534b1e1dad76d06f275406aaad78a442f8d1abbd3affb82ed5efb7af0b291696

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
Size 3.2MB
Sample260910-2bmesaxajg
SHA256 534b1e1dad76d06f275406aaad78a442f8d1abbd3affb82ed5efb7af0b291696
MD5 e38e2d1688fc55de8e3705b0dfa8e01a
SHA1 9e990082bd9f62ab90b1d634970259381118c575
SHA512 0346f259e7f53ac600090ec49d90b529ed72daa5bb60330f44e89898023ccb2140ab72df94522561c50406d102cddeecebe1e852bab088520f0dc7e4ab3f9f69
SSDEEP 24576:Hu6ln7obqwbtpa7SBXYVImj+3VCb/yFPOB1l3OSq2PEIdADeU9jz:HpYK7SBXGpcIKF+1USqHIdADeU
TLSH
T1DBF51A17EBB651D5D0BAC038D553222AFC7134A6833897EBA6C19E461B60BF4EE3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3416	elevation_service.exe
4192	elevation_service.exe
4764	maintenanceservice.exe
3852	OSE.EXE
4112	PerceptionSimulationService.exe
432	perfhost.exe
3172	ReFsDedupSvc.exe
4444	SensorDataService.exe
6140	ssh-agent.exe
5696	AgentService.exe
4400	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\fba739b7238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002165c6317341dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bb2675317341dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b6c3bf317341dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
3416	elevation_service.exe
3416	elevation_service.exe
3416	elevation_service.exe
3416	elevation_service.exe
3416	elevation_service.exe
3416	elevation_service.exe
3416	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
Token: SeAssignPrimaryTokenPrivilege	5696	AgentService.exe
Token: SeBackupPrivilege	3172	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3172	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3172	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3172	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3172	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3172	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3172	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3172	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3172	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3172	ReFsDedupSvc.exe
Token: 33	4400	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4400	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4400	SearchIndexer.exe
Token: SeDebugPrivilege	4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
Token: SeDebugPrivilege	4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
Token: SeDebugPrivilege	4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
Token: SeDebugPrivilege	4236	2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
Token: SeDebugPrivilege	3416	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 5668	4400	SearchIndexer.exe	100
PID 4400 wrote to memory of 4620	4400	SearchIndexer.exe	101
PID 4400 wrote to memory of 4168	4400	SearchIndexer.exe	102
PID 4400 wrote to memory of 4932	4400	SearchIndexer.exe	103
PID 4400 wrote to memory of 2324	4400	SearchIndexer.exe	105
PID 4400 wrote to memory of 5636	4400	SearchIndexer.exe	106
PID 4400 wrote to memory of 1784	4400	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_e38e2d1688fc55de8e3705b0dfa8e01a_icedid_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4236

