0c663eacd6a4b825fd92f6005a3f440655b2b65c8967392e0f077a52759ecb9e

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 13:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
Size 1.4MB
Sample260721-qagmcswerf
SHA256 0c663eacd6a4b825fd92f6005a3f440655b2b65c8967392e0f077a52759ecb9e
MD5 eb65da58f84233ad90b980ff3415157b
SHA1 9c73f0f6715970133a639954e71e611703b4b4ab
SHA512 30d690ce45f25a0124404d0c4e62e703be9c1f177797a9f54eb5d6847a579bdc4c6540e5566ce1d31672ff9e524f24c6afeb462e48cbe92394505e89f135925e
SSDEEP 12288:kAmZXuYFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kAhYFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11965E06A7A4480F5D4614D308651F66DA326BC29D8134F8B32917EDFFFF29D08E29A31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3296	elevation_service.exe
4992	elevation_service.exe
4552	maintenanceservice.exe
4436	OSE.EXE
4300	PerceptionSimulationService.exe
4416	perfhost.exe
1284	ReFsDedupSvc.exe
5524	SensorDataService.exe
2860	ssh-agent.exe
1584	AgentService.exe
3488	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\709e486b5387db0e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e39998a61119dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e0a0f45e1119dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bd75975f1119dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000ca1895e1119dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c2d8cba61119dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000034f2f95e1119dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3296	elevation_service.exe
3296	elevation_service.exe
3296	elevation_service.exe
3296	elevation_service.exe
3296	elevation_service.exe
3296	elevation_service.exe
3296	elevation_service.exe
4992	elevation_service.exe
4992	elevation_service.exe
4992	elevation_service.exe
4992	elevation_service.exe
4992	elevation_service.exe
4992	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3448	2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
Token: SeBackupPrivilege	1284	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1284	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1284	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1284	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1284	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1284	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1284	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1284	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1284	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1284	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1584	AgentService.exe
Token: 33	3488	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3488	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3488	SearchIndexer.exe
Token: SeDebugPrivilege	3296	elevation_service.exe
Token: SeDebugPrivilege	4992	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 2784	3488	SearchIndexer.exe	100
PID 3488 wrote to memory of 1840	3488	SearchIndexer.exe	101
PID 3488 wrote to memory of 1660	3488	SearchIndexer.exe	102
PID 3488 wrote to memory of 4052	3488	SearchIndexer.exe	103
PID 3488 wrote to memory of 2620	3488	SearchIndexer.exe	105
PID 3488 wrote to memory of 1892	3488	SearchIndexer.exe	106
PID 3488 wrote to memory of 1776	3488	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_eb65da58f84233ad90b980ff3415157b_icedid.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3448

