379338cfa75ae3188f8806475c274dc9dd4cab005cda9bc23388f6f590e1fdd6

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 00:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
Size 816KB
Sample260720-a2na8aat6j
SHA256 379338cfa75ae3188f8806475c274dc9dd4cab005cda9bc23388f6f590e1fdd6
MD5 b8f1e9a1fafdfa3fc5b1c6b1e1d94293
SHA1 782ba4213f2e289e1b04b23a1344b7143310fb15
SHA512 e5dbbdf4d31c94dc7237db41dc2f543b7e83be09c01fcf7d9ac51af27c10dff8dcf76f6a15365db628ce42c5bce24c85dae985a9a865d34510f4a70fe6ce0888
SSDEEP 24576:XAhY35SSiVw6uAX8DS52tpz9ZRzbPmSZyo:Xl5SW6H8DS52tdDpbRZy
TLSH
T1DD05E0567B5090F6D0650D318661E76D9325B869C8074F6B36A07ECFFFF2AC28E25A30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5096	elevation_service.exe
5228	elevation_service.exe
4320	maintenanceservice.exe
4064	OSE.EXE
5244	PerceptionSimulationService.exe
5556	perfhost.exe
5724	ReFsDedupSvc.exe
3584	SensorDataService.exe
1380	ssh-agent.exe
1476	AgentService.exe
1140	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2436a8e8e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e6add8b4e017dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c0ac72b5e017dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009ff804b6e017dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c8d0ccf5e017dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c0854ab6e017dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009ffea2b5e017dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5096	elevation_service.exe
5096	elevation_service.exe
5096	elevation_service.exe
5096	elevation_service.exe
5096	elevation_service.exe
5096	elevation_service.exe
5096	elevation_service.exe
5228	elevation_service.exe
5228	elevation_service.exe
5228	elevation_service.exe
5228	elevation_service.exe
5228	elevation_service.exe
5228	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6112	2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
Token: SeAssignPrimaryTokenPrivilege	1476	AgentService.exe
Token: SeBackupPrivilege	5724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5724	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5724	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5724	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5724	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5724	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5724	ReFsDedupSvc.exe
Token: 33	1140	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1140	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1140	SearchIndexer.exe
Token: SeDebugPrivilege	5096	elevation_service.exe
Token: SeDebugPrivilege	5228	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 3212	1140	SearchIndexer.exe	100
PID 1140 wrote to memory of 6084	1140	SearchIndexer.exe	101
PID 1140 wrote to memory of 5680	1140	SearchIndexer.exe	102
PID 1140 wrote to memory of 6108	1140	SearchIndexer.exe	103
PID 1140 wrote to memory of 2692	1140	SearchIndexer.exe	105
PID 1140 wrote to memory of 4828	1140	SearchIndexer.exe	106
PID 1140 wrote to memory of 1172	1140	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_b8f1e9a1fafdfa3fc5b1c6b1e1d94293_icedid.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6112