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3416

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4192

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4764

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3852

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4112

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:432

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3172

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4444

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6140

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5696

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5668
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4620
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2840 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4168
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2792 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4932
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2324
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2840 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5636
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2792 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2cdc485e6d2076fe3da24347d82c32da5677b4fd6ef4a2085eb1d5589eb05c03
MD5 20d5ef85fe6e88f76b00cc66a451f589
SHA1 ef18226c62b6ac616a084daf584fe242d098a766
SHA512 733171664e711fd2adf79a3e924f5515aab08514690b65c9f29f0cd938f0c5bc5279b59532dde75e67d374a62c3281fdee41b71cfb34d694d96dc796bcc655d2
SSDEEP 49152:Ib+632BuPkFKRrdE6ohQstBhuXjfS4LWxnuUSqHIdADeU:i3q6tjB4HIdAr
TLSH
T123D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 d8e17d6e8e27b9d2bc888fd94d716be3254f5112f25df72dc8dba51091e017a5
MD5 d7895f04f63c4001f664f5a6aca29ded
SHA1 091f3050a8d4901fdc006f5427b9c6ff3f4f4bb5
SHA512 d3f1f4ac5245d742493e8c3c834f1f9193f2e724eaab2fa5bbb14739d1e4c8f2144f13cb06faf45de8a0119d5c2e4376fb8c93fabcda35d2c70f02c3344d4908
SSDEEP 12288:01XLsswWkxy2lRq2czAblIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:SXYfDtczAbl3OSq2PEIdADeU9jz
TLSH
T1AE05F12837A009F9ED678179CDA18111E673BC5547A0EBCB03E0A9661F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 b19731db51ff93923e4634d7a507165c91484be5f2ba7d0b113fbee5f5d69df4
MD5 500a8f0c1b7ccfb0b91d72a321e01969
SHA1 346bad2c6123eea6e3fdc79129b6710fff196d43
SHA512 c860822663c013071c2889dbee843d1b4c53cb8790307e963d76218940a71e6fca6254fb2c44a408acb6bea6479f09511a79f25e40f7cc5a88e4d4dd7e50483a
SSDEEP 24576:e0Le5ji0hmxnrMGl3OSq2PEIdADeU9jz:ePji0Ax1USqHIdADeU
TLSH
T1AB35AE16F6748331D073C0B9C5D2A69EE97230865B308ACB4286D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 bee882f39742ba938d10700154985aae68a74288c5f0522382cbe390e22fe8cf
MD5 9fd885d64f5c995c595c1fd6ef6b9140
SHA1 efb2e6fb9981697c0f3962555bd5b71cd20804ec
SHA512 037291afab31c85d27271fdc97f63fd700aab8ad3848965ecc1b80f892803e5f9c3ad2412296c2ad7863428c167396d43ee900bff7bfee58f80ddc998a8b085b
SSDEEP 24576:Fa7/ezSC6vUyDZaqgrvWx6q8wyukl3OSq2PEIdADeU9jz:M/ezSC6vURPvMHjy5USqHIdADeU
TLSH
T1ED755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4ad067b91cdb13d65586ceb4f20511589389a6a4571660dac415ecb71e267042
MD5 bc6928db17f141d261e98ba8952b9f93
SHA1 2d879af458e4b32a9d7547e04a1f62359bd3d300
SHA512 4b8f6004abb9ceed4d918f88ab7ce23b745dee3f25cbfe6ddfb0b6acb2607a8e3503247c0447e24429a0756d2671bbe53a1ba800b4d62262f90b7dbe197f4b02
SSDEEP 24576:dVbqPb88hv/lV73l3OSq2PEIdADeU9jz:dVO88hXlVDUSqHIdADeU
TLSH
T1E1559E66F5748321D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E77BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 7b854f92e14479b90c4e95e5def8c34ddde3877aaadd83567ada4b92997ed017
MD5 d95de029e31d0ab4c0d1a675fb8a9b1d
SHA1 835b3997449f1ec43a278cf94a64041e35ce32cd
SHA512 080205548925c8da8ed660c1b2ae72e2e86525d300accfbe5973d3c7215f1b06cd176fadd6b21c17dd8cef1d89381b27e62be3ec65fec63c941ba203e2440917
SSDEEP 12288:fGClIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:fGCl3OSq2PEIdADeU9jz
TLSH
T166C4234A197512C6E39348B34ED043A5D4A6FFBAE8C4EE45CD80BA89647CF9FE16104F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 022052f86025affcf68af1442e8376e41ff5a74d3ebd77bb16f5c5aa2a0e128a
MD5 1b81a8c65af65e1f3df42cef4021e10e
SHA1 333c0b497ffea3061b98da742885984d1c307350
SHA512 cc96b8b708f220e4e389058896ed6afe9ba57751b4d99f1e42b98f383ffcb73736f5fbba5e26fd98905a64b3d487f6f6c81624148c510e6a932310aefa3eedef
SSDEEP 12288:yeBNUbTVO86UPlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:yJIUPl3OSq2PEIdADeU9jz
TLSH
T13605CF3BAE28FCD2C27A8CB95B918240D77278704F51E3CBD164920EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e7887904191a9d5eae9884050383b03de2732b8baa7108f82cd1fb8d1cee3b99
MD5 1384c9e30dda42f9b1a828bae861cbd2
SHA1 130c5ea4452d29f85346bb10a4568b5e030f3497
SHA512 7da05bdf7ea7239fcf12d8b07956c59d23dababb5dcfee4d9bc236d018392acc5371dc866e53220e3f2645d188382ff7fd99544d8d83176c4bfc4f962c1eb746
SSDEEP 49152:RQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THI:RQvGAdlCEL8c/pRNw5CnHIdAr
TLSH
T1B4267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 28411c7c7afa27439643a97f25505ba2f9011f6d26fff95ce4905b88bc0179c9
MD5 7d24544b462e5448cfb3f900a9d45b35