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3296

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4992

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4552

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4436

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4300

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4416

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1284

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5524

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2860

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1584

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2784
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1840
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2840 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1660
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2924 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4052
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2620
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2924 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1892
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2844 2840 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 fe2f1d99505ba581ace8936cd4b1ad2fae780923e479a424bbb8b2a2fd5379da
MD5 7401210b9382c1e973366b44b9691800
SHA1 068dacbb2944d2383920b6c4fe6fefbf59a5529f
SHA512 6e1a397e1b331c721e0514909e3a4d032308d19304363338f0b94a7ade89ee549e8ac8382b57f8090772485d0bb1f898cd6b486834c09a265c7a10250ee5b309
SSDEEP 49152:5b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnqDmg27RnWGj:P3q6sjBFD527BWG
TLSH
T1E4D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 e1b901a84950a941432d5cf23e11b9938b7d0a71474576ede25052b54a07c76f
MD5 282921bce129ee5848e26455a7f01172
SHA1 d5c878c6f3527438b1ad8d0378cafd182325518f
SHA512 ba8cd0b5243685b544cd43d702b53e0282687b17c07c9b633570c4657094425c11d0363cbc6d74aa9d462a1e04f5b72f18785fa26d432247ea136739da48ca8e
SSDEEP 24576:iXYfDtczAdsqjnhMgeiCl7G0nehbGZpbD:ptccDmg27RnWGj
TLSH
T1C8650129A3D408F9EC67817CC9A2C515EA337C564760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 4ddb15bc2524efed0342a9b436966c3d7641d115abfd60011b6a00cbd073863b
MD5 f4fda741f4812a88f82fc44139827d21
SHA1 7f4fffe319fa61cc91ab7993b461e876a95017a9
SHA512 d83be2233daacbc212abf7279deafce5896a1a323d047c8f9dbac405c7617f584cee33b4f2cba3fc7150a28c635f49815a7d65e1fa401c7147aa3766d74025cc
SSDEEP 24576:v0Le5ji0hmxxrMOsqjnhMgeiCl7G0nehbGZpbD:vPji0Aj/Dmg27RnWGj
TLSH
T1E0859E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 250244205aca6a9a1b98b48ac7e8340f8fc35afc805e6c67b59f4eaa9e5d1949
MD5 b75aeaf6eb291a849f4bfd9b9e4a48f6
SHA1 b9ab1349c8a41db1b4e06bee23d1eb080b349c4a
SHA512 6fe49e2f95d41d87806873eafe594d8d358c2d06c60ae694be4b32d94229940505f28eda05c715dcfdb84e52dc7fe63c4ea9f685eb5dc84da40b92b6e2c68a63
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWn6q8wyuQsqjnhMgeiCl7G0nehbGZpbD:W/ezSC6vUzPveHjybDmg27RnWGj
TLSH
T150755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e8ea5c1037321cbb468cae607e80420262628eabceb594b18def17cd0642e286
MD5 a2935dfe9406eb08427899caa8b2b7c4
SHA1 7bd8ead18d43a3877c8bc39109544260cb5454ec
SHA512 dd14974fc66933f0017b112343665ba2aa41157c8ac724bd1b5b97167ba96c16ec9b5dd81fa4427591b1c7d095ab40d51e8f605bb791ec07064ff59046c44884
SSDEEP 24576:wVbqPb88hv/l+YhsqjnhMgeiCl7G0nehbGZpbD:wVO88hXl+0Dmg27RnWGj
TLSH
T176559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 51df9eafb0b197c43c401dbd8615d6fa73a95cb69f4bb3cbb9be54622c3cf7b2
MD5 3c7c2721c3b1bee895f413902f238b8b
SHA1 718e141fb5e9534a5d9eac44c62d26e4d2de1866
SHA512 0bfc4baf1b5e44d4215bcf6c3c090c70cd5d66a9940e10a4beb8ffefa475e001d71c2bca3b22c88a9c27456fac9316a410a0442bbd827d99ded7da0178b5f1b0
SSDEEP 12288:aLSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aLSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A14523BE824C11CAEA7708B5C3E9F51DAC173E56982008536AA37DFDE6F5464CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 e8e73fefd83d99c19304c2921172d38de68b9ec9796b9dc83a8fb9932f2b40a7
MD5 16684a62b29d9a1ce465d2883867df88
SHA1 9d3c52894779e1a97237e5ad67660780417301da
SHA512 f4e98b5aa420f9aafba32c86ec1c4949d75dda4623b6ddcf60c66b2f3a4a64385a96dbb434be8b06e7e4e1c92fafe56c1f899f39a7bbf50d7f2ecc6535123b1a
SSDEEP 12288:yeBNUbTVO86UpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:yJIUpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16665CF7BEE28FCD2C27A8DB95791C600E77278314B21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b750d00374ca19fe0499a0542bd335cfcd4261d936bea5a5117741dc55663663
MD5 1deb94279434a12d1c40396ab4b9b96f
SHA1 cf4a16643307f30277563fda2d0e665894c2c1ba
SHA512 4f2ee8e587ca2695307b3d729f5071c9821d6bb8f1f2a36d04cddd1e5598f06765100d7d3416ec5fec0079ee2780462720ffe780fe476d1fc69799d79a062b3b
SSDEEP 49152:BQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THI:BQvGAdlCEL8c/DRNw5C8D527BWG
TLSH
