8a92412a9357b1adfc162b777ce2a3c7c05bf7eeec38ef7353e54610b246ec9d

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
Size 1.5MB
Sample260715-pc6tlaft2s
SHA256 8a92412a9357b1adfc162b777ce2a3c7c05bf7eeec38ef7353e54610b246ec9d
MD5 43b60ece492495b550ea47cdea0d6c4e
SHA1 c63ce2778af4d89c489762c2ffed732e89231e9b
SHA512 43985731f83566f07e656a67ce982c286a98bdf92243935e1d50cc3706fce2fa1e06d81bfad2a527a71c4c86d47037b4438cd8136c0e1d6c9de76cfaef810071
SSDEEP 24576:TAhYRsc1uEpNIg0GYWLBd7WtLtq8ploROKg:TbR1uEpNN0GYWLBdWtLw8ploRv
TLSH
T1C265E0567B5090F9D0610D704A65EA9D9325BC68D8134F8B32A07FCEFFF2AD18E19A31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1972	elevation_service.exe
292	elevation_service.exe
4960	maintenanceservice.exe
4372	OSE.EXE
6120	PerceptionSimulationService.exe
1776	perfhost.exe
5084	ReFsDedupSvc.exe
1736	SensorDataService.exe
5804	ssh-agent.exe
1888	AgentService.exe
3292	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8128abf6d744edbe.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\TestInstall.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117390\javaws.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002ff2c6345314dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000053ac1d745314dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007e27f0335314dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d43ebf345314dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b0010e745314dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000005d8f3365314dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dbbf32745314dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1972	elevation_service.exe
1972	elevation_service.exe
1972	elevation_service.exe
1972	elevation_service.exe
1972	elevation_service.exe
1972	elevation_service.exe
1972	elevation_service.exe
292	elevation_service.exe
292	elevation_service.exe
292	elevation_service.exe
292	elevation_service.exe
292	elevation_service.exe
292	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1424	2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
Token: SeAssignPrimaryTokenPrivilege	1888	AgentService.exe
Token: SeBackupPrivilege	5084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5084	ReFsDedupSvc.exe
Token: 33	3292	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3292	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3292	SearchIndexer.exe
Token: SeDebugPrivilege	1972	elevation_service.exe
Token: SeDebugPrivilege	292	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3292 wrote to memory of 2272	3292	SearchIndexer.exe	98
PID 3292 wrote to memory of 6060	3292	SearchIndexer.exe	99
PID 3292 wrote to memory of 3152	3292	SearchIndexer.exe	100
PID 3292 wrote to memory of 4820	3292	SearchIndexer.exe	101
PID 3292 wrote to memory of 2580	3292	SearchIndexer.exe	107
PID 3292 wrote to memory of 5224	3292	SearchIndexer.exe	108
PID 3292 wrote to memory of 4408	3292	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_43b60ece492495b550ea47cdea0d6c4e_icedid.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1424