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5096

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5228

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4320

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4064

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5244

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5556

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5724

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3584

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1380

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1476

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3212
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:6084
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2748 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5680
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2876 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6108
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2692
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2748 2848 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4828
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 2876 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4f6986fd61c5888b1ce8bf4519c1fa3ab2d9f701197b69917e54917075454115
MD5 89e4e105bb200cfcb97e7f6e26f435d1
SHA1 3732543d7b192defdf3ffe1037bde91249f01a6f
SHA512 2d3299adcd1ac2278853faf574fa43d54b186dd28f5f57a8bf13b95e4f4a30668a38c9a3b0315a5be477c71bc52928ebbde717a27541142888944714d58d91c7
SSDEEP 49152:Gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnC5SW6H8DS52tdDpbRZy:43q6HjBT5SSDntdDpbRZy
TLSH
T15FD58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 8ffdbc1318b8856323923668da802c74c6fab6916d65a1cceb6054c24ea2eb83
MD5 4135b5f9071b748e1938161f7f58a5ff
SHA1 a035c23f5fbef241464eeea8292f486cc314b445
SHA512 3451cdf894ed31fbd6f4d9b28d3e381669ddacf4da9e28ae3239c9c212599e1993111823dcaaab03440470b08dbaf3a0f95fcd1d134ca568a6cff75592681eea
SSDEEP 24576:dXYfDtczAn5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:Itck5SW6H8DS52tdDpbRZy
TLSH
T13B05022873D008FAED6B8279C8B28511EA33B8954760E79B03F495664F337C95E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 6012a7271d4a8677a5e6d07c7b266f45cc4c6537f32cf3f35c3e080ca913ee42
MD5 7ecbdd1d8441d1ea254d5c743e3c8935
SHA1 46678cd71665bf844abfb49ffc9ec43ca0686f79
SHA512 064ac62545469844c107a52cf5a8f4ca5f67a5ed37c51fc3ebb0817ae5c2e46cc1a75c5fe73318a942d8d6a8489e2254c3345856a9213e268b48393646ec1c28
SSDEEP 24576:10Le5ji0hmxirMa5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:1Pji0AcN5SW6H8DS52tdDpbRZy
TLSH
T18F35AE15F6748336D073C0BAC5D2A69EE971308657308ACB4286D77C7F27AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e90619f59a7daecd0798346517db0cab1a94a6c052c6641d220cff1c515e0d2d
MD5 d39f98cae109c1c9677435a973205a9e
SHA1 518851d5a022748eeb64a470efa5c3e1a1990237
SHA512 6e4c59dcd74cb40c32be840684357a2be47ac5f06d4eb00c33bb8cbf2b5d9f47c42874f31fec4b190cf295a570eb1d72ebad45b46f40d1e4f74978880a7813fc
SSDEEP 24576:Ya7/ezSC6vUyD/aqgrvWE6q8wyuU5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:f/ezSC6vUzPvxHjyB5SW6H8DS52tdDpO
TLSH
T11D755C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 115ef75bc22191f6e8f459ebdcd3b245ccdc3f98fc6712b3239ce25feb76eb82
MD5 a3f1fdfb560d9857ff45bf2dd5b725e0
SHA1 8302348cd18f860901ff05be68835623c14948f1
SHA512 66239aed6dfc21f5a4a8bd58f1590a2d1fad2fc7dfa3e86a92fd6d17413e624cb9b28fa15cb36a2931d7554cf7e77d34e0f9ff0ca1ea8683b3ec3fff95584f28
SSDEEP 24576:fVbqPb88hv/l+6D5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:fVO88hXl+u5SW6H8DS52tdDpbRZy
TLSH
T1E0559E65F6748331D073C0BAC5D3AA9AEE3234425B318ACB1246D76C2E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 88ffb9e6e7138d7c4601bfb0b520a68151378cc34ca43661dfa22a55e77a1b63
MD5 ba16a34203fa7fc0997c97dc5e7fed34
SHA1 7c44fd489246aa108087ec8301129e48b1bf7127
SHA512 e8bedfaf5dfd7cdc4dcecb85c086e9609e3ad9f5b2b9c84f67710a3ca418303c8d155f84948020954c401199fad22cfec77da690a758f304369f076568537639
SSDEEP 12288:tRW5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:tRW5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T13EC423C4479020E7F71F0AB3B1FA96E5DA18DDED8408553B4E71768BCA3998BC672026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 49232266af11feb0966753e295fbae2d66f068a98012f194fcbeadd8b383c1b5
MD5 0bc307911160011dc34fbf3674551ee0
SHA1 23af7a7f50aa5547f04865557291ed536b8bca39
SHA512 2199f5cd39501a6751327e3d30f9721f711dc4d823d3c51cc0b1b03b16f7077040feef6734751473274b3d2b78c97eae71c84d7453b6c5b6d2e7f59bed1f636b
SSDEEP 24576:cJIU75SSiVw6uAX8DS52tpz9ZRzbPmSZyo:cJIU75SW6H8DS52tdDpbRZy
TLSH
T15305DF7BEE28FCE2C27E8DB956918640D77278704B11A3CBD175820EDE235E14E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 62a0c6affc3bab58a1c024d6dedc1b437fd2d5b2265e357c54001705ce03bcd2
MD5 e647571fea775ee6125fa67843002f65
SHA1 448aacd651c1289bda9b76e023ab23084a84e397
SHA512 47786d1b027446bee8a0551876556492eb5dd2b9ce3ded7f7e6560ebac3f7770ccc4700782feb381f13e739fcaafcff61c2e710384b2bc6d5cbe80637b628fb0
SSDEEP 98304:YQvGAdlCEL8c/yRNw5CE5SSDntdDpbRZy:9vyEYc/y3w8KSintdDFRo
TLSH
T10E267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 d9dffdab79ba2ed18ba7c08b5345ae562c445a380b1872c8cbbff5998944996c