T159266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 3ce7307853067d0cf0bc2eb914c9a49a25151e44efc44e01988739c899d414a4
MD5 d5579e6a06f0dbf069f8de28723afae6
SHA1 d1f2a621ff67552a762b8b63cdc074e9796144c4
SHA512 1f023f7ec8d2602f70f7e3e719f323fa28b559f383eff79f02df5fd7db9f9aa6741e2cbfb0dc5250f32edc41cea8046543ad0744805b55b04d3d0f1c89cc9b9a
SSDEEP 12288:pAwSfxL/2Dc3RDLLmt0LDQewsAj7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:a0ewsAj7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F375E031FA74E036C77B0DB20B76D71A182D7A204F6119C3E3E89E9E99702D12776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3bef3847a279479bacd16b4ff0932034da6973505fde8749fef2f1b385d5ca1a
MD5 2f2a0ac33040e0a7829c9892464ee54e
SHA1 c350f91e0b5bab7952c6b26ffbe8151b82988add
SHA512 36be4549cc62491a7762721a6249b9c6ae5918131454d40b98e1ec8f5604cb733d105d5566ae8609d403e2884ed08fa3a08b9e5768468c9402ebc58f73f9db5e
SSDEEP 196608:uUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHXVQBWG:uUEtQevvqc2W1cpV2tI32uB
TLSH
T1F2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 fa677eb526f855aaab788c74c1d65a11c943349c9bea2a370f794e8e2bb3e6d0
MD5 152e15e4589fdc9415841996adfe5e85
SHA1 a58887d997aa6f38d41e949424cb7026d7fcc3be
SHA512 50a770016b58141fbd0067a3c3be552bdd9695834e4cdd5dc223134bbfed14747cac5bb622b47d40b7b04150a6ea61837cd0188f231189fe669636c557dbfbef
SSDEEP 49152:SCbRquA/m2yL5zTfFiV+XenmE3/zPDmg27RnWGj:3oquVjnmYD527BWG
TLSH
T143D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ba4e324c01fcec6d6a24b79d3a016dad8e07df040bb8a1435c972b7527e4f4ee
MD5 579de36fe9bece994efc296e5e9aef24
SHA1 124bbf23ca99db6ff6f07e3f75c1a63924f3d228
SHA512 42de4c7abd716bc85b9408382ee3dcd9572ff0d85664c5c9e771e10c91baf6192dc01ac530fa4e96e7bb9be9a2a392e83424921fdfa8f677ea0ed96883c5bda6
SSDEEP 24576:9AhGL3IFoiwtA5l7S53MsqjnhMgeiCl7G0nehbGZpbD:9AMUFoiq5IDmg27RnWGj
TLSH
T11E359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 2d6d8a1e94002a1c8b9d4dcccaacf79e8b16b2ad2d6fb40b598e8d35d4215884
MD5 6deef5fbe599ed996c4399b503a7d2cb
SHA1 5ba23602f41b92125d7dcb6de9098d3df5f588bb
SHA512 1f65f299e2a0aec007c699c5a5a3d4672e1e5857d7e7fbe98ff013cdf10c8a5f298d113816030ea2a9a1fcac802c88ba3b1c1782944c7a05247ccdd8147482c1
SSDEEP 12288:Fmw5HEjsChNVBFgl0WDm+CwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:gwu4OWnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BF65F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 bc374fa6d05bac0c76b38927599647952a4ae9a9f6fbe88f22cd88c13d7d3658
MD5 c180c8f0b310206d877b6afaaf5b8944
SHA1 18af752ce14b13d2a226e4911754ce2adfd39f29
SHA512 29f8e96a6e3fd0334dc23c74114d787763fc672de16f7893a504d6b1086c4a7c14373ec82e24d3b7f41251101ffba7b041ca6bc78dd258562150b289d69dae3e
SSDEEP 12288:TeZ1IyrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CZuWsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1735512AE239820FAE563417CC6E5D609E7333C63673003CF166656AA6F739D44E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6862bf46e7580235eb6fa432bf6f3ec72a538128a04d5c008ca70fb1273be5f6
MD5 f65a6d45ccd7d65ee93eb8906b999106
SHA1 157c0daad0d60c7107deed884b8a37a4ff0fed9a
SHA512 6783d57b36f134cd7b57cecc7c0bc05f68789ebf6a8ca66af157a8f20e56e002324553215d2c4a0c3a31abc5f2a03c8ce76cc261e757576bc65833b8eb884314
SSDEEP 98304:HQRQyi36YOcPbLvw2gAf+PN3ZD527BWG:WQyiKa/X+PNpVQBWG
TLSH
T169667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 449d85d48e119dcd4c617c2f5e751b9ac0d86b50e64dff57d0ff9345ad5d8018
MD5 daf0b8b4b9324228fd0fa8e9fa26bf71
SHA1 5b10fd2a382381760a244d6d920cf4b5b6a65ef6
SHA512 ff62cfb5691d84c83ac65d78be5948820d2445faa718a5fc9f6031f81225d73b112327467c8428a0dc6a83af43b573829b37e6c21f70c1dcc36611bb970a97c4
SSDEEP 98304:BQRQyi36YOcPbLvw2gAf+PN3ZD527BWG:YQyiKa/X+PNpVQBWG
TLSH
T12B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 821c9b7e0174f813a26745bd9891026b15c7fdfcd5dd5e7a17cefef003328cd9
MD5 51fbab2d4c050b95613c5ce1c8453eec
SHA1 bba73231f85871bf31fd7d480bf2b09e22f25026
SHA512 3eb5e12684e94d7421dc729e883eb898937a2808ab460d4e5743a6296459666bf62f895fc9232e6c6807ccfcced4bae015571a5c73176c49ecffc501bd06916e
SSDEEP 24576:8wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0msqjnhMgeiCl7Ge:C68Qg55nhceWu7PNU3//Dmg27RnWGj
TLSH
T17DB55933B2F60099C44DE1769F4A973196D27C718FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ab6a7e58099137f5aeb3129a94bebd2e4751d0f14183b448145c8cf99c3eeb93
MD5 058e8ef1bff4196826100aa547e896fd
SHA1 a5642df2a37029a4af2270f032f8c3434f4f3807
SHA512 c0fce1c8e6c43affaa53912e72986ebbe9ad0cc6f9e3660c4c716216160ddeb148ba8dfb7b21ac7212c621794a9059bebd7a5c98c88a51e57e27b7e33eeb2db2
SSDEEP 98304:gy5112gYy5azzVvt69nLKnhZWD527BWG:5LIHEWhgVQBWG
TLSH
T1BA167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 993184fe7b49f93839e5a83ecb994d99528ed7c7cedf54dd346b2d5b07c5dcaf
MD5 7c56da13525a8141abdd3058226bf05f
SHA1 f2d46327de9c225148f897ebfffa047eb45ff127
