7846117c2b123d936b082cdd58794695efb89dd6307fdf26ca33642e6351c679

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
Size 1.4MB
Sample260721-srce3sbf52
SHA256 7846117c2b123d936b082cdd58794695efb89dd6307fdf26ca33642e6351c679
MD5 53e38d836cf5a9f8fb0d75aa1135d278
SHA1 32f84d286b36bd7a7327f8705f5e54194a056fb2
SHA512 aa530c6ed4fee4a914fd65b25e67b384e314fbfbd3d4c3010e11325ae8286d0549f4376fb92a4145195625a4d212c5bf3f55dad86523a844eae2ba00e35cc929
SSDEEP 24576:dAhY7+L6VMRCPU6CENltmVVdpx7fLrQWd:dW6ZU6CENlc7dpJLrQWd
TLSH
T1E565E02A7B5054F1D1A00D348A51E66DA325BC59D8034F5B72A17ECFFFF29E18E1AA30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1516	elevation_service.exe
3180	elevation_service.exe
1612	maintenanceservice.exe
256	OSE.EXE
1252	PerceptionSimulationService.exe
3160	perfhost.exe
5736	ReFsDedupSvc.exe
6044	SensorDataService.exe
2840	ssh-agent.exe
2972	AgentService.exe
468	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c540a16ee05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fc77c09c2419dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001e284cdc2419dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002e396bdc2419dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009aad6d9c2419dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fe22a19c2419dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ea6b88dc2419dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1516	elevation_service.exe
1516	elevation_service.exe
1516	elevation_service.exe
1516	elevation_service.exe
1516	elevation_service.exe
1516	elevation_service.exe
1516	elevation_service.exe
3180	elevation_service.exe
3180	elevation_service.exe
3180	elevation_service.exe
3180	elevation_service.exe
3180	elevation_service.exe
3180	elevation_service.exe
3180	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4808	2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
Token: SeBackupPrivilege	5736	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5736	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5736	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5736	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5736	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5736	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5736	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5736	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5736	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5736	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2972	AgentService.exe
Token: 33	468	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	468	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	468	SearchIndexer.exe
Token: SeDebugPrivilege	1516	elevation_service.exe
Token: SeDebugPrivilege	3180	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 2988	468	SearchIndexer.exe	100
PID 468 wrote to memory of 5184	468	SearchIndexer.exe	101
PID 468 wrote to memory of 752	468	SearchIndexer.exe	102
PID 468 wrote to memory of 1924	468	SearchIndexer.exe	103
PID 468 wrote to memory of 2244	468	SearchIndexer.exe	105
PID 468 wrote to memory of 1696	468	SearchIndexer.exe	106
PID 468 wrote to memory of 6032	468	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_53e38d836cf5a9f8fb0d75aa1135d278_icedid.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4808

