3d41cbf839a283217033dd67834cdfff0919cc10694d801737c5dd3af4bfe610

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
Size 1.9MB
Sample260629-e76rzaet8m
SHA256 3d41cbf839a283217033dd67834cdfff0919cc10694d801737c5dd3af4bfe610
MD5 9de5c7b74219219d95a593c60e0ad561
SHA1 485094fb5646e3a33b80d7aefbfa3d36365c20bc
SHA512 1e9bd6bfb11c4aa4136d6e41a910f8b09896fd3418bbef3494206b545a671ca43ec8b9258528b8654a7b161c21cf575ec076fd3cbe5ffde379b42a0d520d2d27
SSDEEP 49152:Se/G5I3EJbIzqxgvXXL6sArVQSGoWZykiLvbIvsaXBk3IGejsx5kWxAQgAT76sQr:PlXL6sANxCW6qGsQr
TLSH
T1B1956C06F6F712D9D1B7D63885B371B7F939781A87319ADB43814B071B22B50983AB23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6332	elevation_service.exe
1792	elevation_service.exe
5404	maintenanceservice.exe
7096	OSE.EXE
2424	PerceptionSimulationService.exe
6488	perfhost.exe
7144	ReFsDedupSvc.exe
6164	SensorDataService.exe
4100	ssh-agent.exe
5440	AgentService.exe
3824	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a970e5989a0cd01e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009ab277cf8007dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003418f9128107dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009c5253cf8007dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000217d42d18007dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ad5e06138107dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c22634d18007dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000002dce36d18007dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
6332	elevation_service.exe
6332	elevation_service.exe
6332	elevation_service.exe
6332	elevation_service.exe
6332	elevation_service.exe
6332	elevation_service.exe
6332	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
Token: SeAssignPrimaryTokenPrivilege	5440	AgentService.exe
Token: SeBackupPrivilege	7144	ReFsDedupSvc.exe
Token: SeRestorePrivilege	7144	ReFsDedupSvc.exe
Token: SeBackupPrivilege	7144	ReFsDedupSvc.exe
Token: SeRestorePrivilege	7144	ReFsDedupSvc.exe
Token: SeBackupPrivilege	7144	ReFsDedupSvc.exe
Token: SeRestorePrivilege	7144	ReFsDedupSvc.exe
Token: SeBackupPrivilege	7144	ReFsDedupSvc.exe
Token: SeRestorePrivilege	7144	ReFsDedupSvc.exe
Token: SeBackupPrivilege	7144	ReFsDedupSvc.exe
Token: SeRestorePrivilege	7144	ReFsDedupSvc.exe
Token: 33	3824	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3824	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3824	SearchIndexer.exe
Token: SeDebugPrivilege	1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
Token: SeDebugPrivilege	1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
Token: SeDebugPrivilege	1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
Token: SeDebugPrivilege	1844	2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
Token: SeDebugPrivilege	6332	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 6756	3824	SearchIndexer.exe	102
PID 3824 wrote to memory of 7032	3824	SearchIndexer.exe	103
PID 3824 wrote to memory of 4164	3824	SearchIndexer.exe	104
PID 3824 wrote to memory of 5060	3824	SearchIndexer.exe	105
PID 3824 wrote to memory of 5540	3824	SearchIndexer.exe	107
PID 3824 wrote to memory of 5544	3824	SearchIndexer.exe	108
PID 3824 wrote to memory of 4524	3824	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_9de5c7b74219219d95a593c60e0ad561_icedid_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1844