SHA512 f5f947d001e0db3d2dcb059db4a8b2fe815d1a70cab054352c6c58c59e4216b207013290fe5c49800dcc01ab1e1c2bf03e5cef4c5fb2644d8f0bc08e740c164f
SSDEEP 49152:gB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glRDmg27RnWGj:6u6Jmdxd2dRD527BWG
TLSH
T1C2D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 af64c5810dcd311ace793a0dce50300a07babe68840ab6a3929af014b614f8e2
MD5 d83803cf046b24e6d71129e8f4ab9c8c
SHA1 55e15b1f5abd625850edf8e4b0542bc80f8602dd
SHA512 d85b6e0ecf289fea63c5ac2062ee4bbde438bd7cea0b069054de452b04a4a3f9da003889ee5e95cd736b456429352e0117bbb2fd473f5234c0183b9aa90b5fb0
SSDEEP 49152:R1hpsNoJpF1A63U44CwH7R4xNDmg27RnWGj:RmifPWRYD527BWG
TLSH
T136B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 cb79ee163cbd29202966a71c4c1bf8d89dd10cdf9c517d07845038800406255e
MD5 9fca118aab6f96c2dea06957bd11d4fa
SHA1 41ac506d3ab72643997eb2325fd5e8c8db543a8c
SHA512 f67eeea7e42f09cc286c25f2c4d83b1f79102975c8162e90bdef6cf25d9aa6b869ba58818f129fbf6cfab0f0b28c2b5f22cb426452f263fb3b6af68286249251
SSDEEP 49152:aSuZQIY0Be2KcRVtOnks6NMHqaDmg27RnWGj:E5dKii61aD527BWG
TLSH
T1B2C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 54e059ff2ff67303a0dc6bec2845feb7e4284c1d12a9f51fc5fe0346faf03117
MD5 0f2a1b4d8c1c38393b7ff938fd278e14
SHA1 d93dbc7e2a3bc0f11ff71314e52c716fa0bcfbd1
SHA512 540f0703e5916c7e9e303144225e3cbf5aae0707408a6422370e64f153d20f3e2d3940e6fe088b94b01a561ca8b436b4c5c0b99ebb22605d499a8d4d462bca69
SSDEEP 49152:ShtSn8EApI0fig3giDn0AP5wBDmg27RnWGj:TX2imphkD527BWG
TLSH
T19B95BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 fde7fb1711b55f2cf433c4a2e3e0ac9856b4bff52a910ea378f920476106ce6b
MD5 cfedea50bbce20051b8c0e821993829c
SHA1 fe00a13c08f89ba39fcd03e908dc913f763f8737
SHA512 bcc75ec8128eee78d878c0ff1d62f568a85914c5ac4f377b2a8d3aa6deb8b6e81b46384cbb87d1051a1ab87ef9c141f98ad5cb45b333932370b8185e21afbc47
SSDEEP 12288:K6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:K6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C84523BE915C01CBE92248B5C3E5F15DAC173E57E92004837B5778BAF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 fb315592f9c1a4d0ada6fafc483b8aefb5315eade9724b69bcaa0352bac60d15
MD5 d4af996694e25e683b09fa5d2cdfdbd4
SHA1 1f6d31998c5d6b1cacea972616ac450a30249e71
SHA512 0c50d3c45db72c7dc6f113c751812263ae83b82d6663e08a4db7d0264416c67483b3e829c8ff651ca72e42f08a9c5eb1993733618ffc45e3ce59d0ead8ab7cc3
SSDEEP 12288:V/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:V/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T19E4523BE915C01CBE92644B5C3E5F15DAC173E67E92004837A97B8BAF7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 85f38aea069d3625a75179c3ad98c7e9c60574917199bb379a1b7a1430e898e6
MD5 843f5b32f664ad9f1d5e99bf380cb592
SHA1 82506103a72ccf956abdb4a95c575a78a90704c6
SHA512 2347dbe182a914588a29361a6a0d0e5fe835aed7f6894d27536e455404b63cd3b16077ff7c9a9585d437825525b0b2a20afd085ebfee383bca18612fed0d7781
SSDEEP 12288:wxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D14523BE915C01CBE92248B5C3E5F15DAC173E57E9200483BA9778B9F7F28684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 29c74dbab4de6a4ac540e11d8d91f43d0862e5b03721bc8567f0408bee1445a2
MD5 bb75b52713cf96e08d2aa919fe5ee0c2
SHA1 ef1d6a2b8471eafd2b559785fc59d83275bf05b7
SHA512 264b3766ccfa5a0d925fa2abb45d34d2052363cf293c7c5c3ce380891bf1202dbdab7f651ad5c2efdbf516eb8cb2aff92fbdddbff43cfedfa2b4e30b109859f3
SSDEEP 12288:xVsXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11445236E535C01C6E87285B4C2E5E11DE8237D57E73005DB6B532CAE9FF26948F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 885e79f0006792f71b5ea9b9503fef32fcb187945c8f7f2711deeec7cc1086d7
MD5 cfcd4a1f3c0550d9a72976f36f6330e4
SHA1 2d1dc542701834c7b262af016069888d7ac1fed8
SHA512 3845db26760fddcb382af60aa0bd82491189568d109a3cf4aa716751d6eb8cfc70912d3b19bd383058eaefde7825c44daf3ade13a09a84d893b9bcf885fcd857
SSDEEP 12288:2kXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2ksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D04523BE915C01CBE92648B5C3E5F15DAC173E57F9200483BA9B78B9F7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 5950346125a0235763fbfb1dabdf7f0f638d620e70e91d1f23c264821aa40427
MD5 399e6e66625c399146f2f55df412dfd9
SHA1 75ae9d7bbe0b1f2712cecfef694c9e9bbe01f381
SHA512 7c4b6057fed4d765dc2c5c3c0717f59a8010f441bacf3d94203dc86bdd5ed34cbfcaa1d1c68f5e8e1907b61a6d51ef8072b62ddff5a6fe2bc3f64d07889e707d
SSDEEP 12288:7DXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7DsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11F4523BE915C01CBE92644B5C3E5F15DAC173E67E92004837A97B8BAF7F24684B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 8b37a21c4b1ce412e48a1a84c04824a5142799a61d7a7428cd3dba8bfb157b20
MD5 63a008c130b4f395300691c6c079f125
SHA1 062e1283f2d9c5a496781387542a5a9576903925
SHA512 2dae65a4aa7dd6b6c78a1fc0dc964ece11dd368101b0aded05cc8a2922d1bceef4b61182eed992af92e497a2b231650aa692a38f7c60bf8c4da558c1032cb347