SHA1 b81a3d233c9198ed1343f5fdbc02dd138ae9c67d
SHA512 6dfe697bfbd9dbf69e965651f93e1c8543fc17e410e07b56aafb64fc234ddbef193f0a1c3faa55964480d6651a5ddcc3e73175aa0867b309f8914fff789312c4
SSDEEP 12288:fAwSfxL/2Dc3xDLLmt0LDQewsAjFlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:owewsAjFl3OSq2PEIdADeU9jz
TLSH
T17715E031FE74E036C3BB0DB21B65C316547DBA204B911AC3E3E8AE8D59346D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6461779e69f8c63960d38ffc850242bc573f6e334ff6b0c628beb0c6f25946c4
MD5 3ef4164e033ca029d987712b79e53213
SHA1 3d85420c7d6248538a2be4b75528ad541fa2f663
SHA512 628f9a4078c794a2a0a961c0c8b42e58e86a2bba1ef14a7f1c44d225e13645e160fe710f4c48542feed2d4a23117595435c7e0fba9819d016071e4f0bcd90df2
SSDEEP 196608:nUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHCHIdA:nUEtQevvqc2W1cpV29I324IdA
TLSH
T1D9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 49c3f987877b602733319861ba8a12355a2cd3976f8a8b55b5952b6db699098b
MD5 067c5e5bc0d1ac2a41a54553e23e40aa
SHA1 3ac9be352577e495789bce33d71d01f5ff48e84b
SHA512 1effee4219aa299876f213dfef6f49dec0affb98f5fc9c6b3f0371a35e7c6784e64244be3a9bc2b708be94b1b10bc6176cb4537c9ed0b3d77a6e316ad2f03a45
SSDEEP 49152:2CbRquA/m2yL5zQfFiV+XenmE3/zlUSqHIdADeU:7oqtVjnmrHIdAr
TLSH
T146D58D0976B882E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 291d3bbb1da81bb331dbb419a322e7f4d35d698c594d9f76bcfe2ca0b9c10756
MD5 c8ceb7932a5bb3f4fc2b2f260cc684f9
SHA1 045381fbdf76f4754d07f2eaac63841d328708a9
SHA512 8cbc969e390e3ebbffbba3353f6c3a0b0eab012cfe7001e6f6f2debfdbb68260d0a4560e18a7538a84c402001ded25f80b76b81944332d9df8cd595451314c5f
SSDEEP 24576:sAhGLmIFoiwtA5l7S53ol3OSq2PEIdADeU9jz:sAM1Foiq5YUSqHIdADeU
TLSH
T19B359D81E7F955D4F5B3AAB899B68170EA76BCAA5E30D20F2150D10F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 3ddeaf9c021b6be667865aa00ab2c25670648dae38d78a935c49d760bd38e053
MD5 3805e9320d5c4c6b4b566837fd8a5e12
SHA1 a2e8bd1af9a2db13c9f6fbfff5700c8ef6bdd95f
SHA512 9eee016b45b2f99f524262cb2a3f481d8f0996e3c9ac7adfc4965e936c0d10408067cb7cb54549fcaf281bfd6451a2c6b7e2f8603eff62570a42702e6dfed1f4
SSDEEP 12288:Wmw5HEjsChNOBFgl0WDm+CElIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:PwuXOWZl3OSq2PEIdADeU9jz
TLSH
T1E705F14A36A40CF9E5A385398697C136F7F2BC122A20DB1F4760D65B6F37361BD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 ff2da642e3c607a2f0dc41362696ae6438e00fa4470b35ef9754e05df729a289
MD5 e7e95a80c1e1716921559d06d0535889
SHA1 b9ea09e89e3d9cb614370cec47db9b9a5592e879
SHA512 6682230e6d47202559116fe558e1cf9e6bc5173b6abd9ea469255f2f8ca1a7d66f68f7f6dda761d51be63d3fb37bb6ca883d96654187d0d227ff2fc49f129751
SSDEEP 12288:2bZ1IyVlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:2Zu+l3OSq2PEIdADeU9jz
TLSH
T1D0E4124A36A421FAE1A34179CDE04244D3B2BC676770D7CF0650769A2F36FDA5E35322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 cb5a15a38933abb7f1ed85309507c13a4d810d9dbe123cc92ae08d16278582ac
MD5 7a9048816c177a4650e9d2d8d4db7bf0
SHA1 bb7d8768ed9b821bba7b9be6163921f104468f7c
SHA512 f57b4e10e3410957c30b9342e46d460f957f659770a3ba0bf114be1c8a937ede600ad88de50a2c4f83fca81468db8daeda093efc5e3a2af2b7a386951fb453e1
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23U8:WQRQyi36YOcPuLvw2gAf+PN3UHIdAr
TLSH
T13A667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 68e94132a1e7b04f8f5204cd188ca4883aa856bb379eb3ed993ac8c62585c262
MD5 b5f2bcaa358e32c319d286f324feabfd
SHA1 95ca55ad06436d6b9a892bc54c99996b0ec8998a
SHA512 95264948c28373eacfb690b3e5e87f4bf024403a4d2daaa6740eb6e58b3b8497f3bbc1dab962d74abfbc2c5a61a8273a0a2391fbdd9d89b1c7cd1c725d08f514
SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23U8:4QRQyi36YOcPuLvw2gAf+PN3UHIdAr
TLSH
T129667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2d22df739fc1a53447bbf813a6a243dfc7cd64a60f3389198bd6493580799dc0
MD5 a570947186daa0cd1991c8f499c573e3
SHA1 ce581fa0a0009d6895107f1dd5fb0260739d3279
SHA512 c73ab7d46da3177171cf7c25cc5a513460d796777c1bd2da75a1d6620c2cc15ee7cc7a6df74ce372798563802bfcaa7c027d4d6db26e44bf2adf90742b0bc343
SSDEEP 24576:TwvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0ul3OSq2PEIdADec:r68Qg55nhxeWu7PNU3/1USqHIdADeU
TLSH
T171B54933B2F20099C44DE1769F4A873196D27C758FE0E7DB8541720A1BB2AD47B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 de2131087a84980af10301dee35b7b5c4d5c67d8969ef20b50dfa64dfabcbb1e
MD5 debb364524c55995bfdf0a200a69f6da
SHA1 a5160489b2bc23eb5b0055dd71f434581457ec14
SHA512 8e29a57c7cb7fc4d0423b8764dcb048242bcfd32bfdf08f22fcbb8f107cb7e7bef67ca687bb1384645cc88cb2cbac2e8f3ab6d326729e957d3fd505cac57a470
SSDEEP 49152:w3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99e:9y5112gYy5azzVvD69nLKnhZxHIdAr
TLSH
T1E5167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 044945844a1ee75e8b794ab174af9f28ffce84cf97aa485732af6c3a2b117956
MD5 9a05ab5dea138439b86c447c34bdb7f4
SHA1 3cbaa34a70b8efbae5edc168ed362256c6a761e1
SHA512 d4df35213d3db50445c3def393324ed2cf7329b8097668dce0ea2fdaec07f09eba45f7255ce6697b75f93963cf2f863f356259190e99ce71149a0ee917b745ad
SSDEEP 49152:uB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glLUSqHIdADeU:8u6JmQxd2dsHIdAr
TLSH
T134D59D13F1DA01E8D06ED479974A9233EA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 abf2d7a4038b05a5984c6a9a2413a9f943f8158d1933661050e040ad126de30c