MD5 59b3b83cab947846977784b858ad4eaa
SHA1 036af5f4d4bd23494183ec36553be5774c8fe052
SHA512 497d4d4b49e258bb1164409439556f16ae652da14566f90581ae745f191170429fc8dd458a8ad62905e68ebaab204f8e54f7f5194e55d0f582c9feb853eddc55
SSDEEP 24576:ndewsAj95SSiVw6uAX8DS52tpz9ZRzbPmSZyo:dlj95SW6H8DS52tdDpbRZy
TLSH
T19315E030FB74E037C37F0DB21B76C716582CB9604B511AC3E3A89A9E59342D26776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5beb5c7eebdd35a09fc5c102cbc510424ee37484abc9ee3ceeb2eed47c98e0d3
MD5 aa0377e9b1805228ebbe100c9d13415d
SHA1 6884e8b32540803742beaa6a3c9661fe04c55fd7
SHA512 c1d829f46299a942a737b596ba8cbc2d282978cf20a8dfac40569c0292e6543f03718f24a2fb919ab03d9c472b6021ac4ce622bcb871ccf4e1f6daa91dfb6b1f
SSDEEP 196608:LUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH3SintdDFRo:LUEtQevvqc2W1cpV2EI32CedDFRo
TLSH
T1DA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 23484cd66da49ac05481e004e6e8d7afd8ff01a0ab6518069bd2500a9bf90f9b
MD5 897ca47d9a7f707c6a14eb954dd9029e
SHA1 ba9581adc653a3ba2220f1089a314149022726ae
SHA512 3e595451889604b1fed2e536ec85afc56b7d6c62f34325db6c8900907d35dd1cd97e6cc89fe4bfab5463f360017290261dd0546049e4ad744d98386023918875
SSDEEP 49152:CCbRquA/m2yL5zLfFiV+XenmE3/zd5SW6H8DS52tdDpbRZy:Hoq2Vjnm45SSDntdDpbRZy
TLSH
T19FD58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 71479e668fe922fe81bd309aaa2457da60bf7cbe7ecbd52a7a7716cde968cad8
MD5 52198cd3de9e25f63204d3e6aed33832
SHA1 b21ced5ffaa5554cd6ee22963698a6ce165cfbad
SHA512 d9f366edcc076fe00def6212111660df84b1cbf88ad1686aa0d42aad986a2bb4b42a91723d21db45abc0b9b20908a019d3cad949465df21f3e82a6593d40ab09
SSDEEP 24576:EAhGLJIFoiwtA5l7S53Y5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:EAMyFoiq5o5SW6H8DS52tdDpbRZy
TLSH
T13A35AE80E7F955D4F5B7AAB899B68171EA76BCAA5E30C21F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 9847c8f697da47c254718d6709a1c46548dfe9215b1e668b2daff519f374b029
MD5 8abaf0042677f137ef8140b5e4278694
SHA1 faa0256afb2e14b87cfa45851d279870d1b2851b
SHA512 7a24500028d8db459d273b0e660769f84f91918aecaeee6ce2f5a8648dbf665aa39c3245b8aa5b8eafa6eff3975f73978c75d19b5aa28d968df9ea4d0ed5921e
SSDEEP 24576:UwuoOWh5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:UwDOs5SW6H8DS52tdDpbRZy
TLSH
T16E05F14533E41CFAE96B4239C597C136F7B2B8162A24D72F0760C65B5F37252AD3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 908787c37b1ad2635911fd0da2961ca2515e7e1c033d70e9d6e3be89c6f469bd
MD5 21be113949e4d4177784ec79efe6c282
SHA1 a24d2d9ccd260b0df56629c00fba43181de8a031
SHA512 ea6264ca9d9e62578fe8f3a99b2fd54ceb6d55aee77a1044f25eb142c5526ac09f842f814615ac1e69dea28e6ff1739c2bd23dcfa69c28699fb49709e9bb6f97
SSDEEP 12288:MBZ1Iyt5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:aZuy5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T1A9E4128923E430FBE25B427AD9F54685D731B4AA533443DF0A61429B5F33AC64E3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9b3e387a8b2f8f51a8d53f4906018a12450f85c20e7befb9e936d286f221dccc
MD5 07207e64689f2e99b46c21db760c6719
SHA1 e5b1fb4df84066d64ff18563df4d04e0263ec2ce
SHA512 6892db70d1e59d2bd6a42a08b8be532801367313174c94ded82c2ebc2e54425a1550c9c78c39f99cca10bb822fc6a1daaf74733d7d56cb0642765028c2e8896c
SSDEEP 98304:wQRQyi36YOcPQLvw2gAf+PN3f5SSDntdDpbRZy:nQyiKayX+PNBSintdDFRo
TLSH
T1F9667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9c2603ee8355034dd778b403483b411a52f8e8970615d7be62b014f4be7d4244
MD5 9a8c0f330859bf58613c2c666bdb6f8f
SHA1 5c5128fb80b2052f4bdc24f4686e57b19b83e6c8
SHA512 71e05e51ef2d98887d173c1da83f9d0ead7681bb387574b3745b19ebdf7a86c6889043abca71f99215f49eabd13fa644e7b1741564ca2be7f675aea3d712f3df
SSDEEP 98304:wQRQyi36YOcPQLvw2gAf+PN3f5SSDntdDpbRZy:nQyiKayX+PNBSintdDFRo
TLSH
T1A7667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7e0d3ab85d60b42e584612e95533a3713e3c6855d95a1ec85bab11e0674e309b
MD5 0d80730ffb7f06678da065cbe93417bb
SHA1 0b0d55693fb3e8ba1495767a90b49af7e7121392
SHA512 5d84819380bfcd35022f06e2e84023b3ceeac33fc297b3757c974f741101dac6efd4cddba81ffabb801771882ee2affe4dd6628544cfe65af3efceafeaf05358
SSDEEP 49152:B68Qg55nhheWu7PNU3/N5SW6H8DS52tdDpbRZy:/thWRc/N5SSDntdDpbRZy
TLSH
T1EAB54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 506f7bf92b701d4301cd5f25748c61e7f20b3f4b7ab2b1051ec3b3243ad369a4
MD5 bdbe83f033c32b81a6a18c4c883d0ff4
SHA1 77dfe8df22805550464daa968e34aa56bf67ccc6
SHA512 2baf3f77c4aa8af26e2dd051ca05a7facb92ffe722f07ea1bcfb5a791a5bddca3d7d83e36dbedfbab51fa5ce811276e00fe6e827f956430833f9c314bcea6026
SSDEEP 98304:Qy5112gYy5azzVvL69nLKnhZW5SSDntdDpbRZy:pLIHmWh2SintdDFRo
TLSH
T1DF167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 75888aee74c8821abb7f4158f93eb7a701d4b9f08a2d621c0c18828f69265822
MD5 a654c4fbdbc8a5aea7e155a9a68ca1dd
SHA1 b59115aa8bcc595aca769aa8e7d1a943834694ff
SHA512 822a13fea61418ecef667ceb2d635dc39887307da0c090d84773981123dba3878ac06664b30dd4c68a2ba9de8679690ad09ecff013ec1add9c0733a5926f7e38
SSDEEP 49152:hB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl35SW6H8DS52tdDpbRZy:3u6JmVxd2d35SSDntdDpbRZy
TLSH
T11CD59D13F1DA01E8D05ED479974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0e9a5ab23b83483b494f773ea96ed90b76744f53f5c7860696c5c4aa9f81f6d5