SSDEEP 12288:Y3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Y3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T13C4523BE914C01CBE92644B5C3E5F15DAC173E67E9200483BA57B8BAF7F24684B39423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 451219f94fb6ff194410e146146908715e9deeb7114fbc5f9eecb27c054e64f3
MD5 d99e3963e9fd9c28cb56c737bc6ca0e0
SHA1 745172dcbe9d733ae3120d2e12db2254d56d9f13
SHA512 430f346cfba0ba010f0715923ad8dde15891056089be6163ae8930df08de6844c740fadce1fa7da48b8b6318ac90246a3e2cc10753f792b0ba63d35ee03e5e07
SSDEEP 24576:1ZMRzFVSOfsqjnhMgeiCl7G0nehbGZpbD:1ZMRzf3Dmg27RnWGj
TLSH
T1466501A9B35418F8EC63813EC965D90AD5B37C1A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 76cc2cf63de14c0b33c2ab1d209849e1e11b66eff3eb01d64b6b5195cd6ce01c
MD5 8564a4077f765b42718111917a5f2221
SHA1 0ee147f0db6b7945b063fc8f15937fc15b4882dc
SHA512 b70de1e7e5e6ab6e702dd54206c627cb0094a2c3d997d03289ec96613c97e5a1fd33fbb889f4b3a59c899c0a4a07afdd4492809f27081df2cfdfd4739779964f
SSDEEP 12288:cGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:cGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A24523BE915C01CAE92604B5C3E5F15DAC173E57F9200483BA9B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 541cca0d57526456cad89f74bd820818d7e1c10d39fcecb11bd70baf8ed9393c
MD5 2540c0ddc655b6b8cda94e2fcdf55e13
SHA1 d7bd21ea14a4e7f71f9e827f55d08f67d74a01f1
SHA512 6ac21b3f3b5d0df1aca7b6f90a47f45aa1a0352484894d528c9a6bbaa894131503f7a1fa51b2278b1aa5d111765d2d24f4821b65a256843ad3f22dea1fd115e7
SSDEEP 12288:7CXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7CsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1734523BE915C01CAE92244B5C3E5F15DAC173E57F9200483BA5BB8BAF7F24684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 595206ea7ddc73c8028b87c251d8b792f48dd04bb1a78b13a157227d210bae8e
MD5 441755b572187ef6a145d5e4a7284714
SHA1 16c37f97a82d27dc5b7f430fca05a4e852750036
SHA512 30903fa67742921c5a22082335d2479fc29badae326f2cdfdd958f68695f57728c81ff7fdce9155f9e3f369b2cf158fd03a0cee4e47faf60adc6470942866c86
SSDEEP 12288:yyPz5L8rXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vzyrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F155025B73A530F9D1378138C5A29A06F7337C3257204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 53489ffc2d37c27ef5f25a29be87b0971faebc4f789a3f380b8ecc0ba4a4c2ea
MD5 2ee47ba0887d8da9c5fc46c50c443201
SHA1 0e53b17b6198f7a4172351efd70b02a5ae9ea780
SHA512 694c7ac877fcf98188286df945530005c3b1a112130c13e1bab343049d3e1a90722c6f1a505b62251a5196a4adb3f48bc225f0f849f8d5159b6743fad8dd1ba7
SSDEEP 12288:QGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10E4523BE915C01CAE92604B5C3E5F15DAC173E57F9200483BA9B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 aff310fd7243f2bbb48983158b2ae1ac8233defc61020837ecb3914dcb552b8b
MD5 2597d53f07d1b943cf13c9fa1a7fe939
SHA1 6feaab58b7dca0ac72822384c629d77dfb991002
SHA512 041c570cab5575da55394dfe68dbf1a3d17fae27aa00cc084c4f7c0f3b3f27cfd8fc73aa073a2c9f50b7e1e0b585587d32a38160b9384a3f2ae731c2a89409e2
SSDEEP 12288:KGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F84523BE915C01CAE92604B5C3E5F15DAC173E67F9200483BA5B78BDF7F28684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 ecb8e51de2eb0c8016efc5d4a8bc8427eeefd469b4d6a007d171893bf82710a9
MD5 564c52f8dc99789e21fe1a194d067d85
SHA1 a77ade1ebcc56479cd82eef8467fcdf8b93026be
SHA512 9b4ac1079edb3e46990f440a2679c0c3d6ecd9baeec6216bc61c1693725393337662fbaf1adfe81e7f970fa83b2ed6646cc07e846d09873f48abea353bbf8c71
SSDEEP 12288:8yPz5L8rXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lzyrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A255025B73A530F9D1378138C5A29A06F7337C3257204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 d522a9b403c89c9e176ff0cd4e61f3ad6bb211a26a7e5e9c352066887eb5ee40
MD5 02a440797955744b9c0989585465a684
SHA1 7f4541a085f509eeb0b56914d2431c9da5079dc8
SHA512 146cd33712b7a2aedb04d46aaa96ca973ed8f5874e14bc31ffe8846874edd8102ef3804391a8238808a8feca8151e089ca908ae18b5ccfc626d72d826c465cc7
SSDEEP 24576:ZTDaLl3z0zDBsqjnhMgeiCl7G0nehbGZpbD:ZTuLljMDmg27RnWGj
TLSH
T1746501A9B35018F8EC67813EC965D90AD5B37C5A0B70CA1F13A4366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 ebcbf69aabfac06eb26ac444abf8a2b05e6d1a8850f80f092d14d05279987574
MD5 3fb6b298a6312244449b34be508c673d
SHA1 ca88da90b829370bedf7c1fc893dcb35b18e1383
SHA512 cfb676da5740215b095e638ffed6d86db425c6b302f9871775f79ab24e953d8db223bdbd82b3c37e66a2f4ef05c0586a9b37c8030f6878a0b04252a016b4c5fc
SSDEEP 24576:z3vd9CHKy7GZFsqjnhMgeiCl7G0nehbGZpbD:Tvd9CHKya3Dmg27RnWGj
TLSH
T15475CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 83e57e41ffb870d3cf3543db73cde7f1a8e04382e509efdb902c45ccd64e7cbd
MD5 df74c61b094c8f8fe919e556d5f1c4f9
SHA1 e47a69cbeb24fdbb108eb4162a0d4d6329058649
SHA512 475fb9c0b9925b5bec50e895204d1d626f5f820c76069bae6b237ed9fff58b888270485b74e6312cdaa0e8f8a1f35234bea68ea05164d249ab3624640eff0f9a