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1972

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:292

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4960

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4372

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6120

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1776

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5084

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1736

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5804

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1888

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2272
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6060
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2872 2820 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3152
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2888 2900 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4820
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2580
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2872 2820 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5224
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2888 2900 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a9b218e4efa6201e7ac897d16f1a3581a1e7705f89ae9b02cdec4ef0c7a97c99
MD5 e4d550f3fc221942c089997292e3c99a
SHA1 ef2564de03ba3e63a828528d3d80af073ac5201e
SHA512 1dbe018df7bbe435d11c6b8cf2b78cf18ab19b19f7486af1d116030ec8e05b3d37c4f69b58cd5ea67aa75aa132e0c3c6db845483651b84f82da6911d86167674
SSDEEP 49152:Pb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnfR1uEpNN0GYWLBdWtLw8ploRv:N3q6sjBYfuEpL0GYW7elop
TLSH
T1AAD59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 74fb2a9cd64b3decc308b8cfa36e4d196e6b037189206d9c9d51ff350cbec260
MD5 14a2f5762ce4d224446e442b2302198e
SHA1 74b4122d755d9ecb40c42cf71efe6a65a6787db7
SHA512 424d038819e49d7f0d77354fdb1804a2e482f0a773508f7c4187c7c464d3a24e7a1530f1301c163164cc850ff587159a4e8813b0576b2f17d9e5d8395aad801f
SSDEEP 24576:cXYfDtczAUsc1uEpNIg0GYWLBd7WtLtq8ploROKg:btc9R1uEpNN0GYWLBdWtLw8ploRv
TLSH
T11375F12977E448F9ED67817CC8B28501E633B8914760E7CB03A496694F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 b41b7a588844245f18df991b4e1ab7a9f2d8cbc2dab6336139a866b3eb1f28b0
MD5 72f2cc159853347addea6493a80c56b8
SHA1 741f0d5c2c0572613c43614a45024c5a78bc83de
SHA512 44584a9d71ff7689c96ceeec1df7eadbe77befe452b20f7b306329851512a24970a60aa9ec9303de8fe540489a002cfa73845fc0c6369973ea61c390db979d9d
SSDEEP 49152:HPji0Aj+R1uEpNN0GYWLBdWtLw8ploRv:vjo6fuEpL0GYW7elop
TLSH
T19285AE16F6748335D073C0B9C5D2A68AE97130825B308ACB4296D77C6F67BE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 08e2112c6910ff409bc573a8c791418593689f9e5ea12262936914cd27318a6b
MD5 73829098344a02b5b2f223b694a1d355
SHA1 95e3aff4bf013cc33ff69e27d92cd32c7c43b101
SHA512 5e31f1aacbc7ac539c147a4f6c7151fce74f00182cb3a3f2350b92e2d99a55bef0d9228e7da7fe40ef17a0c8ff2c45b8e9afe8063d4436b2db9a1fea13d9db83
SSDEEP 24576:Ea7/ezSC6vUyD/aqgrvWn6q8wyutsc1uEpNIg0GYWLBd7WtLtq8ploROKg:z/ezSC6vUzPveHjyaR1uEpNN0GYWLBd5
TLSH
T14C755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d2482de3d9fec8e1e97d33db1c0740f1bd6397986095e0ee7e5b6bfcb542d69d
MD5 ffff426cb3e3eb3e8fd8560ac6cf519c
SHA1 868422b618ee7044cee58f3689973db109ea73d1
SHA512 e65d5e312c591d62dd3a79ea333aea08c83c33ac0103ff76261364018fb06d70fff60dab3b8b860741810a958ab374d91b3907d494ad1f70c4d7a416f2639ee1
SSDEEP 24576:7VbqPb88hv/l+YIsc1uEpNIg0GYWLBd7WtLtq8ploROKg:7VO88hXl+VR1uEpNN0GYWLBdWtLw8plo
TLSH
T1C2559E66F574C331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E677E5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 1e06d97455fe4e9313202ae3813514eaa4b2b02aae567b5804431586b682c865
MD5 63793330cd1337a7249e7a41b8afc2a5
SHA1 f9e1909579e60f0d0426ac36f4f497ad12af933f
SHA512 aa6f28208e28b8c8f652bb1b4e6b06f807cc5a22f6230601a7ed5b49299ece583675d57b2da8238f8518fc9a0c0aab93f6cf4a2102d4ac5fe99a24aff9fe8211
SSDEEP 24576:fLbsc1uEpNIg0GYWLBd7WtLtq8ploROKg:HR1uEpNN0GYWLBdWtLw8ploRv
TLSH
T15F5523822B54E4CAF74700B584FE59C2511AADE09FB28E8D6276F78CCA7D6E0CC0D567
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 ad0fb9591084cf0f1822a4207815aa1252d888a652975d1fecf2206360679175
MD5 de7370a9218a832545182806d9522afa
SHA1 8cf9d547a39dbab91c6255de41a9555d99429751
SHA512 0a552c095eb17896a5a41721a523e567a72d7daf2e8b4daae35c3ce404c36ed9527c9cb35dbad57541aa9f321855da39c72a82c93639ce9a4e149c4357703470
SSDEEP 24576:rJIUgsc1uEpNIg0GYWLBd7WtLtq8ploROKg:rJIUgR1uEpNN0GYWLBdWtLw8ploRv
TLSH
T15F75CF7BAE28FCD2C27A8DB95A918640977278704F6293CBE175C30DCE235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b1761cdc2970f04aac391688d6f85c88f1abfeb0f23ce5bfb4a4f8330fb40f42
MD5 e093573e8274a7c65fa5fcff870e2b61
SHA1 9003ec5cbaa02d14963430d098a739569139664b
SHA512 6fab18e27d85ee33cea5c1f1534d9a0552460fe7416aa16ce26f11f2bc3665f90e081af6eb76263f0e164292a81718dd3e41e5225b75e64a4d19b66998e4f371
SSDEEP 98304:DQvGAdlCEL8c/DRNw5CdfuEpL0GYW7elop:svyEYc/D3w8dzpLIW7e
TLSH
T1AC267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 9700732aeee1ede29c5038fa9c9ec740c4920663862191ae141c045fb3d0bd79
MD5 22e4632f4bc1bd5e0898e53a10b6f40a
SHA1 eb8c8241f88ca903c91b58151e30dee2d0fe4ed4
SHA512 bea10bfbae76143e922147005727317ece2c6da7e49fd0148d147864a46f3b12a4f07751b7ccb0391bee9b5139b7f49552065af0ea522eb6cac978fbdff06bee