MD5 0411179cfbc697211e0ff6a4dc2d8894
SHA1 eff8451cca527e7d7c06c0d24fd5ac177deb1c06
SHA512 e8d363fa71aa9f1d69a49e6cd8da5c2cdf69398eadd918c8e2a1fb6a6b7172bd86039cfffe66a5dc6bbd2706909b2899de28a6aac2d96b176759f72bfedabf14
SSDEEP 49152:k1hpsNoJpF1A6UU44CwH7R4xb5SW6H8DS52tdDpbRZy:kmifPbR45SSDntdDpbRZy
TLSH
T14FB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3758b27a34750295e63b4ddbe05a6db1e7abb5bd15b35ea9e9207ca40f736522
MD5 21fb7ccf71ea1b15bb7d9812b8534bda
SHA1 3678c49646bf88294f2efca6340d0c3389561a82
SHA512 ad03f5e845c0bc0ef7aa41ddc27d9aef7b854fb2288f1e08abc409e2ebf267d0944c6751442288f9f64455aa8ceef95aaf04472ec47471ad3afc5a401abefdba
SSDEEP 49152:dSuZQIY0Be2KRRVtOnks6NMHqy5SW6H8DS52tdDpbRZy:z5dKTi61y5SSDntdDpbRZy
TLSH
T121C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d0981e84fb0cc90e81d21aaf4048602ad92b81a62bde34e0fdc641f0977da519
MD5 a351e4e26f27017ece9b2695dcdd62e7
SHA1 f222a143c2d8d0ff7166b95d7024701801e3a10b
SHA512 d761a5fc885a6cacc009c85b135939ee6e9ee079a2a2c82349aea0eab8f2ad85d9431d5668a84aa0f1aba9db0ec8ab3eefc3bf03a30430ad47971b9a1022e348
SSDEEP 49152:thtSn8EApI0figngiDn0AP5wn5SW6H8DS52tdDpbRZy:8X2iyphM5SSDntdDpbRZy
TLSH
T10195BE13F2D900E8D05ED175C7568632EA62BC160B38A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 9d82a9b3279208eb9fe02eb30d047ce89b0c43bcb4a97dca7cbea5c1c6a14b7e
MD5 33adfb1fa20b465f69914bdc60a2a724
SHA1 42a3cf19bf9c0b343309a1532e849e551014a413
SHA512 08f1ab1fa0a9665e1e005b2317c19e873c94c173d042271de699342df24d5b530ce3435793ce2f9145426ff4b07e45a48c89b160e11503de769ecbc2d6a68bf2
SSDEEP 12288:vu5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:vu5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T101C423C457A121EBE30E0AF3E1F686D4CA0CA5EFD408523B5F76A147DB35D8B4672429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 cfb0f0b4aa42e737698c9a9fdc528c960d6d0b03d7c9028849525f3aea955bca
MD5 11996f6e4a3c40517ecbca01ada005a8
SHA1 1a70f129791ec8bf429692dc10766ce868134d6d
SHA512 84d345b0611fbd6c46d355c5e5f2ccc5428319a970fbd2b051606d5850f9aa126b67078aa76e81d2a0f85394f2b475c4893637cde435ae6d92eb90b30b38b170
SSDEEP 12288:8J5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:8J5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T117C423C457A121EBE30E0AF3E2F686D4CA0CE6EFD408523B5F769147DB3598B4672429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 830d9b4f7fefe798694c9f2c18c0c8bfe107daa9774697592c160cf517bc4155
MD5 db34bb4d1b83ee46b5227b74d2d01155
SHA1 85f4dd0dc05711a4c2209aeac6e7d907d5ca3bc8
SHA512 6fa1537f11b472a44dd2ea9473b7b987dd4bc5330cc63f33e0588db5c481ccddd084bf6f8a3469cf3dbc3f9f77aaa20b68d1f13086b085b1dfc0f9e78dddfd9a
SSDEEP 12288:+T5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:+T5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T17DC423C457A121ABE30E0AF3E2F686D4CA0CA5EFD408623B5E769147DB35D8F4672429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 c035922a37855450e1fd2463f4cbed9f780267539b6ff068051d3c707c24650a
MD5 7fa5c879fda0056da8b1ca7fdac508ac
SHA1 1829633086e6a458cd3f9e225fe40ade94d5603a
SHA512 68ba2b540dc677f5b41fabc82e0cfa4a7df6a0db3f5d8ed6788f270a70b391c35e2df2457da4be11cee0afb246a45033ea58a1740951c0b140114f5fae0782d7
SSDEEP 12288:4V45OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:D5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T150D4238427A511E7E61F86F3D1F682D4D628F8EED624637F4F21054B4F31ACB8A31A25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 db0d1505bc35aaf5885b5c02ae9616997c4ca4469ef0f61b1f0d76068c32ef6b
MD5 5f5623f286049cd493c2944490b96e81
SHA1 ee0963ec906f4d2711be9aa32df5e984c7d60f2b
SHA512 6e65455cb46472488b480913290c5ad9483ff6734d73cfa64f9f32e65e0757a1c8b7ffbbc40cf4a05d0c18042f5364ffbf58a399be86c187140d8e0a9d0e3b02
SSDEEP 12288:tA5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:tA5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T159C423C457A121EBE30E0AF3E1F686D4CA0CA5EFD408623B5E769147DB35D8F4672429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 7969d27bf28a984b31efdb2427f6d0ba6187beb7a7dae0df10ec0953b729342a
MD5 95782868d71a5b4d74bdbfe5daab6c4e
SHA1 495843c2e6307445f055cadcdf6f9ae6dcbd8a73
SHA512 314593f872a7982050d6e556ecfda55c09b93c15c3d0b5ebeec6bc12049568e7d78cb02de4e1c1a78de11a6dd081754e37fca383a06be8618ade373903db378b
SSDEEP 12288:+V5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:+V5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1E8C423C457A121EBE30E0AF3E1F686D4CA0CE6EFD408523B5F729147DB3599B4672429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 0277bf0d1746e9cef4b12931876de8c78bc2d6528abd6bf866bab12d90925ee9
MD5 a639d8c8869216f2977bab1b5c5c6571
SHA1 ebd30f4852cca73fb4112b86ff7f8e6e903cf2f4
SHA512 458cd0f1a4a6742be9ab52c767fd0759cf15b8654c164cf8306ce30904dc9a4de00e473827fc2b393322a46d23164c321140e172ab03c5e33dbadf52eb537c3a
SSDEEP 12288:6x5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:6x5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T145C423C457A121ABE30E06F3E2F686E4CA0CE6EFD408523B5F729147DB3599F4672429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 ce0c4f9c1f6198b4f704073d30675154b2b27b8950553f8a569433501cf4a504
MD5 e2fa7086296f641e98aabfea5dbd20a3
SHA1 c06218faa62bc696a0bead3d2a40e9e374c1dd38