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1516

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3180

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1612

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:256

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1252

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3160

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5736

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6044

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2840

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2972

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:468
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2988
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5184
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:752
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2868 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1924
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2244
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2868 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1696
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 407310b7610b192eccff47069cea905fb58b44ec4dacb7687b3feb62bb3a0827
MD5 c40f7e240187659fbf6ad5b7748675dc
SHA1 323f45960b11c979518ba592ac65d4256c796980
SHA512 b7bef240ed6d58ed79d0a4d5b2ad9270f607e176c6b28a344d5b568f6c2a3249adc31321921d110417638c1301a7f5f8733b32ed98c05823f01c1678f4b07259
SSDEEP 49152:Mb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnl6ZU6CENlc7dpJLrQWd:23q6sjBS69CEN6rV
TLSH
T18ED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 80b2943471dca1b804e7f1e7bff5f44fedb65f4fc07f6bbe4a9b99b46eb32ff6
MD5 2c488b8c81026a440573ef82f822a756
SHA1 46290b32504686953bbeb329dbc242c88acff88f
SHA512 d1ad562c706c75f93fec8b4efd7f1b8a0fb6e279a17ba6698b08f600eeee41b2c7953cd0ea7d11ea6c6f89b7e0f66584155b6965073149f920b022f5cd0b7204
SSDEEP 24576:uXYfDtczAx+L6VMRCPU6CENltmVVdpx7fLrQWd:ttc/6ZU6CENlc7dpJLrQWd
TLSH
T19F65F22867E409F5EDA7427CC8A2C511EA33BC954760EB9F03B4992A0F336D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 5180d79ab2b689587c0cb4f97c327b2875bf167f7fafee8fae98c128fb076213
MD5 1af7f54cf223eb0741ec2c6c94e4eea9
SHA1 dce7e73f821132110701b4bbf77f06966e864259
SHA512 38c6f79a22f8d2318665892a16feb8ea839481f717faa5bd92602a6ece8048327a09c29448b3cfa083b5f9a670debd6a81c89d5ca9423e0b4a4844844f67d499
SSDEEP 24576:f0Le5ji0hmxxrMe+L6VMRCPU6CENltmVVdpx7fLrQWd:fPji0Aj86ZU6CENlc7dpJLrQWd
TLSH
T10985AE25F6744731D073C0B9C5D2A69EED7230865B308ACB4286D77C2F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5081d665af7b90049bcb8a1d853b407547e970e5dc7f3c1376a634d6d34af89d
MD5 298037fc43770e6593e7a9def57f584e
SHA1 845adc2b3b00d12e14a8dfe5cebbdafa2db3edd4
SHA512 c79ab01d8b92d2cf1558d54c68a170ed4c439c3fffc0cd2103344efd0008f8bd6f2d366fb4fa4835424342c3b63006c3c880b56c5bd738c72398036a5ff3551f
SSDEEP 24576:oa7/ezSC6vUyD/aqgrvWn6q8wyuQ+L6VMRCPU6CENltmVVdpx7fLrQWd:v/ezSC6vUzPveHjyQ6ZU6CENlc7dpJLL
TLSH
T125755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c9e6bafde847633fec5ebda04b36b54fbbecf02f8fe95bad854e0ae76c1567e3
MD5 9bd8f73c1aeffedc76df38b4d1a25b90
SHA1 2c09732e1622a54a04f3a014bcc0418eb70d3675
SHA512 50a441e2abf417d423482a97ddca8d51ef93423a4040ca4e4ed680407f65b7ac5642c92cff7f177ed49666874c181200600fe64cdc559bc8b611bb4bec367ac8
SSDEEP 24576:MVbqPb88hv/l+Yl+L6VMRCPU6CENltmVVdpx7fLrQWd:MVO88hXl+36ZU6CENlc7dpJLrQWd
TLSH
T1A755AE66F6748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677E5D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 0a36863bbf656908e1f9aae4911f20f2941046cfbf9ff2d03a15c5d9ac7784d8