SSDEEP 24576:r0ewsAjusc1uEpNIg0GYWLBd7WtLtq8ploROKg:oljuR1uEpNN0GYWLBdWtLw8ploRv
TLSH
T1C375E031FE74E036C77B0DB21B36C706142DB9604F621AC3E3B89A9D89742D1677AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 229b0ae3c1a36e7b7ccea6e5b4402a58b28107600542a1f336ada564de0c16f1
MD5 26d23422c37274529167d60483f84bbf
SHA1 0fc622ecd82f8015b883f837dac20e78d9bf6e1e
SHA512 f7035aaf503e0251197e34b4ea9f670c8e031d4cb41b2479d9d3ca5980fff2feaa1c2c452e6932963d90636768925db7e2aa5e5c4da203f98bd308d2373fcf5d
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHWzpLIW7e:jUEtQevvqc2W1cpV2tI32spPe
TLSH
T196474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 082999f6efcb9c49c63b0f64814fa7446ec01f9cbc301a9a6acadbb59051d549
MD5 0d4ff89c69fadc87f0a94580e76aade5
SHA1 3bca0fa9ba89715fc550bb0fac67e9553ca15b2f
SHA512 c106bcb097adafda37e79262d63cabfa4fa6e5cdecf28f5933cdaad663bcd9380d46a8ff3737d2920db2187c244dfc8f2b567b701c1cc0d1347c0588de0e4fe0
SSDEEP 49152:8CbRquA/m2yL5zLfFiV+XenmE3/zOR1uEpNN0GYWLBdWtLw8ploRv:1oq2VjnmZfuEpL0GYW7elop
TLSH
T1D2D58D0976B8C1E4D1F6C77886A2C647F37178154B319BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f020c9598b86827cd514f1fb48423938c02831f40df7d048e22b0da8a2c6ad13
MD5 172e6eb38e615ef9b3fb9c780c0fe5fa
SHA1 bb4232894ebd66bc3b7c1101c9f119b285a7e6f0
SHA512 428d6b5b9801295c14ad123cb8225d164846680cdfa03705c1b74f59336ae32d49552f0585e7f30dd82898058541dc647a8fd7f5583319cf2f4424909edd6a3e
SSDEEP 24576:JAhGL3IFoiwtA5l7S535sc1uEpNIg0GYWLBd7WtLtq8ploROKg:JAMUFoiq5JR1uEpNN0GYWLBdWtLw8plo
TLSH
T1F935AD81E7F955D4F5B3AAB899B68571EA76BCA55E31C20F2160D20F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 111f980094e23dcae46acbf2ec9aa77ccb32c28711c37acaf6b0fd59dd192c55
MD5 c278771ca9ed669ca215c5a67649e2a2
SHA1 59245c5ded65c86a9d7c76348b6c73a64a262713
SHA512 2a8bc21266eee9453a56a9bf136b58dfc43ed4c985adff0dbcd7a8c0a5e436881945f6417b6638e27626ddb08bce1ced0708c3d6e889a87661d49e4c8552528c
SSDEEP 24576:2wu4OW6sc1uEpNIg0GYWLBd7WtLtq8ploROKg:2wvOlR1uEpNN0GYWLBdWtLw8ploRv
TLSH
T1A965F14637A45CE9E967813985ABC532F3B2BC512A31CB1F1360C75A9F37360AD2DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5fc6aa36fa105f70df82ba20a9c80623c5c895f124a33c10cbde4861f11cf238
MD5 7347fb4b16907a6c3ed4806780c4d994
SHA1 f72f69e81055d0d8cb5add2690cf25e325443619
SHA512 535e6b1d20b39e30f333e439779df42da9218c602f7f77653f64a26f27d15e4874264368eefe4fe1c422b21ab5a196694c96d8bbc046da1ed0b4b22c55482af7
SSDEEP 24576:yZuPsc1uEpNIg0GYWLBd7WtLtq8ploROKg:vR1uEpNN0GYWLBdWtLw8ploRv
TLSH
T1A755128633A4B0FAE2974178C8F95A81D37278A1677243CF126593988F77AD09D3D723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 506781b47b17b78a8b82fb0f59f22e228e6b4a8c5e575a64647be8c7fc321662
MD5 689cb29082fabee64763410d3c53c259
SHA1 6efa7f1dec08df392efc3b4acd0db32ee848e62b
SHA512 2d879e047be680cab3119e2453f691c1058db9836593dcf4dc55c91a8405913d9790a77d8289fcad5f5d34b9689506b8dc5a320573f6b67d157e73cf58e2115d
SSDEEP 98304:nQRQyi36YOcPbLvw2gAf+PN3MfuEpL0GYW7elop:2QyiKa/X+PNczpLIW7e
TLSH
T1A8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a68c251df53cd9ca7cb64271a6dcda5ad8d6ad032f716d266c524280974c5ad1
MD5 9e6223609753e811061e6dc85ebcb50c
SHA1 98a068f943ed9c71456e6deeea4d21093abcf7de
SHA512 34870b41fae9ef32233c61a066e003ee6295a9983c7e67135ca82efe6500cc85323b4c0031096a596b58943fa781766006c3aab10ef62931460dcfbc35b52908
SSDEEP 98304:iQRQyi36YOcPbLvw2gAf+PN3MfuEpL0GYW7elop:5QyiKa/X+PNczpLIW7e
TLSH
T153667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 dd2f7e14c835bef49fabf56b92350b718ea5091cc799f15c2da7c2af0077a8be
MD5 c1745b11b1ef390ba10e2ba3a206ab56
SHA1 35a80f13801e23fe383b2dec74667e3934be3d0a
SHA512 60e66e171dd1a8d249670d463e1e9a6bac825a6de06150fd01307dc2ab035796dbff9492ba2671985b7db585e6abcc6efd58c498f80b3656e73cb8f34a32554b
SSDEEP 49152:R68Qg55nhceWu7PNU3/+R1uEpNN0GYWLBdWtLw8ploRv:PthLRc/+fuEpL0GYW7elop
TLSH
T19CB54933B2F60099C44DE1769F4A872196D27C758FE1E3DB8511720A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 787964fa926dca435611394709bccd348c4479fccd938c4527b0e4f731bbd6e4
MD5 daf8f954fedc824a7d42ee357088383d
SHA1 0429e868ef8ccb802e709a0072464fc44a94973f
SHA512 025a322b293e0b8cf30d20c566226d34f23125a3b462f338633c24fc13d4ae3a1ffcf60d86b4aa20249d3987340e5aeea9d7f15b441497e4bb6aba8dc5b80d3c
SSDEEP 98304:6y5112gYy5azzVvt69nLKnhZbfuEpL0GYW7elop:jLIHEWhBzpLIW7e
TLSH
T102167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ff2dd8b5f883e987b2829da85b4d1068b6e91df5714594104c9ec5ab8bba3509
MD5 44ba1e9ab0f8a96947af0cf5851f5cfa
SHA1 e23812ef944b8545e16e0d599d60809597468acd
SHA512 9d3afbc569dd79060dae3faf0991d7adc5482b4405ccef13391401852226aa9343a3f388d4a5ade23eef292c4741b0be1d46288a636e67db18d66352b8bc1923
SSDEEP 49152:hB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glkR1uEpNN0GYWLBdWtLw8ploRv:3u6Jmdxd2dkfuEpL0GYW7elop
TLSH
T181D59D13F1DA01E8D06ED078974A9233EA62BC490B35B6DF0A9073552E77EE4AB3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 70eff17e2f9dc5954f69e6a1bab5db82fb2562e16e3465bc9bb90f8a675b254c
MD5 40e7d4d2a75f9d605b05ceb34af4a843
SHA1 0cacbba8195955e810badbc399c8f5af0b8a1d59
SHA512 081a6975ad3478184c281880739aaf87af42037a201d3d1959de58bd7b8890c688582c212279abf16e29e9bd10b10abfc072b8b1909a3bea7303b121b732de1f
SSDEEP 49152:W1hpsNoJpF1A63U44CwH7R4xAR1uEpNN0GYWLBdWtLw8ploRv:WmifPWRZfuEpL0GYW7elop