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6332

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1792

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5404

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:7096

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2424

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:6488

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:7144

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6164

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4100

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5440

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-958335860-2021930596-4099878453-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-958335860-2021930596-4099878453-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6756
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:7032
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4164
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5060
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5540
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5544
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3064 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5a777a4a5132e5b432fe43fbe1f70f4dff0797fd21cad861d8b6ed9eb3c409f1
MD5 1595b4ec39a89740a9744a68a539a415
SHA1 eaea917ee849e0176ae9b97dfbaacde97a85e56e
SHA512 23d5dc18c5bf620d29258a43972179469d0de08bb47f9ea15311f20a95781ee555d911253d97a6e93dfd8148238bd79966abf8465a21eb6cdccade327aa06c4c
SSDEEP 49152:lb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnOAQgAT76sQuE:73q6sjBgqGsQr
TLSH
T154D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 e2aa7898350150e99aa8a052619ddde490905b23718c27990efe919bcbe3b3f4
MD5 85d4482258d087ca2f2f4d94d1239aa2
SHA1 0306098fb47bfebfd8d062f566675b7a58d76c5f
SHA512 bb4dd20650dfdfa4172661c75be0b1a2becd94700918786858a41aa4543d7c9b13bd4369425bbcb294776a7b540e4ea9caa6f1c46606dc9ec9e455cd5e590aa8
SSDEEP 24576:yXYfDtczAPAfYLH8AcevDN0FImbwQuq3Wia7gD:ZtcUAQgAT76sQuE
TLSH
T17875F12963D408F9EC67813DCCB28515E673B8A54360E7DB03A49A6A1F332D85E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 47d85ba6cd96a56d11848beeb8c063ce0182a87346a24e2396d7d63f54c162e0
MD5 5f656a8a6368ba9711e2ef97050f18d5
SHA1 19e28777c78ea7e01e2c90f4be394ab52684a615
SHA512 5935f747789782f82034924f9f304157970cc995e0d954bbb02df49dbde84445d9f3c743c33107bd5d8b521b73e7d4ca5c8cdfe60a1ce0596f02e3adb119146a
SSDEEP 24576:Q0Le5ji0hmxxrMGAfYLH8AcevDN0FImbwQuq3Wia7gD:QPji0Aj5AQgAT76sQuE
TLSH
T1DF85AE16F6788335D073C0B9C5D2A69EE971308657308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5f993f0f4d9691ebfea205824da3182f84917a9722a6d6456dd2f2760b2cc79a
MD5 94a441b17af9bb44903c4c13f7dc9633
SHA1 b5196634cff5bba6618f9a2355b7afa34c974748
SHA512 8c476a1e2e70718743c5c09d347f4ecc6395763e8e8f2f60b46d53f05e2e45cc39711285cfa500d4adf4a406293c276607297d556ff40c91ccea1b2478310893
SSDEEP 24576:Ua7/ezSC6vUyD/aqgrvWn6q8wyuEAfYLH8AcevDN0FImbwQuq3Wia7gD:D/ezSC6vUzPveHjy9AQgAT76sQuE
TLSH
T105755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 a036183bcc40ec8fbfe7d4922dfdd03e50fb97e0968d0a616619b8f748a7cb8b
MD5 ca974f761dcfd808aea1d64f8f4d741c
SHA1 fa518371b0efc9b314828badf6428229e1d3dfa7
SHA512 5d515eab48b06d08d37eb24eca54eb41ee581b263c7ce80e01e68117d7cd993703f04f705079d2f0d07e31a94358a83307de4c339e74b14d59762edd22f7bf33
SSDEEP 24576:OVbqPb88hv/l+YrAfYLH8AcevDN0FImbwQuq3Wia7gD:OVO88hXl+sAQgAT76sQuE
TLSH
T1C0559E66F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f41c42f8a6e2f7c6802ecf9d5e09e1aaf91ddfaa247e861feb1123bdad5d2056
MD5 0bee7f0564a183c510f14823c193cf84
SHA1 57a6446b7371fef525f7ccf654c972f3e1da9286
SHA512 866bdabab8c22f01d77e0b2ce641855c13cd11753b1ef3a02d3887e2453127a930f7670ec41176adbe0f646ba8276a049fa70fe142b44971f475debe2a327a2a
SSDEEP 12288:BLSAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:BLSAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T11B5523578A4C70EAFEFBD1369CBBA5B963D1BCBC8244969A04463BCA793D408D0D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 02a23e1f8dde16c49975c0ca7bec7183e69b6dfa66920cde30a9bc0b3615282d
MD5 ca0b9b4265a1b28cbece54620880ba96
SHA1 ac52548daa209d8c08548011167b39bb1da4f02c
SHA512 b2a5d6d8acc3e53f12254c690608296d38da0588af9764a65d2212434ad20a24c136a6c6a1ff544f482e2c0e2e6533f3078544c42f1284080d110f6db814a175
SSDEEP 24576:EJIUjAfYLH8AcevDN0FImbwQuq3Wia7gD:EJIUjAQgAT76sQuE
TLSH
T17F75DF3BEE28FCD2C67E8D795A918600D7B278704B52A3CBD165830EDE235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c612e5b637acc6e0c53d7edc01b8f438846751cbc4b12eb18c495c365cca3166
MD5 b3ce163ff192577477441a3e9dca913f
SHA1 082f1028c83887b7e6bce120bf44e294540e41d3
SHA512 affc319a3acbea5fcefbbfd8ffa318f1f74d6171fbee381baecbce943ca1df42912bd9c66efacdec1ecec802d590846b123ab1b8cf93bbfbb6dce4113d7d8b61
SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THw:eQvGAdlCEL8c/DRNw5CZqGsQr
TLSH
T1AE266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 79cdf1e0c7f835e988910df97f8cd17457b61a6a8dd7dd42cd09fc613e48a9b2
MD5 4e62f8d83ff47457d9502e89e41ee2a6
SHA1 2a3f406361db1445ffc40c6d6b8e98d96c631248