MD5 9473fbcc9c26aa451968863b63db3196
SHA1 e0cc765f45be3365279221833d1153c9aa230659
SHA512 b82c2c79ac476bc5e97c6a2f638d72487557bfd589610ce7f7c2b22a6f1af6d6644fa6a83e41425977a43ef663e7a033c0ddc890de01eb081892e42021101dce
SSDEEP 12288:2LR8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7/:2LC+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T13845233487682D52DBF80238E1E691F1AD6AACD55B006D1ED2777D0F0D398B4DC5B22D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 6ed0d09a04c7075db4e456461e579a314bc3d7f57625b5bf764339474eb8c7b3
MD5 ec751dca003be90c12672f63114e886c
SHA1 931163dcf764f03d6521b8c2bd1bafad1f85f977
SHA512 cb77adaf4e02a74cef0562e1c8831caa904f6231c96a1b899987ecabe2d0a05cb22c11e0b1a9381b943689c4a2f684fdf1f9a67b0af827eddfcdba9e95599a83
SSDEEP 24576:TJIUN+L6VMRCPU6CENltmVVdpx7fLrQWd:TJIUa6ZU6CENlc7dpJLrQWd
TLSH
T14865CF3BEE28FCE2C27A4DB85A91C640E77278714F51A3CBD175820E8E235E45D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c0811181a55d1edef9cb0d2d3c2357d9410d3439be1258d760d754acda36c735
MD5 e23fed75ec04c92158afb43aa321a39a
SHA1 af76b49a9fd27a820a7e09625831d8fe7143425d
SHA512 1b9f2cc481695117b9d2431218d66e9a2fda3ff4c961aa930be7bd2bc4d1ef04357a2c8090d19f236d8bb694211091be8c96f1765cfb0d037d50bfa7697c1a64
SSDEEP 49152:8QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THc:8QvGAdlCEL8c/DRNw5Cf69CEN6rV
TLSH
T109266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 092c0800f72a6b022e5047511230420a8b6b4ec7e3a5a94479b79a4167fb80ea
MD5 e89223f536b9deba1a90e383514df380
SHA1 6f72b1ff0cc36e36f4dc93dd25153c0f2c00825f
SHA512 66b55b8ba110cae1af60117304b65cb90eb816dc135b0f17806bf4dd45ccb5b9d3ecfb1ae99b9ce1f56defcffdffb8534f6a0ea73a6ec24f8175073f5a9dc265
SSDEEP 24576:x0ewsAj3+L6VMRCPU6CENltmVVdpx7fLrQWd:Kljs6ZU6CENlc7dpJLrQWd
TLSH
T1BE75E031EF74E432C3BB0DB61B36C716182DB9604F511AC3E3A89E9E49342D12776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f1148db6f12b245421ef1b0e7ede3f012a5cafdefa33f90d8ed20d80d08cdd93
MD5 427aaad7aab2b22716c42c247973ccc5
SHA1 092e4f8d263a54fe89c7146edaf2ef5cd8c4f54c
SHA512 e9a76987948bbf35d4694e76fc47bc953a9729ef3e1d2b39bddc8438cfc193186cf401330baa9eb64febe59683ab43b4745adf07eeb360cf432efd58cd1ae903
SSDEEP 196608:EUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHUIm:EUEtQevvqc2W1cpV2tI32T
TLSH
T1DE474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 452f2483451402150ff22fd771c31d3eaf3fa2efefe6429b0b05b1db9717c3d1
MD5 3b54caa8c611002418948ccd2097c9fb
SHA1 b6693e88b518936e78015fb85730cec26f03979b
SHA512 c8fab5987c5b920056775652f288ae106aaac6f2c9969dd55e6c41c5d4e0da729b3dfa8e6650ff7dbff74eab2f6fcea5035ab1cff021e5a136271a673ee8b78f
SSDEEP 49152:hCbRquA/m2yL5zTfFiV+XenmE3/zM6ZU6CENlc7dpJLrQWd:OoquVjnmz69CEN6rV
TLSH
T1D3D58D1976B8C1E4D1F6C77886A2C647F37178154B30ABEF4266461E1E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 48d72a093a1b2276eac391ab5ff94c0f26bfa504f11e67731f4ab3b9a58f223e
MD5 080a6a2d6c6ae541de2e784f96c990cb
SHA1 bed4afd0248de0b86d4dcc39e64b51d1c3bd6227
SHA512 3f56d3f678ecc058833cd9caf945e003f3e08a4d7329e42b093590a05ace068e7489bd56f1e2f7387892e677f5826c9be3f252ed120e7333f95fa78a1eb1bf28
SSDEEP 24576:eAhGL3IFoiwtA5l7S53M+L6VMRCPU6CENltmVVdpx7fLrQWd:eAMUFoiq5j6ZU6CENlc7dpJLrQWd
TLSH
T106359D81E7F915D4F5B3AA7899B69171EA76BCAA5E30C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 29c9986625a8ea820e515ab3bf43371340e2d11615ee744098d86ec6d7dd5e37
MD5 ce7009a98ad6062da1d9227bfe773793
SHA1 3dd7d51fdc3fc65d33f59202eca20500b0e1ef63