TLSH
T127B5BE13F29900E8D05ED178875A9232EA62BC460B34B6DF0A90B7961F7BBE45F3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3290412cabf974ad0b4cb6b8b45c55d3c06368b39a004d64c8a134d217432804
MD5 94f2aa5a339ea78676129777a028e03f
SHA1 15799aa71b31d180c2fbbeae084b7a9c24335c19
SHA512 d46c1ee2812fa2ee622d3ce8f6b0f6a443b545f14fedf2ec7da824a7c682c8bc6dbe1d7d65501b3c3c3f472012e2e6501f3f7f527951058c3754cc15a4bfb823
SSDEEP 49152:pSuZQIY0Be2KcRVtOnks6NMHqPR1uEpNN0GYWLBdWtLw8ploRv:n5dKii61PfuEpL0GYW7elop
TLSH
T1E1C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 a60f22259c1296839976afa24f274e23ba2f2e2de0fa767edd8e1bdd96f8386f
MD5 577d26a3df4db142220f520e050c00b2
SHA1 2cf184947f8b62562a925ac155f2ede9fc715cac
SHA512 482bfbd1780cccdb73d8a8e22fea7cc3eef373801c1f4034d07bf7286efe7360bae0f508b2ad301a17c010c1c40407a04cbe33f16119ee3dba77f5e240088802
SSDEEP 49152:UhtSn8EApI0fig3giDn0AP5wUR1uEpNN0GYWLBdWtLw8ploRv:1X2imphFfuEpL0GYW7elop
TLSH
T15A95BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 bb6e866a24c43f74b9327a16f1d979292bbc254f7261418afa498159b6045e9a
MD5 e5a0fa1b0fa106079e526b498121f64a
SHA1 d2d56b10c6ea5b4b8e6fe12296b4f731ad8b55cf
SHA512 4c0ba56bd237ce592e7fd0c1ede534a9db33f4b4df704f9c2e4f61d3bdf5380e52638195ad5e36d2304a7e05b2e9b1428256f9d894b3c7746ca204865978d5c3
SSDEEP 24576:pzsc1uEpNIg0GYWLBd7WtLtq8ploROKg:NR1uEpNN0GYWLBdWtLw8ploRv
TLSH
T1465523823A56E58EE60640F584FE55C150196DE0EF73468D737AF348CB7A6E0CC0D9AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 b5b5d6f41938190818c07236ee4bbb39b47ba8682f113b2240e66d98390bae68
MD5 d05456cce394beff71f25660496151dc
SHA1 78f8b7d0a64c0599b30b36adba80010e7d441dd9
SHA512 01b1b07429e818e7ad64b37dfe66dfaff53997113594a0691182f684ad3e830400654bfc0e38a8572c4357ed4bb5b35bc52c02d281d65071e798891278eb250a
SSDEEP 24576:oisc1uEpNIg0GYWLBd7WtLtq8ploROKg:nR1uEpNN0GYWLBdWtLw8ploRv
TLSH
T1D85523823A56E58EE60640F184FE55C150196DE1AF734A8D737AF348CB7A7E0CC0D9AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 8f76f977f4c2454bf4fe5916576aa39f20d3d88d676e13810fb2c869383b8052
MD5 4278add0c396a5f003ea74a1a9e1098a
SHA1 49c0f46394b9e895dce9e2ace9af7c76e48323e5
SHA512 f517be9575b4cf94bac18be834d2a2968f3a231fdd2fd1b95b159eb2e7caa57dbfaa97431b782a25053a656c70a1dd7f2912e0bcb782c78879ba36d3197753ce
SSDEEP 24576:8Ysc1uEpNIg0GYWLBd7WtLtq8ploROKg:JR1uEpNN0GYWLBdWtLw8ploRv
TLSH
T1695523823A56E58FE60600F584BE55C150196DE1AF734A8D737AF348CB7A6E0CC0D9AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 257294439a6e981bfd2104af126705debe822dcab7328d845255c0eac753bd24
MD5 bcc1604334be8e602cea419d16c03ceb
SHA1 2162b16893a6f7bde4e295e7103a737547143f24
SHA512 edf60847774539b0985fb0c738c2a1ddc9409ad3d3eb2468f5c5cfae8a50ba053417dbbd118140d24637b7d9f9ddc51cb4c531cff8a70a1bc1488bb4223f7cf5
SSDEEP 12288:aVvxsAB1dwEjVNISJH0KV1kwaWLBdzwV+hdnWtxYCZNrLJV08Iu0ioRcrvKg:Csc1uEpNIg0GYWLBd7WtLtq8ploROKg
TLSH
T11F552342376990CAE90791B4C4BA55C19179BCE0AB3287CF6361A748CF767E0DC2CB67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 8baa252081195bcac7368d984b01554b32358d7229b84aa26d284782b5509629
MD5 3e79c4a0cd307238ea4c83c3184dfe49
SHA1 a085edf3ed16ab82667aafe52c993759412c8b28
SHA512 fcde6a6827fa72219e0d55e2a234e844c2b0f97b2a5643c870e3c6748676620a81334c44d59ce27667cf2e218ee526a1b6c1402dbff95c3ee61c07979c0f9ede
SSDEEP 24576:mhsc1uEpNIg0GYWLBd7WtLtq8ploROKg:cR1uEpNN0GYWLBdWtLw8ploRv
TLSH
T18B5523823A56E58EE60600F584FE55C150196DE1AF73468D737AF348CB7A7E0CC0D9AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 02981a6ae674794ebcdfa6640f1631e642086aacef3d9f8a63c5ca4a59a83678
MD5 2425526eba28e2d073608e9c0ab5cfdd
SHA1 f0b21aebd9b1ce1284bb5c0f7f458d1b2b7893eb
SHA512 602a460963fb9b860e7310fdf1cd08d8194cc65be5d3877d4dc6b78f4e7f9f963f84ba8339d7a9a09b9d8879edfd41ce351f7c6e44bad8249f4db59b0955ba84
SSDEEP 24576:sGsc1uEpNIg0GYWLBd7WtLtq8ploROKg:5R1uEpNN0GYWLBdWtLw8ploRv
TLSH
T14F5523823A56E58EE60740F584FE55C150196DE0AF73468D737AF348CB7A6E0CC0D9AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 9332904d2ddeb00589d917427b6a08c3fa145605dbe1b71cac7ec37dc2cf839c
MD5 4b12711a1105d41581c7121e82255d14
SHA1 941568513b2a0c941bcf0aa7bdd4396a4dba03fc
SHA512 f91be65f79fea6a33832a30d2479d5fc2cb8505a92285433253fb6150a2262b5b2f1139233df8e26c20843b24f53dccc12295a085de35784d50c87b5e06151e8
SSDEEP 24576:NKsc1uEpNIg0GYWLBd7WtLtq8ploROKg:IR1uEpNN0GYWLBdWtLw8ploRv
TLSH
T1B85523823A56E58EE60740F584BE59C140196DE0EF73468D737AF348C77A6E0DC0D9AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 10838e2b8d616a1046b264254bba7b1c3a94b7113fb3c166e1674db55517e90a
MD5 dea9fd3661bfea946d6caf7aeaca49f1
SHA1 3ea17dd50c53229ab4b657f9283ebd19219561eb
SHA512 00bee1a59609fc2338ad4d3666aa5665a890d3576f3427cd73a8f59cb2f38202287344678442fde18cee92a683c5b827f3c2fd1830078f6e34e6cefd5944b94a
SSDEEP 24576:mZMRzFVSOCsc1uEpNIg0GYWLBd7WtLtq8ploROKg:mZMRzf2R1uEpNN0GYWLBdWtLw8ploRv
TLSH
T198750195739058F8EC67817EC8658946D2B27C650B70C65F13B4376A8F333A05C2EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 ac4d151b10b35ad74ddff4d8f77933c1b91f9fe6f876c2cffc981319e3d7ed55
MD5 bba7a50f543ef956aa3544e9e619e5d5
SHA1 607127aed257ffa1a8006b1e7bbd99dc175c5d0c
SHA512 0f5a824ce06c83bc1676646e76393c6b2401ac41ca7efffe3eb8e077658953be266aa823b14d20f6eff13dca9332a8cf36c5e0ced59cf757cf4272e2a1ab523d