MD5 059a6ad31a9464eaf7c2531427afcd3c
SHA1 29215388858dde2019f752cd0c887794dd0f4741
SHA512 f55259b5f075bb55f0e10796451375f5c832157494a5f9e372d1b837f47344212f8d21d9dc3817d0924af70fe60c55ff00b182e06a2c69304964221c94f16404
SSDEEP 49152:K1hpsNoJpF1A6yU44CwH7R4xvUSqHIdADeU:KmifPVRrHIdAr
TLSH
T147B5BE13F29901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BFE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 28acd3c0dd02d760b48c0abfc1191bc255924601d2e3751dac1c4bd9dfae4f4b
MD5 1f5e697cfa1368dd06321ce7754b01a0
SHA1 7e995da6775b2564881173f52e4297337a9517d0
SHA512 4e82e280ab1bc45bba0a2511fad19dad5bb4839906a93402e0f8725e98c15a112fb99ccfc967bf16c9f92928132116436ccd288ac1bcb3ff627b58667ba82601
SSDEEP 49152:kSuZQIY0Be2KIRVtOnks6NMHq+USqHIdADeU:25dKOi61tHIdAr
TLSH
T149C5BE03F2E941E8E0BED6748B659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 bb5045c8e60ef8dba784f888f2503a251c35a6f071913f628517accabcff8c5f
MD5 10384e55b53e54ebba61e6d7ceff0425
SHA1 77bb933070c31622e086d7fc0d60fbd827bbd454
SHA512 7d8729444c09ece37f0c3024dae638f5bbe91ca0dc7e602fa058b06366a9bf5b0d1bf6a98fc456a0904ad0e85d0e43d135b257fe5d4a1eb32b6394e7b73305df
SSDEEP 49152:WhtSn8EApI0figGgiDn0AP5wbUSqHIdADeU:3X2i/phvHIdAr
TLSH
T19495BE13F2D901E8D05ED175C7468632E962BC160B34BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 bf896653c96d1c9750839f8ff6f3dc5be36200404bd39aad034280cd5eaaa6ed
MD5 cd545b87f354b094468dd4601e44a375
SHA1 70057436f1fd6e1d73e281081fd1322cbd1a0193
SHA512 dcb9c3818c2b3f82e023160f56164a48eddb2eea708ca64ac6cbd9f31e9ed8d1e3d5290e490091e11efedd2667706d57bfe3d2c825988ae3d4ac32cb91e0bf6d
SSDEEP 12288:QalIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:Qal3OSq2PEIdADeU9jz
TLSH
T103C4234A287603C7E24384B38AD043A4D4A9FFBBF9C0EE89DE80B545657CF9F616105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 6cc6eac27a72565b359dd071c58b2acd7ba36bd56b8014c5cc4b209145863178
MD5 76029aaba0446d1b53e29d39edd79353
SHA1 72cb4339da99b39e30d33858fc67291bb44ba142
SHA512 8dfb22d1410838126ca84797c65d8efac74623032dcc653efac0001224bf4abb52d9d203120ca8d8039a4b6439863d2230d933b3d614c24c5ac1b6b6be963ac4
SSDEEP 12288:bhlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:bhl3OSq2PEIdADeU9jz
TLSH
T14FC4234A287603C7E24394B34AD043A4D4A9FFBBF9C0EE89DE80B545657CFAF625105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 e9fc346f0b9dd857ed59e1cca08ebe33e5a017a175d94fcf38e0579a681ad958
MD5 e68167eae96cfd46c23f9036d05a2dc2
SHA1 08c670ffc00d30751cbaa6aacb457c499a47975a
SHA512 f76ce61aef6d496293aadcd6fd310880a5396058c69cf9034f7a4241dd625246f12b1515a96aaeb8c2a80d66e7030c3d3c9d447dd3921fdef5c36b7747707e6b
SSDEEP 12288:0nlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:0nl3OSq2PEIdADeU9jz
TLSH
T1E7C4234A287603C7E14394B34AD043A4D4A9FFBBF9C0EE8ADE80B545657CF9F626105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 cb6c818d809594ce0229e855891635c0b398f47726bfe1b2afe796d0942fab99
MD5 ede6569b6df6044a4cd75723926e02ee
SHA1 64bfa516121b703eb216db0e3eaa09e15e4e2cdd
SHA512 fc01172a337c8f96f285a9ecc613e673b48413ea68cb1c9ee18d7b60c6047681ad0cf46f8e5694a4a5664eff125433dc8103de4a1ace9d1b9151434c9addfc48
SSDEEP 12288:DVIlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:ml3OSq2PEIdADeU9jz
TLSH
T166D4230A3A7502C6E153C4B2CAE04260D1F5FEBAFA50EFCF9E4079461D78BDDA530659
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 ac8195ff024bd00a971e9dbe574c766528a0a6255a907f2cf40508e245c22813
MD5 200b271d6b8d93b81eeefcff9e41781d
SHA1 ee806c7297531d711c4ee638db8997a62aec4a6a
SHA512 2f2cf7f976c6f74a478ef20a20a746e87099d427c33ec7f28514593f139966f5ac9d333769edbf177273c02a0b72a9501cf559ae378b070bf90f677ffe438ccb
SSDEEP 12288:IQlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:IQl3OSq2PEIdADeU9jz
TLSH
T152C4234A287603C7E14394B34AD043A4D4A9FFBBF9C0EE8ADE80B545657CF9F626105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 52a34f351cb5ade514a432b07c738b3fe066a0dfbeffe925e38037725d8fd0b2
MD5 95f0db88e46fd57a56ee71f0a995312c
SHA1 4598241b70670f60547ea7b06125aa90bf251c3e
SHA512 4f9d751bc576fecaed3980258883fabda5649d24a052103c7cbf10c6a23d2e8ac9d616b8668794f00b8ee67456d9bc183acdc131a2220db465e4670d6f3554d3
SSDEEP 12288:7dlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:7dl3OSq2PEIdADeU9jz
TLSH
T1CFC4230A287603C7E15394B34AD043A4D4A9FFBBF9C0EF899E80B545657CFAF625105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 0301192f2428df55dae8ebcb678d499f5957fe4af5a9b6cf6cdf31c9f825b97e
MD5 2e7d8fbcbe2e0d69eab2bbe658589615
SHA1 03b33f78e2997709d5306d61d7b75ff48784e7c8
SHA512 af0a5ab4226b8fb83c510feae3d9787091c9a1cd59abadb6d350dac44173d25725d764522604d4df1b2a92f894584aaf5d04a5b7c1af568bef468cad8b5fd4e5
SSDEEP 12288:zJlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:zJl3OSq2PEIdADeU9jz
TLSH
T1C3C4234A287203C6E25384B34AD043A4D4A9FFBBF9C4EE8ADE80B545757CFAF615105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 1370ddbc3e7f1cce7a471644d517fb0b0f18c34250587db16b506c7ac41a78c2
MD5 457ded82579307eb9c66f2baa42cab7c
SHA1 8f8a912aee5190bd9673be927611226034b8dc76
SHA512 50f858c633f90b75f80488ab45da74fe2fe5c7ef8cb4cd73d7f4eab1070f8aa3732f83e86898b12ef9c0e69b1e6771da917e2b9cc6eeca6ec4efea234f79ef76