SHA512 761b1480f98be14775b0a6a4e786d3db7988477a024f91203dfcfce74f91b8c2ac02511c0ef7285dce5df218d58d43b6d91b1a70c836c2f8062d7e96e427039a
SSDEEP 24576:FZMSzFVSOp5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:FZMSzfF5SW6H8DS52tdDpbRZy
TLSH
T1E3050294B39018F9EC67823FC9658945D6B2BC5A0760C62F07B436675F333A20D3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 83fb274d1fb3a443101bb6182087308443390e67bc366ebadc96ee91518ced1b
MD5 11bf31cc539425f5d0317b8ef7622492
SHA1 292290d9c72a44be4c8e1f1da6cfa585117fa676
SHA512 39f5519d0c1ac8fa36a099d596712850d835622a1ef31e67c56f21dc9e848b868478ecda1928c906f7e641b54a0ecc3d420138479aa79da7f79f1a40403948df
SSDEEP 12288:Ai5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:Ai5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1C6C423C457A121ABE30E0AF3E2F686D4CA0CE6EFD408623B5E765147DB35D8F4672429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 0bd58441d68a4c712f9525cb0bae9d90e4f5aa8633f8042fe266e5d7cec1b935
MD5 4d252ba260110d16c2fd4703d73707a2
SHA1 37c7eba9c94009461f5f90ca53b645aca19560c4
SHA512 06869ef4ac49960196dfea1070d41a79d5f792f00c6b1d0b96a860acf34497159b60b9a48cd923a30e178f27a023fb60c30ab1a917ffe03e7f7ad49b98733cde
SSDEEP 12288:uG5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:uG5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T17AC423C457A121EBE30E06F3E2F686D4CA0CE6EFD408623B5F769147DB3598B4672429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 52963eb3f930da824265d322ebc217d70511ecad02c6d8bc4f9f29528cfe0383
MD5 450b4f787aeacc174ba4179902cf734c
SHA1 01d2607495f8191563f2ef38aa9184d237d5d279
SHA512 1bab9f41146491a2fa2f6880f7db44217f89e91f6fb55ba8e40f1d93110a2a85d76c9d165e63ddbf4f9e1ab2d819f645696ebc1713e0112c956412d8b30439e9
SSDEEP 12288:7yPz5L8t5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:2zyt5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T1CEF4024773A130FAD12B8275C8A20A41F775B87647248ABF1BA047775F376D19E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 d19d317cc1e9c533f90cf9f62c39381e19423305479840fba33cbd9d7d59d711
MD5 cc7cb50474673cf433b6eec435997707
SHA1 25656dc48abcfb8735c28ceb818828ed70fab9e6
SHA512 75a383ed587371e6c59c769184ee6f630e530d6e6106ef72b910c7f5a46191a232294125c2303a48fe369741bd9095904aa1fb88372c0717fc3151bb894de2a0
SSDEEP 12288:Ti5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:Ti5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T100C423C457A121EBE30E0AF3E2F686D4C90CE6EFD408623B5E769147DB3598B4672429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 f91dbf8746056d556cce2e8d5873f040aa40efdc930faa7ff8029103c9b0f568
MD5 19d20b141ad2325c8a6d09470d68efe2
SHA1 cfeb6de7ab053fd394583da359293ddf118d042e
SHA512 a3f1b84472d22aa50b19f4c6b7cc8bcf9d908acfd700ca3a19b15016d993af45ea49d859a6c7246f0007d7847f85b5e694596470ac93fae120fbb0e1696d03c0
SSDEEP 12288:Ii5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:Ii5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1CEC423C457A121EBE30E0AF3E2F686D4C90CE6EFD408623B5E765147DB3598F4672429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 517a9d360085a7dea45a702e289c690dd059ba7dcb82237507457ad4c329239b
MD5 a607243130d6c6880f6261d90d134373
SHA1 7bcc94c2b81b18ca42f694efd99a3f066fd75a16
SHA512 721053509d86d08c1c940feb443ff0cb1699c9d71dcc327972f0ade61b256360feaf840a35f6c034f5008908492fb1f74719af7b57126884a911fbe16b605d52
SSDEEP 12288:3yPz5L8t5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:6zyt5SSiVw6uAX8DS52tpz9ZRzbPmSZP
TLSH
T164F4024773A130FAD12B8275C8A21A41F775B87647248ABF1BA043775F376D19E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 9b5401f345436dab1f4752709bdbf3010a2592d0bb3c586e785997074d446d9c
MD5 b63577a4466751e7449423f2664146d7
SHA1 91cb08cb53b90763f490e1efb155370463b23334
SHA512 5481c2c31c6e99b13ae6a3aa3ced96a067a55091023589d164140ebec2d19d2c161b58c01bba43d456f11b79539985d3ae101c228e3f5f006f67aff624bbac5d
SSDEEP 24576:gTHaLl3z0zDj5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:gT6LljU5SW6H8DS52tdDpbRZy
TLSH
T1CD050294B39018F9EC6B827FC9658946D2B2BC5A0760C62F07B436675F333910D3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 119cc2ae3b1c5214ff9bbd100534b609d5f3612113f219ea1a6b4bfec67fc60d
MD5 838eb8a56713d1e25875864121fb7239
SHA1 8f0d3444cfcf4121e676b745ec900ee78bc6481e
SHA512 05b1c59ca35c1fd192d0852a11126604eb10750e912f08fef0ff801125692305e5da3aca38e5a72fdf97b999dcdc7cf579f3197df774b59793a1dc66bafb188d
SSDEEP 24576:o37d9CHKy7GZ/5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:y7d9CHKyaF5SW6H8DS52tdDpbRZy
TLSH
T15325CF90F3E410E9F1B79A35C9768511DA767C9A5B30DA8F03A4261A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 34b38d48a8db8bd86eafcb1888040373cb50a4509f27c5b277415e48c965779c
MD5 9ff86419b878ff735fea3309c409cd67
SHA1 2162705130de707d1f6ffdc08fce056dc14e20d2
SHA512 93cdec66a142f9e80b2dd0da724e42efeda31e621d562b6d864e8174036353de35e4bc1caa647d927c39fa7a3b149f220b6bdf937ad664f307c7fd13c3a1f2f6
SSDEEP 12288:Az5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:Az5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T15AC423C457A121EBE30E0AF3E1F686E4CA0CA5EFD408623B5E769147DB35D8F4672429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 b5ad6bc9b81189c2196b277f1db18d151c0ba138c8c96083b1900cc0248a9ce2