SSDEEP 24576:Y/sc1uEpNIg0GYWLBd7WtLtq8ploROKg:MR1uEpNN0GYWLBdWtLw8ploRv
TLSH
T1EC5523823A56E58EE60600F584FE59C1501D6DE1AF73468D737AF348CB7A6E0CC0D9AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 25181f3ef500edd3d331e6ad79fb64d04ffb8416f63a7a4a1f2b50604336fb56
MD5 d2deb0324fe282215184f10496849018
SHA1 9147c1beb1690f6fb15d0b8d48e0453eef5f36a4
SHA512 766de4ed7f553400d83cd7adc435e92e1e06ff0fe770c1a164872f7f068bb4a0565ab8dca471507b6a7e9de6f22f6e63926f6a89b2f11f9d7a1535d2a8395d7e
SSDEEP 24576:sLsc1uEpNIg0GYWLBd7WtLtq8ploROKg:4R1uEpNN0GYWLBdWtLw8ploRv
TLSH
T17B5523823A55E58EE60640F584FE59C14019ADE1EF73468D737AF348CB7A6E0CC0D9AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 e47b20d1480198b4791e1d4555a4928a6a12a607bbedeac5c6868e32f2eb80a1
MD5 30a291e948bee036845fd51d139df627
SHA1 5d39edd44531e5d786d1d3026c919ca15ab71b11
SHA512 666f328ce35035554c89a10c78e1b16dfb66253ab3a2b09ba0bd939fba70d89f11e67fe118814b663ef951f7160fdf3166f925fe2cb774ee0e113523583c0b45
SSDEEP 24576:yzyesc1uEpNIg0GYWLBd7WtLtq8ploROKg:yFR1uEpNN0GYWLBdWtLw8ploRv
TLSH
T17A65024733A570E9D1278178C8A61A42F376B8714B318A9F23A453798F376E09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 bb42a3a177d5e75e7380e95282623523115d07210bf7d52b9e7d0b9b179c922c
MD5 61ee3ec63f2f11ecebc3d4a6e4c63411
SHA1 27e6733cdc9b78150d422f9dd5c5329d8c803eec
SHA512 c012b232daaafc2ad39a8dec199d8c382404251a45e13d0cefbbbb922c22234645c523af2b2d9fec137932e3e5de9f33fa53e43652b35a4394c2405f58b3e148
SSDEEP 24576:c/sc1uEpNIg0GYWLBd7WtLtq8ploROKg:YR1uEpNN0GYWLBdWtLw8ploRv
TLSH
T19A5523823A56E58EE60700F584BE59C1501D6DE1AF73468D737AF348CB7A6E0CC0D9AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 7828bfade0e30945d60fbe5f533a95a177e87e03df995f3de160aabdda806f47
MD5 35cde3cef1d3a61ff87476bdd3ffbad4
SHA1 12ba8d3258eb8c9bf30a8f72e8ccd94e17bd4251
SHA512 25b51112f99dc02076413fb1d700071b83f961a18625045ee7e7663944f930b61d603fd2d94137aee6523ae86a0afa6af0a0e337529e166f8eceeff118b0be8e
SSDEEP 24576:I/sc1uEpNIg0GYWLBd7WtLtq8ploROKg:cR1uEpNN0GYWLBdWtLw8ploRv
TLSH
T11F5523823A56E5CEE60600F584BE59C1501D6DE1AF73468D737AF348CB7A6E0CC0D9AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 4e9c12a5ef4c9dddf598e5156bc7bb239e5fdd56da2b85bea61ba2c8cdceb160
MD5 95e2213e8a86c1c11d2058493910ff14
SHA1 4b76038742384839e5134f61236102fe1f479058
SHA512 d7be9aefda8f1ffb8c30263efc2c2cf13c849d9f93924aac5cd0cf5b1ddca277788c73757b0d1c0dbed50e56da9de40dccfae2043ff8ddbf8c4cc49858bb7277
SSDEEP 24576:Czyesc1uEpNIg0GYWLBd7WtLtq8ploROKg:CFR1uEpNN0GYWLBdWtLw8ploRv
TLSH
T15265024733A570E9D1278178C8A61A42F376BC714B318A9F23A453798F376E09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 b6e4ba9c534add09ec86279b4090493fb7cd709f88c61e2f8feb149ed781783d
MD5 a45ef4bd0adbeb8891bbbd893b2c1f17
SHA1 aee6a80b474e8ec7a72b45238c7480a8f16c0254
SHA512 ebb87108eb987fb26515101e341aea6748d01d87386adf6e8f27173aac8375671d22d76a7d4abbdeb64ecefe781840f4c8bd9d2b305b593097bf469e2425b34c
SSDEEP 24576:QTDaLl3z0zDosc1uEpNIg0GYWLBd7WtLtq8ploROKg:QTuLljtR1uEpNN0GYWLBdWtLw8ploRv
TLSH
T18B750295735058F8EC67817EC8658946D2B27C660B70CA5F13B4376A8F333A05C2DFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 04ab621ff9aca767838b3286273ba7c78a60bb675fbc543c1ae144ce7d4fd204
MD5 fc1a89ea219fe4d8c7e67df82586f22c
SHA1 e324ec3121b114c682317d05774c6d66756ed0a6
SHA512 d6756c52f3008a34f49bd3438fcf77abaf1c45ad4747f8fe1f7701efcd96c8390bec8a5fe73b7da698c1f542631ee729f52e4f7bcfe22e7798110929fa739583
SSDEEP 49152:+vd9CHKya2R1uEpNN0GYWLBdWtLw8ploRv:sCq2fuEpL0GYW7elop
TLSH
T19785CF90F3E414E8F1B79A3589764502DA767C991B31CE8F03A8665A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 74eaa2fb5931842b08890a31f56c48ae38c67abf4bd8d08a83d4f5c3f3aaaa5c
MD5 2a0ce9b7f263006c450c557372696d87
SHA1 af1eef452b4f75361521a94d3826cd9bade164ea
SHA512 10292e7ab69bfbe117c031e4eaaf2182eb7bbe42381f994cf59195299e916c64bb93ad826e7bf0534712a33536feecefd53c9683a75a981a6ffc30db0fdfc6cf
SSDEEP 24576:/4sc1uEpNIg0GYWLBd7WtLtq8ploROKg:wR1uEpNN0GYWLBdWtLw8ploRv
TLSH
T1E45523823A5AE58FE60600F584BE55C150196DE1AF73468D737AF348CB7A6E0CC0D9AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 1cada777efb7cb895368f487a81ab09e5a8deaa514cd5778cfdbf0bbc0dc5193
MD5 9bd16d1fd5bf7296861f89277d59c0b9
SHA1 3c794bba49dd5a2c1dd728c21fc6b737ef82d16d
SHA512 bf446e49ca3132c18f54e4d7ec97291087d5bcb49a4f3940addf16966c9bac8363fa27241a5313e8f257214e46080b9516eaff3f69bc99a60dc5b7df33bca48a
SSDEEP 24576:G+sc1uEpNIg0GYWLBd7WtLtq8ploROKg:hR1uEpNN0GYWLBdWtLw8ploRv
TLSH
T1545523823A55E5CEE60640F584FE59C150196DE0AF734A8D737AF348CB7A6E0CC0D9AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 167856e9b9d5bfae40d3c581756fff355d688bef393dd29eb156236e3eca4f1b
MD5 a1f7a56c53139fea4ef271459b969a2c
SHA1 f5ba71918071e1f00a664695269e32fd5b17a00d
SHA512 ee922cda298d70fa7876f3460bd7f67d06d0f504eb665894e479f69b973e2139f8fb78866acec981e8be0b6e656f8fa28d05e69d8ed827194d609fc9d528c8b2
SSDEEP 24576:N1sc1uEpNIg0GYWLBd7WtLtq8ploROKg:vR1uEpNN0GYWLBdWtLw8ploRv
TLSH
T1815523823A56E58EE60600F584FE59C150196DE1AF73468D737AF348CB7E6E0CC0D9AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 412465b27e45820ddd0fa8d33af6c990e3588ee87440f848615f3de2ed6089a6
MD5 8246eaae30e5f0fcd49b0f92d281e4f6
SHA1 29689e36fac127b48c1feef5c111411eed20ab1e