SSDEEP 12288:WRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B14523BE915C01CBE92648B5C3E5F15DAC173E57F9200483BA9B78B9F7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 b8707b8b467dd602c121d1e440249a3a51b6f34c7621a9fabf2e3f94747acb9d
MD5 57f5e49ec2dae5afc2213a986393407b
SHA1 f7c081d75539ae0066f2129d6d8d8dacd747e7c0
SHA512 12e124e3e6ee5e9129079dbcefa04cef0bb53364230e9b66bcb6ef3ea666f380d8ff06b38af12e748b220c16525c62f4add378d42324e2fd43019b400ac1e104
SSDEEP 12288:FLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D04523BE955C01CBE92644F5C3E5E15DAC073E57E92004837B9778BAE7F28688B39423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 2cc0f91699a30e8b37b613b13e2d6a34b73bbea94edc91580b9d2025363bfc90
MD5 ebfb2161e8b978803d3bbec26fcb8c2a
SHA1 f84fa1e826e052aa1942071b0738ed269927e41a
SHA512 3a5f30f6edb0412a82da032376757ba22dc868a250d8488f306b1254c8e9e24def143ddcad81ecb43f96c72aa9254a184376c51adb85c5f77cb3430b1bde2417
SSDEEP 12288:+oXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+osqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BD4523BE915C01CAE92244B5C3E5F15DAC173E57F9200483BA9778BDF7F28684B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 c680ee69e77301d528f3c1e98fb8ec220a9292eb62c1bb0fb7bdf3e5bb784920
MD5 4ebab90a1b289284a892610582396ae3
SHA1 736fb4a66ee1250e6d0561ded15110674c25a937
SHA512 0b895c0279933fbdb9a3ab0dc79aca5a89bb883babe04a208539b7cdf9328f53036bd1b2e5856463b920f4535559c9fdaba4eec3abafdae0e0eb777be724ec89
SSDEEP 12288:+GXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+GsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A84523BE915C01CAE92244B5C3E5F15DAC173E57F9200483BA9B78BDF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 5b12a21de93d051849443b036db07549987113c37b7123bc5eff774fd9be863d
MD5 a17072b30c9326e89d2cc915d9b11390
SHA1 102c3f918129e393a2eaa74bad6992dd4d5afd2e
SHA512 615327007f8a368aafdbd858c68181beb8a7aa22b6e19bd48525103c4e30729ac78da48a59d842b4328bfbde41b047038313d052b83e89a0c25d0f4d30ca1f3e
SSDEEP 12288:VRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1944523BE915C01CBE92648B5C3E5E15DAC173E57F9200483BA9B78BDF7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 890b7f2d0dc503c94148e8b60032d26e7d0ffbc955daa0dd0133422bf1651762
MD5 f77d2205d90a16af29b9a8ca0a3401ab
SHA1 c9810ec4c18eb8e867765934b0c450e5e770fda6
SHA512 061c994e49bace33561f85c54f8ed20b73d6028b01bff14ce3528704d2c73eaa67accac454b61378e4c522e00f480d881686a6da0222c35ca04ed1a7c406ac4e
SSDEEP 12288:VeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F74523BE955C01CAE92244F5C3E5E11DAC173E67F9200483BA5778BEF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 ecaa8d19887765a0eb4a990f29e0aa42d8a0152e658a744b56ba90967d2fb241
MD5 55e03da730bc5be08cd588c4ed5fd802
SHA1 812178ca360984ecb3d0acaf5b6202d81ec7e252
SHA512 218ff35595f5ae3f357288b1295e6854fe90f744c52154a4ae37852343e80b7d69839b070fa4a4c6c49f7b3370ea9aea46a5924ac5a1a0a6baea16bb5ae49b4f
SSDEEP 12288:3kXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3ksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E64523BE915C01CBE92644B5C3E5F15DAC173E67E9200483BA9B78BDF7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 47a10c6fc41d373287424d9992cc2d4f1b844a2752ba81ad536fba59242d0576
MD5 b6a60ca83374cff95071e5ad744fbc26
SHA1 faa95cf19acf306c7660168393b6bb024d177ee0
SHA512 88d09243fe78d32c4504c3f5e639c27b9333e468cd5c7bcc40eefc7a8069ab5f1510e78aaf5ca962fa4e8e03fe1c1fc7021f936c1ef0b1966f145e598cb2ca65
SSDEEP 12288:9ZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9ZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11B4523BE955C01CAE92248F5C3E5E11DAC173E67F9200483BA5778BEF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 5643d59c3ec3a636f4a85303943095efe00c5a2c16d46db5a7ce978a6ca0e334
MD5 79eb70c0b4a5a8c4091565c22ca69272
SHA1 ac828d17ca0746d7fcfd510f1c0b114952da56e5
SHA512 b8026031d4d47720e5957a1de9231c186db4602e548dcb595ba2b99bbd64e8227edf8ae3e39e068d958791b82875dfbbeb7190f059a9ab793c444ddfbc15a94e
SSDEEP 12288:BkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EC4523BE915C01CBE92248B5C3E5F15DAC173E57F9200483BA9778B9F7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 9510cc1e4316041feb9fa8adf21566a3acb39f8ce43a01fac11ad46780adf2e1
MD5 4c7eb5bffc718f367ae5bfde4f62a447
SHA1 70b5a397fecd317715fbf2c155858fd3c83091c3
SHA512 3793891a337775a324fc74638f2cb9eed6e610ad991577096e5a72dbb3c0492d75f7aa5da626c3c990eb16059ad8b16f6c7c9b4f13983e0ecd4b97c8b64ecb6b
SSDEEP 24576:EfwvUk9RX6wkyAIysqjnhMgeiCl7G0nehbGZpbD:AMnYI2Dmg27RnWGj
TLSH
T1C685D029EBDC04E5E177913C89B7860AF6B278691B31C6CF125A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 af675a0b2f80c24c280c9dc1c192411c9eeb2e7071bdad1ed326d1de9af7b5ae
MD5 4f331e19d90d12c2639286b0e636745c
SHA1 0afa05ad6e19cdfd0edac62e0fd0e419f4675319
SHA512 3c88e57010e8f720d4569315564127c4104ed8804a98fb7120f8fa0f9ae54aa04a3979586d2ee6c3ac8297da57284642b9b0c229cd9343e50f7a5000f0a316ba