SSDEEP 12288:biZwbNzzFEoS2cPvyBlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:GZMJzFVSOBl3OSq2PEIdADeU9jz
TLSH
T1D8050295736018F8EC63813ECD508915D2B2BC6A5BA0CA0F07E036675F377A11D3DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 e59d3c6cb5067b8a3e857b8c87913640d8054e8d1969b43587b1ec1744f7510e
MD5 ec22b5411d5ac3e8671dd6f9676e1bfd
SHA1 0faae36cf0987e74f6cb1283bf9d1a39692f5e4a
SHA512 73a2d32483eee3504488628b88bb03cea8aa1bd37d9b28c5a4bd7f7d706d62daa6f7ad35a359490f98e77cbc8cb3bec0be579689cccc2dbba08daacd0a09f197
SSDEEP 12288:xOlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:xOl3OSq2PEIdADeU9jz
TLSH
T174C4234E287603C6E25344B34AD043A4D4A9FFBBF9C0EE8ADE80B545657CF9F626105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 83a1f2316aebac9c6bb11a1d33af7e8971e748624f3dd66fb35b9a6d3b09ad07
MD5 792509bcdbc10897e13bcd576fdd59a7
SHA1 b17e5582365c50a5b2e90976581ed47199152daf
SHA512 f3e4ebb5beb45bcc416a1ca2430edbf05a7b704b9372012f7c4c6b8641842480db088eecaf6283a4304b28c70614907ee8a7021bc3d87d6387ad02b2298f9e83
SSDEEP 12288:FSlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:FSl3OSq2PEIdADeU9jz
TLSH
T1E9C4234A287603C6E25344B34AD043A4D4A9FFBBF9C0EF8ADE80B545657CFAF625105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 c22ddfc8da86e808c6c99fefae8a3bc02033d6be7f997e91109ece07630ed056
MD5 4c1347fc0bfbd668b93157ff1e020fb5
SHA1 90e83343d8fbd794323a8dc152db09a81a23b293
SHA512 a249d5eb6197c6321731c3045a4682ae107088bc79bdbef0c7ac1b39b140a2785abd33b501fab859446e53215a3173c24e726d566a0b341fe1a93b51af0f9e81
SSDEEP 12288:3yPz5L8VlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:6zyVl3OSq2PEIdADeU9jz
TLSH
T165F4010B36A121F9D1638135C9E10601F3B2BC365B60DF9F579066762E37BE5AE3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 93f93394c5fd983d04978de24f5acc0ff48ec4d68ece9293f0c0f522077f3a3f
MD5 916d39db3a724c223566cdd10ac18da7
SHA1 052c669616ae35e8de696e9944b2f144e0f5f468
SHA512 c60787be3a9d4224696730a6b26d719be2f8e55786242faf267db66b5c5f6c59036681b212db2a40ed379cab3b76496c86cb4a3142252ed2889d42663d5ebba9
SSDEEP 12288:0OlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:0Ol3OSq2PEIdADeU9jz
TLSH
T1A5C4234E287603C6E25344B34AD043A4D4A9FFBBF9C0EE89DE80B545657CF9F626105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 6334c8756725f7d7bb1907d3fbd2d5e7364746df43cd0fa6f26b32d45ac023f2
MD5 918a833013882fe2e2754aa81bb77d29
SHA1 f458d3e69908aabd2a4ef78c4958e8fecedf06ad
SHA512 945878321c908d2865b374f3900ef6b3e9fbc366b5d0945aa3f81b6ef727749f8b78c2df82dc4efb0d859f28541b82c0824f10fde3c2de4d4a89eabe11f6c4a6
SSDEEP 12288:yOlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:yOl3OSq2PEIdADeU9jz
TLSH
T1FBC4234A287603CAE25344B34AD043A4D4A9FFBBF9C0EE89DE80B545757CF9F626105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 4e0cf955cda483f7d67c4b10c7e57b65277f27e3fc63b154fc0164f747e2ca16
MD5 67858d7aa1c8ff215f94566117c45bcd
SHA1 4fdc8c4d0a8699a3c572f722a373ac51bd9d78ee
SHA512 470d6942dd9152d9539acd6383b540b7174648eb8e484b2a157364a6f34462a49bc7458abc26b571a682de2acd11b7014b5c67870153292866aba70cdbea8377
SSDEEP 12288:gyPz5L8VlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:RzyVl3OSq2PEIdADeU9jz
TLSH
T15DF4010B36A121F9D1638135C9E10601F3B2BC365B60DF9F579066762E37BE5AE3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 8bc04e380a312c4bcb1c58f130d5be4fb6122927fcc6df1b84dfc30455a6f944
MD5 17a5f0c2790786068843f16abe044252
SHA1 5f5972de08415ae9712ea3ad5337a5f341c92cff
SHA512 4bad738610c69c0b0a0b64aeb480359fcd391325626f8ebc8ade3f5090018527216274f64fab0bc748ac76a098ea61c8fdfc4281c4e26b7e2b8211e79e1bd8fd
SSDEEP 12288:MCd9XWYoaLHF3z0z04PDvhXlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:VTuaLl3z0zDXl3OSq2PEIdADeU9jz
TLSH
T144050299736018F8EC63813ACD918516D2F2BC6A0B60CA4F07E4365B5F377A11D3DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 48978e6883110f53b8a08fdd62419bcd6efae628052241f2be6aeba93d36a36a
MD5 5e9f0406769ae55918d94a20e5439c43
SHA1 28cb240c6954d7859e44623d7bbf9c992e8e39b3
SHA512 d9a8a3497015a201c9050b8a4b6a4478841ba2c17bfd69c169fe7a4da72fd441e41b7ed35171157ebf5c31381d56247399d34a8fb3e2ef556f69c46e8a4f8895
SSDEEP 12288:hi4e7URdTfgwCHKy7GLbbdIvMlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:h3xd9CHKy7GZTl3OSq2PEIdADeU9jz
TLSH
T13125CF90B3E410E8F1B39A358D714511DAB67CAA5B70DE8F03A4665A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 5c83526308c72407f6f40385f2e1e5f2ff956b7310c98e67ce8712735b28da37
MD5 ad4712ac786e7ae18621fea6b7a8367a
SHA1 3d3e5e1e56da45451b35f98eff192ed10211efe7
SHA512 81ffb6e73faa3dd65ac575590cac2ecc67fca43890cff83ea5f2f13c456f737d9f7cd90ef013e16f384b73d00d4d123625ed4b79ed6d3eb0a98cb9bd7cee7e3b
SSDEEP 12288:YHlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:YHl3OSq2PEIdADeU9jz
TLSH
T176C4234A287603C7E14354B38AD043A4D4A9FFBBF9C0EE8ADE80B545657CF9F626105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 74ab9aaff7dad5baf136ff8d2b8f0bc37006ff01d4207cc6bdad63d0c8bef7a7
MD5 01834f0a7bacf4e82a0b96dbdd36fafd
SHA1 44bfa6b9dba621ced95fbad0d9e30b4278221388
SHA512 c2a1aa05b096d008e0e2d0c2448e034ae43c9f0f0965948ca814922f1b10f863c409b87a3a93ce257d46d3bca836266021396de8050b5298851b46dad62773cc