MD5 369f70668fec2b4f27fe5d9f614fff5a
SHA1 ea843d431b8080053068674447f9d3b3984d100b
SHA512 d51335191357d61d82657b4e9ec54a386d34e1af89cf0dd3a3f8182766b5f12b93581fe4af4d3ae4de63836b82449bbe28876301d330ecf603e66c3f1a9b94cd
SSDEEP 12288:XN5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:XN5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T14CC423C457A121EBE30E4AF3E1F686D4CA0CEAEFD418523B5F7251478B39D8B4672429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 b18b98227f884425faeb2868bcf4e96430488a6bef31ccbe71d2006256f4a8c2
MD5 838901437aadcd27f9c4228e81c9d065
SHA1 637dad02bd80c6e388a7d2adc7d1a35d4f4b1f20
SHA512 3f77a4a41e70c84bd7f189679f2997e7a2a52497679b1d1670b9254b8a7689d55e2fcd026a626a8c5486e5c11a8e9a179f205d3f83d5718c25679cbefd81b3a9
SSDEEP 12288:785OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:785SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T145C423C457A121ABE30E0AF3E2F686D4C90CE6EFD408523B5E725147DB39D8F4676429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 07982e5f0e99ce4c1c61529b5ac21c0efa0730da98538e9f4ee308966bc46cd1
MD5 2e8acfeae56498577df7df0dd9d7b23b
SHA1 4adf34013d8532cace242167e6ff38376efc00f0
SHA512 cbf78e84cc82601a6b9ea6130fdf2a4489dd17aeb548ec7e818396fd9ea4472bbc8bc761870221f2831797e6a53d35787efc7e2c4a4f1a1f6912dadcf506ed49
SSDEEP 12288:7i5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:7i5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T19AC423C457A121ABE30E0AF3E1F686D4CA0CE6EFD408623B5E765147DB35D8F4672429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 d0378c0fef6d28066f7237cc4d52165ac4ffd70ac28254bfa9ab13295eb8560b
MD5 315e54faef73b3f35ffe9cba724c1d41
SHA1 da6207a3f11f24f9aa4fcf196f81aeb1288e30e7
SHA512 23afe89ea5b91715ae80f9d8c057161483df558c4ea17378ab6d54cba4235b1598729600ae2c1184b1e3aea153c0c28a6e2b821080f81908b24587437e450807
SSDEEP 12288:Wz5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:Wz5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1BEC423C457A121EBE30E0AF3E1F686D4CA0CA5EFD408623B5F76A147DB3598B4672429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 89ec9c3106b4a80c6da4451e40d1c94f0c0ef5ad4516071f5eebdde12fc4626a
MD5 c4edf3c57a0e4af607d1a41f97fd2137
SHA1 958d67fa86bc23ee8156811d615b02ba8f6e286e
SHA512 4ee05501bcc863c2829cc3706481414665c1229f50d6dba800d3f4489bfe77fe5ad5e94a7b4349b07949442f5f4d0f08b93e129a6103890287cbd4d206c4b50b
SSDEEP 12288:jq5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:jq5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T192C423C457A121EBE30E4AF3E1F686D4C90CEAEFD408523B5E725147DB3598B4672429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 35c2ef6a24f8997f243986edc6ef4f3b5c5fda9f59cdb8d6a852777005a50b90
MD5 386a0687b5c90928e59a6617362d651b
SHA1 3fc0dbb84048119b090aa989bb25d0dd479401a6
SHA512 11c808c1fc2659267fa5395496ffe6d0a53c16c7f2ee2483699b4773ec69d16496be8c5219ee027d202e67d6a84008cf3928f565dff7fc5b8b7d7db7a01288cb
SSDEEP 12288:PA5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:PA5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T122C423C457A121EBE30E0AF3E1F686E4CA0CA5EFD408623B5F769147DB3598F4672429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 ba40c4534abdeb322e8a52f30b603682d290dc436b90e3a532572b2b50f8f58b
MD5 6846a20000cff83e6e8aa0395e7895c6
SHA1 b1e85f0e350e283baeeff0ef3436b8d068b8777d
SHA512 e41d82b698f56a881d574160d31cbfcf311af5abe05f218ddf5107da227768c9f07f3569f29a379a617c1097b1cfdc4392fd4f98992f08519275f04b52a8afa1
SSDEEP 12288:ir5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:ir5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1ABC423C457A121EBE30E4AF3E2F686E4C90CEAEFD408523B5F725147DB3598B4672429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 d7331b9466b00d1be44e7053b6909c5c737ab1e0b1267dbcc75a834987afc4a3
MD5 a3b422cb54f0e1efb2151be8ced703dc
SHA1 32ac3130125b0dc9c3fc2045573cd47a0fec4ee4
SHA512 fb9997ffac49fe6128f905c6278f0b069fd2d6936dcd9398bd7db54916c6020cefa7734eb3167857af47f0c755200b99b4ba2fcc7917a6f20dac7a124b3c159a
SSDEEP 12288:WA5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:WA5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T197C423C457A121EBE30E0AF3E1F686E4CA0CA5EFD408623B5F769147DB3598F4672429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 c95d538fcde170eced4217b0fc7c7ae551fb84ef58adc4ce7dc7fbe76d092349
MD5 f15b81473f0053b7b6581e3b5fff7f50
SHA1 b94e8dc1caba4487236f66f961dcf89f1b914e91
SHA512 72d301ae65308a1ff93ce1ac46409dab3e86c4cdd8aa565541c3687e17fe85afd2742019be080e6890823258c999498349747613a62f22707b513e5deb2a2611
SSDEEP 24576:Ffwvok9RX6wkyAI25SSiVw6uAX8DS52tpz9ZRzbPmSZyo:DMnYI25SW6H8DS52tdDpbRZy
TLSH
T13C35D029EBD804E6E177923C99F7460AF6B178691B31C2CF025A536E0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 0760b4c159d26fd19c774fafaa31bfe209490dc8ce2705869d9606617eee972c
MD5 ad26e63238f34bae57ae7d4a6ad96e02
SHA1 f433f69cc40a57c9de08d462d0fcf2f9a68775cb
SHA512 c513514798a57c9ffb6eeaac184272647ffec67755393241eeb98426a7008de54872ea78a9a820c413d961df3e6f45e108db31ae690c105ca64a6a648af58575
SSDEEP 49152:/YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0H5SW6H8DS52tK:7ySzP/5SSDntdDpbRZy
TLSH
