637611F4D1A7D07DC6C30512D2B2B0B1976669DF06D488BA8FA3EC8BD38E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 932KB
SHA256 3959850ff1a7f3288e6fe05f3e5a57391a7aa069da5ba53de1552969984d2107
MD5 3452114a46096a69e7d9c02738b2d85e
SHA1 bb259ad00f14878e2e6f87632dac64f4218022f0
SHA512 33e03b0ae6948086b3360a021417ead9de73fc57565be44499cf5bfa2e202a20899b7d6b83ee68e48b3026ba0a2652c0be300370ad638f6e0719751f710cf3f3
SSDEEP 24576:AtycoBy8xwyXjo7nagR7CGVYCqq0EKNR1rg7uLA7:AtWxwyMn6GVYCOEKNR18yL
TLSH
T112152359A26055D4FAB641B8CAA310A28B31BC716BA29AEF10D09D7F5F35BC07D70F09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 3ab8039ade438ebdd91f4215afb2097d6a3d8cd0b59da1616ab0ef64243854c3
MD5 b745149f0899f5b90997abac6b0a2ca7
SHA1 3b18b277ce81f4b76995fb38fbc095f2f3846462
SHA512 34693005902e1e785b311c07e37e01ca8bfaff62da29b6ba5c849741ba680cb523bd964136d2df1d1ecd368a15a5ccf29510713867c5946b5d328e976d9f4aed
SSDEEP 49152:+DMwBtOmbDmg27RnWGjWxwyMn6GVYCOEKNR18yL:IFzD527BWGS/M6GiCOfj18i
TLSH
T175A5E16EB6B846E4D1FEC5B4CE238112EA727461173293CB5290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 339dedf73b8064210b98d7a6a20f3613b049d0af70646605997b4eb0be25b9ac
MD5 00b026171fb6304f7ebec934b7051cc8
SHA1 059a893b215beaab29a9bfb641194e7dd4de8a8c
SHA512 e10acaa09e059d50647735e6e067edc2e224e54c028d244b5ba344941b67e14dd40b06037a2d8e381dd174d59a5e936b6e1cb95e47410f618e216f0c2817122b
SSDEEP 24576:WD3FHshBIYQgAPsqjnhMgeiCl7G0nehbGZpbD:WDVHeBIAAzDmg27RnWGj
TLSH
T17B85E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 796KB
SHA256 b2a9c3d2b00dabb4fa7e36b6f14c961ee3df69d0072c5c6c1f0d4b814a920b9e
MD5 a0898c2675ea16555c3e3757a8ec2b86
SHA1 6419b03e4963b7cf6e3a9c960cbae49169350e98
SHA512 01d9a4f02c45c63aa6af7914e9d2a8eb996d41d60ab0d7c21cb78b122262505c88543864e3afc5180d756b4cb688ba3840e8b4b8fb598a297fcb97c413cbdc6d
SSDEEP 24576:PUoBy8xwyXjo7nagR7CGVYCqq0EKNR1rg7uLA7:PtxwyMn6GVYCOEKNR18yL
TLSH
T1190523EED831CB54EA9294F4C6D224638B21B0F277EAADE710D50CD296789C53DB4B4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 940KB
SHA256 b664002e29472fbdf4c0f63f8d0817b6f649ff5070c49ae6ad7836dde597153d
MD5 ff115fe7d055186bd9f2ebcc2c1a3e6d
SHA1 9bc7641cd21acb937183d9526aa8c02a1121807f
SHA512 7ee94e2ab67b5efc66b4fed543efa12532eccf050a173706bf0e0c66f279050e69364d8dc7dde6b40976b7d4975d9ed81e6f6273ffd5a23b3324245af16c564d
SSDEEP 24576:x6UqjploBy8xwyXjo7nagR7CGVYCqq0EKNR1rg7uLA7:x6UNxwyMn6GVYCOEKNR18yL
TLSH
T12525239E55A059E4F47681B4D5A240378331B8B227FAADEF30D489BB8B31EC05D3AF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/976-62-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/976-327-0x0000000140000000-0x0000000140184000-memory.dmp

Download

memory/976-68-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/976-61-0x0000000140000000-0x0000000140184000-memory.dmp

Download

memory/1308-104-0x0000000000760000-0x00000000007C7000-memory.dmp

Download

memory/1308-357-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/1308-98-0x0000000000400000-0x000000000054C000-memory.dmp

Download

memory/1308-99-0x0000000000760000-0x00000000007C7000-memory.dmp

Download

memory/2032-32-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/2032-24-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/2032-23-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2032-123-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2952-16-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/2952-17-0x0000000002970000-0x00000000029F3000-memory.dmp

Download

memory/2952-7-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/2952-0-0x0000000140000000-0x00000001402D2000-memory.dmp

Download

memory/2952-79-0x0000000140000000-0x00000001402D2000-memory.dmp

Download

memory/2952-143-0x0000000140000000-0x00000001402D2000-memory.dmp

Download

memory/2952-1-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/2952-130-0x0000000003800000-0x0000000003860000-memory.dmp

Download

memory/2952-136-0x0000000002060000-0x00000000020C0000-memory.dmp

Download

memory/2952-134-0x0000000002970000-0x00000000029F3000-memory.dmp

Download

memory/2952-9-0x0000000002970000-0x00000000029F3000-memory.dmp

Download

memory/2952-132-0x0000000003800000-0x0000000003860000-memory.dmp

Download

memory/2952-124-0x0000000003800000-0x0000000003860000-memory.dmp

Download

memory/3204-375-0x0000021199AC0000-0x000002119A140000-memory.dmp

Download

memory/3204-439-0x0000021199AC0000-0x000002119A140000-memory.dmp

Download

memory/3336-165-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3336-171-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/3336-163-0x0000000140000000-0x00000001401F3000-memory.dmp

Download

memory/3336-363-0x0000000140000000-0x00000001401F3000-memory.dmp

Download

memory/3824-157-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3824-149-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3824-151-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3824-362-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3824-360-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3824-359-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3888-44-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3888-150-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3888-42-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3888-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3888-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4484-55-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4484-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4484-77-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/4484-48-0x0000000140000000-0x000000014018A000-memory.dmp

Download

memory/4484-56-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4484-75-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4500-109-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4500-378-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4500-115-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4500-108-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4500-358-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4500-376-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5436-82-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5436-88-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5436-80-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5436-342-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5556-186-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5556-182-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5556-176-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5556-175-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5556-184-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5940-191-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5940-192-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5940-364-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5940-198-0x0000000000620000-0x0000000000680000-memory.dmp

Download