SHA512 1ebbfabae005369e49173a024987c977ff139f88346ce359f38465f73de80151b5cc79a516476be29236bbac5c6b1f1fd652cb50212861158ca19607b3bcf816
SSDEEP 24576:r0ewsAjpAfYLH8AcevDN0FImbwQuq3Wia7gD:oljpAQgAT76sQuE
TLSH
T1BD75E031FE74E036C6BF0DB21B36C716146CB9204B511AC3E3A85E9E59342D263B6E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 450a6585d903075786eece7cbc129243fb60ee587d983d85259bc176e68c7956
MD5 f6594693808ca6371a8ec431c325639f
SHA1 0930b40c3cf8e9fd7358cb9190f7c959f1f55da5
SHA512 e58a8975e364e59f4e346648aa3ef33f584149ef42ba9e20b7d8d825bb8033270f4677d3d13b665ec5bc72ef58fd1d72954d9a54c4b23b99036883a0869d7ae8
SSDEEP 196608:iUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHMj:iUEtQevvqc2W1cpV2tI32
TLSH
T1DA474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c4cc9e4b381dc41023845fa48e27d912755806fbff32f70d459f7b5bb7d9c929
MD5 9ce5cf038ecc89f6791d1f709a83ac4b
SHA1 643d0186286f600c21cdc171aed88ad47852dca7
SHA512 8d223ace3210796576db7b93c2a42f572e62b1a68648020ee1817b070ca9d25111790de95fce15006518590389542ff89dfb3e60ccf7cabf0eb69812200db6c2
SSDEEP 49152:XCbRquA/m2yL5zTfFiV+XenmE3/zJAQgAT76sQuE:AoquVjnmdqGsQr
TLSH
T1A7D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 98fea639d35b73aa9ad98848b5cad283b7ecee302f745c950fdfe7c2072272c4
MD5 91191c44b39aeabaaf27d8cec277f7a5
SHA1 1831f49d539968c60effbeeff0a1ed4e8014ae26
SHA512 8c0ca0699c63e55996dd394fc59796f2ab71f4785e37e0a4a369c0c3dbd371ea80a8f92ede4bd0928493ca9065728cdb48d397cd406d7c4b46107f72454ed53e
SSDEEP 24576:DAhGL3IFoiwtA5l7S53IAfYLH8AcevDN0FImbwQuq3Wia7gD:DAMUFoiq5YAQgAT76sQuE
TLSH
T17D359D81E7F955D4F5B3AA7899B69170EA76BCAA5E31C20F2150D20F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 16b362ff6a1ab76d9af7df1d82adfb377851c510f88468c3a9b8bcba2d2f3379
MD5 6e94fff6e31c00bd0832bd13721cef18
SHA1 99077208d34a08275b48818475e0ddccbea1c0ab
SHA512 2b711a3e0ef42279495879872c17e9e03e3cd1fddd033993cff64e3c2bc423c6b05f79d6cf6f89d3e530c0f3fddd0aea4003328b8473bfeaa6c49ed3bdf2cfbb
SSDEEP 24576:Wwu4OWdAfYLH8AcevDN0FImbwQuq3Wia7gD:WwvO8AQgAT76sQuE
TLSH
T14365F14A76A81CF9E9A781398597C136F7F2BC152A21D71F0360C75B6F37221AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 d9212da74c741fcbc7038d51d0dddd05b1d283d7493b12b19db87a55d2b667ee
MD5 6727d91d7f9f6792c90189985e665dc0
SHA1 72df070a6334103da2eddac9177542753517d4bf
SHA512 b242011637089ab988d47d2efcac979fff6dcb9e1b0ba9513fc085b2fe420e6d36030e47acdc9bca4b689b71f08eef6d6364f030b8d88478a875d7484d1b3b2e
SSDEEP 24576:QZu+AfYLH8AcevDN0FImbwQuq3Wia7gD:EAQgAT76sQuE
TLSH
T1D855125B239830FAE5A7C139CCF65659E3B278A6532283CF0115079A2F37AC59D78B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 273b638a6c8edafaef35fb453bbf52a2be50ad1a57d6b6933d6a7c9aeb2abf0f
MD5 7ee3d1767aca180f36dfbd540e8fb373
SHA1 c31238f547821528c1f0cf8635d3a58c5771742f
SHA512 daf5fdf21d33c4441decea6efdf116259a503c0e728bc8c9e65778f6281e11b1a54ba8817f02733f2ee81a0886ab0e08bafceb30497f878ba466a3ebdc4e913c
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UM:MQRQyi36YOcPbLvw2gAf+PN3MqGsQr
TLSH
T125667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 08dacc8b893102a0ef5d599b934b175471c0b9d0f0aa567aef0ae12ac4ad81cd
MD5 bc9b02f9c67080898af354da598afc58
SHA1 10e1a2044030752fb2c2d13cb6c68cb4262299af
SHA512 63d6e39e3aa0cbdf91b38450167ceb633416d3c80c123d3296779373b44683d7406bef8ffd93bc1d16532ab345ece7e3890dc16d8a87fee259d0b68cb9470ab1
SSDEEP 49152:sj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UM:jQRQyi36YOcPbLvw2gAf+PN3MqGsQr
TLSH
T115667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 caabc302f2fc324c03bea0dac4c5fb30bea42da793bd16a65e91894bf4c1c33d
MD5 a1c612c2c9803892c128f236846eb4d8
SHA1 36ff5227380938474120a1cc3a499356d13db3d0
SHA512 c4da42af1eae3bc565d751b9041318515e45b73dbe52850fd13201dde024162eb580e3a4f3d17023ea12761a068a94c3973f5ddc64a72c9d3139ed24829fb9b8
SSDEEP 24576:CwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0OAfYLH8AcevDN0Z:868Qg55nhceWu7PNU3/5AQgAT76sQuE
TLSH
T15EB54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 963c5f752969455628fba1699f3b5a94c42248d81f983a6a4d05f9828b0a3099
MD5 aad421050d975f93ef2b24c2946764a5
SHA1 203f38cf7fc72c3f8169a3f40370de99a36d02bd
SHA512 1c072ea1d984949c4ee1fae0da58b0ad739beb58f4abce17ba26e0c66e9d2866399a3fd6c15218e13fab21be4f5095733c00847a2b01100062bbc312d0ecb468
SSDEEP 49152:83aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99K:5y5112gYy5azzVvt69nLKnhZLqGsQr
TLSH
T149167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 47313c554c0de39317d4ff03885b7fd4e762ee9239a645fdb1e01afd1b8b3876
MD5 c144026c8fa2ab93f85915b810994bae
SHA1 361c544450c35aacf80430135856031b3796ee0c
SHA512 2e256d926ea0741da14f8b0cd9a2960f9d46f8da33453eadb573ff16e6dc3e5d93badf5d713b24053f06e38546bd78f037eb4786e8e285aee4cde5d5f98ba95d
SSDEEP 49152:3B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glfAQgAT76sQuE:Zu6Jmdxd2dkqGsQr
TLSH
T1B6D59D13F1D901E8D06ED478974A9233EA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 54d6078f74ca1eb819d36a092c4919242c80dc3b8d39eb9031401f003bfe139f
MD5 6c36235f966e6a26540cf2ed3c6d9790
SHA1 03816d9dbf2202454ade0076aa834b6aed0c4fd5
SHA512 7e5dc3a64427d05a3f5e078a960f551376d55938618ef357320e9d8bf8b9b03e226aa80116f3a15d4a55c433db466887b84dc6d3333223dc4a342390992fa37f