SHA512 c55438b4a0dccff2e9b75e6a5598a0a341729cfd82cf8115f4bb82971ff76a8e49ac181ab5ce149826f95a28eb760cacf863d183ff656df441a3a3c23caa7fc7
SSDEEP 24576:y/sc1uEpNIg0GYWLBd7WtLtq8ploROKg:qR1uEpNN0GYWLBdWtLw8ploRv
TLSH
T17F5523823A56E58EE60600F584FE59C150196DE1BF73468D737AF348CB7A6E0CC0D9AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 eb00e631957b338193b4b33e52ac49fc205aea24b93c64e7a7391bda70702624
MD5 21028a9e26c59bd2cae30b9c22e7db9b
SHA1 6de37927eebebe0032a9e505b0c5cbcc03b75bd0
SHA512 d6ede63a93a3896271bad18bf09c3ad34965911b3ece7cc791c081fe8c76fa417aadb0c8cde8619943218b0e35cf64fc344c410ad5eb459030bbe19f366d5275
SSDEEP 24576:j4sc1uEpNIg0GYWLBd7WtLtq8ploROKg:0R1uEpNN0GYWLBdWtLw8ploRv
TLSH
T10C5523823A56E58FE60600F584BE55C150196DE1AF734A8D737AF348CB7A6E0CC0D9AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 0e1784f51e76fc4165fa145f51320787bbe692df7a4ddda29dddff597e129cb7
MD5 f7ae7880f9de37d154d80f81336c1f75
SHA1 12ec58f195ea760305832a89d62b4f14d597162c
SHA512 9ad771c1bdf1d1093d650a07c4999bb9dc94d33b4ee5ff246740bae6bb876840bfa80fecdf715b60788b8a044a28c6824c8b652d3fcd379ac5262bf8d6020a0f
SSDEEP 24576:uHsc1uEpNIg0GYWLBd7WtLtq8ploROKg:GR1uEpNN0GYWLBdWtLw8ploRv
TLSH
T1135523823A56E5CEE60640F584FE59C1501D6DE0ABB3468D737AF348CB7A6E0CC0D96B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 27309d53c648e45b657af8e0d9919a27e43b2461da0544706884f20fe7fe9742
MD5 f27e8991d712aa2bc3d9d388f25d8133
SHA1 516ff2a65049da1eb5c5b528cf988657c3d1d8de
SHA512 29bc84f078451a24542971e8870d894310761dcdfbb1c9173a7a329a390196ce667db369e3fa8f1cad35afcfef649e49b43cfe78020b3f9a228ca4eb2af1ab8d
SSDEEP 24576:bhsc1uEpNIg0GYWLBd7WtLtq8ploROKg:9R1uEpNN0GYWLBdWtLw8ploRv
TLSH
T1295523823A56E58FE60600F584FE55C150196DE1AF73468D737AF348CB7A6E0CC0D9AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 f70e01e5823d7e7c055396dd0f075ce420da8b3b05c767d0f7bd0b734da4346a
MD5 c9026c24d61590b2b741051a9b973147
SHA1 19251eb9eb4277bb6d7cb4b98edef7b9b6be250c
SHA512 6cc516952d18e996e1c4d94353e037dd35ea89148d91d728ae87d9a2eba35491048315451fe76d972eaf668548a84e4f77df0f3da974d27e25e3f051d0035755
SSDEEP 24576:oQsc1uEpNIg0GYWLBd7WtLtq8ploROKg:tR1uEpNN0GYWLBdWtLw8ploRv
TLSH
T1145523823A56E5CEE60640F584FE59C1501D6DE0ABB3468D737AF348CB7A6E0CC0D96B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 3a70dda1e2bccf9e0e704d6d8e7a94ff40557ef6bbe2534c3eb6340d71316d75
MD5 7a27878091e42df6f8ae95750b3d5806
SHA1 9f3ac3e4bae0757bf3e23a1a56ee0065cb303f0e
SHA512 ea09c94fd974506e7f83eec47291e3faf9a586d6205e4bc072457cb090e298840f100d86add627b93a7e18bf63ccb2e4857a62e7419bd6a0f3ab08c625d10d19
SSDEEP 24576:ohsc1uEpNIg0GYWLBd7WtLtq8ploROKg:SR1uEpNN0GYWLBdWtLw8ploRv
TLSH
T1715523823A56E58FE60600F584FE59C150196DE1AF73468D737AF348CB7A6E0CC0D9AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 3206e6bce5387bb2a5a9fb80cfa40df0e028fb4dd34ac3e133833d2f25688ac4
MD5 1d262dff142764010288c1d06be2529c
SHA1 fb36ed5a4a2f9dff2d3dc7c0c99b49255afc4e05
SHA512 44aa5549c30fc74134fbdb70813c02000b9ba692b5309a2c6a57d5b54570e55c75bc3c76b596b10c84f331202a5a8c14392c7ceb91d8d33af04253135c1b0013
SSDEEP 24576:6fwvUk9RX6wkyAI7sc1uEpNIg0GYWLBd7WtLtq8ploROKg:qMnYI7R1uEpNN0GYWLBdWtLw8ploRv
TLSH
T17985D029EBDC44E5E177913C89B7460AF2B178681B31C6CF129A53AD0E37ED09D39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a3c300cd90ec9d1ccb1f92fe8b9876d7d4477fd64c2d126e5a2647419321720f
MD5 51c2cf2796625233bb076b6c23c7e5c1
SHA1 775aa7e666b23aa34c3da64535c30bf7d3c72be6
SHA512 7f4f66494f70a37bf13814dd0da10c01f9bab6b237ba050fbe1dfea1b21e523345b92db225225f5ecc0108696881f4857c89e55d18ec3b432f06359b6b247f39
SSDEEP 49152:EYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK00R1uEpNN0GYWF:zySzPsfuEpL0GYW7elop
TLSH
T114067C96A1A841D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6570a814253a702c7967a1b8318e43165ed96a9a7f5b3c35af116d5a923e7ce0
MD5 4ca368ab977793367674391a0f0fffeb
SHA1 ad8617606a2fe0e228aa9c1acb23e78b8d4131cd
SHA512 fa317d1a084ff6a86abda7ab3bf24165c8ad2a8aed509603f93ada79535d3a9a158be196c7b90b2ae8ec1f4a2b5a57926507ad3970d5c3b152f32c261a8cad85
SSDEEP 24576:247Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYysc1uEpNIg0GYWLBd7WtLtq8ploROT:247JUQjTirIhCnDHUPfF/kR1uEpNN0GN
TLSH
T1D765AE1EA3EC01D5E1BA927885154A5AEA71782D1F31CACF2270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 b6fb257331b830bc83ba7af930fa00468160d5287b20d8947f61717d9a034cae
MD5 075db91d13489bd2b08979dcd698e7b3
SHA1 31e963b234276f9226bb2d8bbaedeb9ad8ae7797
SHA512 70ecc6c98bc85814ec70258601b628e5411d0481a9f28280b35ed7603241854f3218b96746a04231749b0475a26f519edf1147db48da0ad46066cefde5dc25aa
SSDEEP 24576:mPsc1uEpNIg0GYWLBd7WtLtq8ploROKg:uR1uEpNN0GYWLBdWtLw8ploRv
TLSH
T17965F10AE29852D8C05E5175C7AA4A81B3277C6097F2C3CB63D0F63D4F7A6909DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 0babe7ce16acf71ed3b9825714da11cb240814df889d7ecc919628f903f1ae97
MD5 ce32bae713c2ddbfc4075bfcd616008f
SHA1 049df54a8b03973f2c4bf4f2786c0f27082f4288
SHA512 b444a5553b27d1dac6e6d8e2f2cf8197e81ee77427253a47118342420cf074712c7a8149ebdc9ad5ef982802220c22d542b0617e9a2e097f57340db9d4685ea7
SSDEEP 12288:11qOYcxU3fRl0rOfaPtMQ801Z58iiD6D4mRLpSR9nF7:11JYQUPByPt601vi6D4mXSR9
TLSH
T170351851766ACB5FC6A940325E33C2CCA7707D01EE056B0373C8973FD576669BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 9a3e8d67d805df648f0dacc3751da87230fc8b773e349951f6b84b4fa88410a7
MD5 e56359eee27667a3cfcbda2d3c39c0db