T1FE066C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8b7a76f679c07a01e6b16cbbab628be08ca2c22fa735eaf4aeddc9085bf56847
MD5 44b4d3c9fef4393fe96466b49a206115
SHA1 a9d8d448ea07ed53650aaefbe7176002ed9151ba
SHA512 e1a6851fa68c9769ca18b1e34c53b00a1adb3327f8d426d3ba8f4a54a6630abf98f78bd9812a067026189c298bdde25c18535afa3482e2e3db6f0e0a8f641b7c
SSDEEP 24576:347Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYZ5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:347JUQj1irIhCnDHUPfF/35SW6H8DS5X
TLSH
T1DB65AE1DA3EC01E6E1BA927885554A5AEA71742E1F31CACF1270837D6F23ED44F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 473a260dd636d9495e5f2d96c1b5563bfb7361dd886723b1e9cc14abc7283130
MD5 1fe07814c5c08249b04a190d1a2bb99a
SHA1 e16c423f149d888c929a79c84ee539e0efd3539f
SHA512 a52394b2e666ca242d90a6d5e62b9fb29a80e45e7452d006ef4729ca04e6bded5a82a431f3439e55ee771567d6dddd895bc85206f73e00631b553ffb5e9c49e8
SSDEEP 12288:JNsfy5OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:Oy5SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T165E4F149D39412EAD02E5276C7A64680F3277C6983E0D3DB5AD0F53E0F366858DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 18e2213e732c83af6a179064b8079f2215f698f623d21afb1841943d302c7218
MD5 1906ecfbffe713f5a21228a1a4a4b8e0
SHA1 168b279db4ff18c095b51e1f99e1e29ea6b3bec5
SHA512 34f77fd99dfd967a56155acc9ccfed253e786c821e57d62d11ff2b55e202a3caf2fb8fa9c545f28191e6d7eff5cd75aed13841b5a4537eb19612a7b49f1b6705
SSDEEP 12288:rXsk+CU3ftHlqx8EFr4aR1kVToI/MkB80:rXr5UPXsjFr4aR+NoIJ6
TLSH
T1E4352840766BD75FC6A940321E72C1CCAB707D41FE05AB0772C8872FD576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 b32db23a255bb4b82579d380180d5f403e6d6b5342c752da4536d0030b3c83c6
MD5 54d0313f3424c32977dda1b21e7fd2e0
SHA1 593b2b58eb2f1ffda3b3ef275ddf66b57b974918
SHA512 56a4074c7beb2df1b09a24f3e404b9acfd6392f66b3bc871ef8d1248a33fb966a83208549b20f2567fe54d8c134eb63cdcb5de05077fcc3ee65ccdad4cea6c97
SSDEEP 24576:cf/zIreou+YkdGeIquCAprHdSmUo2f3eRenXs92TXpnJCTVBzgm7JL:cn8qou+Y6/IquCAprHdSmUoCuQnXs+5e
TLSH
T1F655E9819437A38FD5F76032072A5B4CAB64EC4373496F266388453ED82AB65B1F93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 c980b35087f1a0fb231596d36c15b506340428a3702c3066b071078e89a9f662
MD5 db16da16cb08b8f859a9bf4f8cfc637f
SHA1 f8b25856869f0d8b1c066f56578ad2a05cb4eb17
SHA512 c08c6e0bd291cfe919ed495c17a188ad91d6c106be286de3018de0f5e46c38fe0fa966a5286d337d7561b69ba9115d7d57ea091bd48403d599441d4cf2a7176f
SSDEEP 12288:GF765OjSX3CVlqNYuAX8DeBJT18Xzo3GpzO+xZRzbfnXAFSZHSow6:S65SSiVw6uAX8DS52tpz9ZRzbPmSZyo
TLSH
T1A2D4238043D52597F22E06F3A1FA82B4D60CF5FE8B0491FBAD2152879735DCB8E7251A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 30e850a2e46673b9804a7687caab5fa7ec2e5f5db4471c1395ec138155f11047
MD5 5a0d86b5188e0d6351f9bc7fcf1f26bc
SHA1 db864e3fa54f75d35bb220c1dac3fa1e25e04b5a
SHA512 7b3bb2f6c0b7935c5302a1406f7fe2d80661e40820933862e34c0c1e0f6d14a4f33bf22ec33b53b1685e968d4f1aa8dd5a1ba893e8e1509ed1ea5e303c8492e0
SSDEEP 24576:Cgb6bmBIi49WNNFpg1rSvFv7bYU5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:Cgb4mBIBhGFZ5SW6H8DS52tdDpbRZy
TLSH
T14465AF1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 85b11bbfec7c5f932d53e77cf441f17f870fd77cc3099b5507e76e2452023b1e
MD5 f1c60739738c0e4d746bba53cdb8e4ea
SHA1 e857c83acaf026352d7e9a05e805f1cfcf92b944
SHA512 2e33e62ed168f8c5f512a40bf032b658653856d60fa3643574748ff24f8d6b1aaa19b7e690331dc2da51ed00e1124fe69202d61370840c5e66298f56e2314aad
SSDEEP 24576:yG88u8FpJqH1bzria7/mp5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:p7ZFPqVea7/c5SW6H8DS52tdDpbRZy
TLSH
T1DA35016577E101F1D47BD138899246A3F6B1B4250324EBEF0BA88B521F23AD54B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 8ab28f54481b20577a694c09af65c5e43cc9235bf1e969c25c7dc012244dd44b
MD5 899a9e36a2c6050c286e527ee7af5883
SHA1 f3bb754779b6fe86642219802c4957d3bd03f234
SHA512 388fc7639cc08e905169ad248c90d1bed025493353cc45745a0091f35acc4295cf0cefb11e0ed55027b0e6c59a38ab83ca7aeb73b6bf6907d592540adc489fb7
SSDEEP 24576:RPUr+NQF5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:RJQF5SW6H8DS52tdDpbRZy
TLSH
T16C05F15E23E818E6E67AA17D85828719E771B4660311D2DF06E0817F4F37ED8AD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 623a3d2401e884346b0b72373ef440c992420867040a0996b011bb48ee3e684c
MD5 6107b2a38c702489a3a9c3a323b780f7
SHA1 63e2f08aa88b3e0a884db23d3091df11c06753db
SHA512 2862fe748f5d252ce0ca6499dfce6fd15d0d2f01db7e7e936cdf3ba3487097b23cb0dc4b2bbe25128bc86eec61a3fdd6013d34396178d64fe7c50587b1e363cc
SSDEEP 49152:TBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjV5SW6H8DS52tdDpbK:8G05lO43be5SSDntdDpbRZy
TLSH
T14FD5CF6A62EC11F9D1BBD17CDAC64A0BEBB23425033456CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 743fce18c0d055b440bbeb6855b9d37208c4a798714c53723b622efdc110c199
MD5 a0f91aabf759e0eceb5fd3787fedba2c
SHA1 8688d7e2b6f14529cde6e273e4e712ce228a7c30
SHA512 66230632e72fdb0c40e656b06ab5b0a4ff116f4e2db6960472661bff719b867e7d0624b615c97f4abbfe195bed36633c59a3c813dcc4452d92ec4f9cb259ff1d
SSDEEP 24576:xfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnH5SSiVw6uAX8DS52tpz9ZRzbPmS1:Ra5POZ3+Jt2pasx2+mN5SW6H8DS52td
TLSH