SSDEEP 12288:F1lIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:F1l3OSq2PEIdADeU9jz
TLSH
T114C4234A297103CBE15384B34AD043A4D4A9FFBBF980EF89DE80B545657CF9FA26105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 69be26f8f32e353c27cce0f9d7e1eb5e910067241fa2a701949ebedb244f6f2a
MD5 937b0bbdc77142ba16da9c50f7b3c671
SHA1 54941b80fae7c08f80f80594b0b541904f3a7c70
SHA512 28388478a55ef3f5d9171e55951d83c20f6b08fed8efe4853baf80bf97ab840dc2d439575c7c3846d7cbb74999c288f733cf8c9703f3b7d42778e89d726ac2e2
SSDEEP 12288:vMlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:vMl3OSq2PEIdADeU9jz
TLSH
T13DC4234A287603C6E15384B34AD043A4D4A9FFBBF9C0EF8ADE80B545657CF9F626105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 365f418dcfea9af00f59d70d476b798bc6acddd9c152c7a15bac84f33d6bdc4a
MD5 8aba72f5dd2bc6a1f12868dddd8db936
SHA1 010245f0f5afb5ca5f14a761adbe596d15e325d3
SHA512 8a561e2f8d4494217f99c60aed2114eb3c73bc803a1a54109c7cf5c919d60f5763d1cf14954ac45a989fab4e47ab3860b9b138af3309d79296833863cd7bdc54
SSDEEP 12288:SOlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:SOl3OSq2PEIdADeU9jz
TLSH
T154C4234A287603C6E25344B34AD043A4D4A9FFBBF9C0EF8ADE80B545657CF9F626105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 e8087eda4e432754c8329205111d680437e47b161bb4c86e584b689a0b3a3db2
MD5 d07f649e980c0d32e847e928dd00b889
SHA1 f6826c9acd811fcfea5310b9024d1e2b87919470
SHA512 17d4ad274fe26701c388c64797c906bde0bf1c8a87019f97162500bf063a3e7391a3a2672958145cdf9420f97ea72f30dabea43904884a20b5d155369c833c8f
SSDEEP 12288:YHlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:YHl3OSq2PEIdADeU9jz
TLSH
T1B7C4234A287603C7E14358B34AD043A4D4A9FFBBF9C0EE8ADE80B545657CF9F626105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 78bbba0590dab6c3bf61284ec678d91f3edd057858c8947e4d0d36839c61d439
MD5 4d49ea3a7800ce4f845048b66268afbf
SHA1 4cecf9509cd9dadffc9273fc98208e9586b48b9f
SHA512 b2d7d1ca00dffa14db741e6147ec1cc314415167cd421c0d6fcd00b822d474c4e34d845acbef030b8290b604211dce412bcc13af3fa35dd4953ee2153ee9e488
SSDEEP 12288:I2lIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:I2l3OSq2PEIdADeU9jz
TLSH
T1D4C4234A287203CAE15384B38AD043A4D4A9FFBBF9C4EF8ADE80B545657CF9F615105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 7857f7d8b27d5e01d37bcdffc2e45ff05bef65546753202eda322f6a694d8b3c
MD5 44b5937feb432c00a732764f8ccdb4d2
SHA1 2d555794db0d7523950f8af404dccc8ba0c05276
SHA512 0b21ff862d8eaa6070043aa45b2c7fecc377d45aa73c26eb7fcab382f47af33c5e793eb5dfa4abe3c97716ef669c4a7463a367644b0c042fb663f4a8ae87b63c
SSDEEP 12288:sQlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:sQl3OSq2PEIdADeU9jz
TLSH
T1A4C4234A287603C7E15384B34AD043A4D4A9FFBBF9C0EE8ADE80B545657CF9F626105E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 4ff8dd19bfd277b9b6ec0a6af13677ad536150f74ca7bbf64c71328ae94c55f0
MD5 f11832d5559275a75e450a101d17ced1
SHA1 458cfd1b8f7164828e9a8f6e63a234f5ebca299c
SHA512 2efdc6374c713a2cb3dab6ec2150a1d280daa839fe64bf06031d6f2aa38c3858f044c7e0ce3f1eb630fa1ba29374160ddd54c27d4b99eba7cb80f0c890626fff
SSDEEP 24576:UfwvOk9RX6wkyAIil3OSq2PEIdADeU9jz:aMnYIiUSqHIdADeU
TLSH
T1FB35D029EBD804E5E1B7913C89F3460AF6B178691B31C6CF129663AD0E37ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 438517e669ab897cf0602d09e4ed7c5f1d7a1f9ca644f4fbc015015ab08fd545
MD5 4e0c3a4c9e8537d558d846eb68e8a439
SHA1 9a813601cc24e16b1dc9fe10bc5fb2e19368a654
SHA512 1d8a0cd83a600c7f6cd14d8659b6428dc5403cf592bb9a1efbc8a78652c792d47f8624e39ed42772a42e1d59d9902c7e59256efb2a0b09a3f7c694558d11090f
SSDEEP 49152:MYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK07USqHIdADeU:AySzP0HIdAr
TLSH
T199066C56A16801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 fb248e0ed3cd08fe4e0cde01c3b2dd6b1adc3308fba1d66a34a017a20b5833eb
MD5 51f26322f01798e85b87b1adcc26272d
SHA1 4383a473e43ad6e15ec02a3e8c35209e5098259c
SHA512 92d5c4d87c7b50a9f3d772ed388b8c528af6b3804b2d86a2e4099d68ff04548fa5b11d417b19dcabb1c04731cad966dbbea3044ebfc41f1d784e46e0ee6cf1a1
SSDEEP 24576:u47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYRl3OSq2PEIdADeU9jz:u47JUQjairIhCnDHUPfF/LUSqHIdADeU
TLSH
T14A65AE1EA3EC02D5E1BA827885554A1AEA71782E1F31CACF1270937D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 9092739f69917c55290979e01fbc278af13ab29bd2c7aa769eac4aa2b15162cf
MD5 e82b3a87d81fee8add8bf4876ce0b3ae
SHA1 98855c21baa5106dbdefb83e796d7fa9d0df1420
SHA512 e60f1ab78bfa7da0c5618813463225d63264d46fc0faca72382c394a50e73c159a9e07fda8afada1ee6f1a14413e7afe6e174c67bf48e7906d7dd38a933abb7d
SSDEEP 12288:Iksf+lIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:y+l3OSq2PEIdADeU9jz
TLSH
T135E4010AD2A402D8C06F6176CB914240F3737C6697E0E7CB56C0F57E1F3AA95AEE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 94ce5caa90686ba495eeb5003d60ac172bf16f0efe1b6f0322a672342b8cd131
MD5 8ab61911ccf5259a6716851ecab88a0e
SHA1 5edbf1730a472c41840eb69a9fb01f15b9b29922
SHA512 d419819f735e8c8e01dcd27bd29eb804bea88a14df39ede7f3b75211e4a2907f9d556fc582619aacac3b12cb170be83162952e6f1df8d83a36516e5bbb04b8a2
SSDEEP 12288:Xjj7Gy5vTGn/cT+GzxH09q/81gEaRMZp6kIr:XzGCSn/cT+OSq/GgEaRMZ1I
TLSH