SHA1 1433b1502bc7c0acd9551c0b6e37a8f726a4fbab
SHA512 c827df197e3c82ef11f6d2904c0eabc78de4347fc60c236d3c6e44ba9a5f6d0871637e836505b1d4fb44b5253d9e162847f9abdb83380f898719c693c37155cb
SSDEEP 24576:XCfXy4OKT0r8QXDRKkMOoc9jGbM8tCIFj1Iu:DkRFL
TLSH
T14365E8416537E38FC1FA6032072A5B4C6BB4EC07B7055F26B3C8453AD86AB65A4BD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 14e1db9b813eec86676206b80c1e2805f2bce7a3ad4e57a030b2baa75e213115
MD5 872510f037bc0d20be636eb260d67463
SHA1 bc28f5e3beb856ebbb61c14cf05e2e919f78bd63
SHA512 65817180ab196e16a27faf4b92fca4f26539f5dca5e886dee1a59c05f11f7b6ae9eec612571db7ef9f8be05b6a4b07744688cb2ae1f0af4914803b1d603c921e
SSDEEP 24576:VXsc1uEpNIg0GYWLBd7WtLtq8ploROKg:VXR1uEpNN0GYWLBdWtLw8ploRv
TLSH
T1B85523523759E98AF52710F044BE9591111EBDF09F7285CFB226B388CA79AD0CC3CA5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 55d7e6102338677809943fadc94caac1ca9dafc730cb907cdd77d5d0003c8e97
MD5 ab7f8665758428a5f9592cf56db4f73a
SHA1 4f14ee5466313e433eac5d405abc03ff3849d71b
SHA512 780389522030acdd95ed954d3bdeeec6c4d034741789182c724d96e9b6570b1e36f62e7217272dcef660f983a1fa7e62d8e57072482804032c88c526fd4a9626
SSDEEP 24576:rgb6bmBIi49WNNFpg1rSvFv7bYtsc1uEpNIg0GYWLBd7WtLtq8ploROKg:rgb4mBIBhGFyR1uEpNN0GYWLBdWtLw80
TLSH
T1F565AE1E22EC02F5E0F6D2B8CDAA4417D6B278161732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 ba57c1780a5ae6337f74f576623c3a93ac370b2efd6b6f1ac45a91e5bbc26ba9
MD5 eae62436f6769575df927e7e26faaa62
SHA1 13176ac21fd78ea4e698a139b96492927d5586d7
SHA512 2e91ecb75a4e522576f500e2a4348d765ae415fe268cce9e696e77c6acd6dc74143f2df2cbf148c1e7109499d66b7e434f97f9b1ac0e3f85bff1c2b666cc05b4
SSDEEP 49152:D7ZFPqVea7/VR1uEpNN0GYWLBdWtLw8ploRv:DtFza7/VfuEpL0GYW7elop
TLSH
T1BD85F16577E101F5D47BD138899646A3F2B2B8211360EFDF07A88B550F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2464676ecb78518f7f3dc9a92ce9c5b4e8fe7460bdc324977a5ac36773a093c2
MD5 6b1926c2fadd8cb16867d01d25df8964
SHA1 99edfe218ab6c9938763d779c3e8b06ab7e1a55e
SHA512 beedf97eb563459ce38149c868c8650341e0bb99b565fca62c0dc1a53ab6001f5f9118f5f9b33ee3e82a928919f0e3f8d2810cf722e021360c627808b0e55f29
SSDEEP 49152:0BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjGR1uEpNN0GYWLBdWW:XG05lO43bjfuEpL0GYW7elop
TLSH
T196D5C06A62EC11F9D1BBD07CD9C6460BEBB23815033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1e76deda874feefe2c02b08643ebb485feba94f45133e2377ea23929c4d479fa
MD5 d15ad31a1a43bc647ebe595ccda3b7c3
SHA1 fb952adced428c6be441db3eba738c751cf5ea22
SHA512 b49914d6f7154de40ec1156b8cb94c2d892b82d10a76bf7c183206ae5b236697f40dddd8e890a2322ca37949b5beeda1bbedef769e3fa2c330d713ad86ec6974
SSDEEP 24576:mfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn0sc1uEpNIg0GYWLBd7WtLtq8ploG:+a5POZ3BJt2pasx2+m+R1uEpNN0GYWLp
TLSH
T19465BF5EA6FC01D5E579D17DC583860AE5B1342153329BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a455cd2199a5b6561608eab77a17b44909caca78014e6dbeddfa0efb326cfcdb
MD5 c7d73a6d12bf6714fbd93ad47f2c9b48
SHA1 3f5b8f3d12069ea6779c1add5c5737f53744887a
SHA512 3fe25fb0b2807d95d35580662e5b0009894933a86b43e997605eace0c55441dea45ccc1b8b386196a35419a7aec3c6d7e21d78d72df36c495a97afcb8295cf23
SSDEEP 49152:NNc/zEOVHF1R1uEpNN0GYWLBdWtLw8ploRv:YIAXfuEpL0GYW7elop
TLSH
T13A857B1623E901E4F1BBE1BE897B9546FA71786557308ACF0291811E1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 60cf4e201b40dedff3e2bdc471ec3273e62b6c3bc4af1d4e4aadfd455ddb1b43
MD5 f826dc87a65f71b00731c6a6162a4ed6
SHA1 781e559eda82e7e70825f1be18c6bdb13df86b7b
SHA512 d64c8ab0e79ae045a9ab60454d96e79f480e7b6ce395e18a58de25a5f0f75c47a9d9bcf485a8907fce8b9853995ca455936b3f5628aad4d176a13e1f877bb691
SSDEEP 24576:CTkNvNnaFeYhJNtmZBmQsc1uEpNIg0GYWLBd7WtLtq8ploROKg:CTMwBtOmQR1uEpNN0GYWLBdWtLw8plop
TLSH
T1B555AF6EBAB846E4D1FAC6B4CD238512E6727861073293CF5390C13E4E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 3e4ebcde5c729f99036000db265c5aa67608505ec36dc29b24009cc455e58be9
MD5 b9773369a16078ffaeae518490da1ad9
SHA1 cd2bba2c7869a711d640c3123d72a1a944a41983
SHA512 0a9fac7953a2f48bee00cbc2937e7aab8b0af609ae5c9d0ce5cd95312e70451091e5f9addf7bdf482f93add77d706a1099f76a0b4c16cd906b04cc6794a3c792
SSDEEP 24576:JPUr+NQ2sc1uEpNIg0GYWLBd7WtLtq8ploROKg:JJQ2R1uEpNN0GYWLBdWtLw8ploRv
TLSH
T15065F11F22AC18D5E676A17D85968709E371B8621712D2CF02E1817E4F77EE8BC3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 8fe5f21acad824b9bb2c851208a05fb6c4e235956b4d418f52fb761a18b263f4
MD5 bbdce4d656783a9b3f4644bfd2ee8ad0
SHA1 924ffcd3ac0df50f65f2cd6717a84cb502b878b3
SHA512 a954f595daa42f07aa56064933539a203417e5813f5cac3134154e19e71128f08bbc2da7ffc83b4bc198712a289e83877021f7606b8030fb1c5f30ad553e4ada
SSDEEP 49152:MDVHeBIAATR1uEpNN0GYWLBdWtLw8ploRv:ufuEpL0GYW7elop
TLSH
T1B075E17EE69C04E4E57BC1BCC6638A06E27138A9033256CB1294C1B95F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/292-142-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/292-28-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/292-36-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/292-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1424-8-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1424-7-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1424-308-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1424-6-0x0000000140000000-0x0000000140228000-memory.dmp