T12E65BF5EA7F801D5E179D17DC583861AE5B1342653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 d60a6c29b9e78066371d70c91fc85294036575f3209f664f772121404ab6b4cb
MD5 ca20f613e7d4f2d0b35db5b82200ae6a
SHA1 1c847138b1a76eea25f17510e05620c11d57000d
SHA512 29c1e24afb4ac473f9aa77506cce935943a0e82f9b5f25508ad0923c2e26d1f605b59c7ef817e9d6af097d24fb07e8139d4341dcf489b93def85e193680f100b
SSDEEP 24576:dNcwHdjbyQ4nLC18lb/EOjowL7FkB5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:dNc/zEOVHF85SW6H8DS52tdDpbRZy
TLSH
T1BA857B5623E901E4F1BBE1BE89779546FA71786953308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 289a4f7e6b0b8c4c8f078837e78933dc13ef092fa5fd2d852e210947fcef07a6
MD5 3fcc74bc5028d54b799e41f4a367eb6f
SHA1 88e1d7c5769f738205d66d1bc0fecc29d1d795b3
SHA512 d8243d95254073b1687545ba73f1f51bd3d42303048a3c26ff970043e1425838060499f7dff9d99a37da404dc08b10cc0b34864f8a2387c621bc7a199d124ab2
SSDEEP 24576:S8kNvNnaFeYhJNtmZBmr5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:S8MwBtOmr5SW6H8DS52tdDpbRZy
TLSH
T1D355AF6EB6B806E4D1FEC6B5CD238512E6727461073293CB5290C13F4E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 5d770f4047ad3f23b4cac47a3609d60ee92c27d5d01c413de6c2e37e6aa6954c
MD5 0e6eeee1b85e2620a5d6f779e0c86025
SHA1 6e69b545aff001087d3a4694415895c656535561
SHA512 1bc2ac62f80294ddec5c957dd34ae88420f27db223f6ba17a40e138c07fedf8bb330ebd71bfeef2e514ecb07c8ec66b255dbcc711ddb28c53294403f4577edfe
SSDEEP 24576:tD3FHshBIYQgAO5SSiVw6uAX8DS52tpz9ZRzbPmSZyo:tDVHeBIAAO5SW6H8DS52tdDpbRZy
TLSH
T1FB25E17DE79800E5E57BC1BCD6A38A06E77138AD032166DB06D081B65F2BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1140-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1140-370-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1140-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1140-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1380-122-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1380-369-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1380-116-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1380-114-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/1476-134-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/1476-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1476-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1476-139-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3584-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3584-108-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/3584-102-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/3584-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3584-365-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3584-367-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/4064-61-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4064-293-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4064-54-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4064-55-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4320-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4320-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4320-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4320-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4320-52-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4320-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5096-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5096-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5096-15-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5096-21-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5228-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5228-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5228-113-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5228-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5228-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5244-308-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5244-73-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5244-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5556-78-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5556-79-0x00000000006C0000-0x0000000000727000-memory.dmp

Download

memory/5556-84-0x00000000006C0000-0x0000000000727000-memory.dmp

Download

memory/5556-309-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/5724-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5724-89-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5724-382-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5724-384-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5724-95-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5724-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6108-381-0x00000204C3790000-0x00000204C396B000-memory.dmp

Download

memory/6112-1-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/6112-0-0x0000000140000000-0x00000001400D1000-memory.dmp

Download

memory/6112-311-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/6112-77-0x0000000140000000-0x00000001400D1000-memory.dmp

Download

memory/6112-314-0x0000000140000000-0x00000001400D1000-memory.dmp

Download

memory/6112-7-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/6112-8-0x0000000000760000-0x00000000007C0000-memory.dmp

Download