T1BA452841766AC75FC6A940321E33D6CCAB707D05EE456B0373C88B3FD576668BAB2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 9d6fb70fe44848bc9ae188e2c8b35c95bcb09fb05f6d379ff8fc2f50447428b7
MD5 1f1c7fae6a3816af62f7aae9ce4a125f
SHA1 1b08e08dd06bed677021ec4bc303a09fb5a76628
SHA512 3e627dbe6bb0463166f30aac98460056089a88bb43774f88e5430847d2a570ca3466089ec7a601cdccdd8e94b8b2acf3a8c7d98080cb7351ddaf99a9daa44952
SSDEEP 6144:lktIKIV3XXXB0O9crQ7IcUjCvI8k+IqgocKDexHKcKDexHLgP0RPbQIpGbjInF3g:vB0CcryGBGp74gP0RPbQEnxa8i
TLSH
T13265F881A537E39FC1F7607207295F4CABA4EC0677056F26B3C8053AD86A765B0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 652fe87beec0a5375981375f161886e443d29b4c9c22493939befb3d73d066bb
MD5 cd262b0e11d0a871185db365727943ee
SHA1 8cdd8b146b97baf9b06175249333e235ae5b9f89
SHA512 25cf1c5193650924bd643adfe2e0398910c6ae4512cb424a0c777945a710602b5f7578176c678cdf2bcea72054ec68d398abb52bd307808ec5a75cd8d4b628cd
SSDEEP 12288:tM7mlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:Gml3OSq2PEIdADeU9jz
TLSH
T177D423061A751686E16354B24AD48374D06EFF7AAF80EEC7ED40B585643CFDEAA7010F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 df810e33706d28b812f851b7976ece7f7c4941fcaad37a2b9f6796ec346c06a8
MD5 a0e760f3b98e96d23a9b4239b0ab9a31
SHA1 aeeb8d2869d95d011e2847deb2b8e2a78f70e811
SHA512 8e3c8d6884b419f8e18402a457533a63ddbef30b98e2cd6aa73552b1bd1d13a36aa61d11c3b76ab03f14ecdf1c98b17dcb6aeb8aeb1729240f1abc08cf770a74
SSDEEP 24576:sgb6bmBIi49WNNFpg1rSvFv7bYkl3OSq2PEIdADeU9jz:sgb4mBIBhGFRUSqHIdADeU
TLSH
T19C65AE1E22EC02F5E0F6D2B8CDAA4417D6B278161731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 62acd631adcc53bef0b57fb2019fa11d835192bfb5786a65bcf5786bab6fe3b3
MD5 026a65b4bf9275cbe050efd7f0512f1b
SHA1 ee4f770e6c6c03203dade4240210a76532bce8ad
SHA512 f2fe5472af8ded3d499ea68060f4245a3482db32de3d8a28407b2b10dd4c6cc133464d55ae20cdf593a8457762c42c9f2bd831622c082f9596fde3e468b2349f
SSDEEP 24576:vG88u8FpJqH1nzria7/mBl3OSq2PEIdADeU9jz:e7ZFPqV6a7/sUSqHIdADeU
TLSH
T10535F16576E102F1D477D0388A824663F6B2B8251360EFDF07A89A511F33BE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 5769f1d42764808e0d868115d6d91866f730d326c4f5045a2a01eeb4f60ee3e5
MD5 1200cbc8b4991b2843a32543e768e1fe
SHA1 3dd5e1a8ceae9914b8fea50b55df474a2d7b6fb5
SHA512 44850347d4c9c3c1c251e0d17522b1d51201cb66b65765960d302013cc7a737eab048885c7f07f7f79a6d92eef284b69fa917b21795ad260c5709c2cf23ef41c
SSDEEP 49152:hBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjdUSqHIdADeU:CG05lO43b5HIdAr
TLSH
T167D5CF6E62EC11F9D1BBD17CCAC6460BEBB23825032556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0be57642abe43d3dea867aa2d471bde018417a092cb0306393f8879aae821242
MD5 6dc62a64b599dc3da12bc54634da6fed
SHA1 3012928550f9802bc2d706ac91753612c69a15c9
SHA512 b211475552acd5898cb778632be8c8e71b0b1b265316f8c2ccb3e1e11d57fdd8217e31259ba0b57339e173ba53f444c8ec4d0eeceffbdb5f304c931f2f38c595
SSDEEP 24576:gfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn7l3OSq2PEIdADeU9jz:Ya5POZ3hJt2pasx2+m1USqHIdADeU
TLSH
T1E165AF5EA6FC01D5D1BAD17DC583461AE5B1342653319BCB022182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 537b5ade3eca26923c54e4a7ca25545085a9fd8022f34964b383c2c8dbe1cd28
MD5 f03c0914f51a6ce616c5b9b8610cfb9f
SHA1 fbddd12d5ad970165fb37c146c477e42d8a49979
SHA512 b7b244365606f4d999d25f2f570db7b9361ecb31b184f5bc0aebdc560597ed9ffe837fd7b3186ab865a2747801f4e2614c338cd296a3ce62fe90082652211f5b
SSDEEP 24576:FNcwHdjbyQ4nLC18lb/EOjowL7Fk5l3OSq2PEIdADeU9jz:FNc/zEOVHFMUSqHIdADeU
TLSH
T17B857B1623E901E4F1BBE1BE89779546FAB1786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 dc4e1018912c89838986b8075b221194c8b0f7874d229575e37f479f93ac6b5b
MD5 a4992894f8a1ab5036fc501e19cca365
SHA1 6c5a264c2031b228db49485e3dd4e97208b42ecb
SHA512 0ba3c5682040c2c7f432bd0183e7e0bd2feeaadbed332f8768dfb3527374601f9253183f90015291b7e4c8a9ace3793f594b5d63b674dfddc0d2f719139aa5e7
SSDEEP 24576:93kNvNnaFeYhJNtmZBmfl3OSq2PEIdADeU9jz:93MwBtOmfUSqHIdADeU
TLSH
T17A55AF2E7AB806E4D1FAC6B5CD238112E6727861173293CB5390C13F1E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 81efe1137cb83b36cb7260225b17cd35d56322494b83830041926a6f862aa6df
MD5 aed0f633cb5fc4a0d65da9a4049e8c2c
SHA1 82022a25382e1e01922cdb59ad9eb40ea89e2c69
SHA512 30c1cff6e4a6fa91e6107de1f812676c45dc9130b4988531847c9caa9cb3f5cd06a3c8828e52d18f32952fd8e9825d68da1987cbc692b3bece99feec3619fbf1
SSDEEP 12288:mHvUrBFrEjwaQtlIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:mPUr+NQtl3OSq2PEIdADeU9jz
TLSH
T1AE05F11F22A818E5E677E17D89818319E772B8621711E6CF02D0917E5E37EECBD39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 f641a01d9c1194950c34b86d158c3b0785742d6528ccb5eacfb2e2fa856e07dc
MD5 4e4ed365d5bbf9f5716d0f206135bfc2
SHA1 9068e62ef58d2f341a2d32cda620202f68fd8fa2
SHA512 5830be61d7ba06a7889e2356cb5da8d75e2241c3aab64e81de5bc6ef7c68cdeb86267e0d4d33f49e035deb080c850d5b32534c71c90e2035b5a982ab5b1d6c25
SSDEEP 12288:AQcMxWDXN1Dp/fshBItT1IQgA6lIWFJ1H0iDqKt9FBmTt5m0IdADeU9jz7u:SD3FHshBIYQgA6l3OSq2PEIdADeU9jz
TLSH
T1EF25E13EE65C04E4E57BC1BCCA938606E67178A903216ACB06D091B65F7BFE47D39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/432-78-0x0000000000890000-0x00000000008F6000-memory.dmp