SSDEEP 49152:1YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0hDmg27RnWGj:4ySzP5D527BWG
TLSH
T111066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b93d607062a9f1d5ee4fc70d784433c94af531a7b954686b711407e878f4e215
MD5 0e27f9b3d6714c7795cddaf1066045c6
SHA1 ad73b9f40acf7a8b4dcf2069eb5e54da84099f6e
SHA512 1f08025fda12058e7b49c23cbc38d6c303e15028b6588d851871168c1dcd027120402184deba1f1452135766646bb6154a7330cd74d4ec420048c2885a38b0ba
SSDEEP 24576:C47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYPsqjnhMgeiCl7G0nehbGZpbD:C47JUQjTirIhCnDHUPfF/RDmg27RnWGj
TLSH
T13065AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 4212f251e42c656dfd26d6b740f5baa3021198dfaa25958a7273b95f1e75823d
MD5 415bca696e107e409c55306f76178bc4
SHA1 642ca593af9d5615308057077334c52b3c5d0127
SHA512 f0514b627b045d82ffcc27fe7492489970a7913e9e1e6d61c31c9274617e06cd7dc79bd32c28a450e9f7a74263512728bd6efc277b96c5134b77ad3b55f79857
SSDEEP 12288:nbsfWXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6WsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18055015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 3e02fc5303c41515b2984b3505f8c850338a11b884fac1ccab04692a0d586a71
MD5 f65b39e9a67b139c0a7730598e4cd7bd
SHA1 dec7e795f4d8d57ff400244cf4c602504c235813
SHA512 667f4642cf2a22b20fcf49c314f2bd851cd08646635e927de82e23132a6e32d07abc859a7c905b7f57c46db197989b31dff02be5172bf0556374dfbdf1eaf05d
SSDEEP 12288:T9ltPpU3fgUHLueGQz3leuwiKnpptrFdjiaOVip2DgwBkmBjsd625N4n:T9ltRUP0ucpvtV6ip2DfBkmBjE625N
TLSH
T160351740762AD74FC6A944321E36D6CCAB707C02EE05AE1773C8473FD576A68B6F5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 fadebb3ebb32c6fe207a09ef81008696972a08a708dd9e2bb3aab4b2f133a0b8
MD5 2f4adadc649a91112d1f35af3194dc51
SHA1 f67ad55193cdd3b8401f05a51966ec5e0bce8cb8
SHA512 cd9b439117042d9b977a458d7b5eaf504dc739925365c0f266effd265d968a01f7a288f471e800db6e4fb5613b5ee6091c1b645e4651f7e25a721d4317c06dbe
SSDEEP 12288:RO4CVFPnLgXEUnBPTOOk0834q6de+DLueGQz3/LueGQz3xLueGQz3teWe8Jxl4Jj:RO4Cb/808kL8JxmH
TLSH
T1B555394164ABE35FC9BD5037433286CDAB745C06BB453F0573848A389867ABEB5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 d60bbab8d5d2098cb0c6cb5d61b009706a6d8730fd3258adfedb46a293bf5a69
MD5 14083849ea6dd16143f414a60899b091
SHA1 18d68d4f3f420fe7cb455eff38058f9552471333
SHA512 6be0aa8a4a0b503452c376f2afaa9fab0cd42699ca35bb9ee6730ab746d3702cb6532fd5c82a2caa9c49cb62828cfdc5bc7dbcf167932c58bbc1bb7ff0bda388
SSDEEP 12288:407uXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VusqjnhMgeiCl7G0nehbGZpbD
TLSH
T13245237A834C118AF93605B482EAE12D781B3E669F2004C3BA5779FDF6B18D48F39517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b5f4f8992d31de286eb69bf3f2c24779a239cc99cca34f32c596e638fdcab005
MD5 f090ddcdbb84e28a35e39c2639190ef5
SHA1 93146ba4e293bd230f2eddc813bf4e0d70013f52
SHA512 1a3d47c5e4c713902e575c53316042ccdcbff8dca4c0bab637406fc1a57fe462f2166c42f4b15478c4858267717efbac7cb58cb74b28ee8d19f37f0717692d27
SSDEEP 24576:pgb6bmBIi49WNNFpg1rSvFv7bYQsqjnhMgeiCl7G0nehbGZpbD:pgb4mBIBhGFzDmg27RnWGj
TLSH
T118659E1E22EC02E5E0FAD2B8CDAA4417D6B278161731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 70bd9c0fb4bf582a42db0743897d9ce65141b049a0f534d1bf1c1f82ce4ac93c
MD5 1d42ccd34ca0dc5a1db934fffaf20046
SHA1 24a259b0a43143e4f8fdbe876ad094b93440c026
SHA512 73222be69de71557d0f64ded3d0289dfe0706fc92e424b47593dcadeee00df81e74399150b2d0022b0f2f38a363464787c615c5f385ed64411deeceb89c10271
SSDEEP 24576:kG88u8FpJqH1bzria7/mfsqjnhMgeiCl7G0nehbGZpbD:X7ZFPqVea7/0Dmg27RnWGj
TLSH
T10085016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 5a1cdd9efefbd377a0576ebd11780d519fdf12f8f52e98bb331ef2ba55ed7d47
MD5 19b897250b6f7ebae8474b5962ebb7ec
SHA1 ee657daa711a89d018f2ce69d504a4ec57813728
SHA512 bc414bf081c18333e2af4467e21d91156ac93f82107404b13708a5ba87ec34895ae2ed32cd3fd08b53144b0a7912d149dc6d7835aeaca0a109ce098a4f9ee347
SSDEEP 49152:OBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjHDmg27RnWGj:RG05lO43b+D527BWG
TLSH
T12CD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 23873c9c643d28a3f7d8c6705a332dc408905e0969f29c8851aeed824a7fbd86
MD5 190e0f671330a3e46dd3e01bec9b8754
SHA1 cd0fd0569702e462b5514fc124882c90387f219a
SHA512 c67be5fc0850bdcde6d210bd949ee8dfe056694eb76871b7eb6df9d81e471f06a0feb108144538d11ee08a766fd2223c6b7c082fea39299f830ec1f7b81288ee
SSDEEP 24576:4fa5POZ3dpuWVM50JicR2hG0lasx2+47eidn9sqjnhMgeiCl7G0nehbGZpbD:Aa5POZ3BJt2pasx2+m/Dmg27RnWGj
TLSH
T1C865BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7d68b458cfd62f2a3015e94463ff054569ca7a47507dccf72355855908ebb050
MD5 0b87718ea1974d9c52486cd3ed3ac6f3
SHA1 2db0ed976b93b509964b87fbb812c346b42f459c
SHA512 a6c29c4a5e7088d7a0fcfe4d7ac116ecb6e2d3b6ed17dee217c11d950a3ab8193b464ab8ab108391e43a8321024291ce07b51d5894a9c6116e4b988ec2ae0770
SSDEEP 24576:ENcwHdjbyQ4nLC18lb/EOjowL7FkHsqjnhMgeiCl7G0nehbGZpbD:ENc/zEOVHFUDmg27RnWGj
TLSH
T109857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 410eddd6d39acc1a1a865a019e41d53e90d46b1e08fab261727874b6c5a3e54e