Download

memory/1424-0-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1424-77-0x0000000140000000-0x0000000140228000-memory.dmp

Download

memory/1424-315-0x0000000140000000-0x0000000140228000-memory.dmp

Download

memory/1736-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1736-363-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1736-365-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1736-101-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1736-107-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/1776-79-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/1776-362-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1776-78-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1776-84-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/1888-130-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1888-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1888-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1888-137-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1888-124-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1972-121-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1972-15-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/1972-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1972-23-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/3292-368-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3292-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3292-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3292-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4372-55-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4372-54-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4372-61-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4372-279-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/4820-380-0x0000028DA9700000-0x0000028DA97F1000-memory.dmp

Download

memory/4820-379-0x0000028DA9340000-0x0000028DA95CB000-memory.dmp

Download

memory/4820-409-0x0000028DA9700000-0x0000028DA97F1000-memory.dmp

Download

memory/4820-408-0x0000028DA9340000-0x0000028DA95CB000-memory.dmp

Download

memory/4960-52-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4960-45-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/4960-50-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/4960-47-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/4960-39-0x0000000001BB0000-0x0000000001C10000-memory.dmp

Download

memory/5084-382-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5084-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5084-94-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5084-366-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5084-88-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/5084-383-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5804-367-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5804-113-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5804-132-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/5804-119-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/6120-65-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/6120-73-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/6120-67-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/6120-296-0x0000000140000000-0x0000000140222000-memory.dmp

Download