SSDEEP 49152:i1hpsNoJpF1A63U44CwH7R4xDAQgAT76sQuE:imifPWRdqGsQr
TLSH
T11DB5BE13F2D900E8D06ED17887569232EA62BC460B35B6DF0A9077962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 acafa3406ff5b3f56aecc28cea4d2cf28840693254731bd5340b1f3245c7064a
MD5 fa03d20d66542a97712342c1cf60b5c9
SHA1 761917f6823a29eb2897590a3f4f40bb494fe914
SHA512 cf81644f63bb80d4cdff16eb21630144ee6c3c0631b495c2239b83635c4f5a2b936ce291688c1be826f05f8921b03f0fad87eee475a4eeef2dc3193832251ac8
SSDEEP 49152:GSuZQIY0Be2KcRVtOnks6NMHq+AQgAT76sQuE:I5dKii613qGsQr
TLSH
T113C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d265357d09f41eb29f5f88902409f0d985979d118a3bdb456166536e75b46db2
MD5 50e46cbb5a486da522a6ff3ac151b864
SHA1 ad90df50d527e0777ed2166f7c69d8e50c7eaeb6
SHA512 73243bdfb8e5c7d8bb311e68cb2bec7ff9d4d4c034f48236df852cb381beda573c0c5b7ebc3a30b9ed4a17928e7c84f457454080b8796067f0d77a5243d397af
SSDEEP 49152:JhtSn8EApI0fig3giDn0AP5wPAQgAT76sQuE:4X2imphhqGsQr
TLSH
T1CA95BE13F2D900E8D06ED178C7568632EA62BC150B34A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 a8cbf6fd45e10d9ebb9d8925b80cd962ecb40434d70136c323a1aa10c461fb93
MD5 1a621ff8e7ef14798722c2f718c31bd5
SHA1 66f37a8bfe419c76c6018c55bc4b7b6716c2ab95
SHA512 1ecefc3a53764cc82a032171b5846a8b6d50b03496a58362cc300d4cc28725d4758602e0f193b661acebce6a14048d1fe7c1fa79746b5bfaf43cb17599523dca
SSDEEP 12288:rKAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:rKAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T19F55235B594C70EFFCBAD1368CB7A1B9A3C07CBD9346939A110A278A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 a8f32976b8eb6cb08be5890044295b9128b0613bb74282c9407772c5f79c6514
MD5 c574ce0c7c185252cfa994e6ba0a36b8
SHA1 8295e87ebba62334f128ed31308cfb86395e920a
SHA512 378d0ed7b5d251b64f4ee96271569c917e5975b8de526dc743d63eab08a5259aae326b93f07d54c0ae104e4ead798b961e8100067d8f10899e7a5acc27d1214b
SSDEEP 12288:7FAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:7FAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T16555235B594C34EFFCBAD1368CB791B8A3D07CBE9346939A110E2A867A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 0c318b1544e97805f39a84965497a6f91b1450c9fbe30ef57828fc6a792c7c47
MD5 6e9b21d35c16425d961f7ae558271ec8
SHA1 458d158bf7e2bd7b74af756bb1cd7b824054cf3b
SHA512 22494370b44c050a952fe0f563b206a98f8bfc398bf79f8bc66660c9873baa1a7257f8daaee56634f16872a56760974580f3972f86bdec0e0e5c4c49c7d1d717
SSDEEP 12288:37AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:37AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15F55235B594C30EFFCBAD1368C7791F8A3D07CBE9346939A150A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 8bd79352dd4e05fa5dbb49994e894235cbf975f8bf8e9d9ff6972b6f587d9f5f
MD5 05fed72d15712148857530e8808492cf
SHA1 8807e38e7ff6af8b8ba6c507b6612fc078ff5064
SHA512 2f5ba8e86973abdb86c2190445aab6b02d2557aea7ea24090a21bc9650e3ba334eb6e61a117f7825811103ff9dbd42b5fa87da012e2e61ad2e977169f1d75be8
SSDEEP 12288:mVoAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:hAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1D6552357169C20DAFCB7D135CCB791B9E3E1BCB9930293DF06011A8A2E3A64895B4E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 5b74d64e071c96cec131bba8ccd6df0fd4f6dbf735c27fb78eb991c4ddac3238
MD5 0583d92b67e85a7cffbfd06735c81e09
SHA1 d046f62a91f2d85bf698d2a0fa867dbb6651e388
SHA512 8946d8af6639d8d6cc07c63e0ed4763fa0ecc56cbf67e1eb7ca79c80a57d00b97e4decbc9b0949a9032e93faefaf5c15f1fa8d3e2a763f58b0606e6cee20cbae
SSDEEP 12288:IwAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:IwAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1D255235B594C30EFFCAAD1368C7791F8A3D07CBE9346939A150A268A7A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 5e9a2fe0cf2172b78300e83eef03318ca652d8d4d4e47ff6b32673b13dd57e27
MD5 7f04cac657ac89e9bbe39a098ee807ff
SHA1 a1f998493b950f081a3c59cd41dde071ca0b835a
SHA512 bea47391fe3eaa2196b524ba25238d9eeb0f140c0dc38859b379b02e92ef090a52ae6f8d4a12273a315a9e2d1dc8c531a9344654895e97834322fa863f7fa082
SSDEEP 12288:rhAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:rhAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T10A55235B594C30EFFCBAD1368CB791F8A3D07CBE9346939A150A26867A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 d8f71d4af14d783f74e46787e0a054af87abb4197887ae030742a8418b3234d1
MD5 30472322226dd1381c382e7a54085441
SHA1 639ec4191a0c91f259e32c54b382654289c64777
SHA512 8cc4a59619846d401b05da8868ae49938f1912254c46e20ad2f4c0365fcee2e24f65a9f51f3ce12aa80bb3a4bf80e5d6cd2b1f512fc2e0741d81a795e83fa568
SSDEEP 12288:VtAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:VtAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T14955235B594C24EFFCBAC1368C77A1B8A3C07CBD9346939A150A2A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 90b04c3283764ead4d0125463c060ba465a2ea77487bcf152bfdec0d08e70d19
MD5 8871453e02575ea1ad0b76ddc2d3e308
SHA1 24f2abf869d2a5a45f80491dc86224169f24d6a7
SHA512 63cc8c46d98670feeb967132196efb4eb713023d78a6a0ad440091140d1d9345f31a5c7df12cfb3258969a7e99de3b9a5ae6ad0ae888116d777d2e553c46030b
SSDEEP 24576:AZMRzFVSOlAfYLH8AcevDN0FImbwQuq3Wia7gD:AZMRzfRAQgAT76sQuE
TLSH