Download

memory/432-77-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/432-310-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/432-83-0x0000000000890000-0x00000000008F6000-memory.dmp

Download

memory/3172-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3172-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3172-328-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3172-95-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3172-89-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/3172-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3416-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3416-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3416-15-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3416-23-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/3852-294-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3852-55-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3852-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3852-61-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4112-67-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4112-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4112-73-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4112-309-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4192-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4192-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4192-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4192-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4236-1-0x0000000002180000-0x00000000021E0000-memory.dmp

Download

memory/4236-0-0x0000000140000000-0x0000000140437000-memory.dmp

Download

memory/4236-7-0x0000000002180000-0x00000000021E0000-memory.dmp

Download

memory/4236-9-0x0000000002180000-0x00000000021E0000-memory.dmp

Download

memory/4236-87-0x0000000140000000-0x0000000140437000-memory.dmp

Download

memory/4400-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4400-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4400-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4400-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4444-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4444-101-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4444-107-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4444-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4444-314-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4444-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4764-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4764-40-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/4764-46-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/4764-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4764-50-0x00000000015B0000-0x0000000001610000-memory.dmp

Download

memory/5696-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5696-137-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5696-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5696-133-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5696-127-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/6140-121-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/6140-113-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6140-313-0x0000000140000000-0x000000014013E000-memory.dmp

Download