MD5 63c4a77280eed5a387d85ef0d2cc7775
SHA1 71f69ea0ff226514a0605357866d3bcbbe98d0f7
SHA512 22d2f27fe75e78290e6cbfbc827cf146af374c9c044f3e697b4e7117e81598f23f7c26b6e50719d599b6311d33569e54b3ddb542080bf2f0e0eeea6809464861
SSDEEP 24576:YTkNvNnaFeYhJNtmZBmZsqjnhMgeiCl7G0nehbGZpbD:YTMwBtOmdDmg27RnWGj
TLSH
T11655AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 5c1679f20dc5101d5b4bd0e124d04008920fa4595f23a432cdac02b8c0c569b8
MD5 e569448d03d5475d8f2148c555b7c8f2
SHA1 636d39c1e724f77f4fc3a25ce1e0d1a0bc6c8f7c
SHA512 f523658e651009115076e49cbde0236609a55e77d32eff9fee90ccd959c502d4f5f7b530449528bd9533d3bfc0634879d557003d2316116e6075a217e3812bc3
SSDEEP 12288:/HvUrBFrEjwaQzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBI:/PUr+NQzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B665F12F62AC18E5E676A17CC682C60DF6727862171192CF02E1817E5F73DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 c914b09e1de550e57457a14580e399d6562d325d85692a9091261a1f4156c515
MD5 b508b00e300440820dd5edf1d6d3e268
SHA1 7f397d0087861427ad7e65fc31b3879c34b0a389
SHA512 2203876afede77bf86695dda3e5f579504aecf781bf2b1cab2965e18761b9350816f1369f087de18d9b6951454470cd2cc7f11e11653c15a8390a9baf3318c60
SSDEEP 24576:bD3FHshBIYQgAasqjnhMgeiCl7G0nehbGZpbD:bDVHeBIAAuDmg27RnWGj
TLSH
T1A775E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1284-90-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1284-83-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1284-361-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1284-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1284-374-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/1284-376-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1584-122-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1584-128-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1584-132-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1584-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1584-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2860-110-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2860-117-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/2860-111-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/2860-362-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3296-15-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3296-95-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3296-23-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3296-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3448-67-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/3448-292-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/3448-7-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3448-0-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3448-6-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/3448-8-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3448-288-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3488-145-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3488-138-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3488-363-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3488-139-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4052-377-0x0000027353260000-0x00000273534EB000-memory.dmp

Download

memory/4300-68-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4300-343-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4300-76-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4300-70-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4416-357-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4416-80-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4436-291-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4436-56-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4436-63-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4552-54-0x0000000002300000-0x0000000002360000-memory.dmp

Download

memory/4552-53-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4552-46-0x0000000002300000-0x0000000002360000-memory.dmp

Download

memory/4552-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4552-47-0x0000000002300000-0x0000000002360000-memory.dmp

Download

memory/4552-40-0x0000000002300000-0x0000000002360000-memory.dmp

Download

memory/4992-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4992-121-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4992-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4992-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4992-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5524-360-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5524-358-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5524-102-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/5524-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5524-96-0x00000000007F0000-0x0000000000850000-memory.dmp

Download