T106750195B39018F8EC67813ECC668916D2B27C6A0760C61F03A4366B6F373A15C3DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 a26b51307e91375e131375d98046f8de9cceb4198af85cee16e3f62093348ec6
MD5 552cb0e5045dea055e41d95449e80bd4
SHA1 71da6f8846988b16f327a506394471689e686570
SHA512 cb525e40562c37fafe388a6207a3c5429c1eda118aad505021a8fa237b8dfc06a89c8df15e02320f0c51860d99e4a642e6f772ef9e71838b977db9174d48e02c
SSDEEP 12288:NuAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:NuAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15755235B594C34EFFCBAC1368C7791B8A3D07CBE9346939A150E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 6398d19bfcfca47e0752caf4f3e0009ea7be4ca9a74b23fbd965c4481f7b5143
MD5 2f72cadf7b758d1ba88b851d1115346b
SHA1 655c1b605364cb3fc429156bbe95aedfd2f0cbbd
SHA512 2e516b8d2151d720da60154b91038ce69d932d821d9d5479c5d9e42d306183df4d45e81f453e966b7bd47d5ce2829ba95b91a4fd800a78b981c6ff3c270dfcb1
SSDEEP 12288:GCAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:GCAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1F455235B594C24EFFCBAC1368C7791B8A3D07CBD9346939A150E2B8A7A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 c3a9db8ebf0052b7ccc2e645f39767835ba77aabe9495ca641f71b36954ada6b
MD5 568039f1e308f0e8aa5541962e10c5a9
SHA1 c089fb86e016104a329a13181a1ef6bb8f0c2719
SHA512 966b9ef296db70abfafe7e03873c3489d2f8527b9a8000bb4ebed4d77c83f1dc1cc6c92a96d45f4dda9a1bb4f080613624258bc985945a14e779436336934a2d
SSDEEP 24576:czyZAfYLH8AcevDN0FImbwQuq3Wia7gD:ccAQgAT76sQuE
TLSH
T15865010763A530F9E577D239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 9ed7ebe23869b333802b88e8997990da63635ac182d5201cfdb3a2563488fcd0
MD5 53ae10f43e6475ee38fdceac39f4411e
SHA1 9a1075e407c7a1bb5be343f52a5bd167432a36eb
SHA512 d50dbbb5e6d653a58c0ccfcc71a03672cec5f2f0e311f4fa97e8ca3712bdf166c203beab1852c0430ebaa0976525432aca268957a2cd0f1330b595997d2b6ed5
SSDEEP 12288:6uAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:6uAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T10755235B594C34EFFCBAC1368C7791B8A3D07CBE9346939A150E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 c35da149a294fec0eb6b1f08f2f104e959b598574d6c140f883a93e53d2338b3
MD5 2a9315d588bc688a8dfc76eb086a1238
SHA1 903f0822ec35f29bbb2ded31c0c885f5ea5fcaa9
SHA512 9f72275ecc0ecea44c26411ad7c25288aae145b385b9611d1ea681f2e430ea2cac10168ddf8027eb2fa6f5177028e56e95f8a2a66e5e79d35736e8461e4af5d8
SSDEEP 12288:SuAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:SuAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T18355235B594C34EFFCBAC1368C7791B8A3D07CBE9346939A150E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 a8237af7b526c871ab7b02faf340204d4ad2547420682b171539d46b5c70b4ce
MD5 e9b515736db2ec7af9612c372834a8f8
SHA1 1de5d902d4e9c35ebf84348467760f91910ba89e
SHA512 e417faaadc4c759d9b4af7e3225540ac52d7d254287694f5dcd33dab0cf3eb3e500b393606c4ca0587abfe8464a6a07c166e4c4a9800cd419fb8cdca6adf17b2
SSDEEP 24576:gzyZAfYLH8AcevDN0FImbwQuq3Wia7gD:gcAQgAT76sQuE
TLSH
T11665010763A530F9E577D239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 9bfe819b6d1ef3ec9cbf0c62bf613f88b528ad15e5ea268b592806ebfff29846
MD5 87a10efb44bc32b35644adbec230dd00
SHA1 ba1859527c5880e585d9e57ca34ca38420132b24
SHA512 da80c97f4f29ad23c7d7e3e76e196758db91d54d0b6cad585c290ffd92abdf422c17ff8ba53b276f222ba5432d015d3198120e8ee94797c888158f39decc0a29
SSDEEP 24576:LTDaLl3z0zDLAfYLH8AcevDN0FImbwQuq3Wia7gD:LTuLljEAQgAT76sQuE
TLSH
T104750195B35018F8EC67813ECC668916D2F27C6A0760C65F03A8366B5F373A05C6DFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 4411aaa7ae90d95381f6048d19f127206bdb7506a4295a65efe4feaed9e91e7c
MD5 70e3f7b29df007465453e94356880109
SHA1 eaa266fa9e9838416e0b429856b7a9e95c656854
SHA512 c340b123c541229b6aaa704a8753cec8edf78c48cb86c404c447e54b10bdc206374464651a13c0b71908bd16bd2be99c9e9cbd1a7021ef492b8d6af1fccda082
SSDEEP 24576:f3vd9CHKy7GZnAfYLH8AcevDN0FImbwQuq3Wia7gD:vvd9CHKyaRAQgAT76sQuE
TLSH
T14085CF91F3E810E8F0B7DA358D765511DAB67CA91B21DA8F03A4265A1F336D18D38F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 b9f6e143e6a499eadb9fa2ed159fe73ecb102371024679facc7b4886807c63af
MD5 21e8e83156dfb935a6f05a6558b63ca2
SHA1 17f7d0ca982be556468fc2ff1ac11e99eb929ec9
SHA512 73f8ef0457c7ecd04518b7d6e18e7202d8937e27309f2bae25c72d3e857eeb1a6cbfe645d42a82eb362bfa624f635fc608532dbd8fd23b0c2f71989b0f388291
SSDEEP 12288:LbAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:LbAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13155235B594C30EFFCBAD1368C7791B8A3D07CBE9346939A150E2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 e67eb2106e81e3d2d3aed8c2954a74636fc65c2ec16bf71874bf26edb3e07a4c
MD5 9c8665f9e2d7915cbf23091f82cb16a3
SHA1 ca6a7a53adb13f6f664c7064c588fc743959af58
SHA512 af0248621460b2d0156dfd4907ec03022a9eaeb4f54711c12ac312fbefaed9537c0fbaa195c481a623bab18a8c40f674b4e098633888849889a7c9c614bb51fb
SSDEEP 12288:Z5AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:Z5AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T10255235B594C30EFFCBAD1368CB791B8A3C07CBDD346939A150A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 fceeec59b7e2bd81e5e589f9607e2d86572326470f13378e2e4b05cad136142e
MD5 7331a0c850ca21a52e572339006afa9e
SHA1 7d14676c04af34f7e9d328d5811c792552fcc8b1
SHA512 c675533081979bc87987c356b752462aab889ca838e85b682c0e71f6baf0e8b1a42f8b896436e43a19a3e941b396427fb14473dde41a2f0f8afe31ba8c05a9ca
SSDEEP 12288:7MAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:7MAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T17D55235B594C34EFFCBAC1368D7791B8A3D07CBE9346939A150A2B897A3E408D1D8C74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 253aa934812c90a8dc78a79bc29941e50a38c988fb3b7f66929e97b6f2973305
MD5 c47580d4c0ee82a289233b475b4ea89f
SHA1 97ce4a174d218c58c03ebc77fdc19642af8f5eb3
SHA512 97857bf724aac8a616b87ffa9e249dea8806ce7947a32d3454d22d8bdce2cf22388b1a3020913b94b806ba5593a97183f61460b803199299f0486236c4393951
SSDEEP 12288:cuAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:cuAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T16955235B594C30EFFCBAC1368C7791B8A3D07CBE9346939A150E2A897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 a17dcea2cbdea7a2cbcba4464990447074df05ba63773a8dc1ee55d37e241fed
MD5 1bff9484f0d4de1a9aace87b7ddbf861
SHA1 47e7d134fb147a3dc3e62c02d22034be573018ef
SHA512 077a05b2cecbe8d78d1fd0b23dccb04be99b830a0f42e5fc6ea7c77789b2963c9605e057d60966892bfabf54f854e47a5d29dca6be975fe56d5224db3e2f389b
SSDEEP 12288:3bAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:3bAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15255235B594C30EFFCBAD1368C7791F8A3D07CBE9346939A150A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 839f250c36255766366632c0b4b319d5ada7b745247e4f6dc34c6e88aa4e1642
MD5 0e835378a2ac00684e686740146945b8
SHA1 2c80a0e067eed9d50c74189b67ac036e11b1fccc
SHA512 5703cd96f73d1027a15090f0b4114416c497dc5353e0d9ac8b6472013a2ee507424242f209897dfad83259e83590afa297ed209118a943968e84ec1507b02b9e
SSDEEP 12288:nWAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:nWAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T10C55235B594C24EFFCBAC1368CB791B8A3D47CBD9346939A150A2B8A7A3E408D0D4C34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 e03dc5408166207a26c7a787ad119f5e4f773674ed983a95c852d8301bb070e2
MD5 f221915c2bbccb8e919f1f9a1f7f85e7
SHA1 49b095d5a06533d03ef3afeb3ced783b72aa862e
SHA512 d90c081728c120e372e94afc52cfc2be7e1b2706871d7ce71fd031e66a5429d6ba513abab36e676ec48572e06ddcfa4bf5157cffd9644830e646316510bcf3c5
SSDEEP 12288:WwAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:WwAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1FE55235B594C30EFFCBAD1368C7791F8A3D07CBE9346939A150A268A7A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 d372c367e8e0a9d34911ef25f70dd1b6862e5ecdb4717bb80f2a727c5ce41ee1
MD5 8677f644867068ec87437c44c8aa31da
SHA1 c0c08f1cd69ae508290047020cb70f88f3e98ac3
SHA512 19a8dabfcbd5a4b7c66313a20f871dece31c2ca9b30486bfd0b0e9e84224577223096debb60b909663cc9f100e6a01523e9a4b57305519b66bf4ca59b193c8cc
SSDEEP 24576:TfwvUk9RX6wkyAIyAfYLH8AcevDN0FImbwQuq3Wia7gD:JMnYIyAQgAT76sQuE
TLSH
T15285CF2AEBDC44E5E1B7913C89B7460AF6B178691B31C2CF025A53AD0E37ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 0428373fdcd4829b614244b7302fbc4d595a383dff469caa5a2ddf3b4d826cc3
MD5 0e4cd69cf06fe67a14ae8b003c7874fb
SHA1 062365bb02334da03b9b5e259fa51e17babd35f4
SHA512 d67e55586d186cb92378b61d252b2f9ec0f2c6fe40c9aeb51360908154df078ca9e1ee0ee313044ce7b9d81a38c94a159bbfba6c137f3952aff84f5f47fcd64e
SSDEEP 49152:vYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0vAQgAT76sQuE:6ySzPsqGsQr
TLSH
T14C066C96A16801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 737ca3bcf729cfc99c13cec4ee5c857185e802e2c2e481c127d493471d18e65d
MD5 2ef2ffc5dcabe6ba45af6f592575e69a
SHA1 8b77630e5ff28540ffe9879aa450acb5b926c582
SHA512 43f6abdf38c1e1cb9fe49ce277f2a9de720f90266bf182a5d8482b4b3a88253440aec174c2aac5006f3e8d4b1ef734e0b680aad0a51b2c378c2ae858077a1ec1
SSDEEP 24576:047Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYVAfYLH8AcevDN0FImbwQuq3Wia7gD:047JUQjTirIhCnDHUPfF/fAQgAT76sQr
TLSH
T1FC659D1EA3EC01E5E1BA927885154A5AEA71782D1B31CACF1270437D6F23ED49F35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 ba3860a67a720423c37dd3031de3d3873addd57883030ef70f6c28866dde1bf1
MD5 dc75371a67164b3597b2b22cba5ab6c6
SHA1 11fd7f7ce08c7b94db0506a2328446e5a409fcad
SHA512 d8c6875652e46a2508f85b2ba8dea2bb15af23cf565ac5d905e7f7b11d4df425513d57e46f6202093bba336d3e9366ef549b774e158a5a916a16b2aab248e65b
SSDEEP 12288:dbsf+AfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:4+AfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13765011AD29811E9D46EA139CB664650F3737C6983E1D3CB12C0F67E1F3A6809DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 63c82f1317729ae7c9a2fea851fd8ee53d6a9daf501414ba66bb548adb21b1d9
MD5 93acb184391b6eacb24b72d893047d3b
SHA1 8c43d8b40b52e2431bb6ecb229612fff2d563257
SHA512 1384ed611858f5c369ed0ed108b0f8390be3569a05c85aaff99d87c75e309f5b9e2ad2da13e9ace970dbaece53a7d3e709bcff5c82715b82ca203c352fc1184f
SSDEEP 12288:Fk24U3fbqvitiGvud9KJSO+uHNk1OLDuHL5cUs:FkDUPZFt4OmHLO5
TLSH
T1CD350710B66AC74FC66980721E32D6CCA7707D41EE44AE0373C8873F957665DBAF6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 50fa9ec56ae760c266d2dea21e89a98a4e8a824e8a9b0ef860c3d44f889b89c2
MD5 a624099a67bec9584b6eea32fcc325eb
SHA1 08d79ebb90290dce9c8e7b876062786f40e3b531
SHA512 aa97710f5bff9e16e73a70c80a693f0283df1fa824452835ed072d7bda7a8799412ddf1246b9021e327d42037e1d2b6392747954fde3b79d1526bea2b67f76f2
SSDEEP 6144:GoDsD4qL4gZFtcrWy53LYKPx7KFtJFv7h4uyFgxPaNreNy7ZCMshAs1vkZFoKbQL:7WAhP+/H38iC8NAeM/JLs184
TLSH
T15165C940513BA2CFD1B6607207266B0C7B64DC56B7496F27B388453AD86B70AB1FE3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 40ab4151823496fbaa14bf684f12323c2262b1a58465950456bebf34b537b740
MD5 2e89dc24b08f620b806cf79e48d391d8
SHA1 06a4e5f3e5b43803726b32b2bb9a27ac81bebf6b
SHA512 c545a7d69e5ffc457a8fa985b8a00b6c54693954ab71870a84bf694a70fbbff45926e58ab4e2fabc35e0ea5cbee617a2e0496cfe59a1faa09f2b1d1382a18e51
SSDEEP 12288:407mAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:VmAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1DC552357864C74DAFCBAD135487B91386399BDBC8700D2DB640A27CA793D8C8D9F4E28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a37f6ced48e78c0ec70314f191ce5dde1db24f6ad5deb0e9c94b62cc4ac66b42
MD5 40a02f1c7192c7f4863d629514904be8
SHA1 4fdce6a3dfd88232a02ae4c6e3d8cb7fdf3b83eb
SHA512 fac4fe8c3b2bb478242f1d5234a454e244f9794d2d0163d0f2ac4c3210f64afeea06e7f4883f832db6f6be587d15d8ea561ecfad7863fdbf268ef58b04224d40
SSDEEP 24576:agb6bmBIi49WNNFpg1rSvFv7bYEAfYLH8AcevDN0FImbwQuq3Wia7gD:agb4mBIBhGFVAQgAT76sQuE
TLSH
T14765AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 96f1b6c2c4bd0428bbd42f123748224cf2ca5967049e275a876f336da4133b1f
MD5 c016d3a486b39875d15c371c62499168
SHA1 389e28a029e757e37ba7bb2b6eedafa668de9479
SHA512 6e800671049f324a0fe6487486c1f848b100cf6a0e5db85fd87ae7e8653d73157ac176aa88ab2c68b03f6f023873436590d05b6bb6cb359a19352ebc9e0398eb
SSDEEP 24576:GG88u8FpJqH1bzria7/mlAfYLH8AcevDN0FImbwQuq3Wia7gD:N7ZFPqVea7/sAQgAT76sQuE
TLSH
T15585F16676E401F1D47BD13889924663F6B2B8250364EBDF06AC8B551F33AE44B7EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 868a3234c2b6babc638738714a0a195a64c072bd01c1fa42c3b729472594ec9c
MD5 4c9410bcf5062bce122a995486137397
SHA1 3afdb5f16de285a11b00b477f5972d59818f0189
SHA512 881a918e811179796a86a2b0f32431c1b5bd91ed00e937ed105f256a582151982636d70f498f83cc7cd240789ec0ed9a6010ce2e01926d4f58a852c75f8d9aa2
SSDEEP 24576:jPUr+NQRAfYLH8AcevDN0FImbwQuq3Wia7gD:jJQRAQgAT76sQuE
TLSH
T11D65E12F229C18E5E67AE13D89968619F771B866031292CF0291817E5F37DD8BD3DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6c2b45b47aebfbb03beeffb8d05396b581233ede79d8033b4d61179c03cd2917
MD5 74262df330edd675ca83b08aef45342a
SHA1 74853b9568e65eaa01db3ecb002675468eb69ae9
SHA512 97251ab6c872a0eae0d318f0e8fe5f7eebf2c8645351db3f8c5253b10535fede8063d559d213e4ae9410aac8cdb1f9d59a77df8f53498b2c96fa18332bdd6887
SSDEEP 49152:PBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjhAQgAT76sQuE:AG05lO43bzqGsQr
TLSH
T1B0D5CF6E62EC11F9D0BBD17CD9C64A0BEBB23825032556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 666260439c9fd6e1ea74f07182a657ff703f608ac5e993c93dbdf9a462e5c7c8
MD5 35f89ba6dc4011deb730bcefb3da5959
SHA1 10a50a7d354c6b429da115937ba848f3f4a1fc41
SHA512 f1731f450b5110cdb29912ba956cc5cd549d0117509133fe7ec3bb765ce5f4e71a62591e4256fe2583028deb3d128a24fb455e082436e6593df670f0f9b319f8
SSDEEP 24576:rfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnvAfYLH8AcevDN0FImbwQuq3Wia7E:za5POZ3BJt2pasx2+m5AQgAT76sQuE
TLSH
T16B65AF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e55f4bf1b9bec09f7cc1f226288db13ee2f181dd9820a6b8b750b53923b67c21
MD5 25c3c65cc1c54f828ade1722c44b79b0
SHA1 cda12496636ea5f85f50c82b50278f722c296853
SHA512 1c8399f8a3566eb98145c56838a81d942ed4a8311e95eea363c0e5d2285f74b6716274a4bc15c5d21890aeff57955108d8851982be00924e9787c28f4a2ebe68
SSDEEP 24576:RNcwHdjbyQ4nLC18lb/EOjowL7Fk9AfYLH8AcevDN0FImbwQuq3Wia7gD:RNc/zEOVHFMAQgAT76sQuE
TLSH
T13C857B1623E901E4F5BBE1BE89779546FAB17869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3b4d43f24c2faa0434b05a852aadb24c220aee73487ad0768475cdf85858c0fc
MD5 5aa6da1269109f8a782b7ba3e52df3fc
SHA1 1b3aa6e2bf9f6617baaf0c95a4ab0ee77d502fe0
SHA512 9cdbb85dc1f3cca748f2457c68927f40e4f0e7efd7162a9242483c5c189343354b8ef1e356870fe071c343d74e7d5517d37d8e04849e87e58964d23dc068f449
SSDEEP 24576:JTkNvNnaFeYhJNtmZBmTAfYLH8AcevDN0FImbwQuq3Wia7gD:JTMwBtOmTAQgAT76sQuE
TLSH
T1F955AF6EBAB805E4E1FEC6B5CD238512E6727861073293CB5290C13F1E279D89D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 fb54d89afa8dedcded077163dfeff68121d6cc28d0f238034d0d4834f4a6d2b2
MD5 6cb18c72509e3e82fd2085ea143f2328
SHA1 30c780e791c6ce22446246eb11efb4577f7f5106
SHA512 3a0a88e3fdef1670bb942525c4ee769eb5c148886b3e1e58d71f212584e62cca0cd1e4d4625f6c419328445d936ea45f7d8b2cf3d3c37f44dba2c22568f356b2
SSDEEP 24576:OD3FHshBIYQgAqAfYLH8AcevDN0FImbwQuq3Wia7gD:ODVHeBIAAqAQgAT76sQuE
TLSH
T13975E17EE65C04E4E57BD17CCA638A06E7B138AD032256DB019481BA1F7BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1792-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1792-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1792-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1792-297-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1792-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1844-1-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/1844-0-0x0000000140000000-0x00000001401E1000-memory.dmp

Download

memory/1844-132-0x0000000140000000-0x00000001401E1000-memory.dmp

Download

memory/1844-8-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/1844-7-0x0000000001FB0000-0x0000000002010000-memory.dmp

Download

memory/2424-110-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2424-71-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/2424-299-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2424-65-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3824-140-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3824-134-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3824-133-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3824-305-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3824-304-0x0000000002F20000-0x00000000031BE000-memory.dmp

Download

memory/4100-119-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4100-106-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/4100-100-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/4164-316-0x000001A7FB520000-0x000001A7FB7AB000-memory.dmp

Download

memory/5404-49-0x00000000023B0000-0x0000000002410000-memory.dmp

Download

memory/5404-51-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5404-45-0x00000000023B0000-0x0000000002410000-memory.dmp

Download

memory/5404-39-0x00000000023B0000-0x0000000002410000-memory.dmp

Download

memory/5404-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5440-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5440-122-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5440-120-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5440-111-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5440-128-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/6164-303-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6164-118-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6164-302-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/6164-94-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/6332-15-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/6332-21-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/6332-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6332-269-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6488-123-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/7096-298-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/7096-60-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/7096-54-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/7096-53-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/7144-117-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/7144-83-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/7144-77-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/7144-321-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/7144-300-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/7144-319-0x00000000007F0000-0x0000000000850000-memory.dmp

Download