SHA512 f5d228ef1c36daf65c02048436e27319c78691a2c7bc050e7823a3f67de457be81ae31d5acc5f704a44ab791ecb07498cff64ce9dd93df9b5bbe47e0ede1553d
SSDEEP 24576:Kwu4OWT+L6VMRCPU6CENltmVVdpx7fLrQWd:KwvOH6ZU6CENlc7dpJLrQWd
TLSH
T15C65F14967A41CF9EAA74238C597C136F7F2BC422A21DB1F5360C65B5F37260AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 4a2e28a4663a41c248f1433b20c39a2f304739e8878a16001e12231d77f1cf84
MD5 ba0bc58763574ccd39b61f99469cf86c
SHA1 e7f4758f12c2858ec30738916d5bbff1194b1a9a
SHA512 efc605f056855ccf78dd9d843c6ca445a9c0b2fdf741e4f78e5cc0ad21e9b14e767c80e9e18114196fcca8869617fc1bb826fe49ee16228d256cad7e8f3b7ed0
SSDEEP 24576:2Zum+L6VMRCPU6CENltmVVdpx7fLrQWd:J6ZU6CENlc7dpJLrQWd
TLSH
T1AB55126913E834F2D2E6023CC9E29655E772BC96273147CF5226565E0F37AE45C3A332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e5b7ec3ef70fdceadf126ecdf5c998d7f0bb56640f104d00b0cff28e774919f2
MD5 d9bc4bdf658f8fe990f6dcebf66cc262
SHA1 45193ddf58eadd51b3349fc22dc0615ee093b3af
SHA512 8d34ce8d9e27d143a00a1d88765a4b879712a6ab932c17bbddccc4bd4b6c7edf0713851d599e14c8a3146453e16b06f5bfb6a39d7b27e9845a351cbe437302ca
SSDEEP 98304:fQRQyi36YOcPbLvw2gAf+PN3+69CEN6rV:uQyiKa/X+PNOIm
TLSH
T112667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 631b25fa0e97a27da11f52e3fca7cd94dc8e741d666b10c85227ba5d884dc1cc
MD5 196240ca26193bc686aebd3708d936e8
SHA1 81748db7596e4ca7e85dd95f365cd24f6a38120e
SHA512 c271d47e883bb3e6500261435b3409c8c02606fd89a767c653c9e46d2741665191f676de22da4618d2b2f9ef8893483018549efc181aee2db3d7999a5791b79a
SSDEEP 98304:gQRQyi36YOcPbLvw2gAf+PN3+69CEN6rV:3QyiKa/X+PNOIm
TLSH
T130667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a28e92c9ff700465e8b094810679f146ecb7dababb3aa093a264fd576ec8b352
MD5 9eb90a7ed56883e3841ce75169c7c654
SHA1 f011f11ff5023778619fcfce4f829213a9af0ef3
SHA512 5dec5ee065c8f703662aa3df40d163f2be929ec1c338efffca4c79f21020a829c25debe98ca9121f37fb6f2a12280e7b2d6835b93db863dc1b31205cc86c91c9
SSDEEP 49152:P68Qg55nhceWu7PNU3/86ZU6CENlc7dpJLrQWd:JthLRc/869CEN6rV
TLSH
T146B54933B2F60099C44DE1769F4A873196D27C758FE0E7DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 754d683ca94e13170c3f18d86da06f12c6084300da8d483748a34414caa3cb9b
MD5 e226894dfd894f961056c8cc602feec5
SHA1 3e8ae8a3b63df8fe1b4e1d7e18ca5c5e02aac7e6
SHA512 ee95324712b72ee50581faf5b50cbf8e3b2241d9544a45b4e264cdd3be732e5cdc059950882785122e1ebe4c265da3fef1df0e3b310c62bb440d6bb53dd84cae
SSDEEP 98304:7y5112gYy5azzVvt69nLKnhZ569CEN6rV:WLIHEWh7Im
TLSH
T106167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5d6211fab9edd414ccacadf4bb335de880bf70c27ee99851b80db502fbc042f1
MD5 c7cd6e2d7f785b085cdebef4201d1368
SHA1 7e141c94d275135eb8db5c69d562622e19abe937
SHA512 96e3c4b84f016df2a3c246689957f6c79a64e15022a7e5ebca2f6c9b2674b85fd6ef8bf0952991cd96ea787217bd54d89a7653a6260d23bae0a9d4e59f435b06
SSDEEP 49152:SB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glW6ZU6CENlc7dpJLrQWd:gu6Jmdxd2dW69CEN6rV
TLSH
T197D59D13F2DA01E8D06ED578974A9233E962BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fb4f7e4ba455644f8944399f094faa1aaa512a9eeea321e4ae023e51e6b0bd01
MD5 6420030b5b8d1132d6ab39de6bdc6e4a
SHA1 af9085e1bdc05af63e2f1f2cc16e17d73d8f9c90
SHA512 6223dd9495246eed8f6cefc00cbd86db52b065c99ef063e5c3822516970e41ce37f1902b0eefaa88f4c74433b6b184f00177f9325531363acb682dff822e5c39
SSDEEP 49152:a1hpsNoJpF1A63U44CwH7R4x66ZU6CENlc7dpJLrQWd:amifPWRz69CEN6rV
TLSH
T18AB5AE13F2D901E8D06DD17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e585fa1ac5c45724a6a5bba88151ecbc1bce18ef9fbd325554bab816fe86d9ab
MD5 67fda89eb70f96c9d16b0d7a65a1a4d2
SHA1 bcc356e68f2197bf3ab3d4fe94dd3d59dead53c2
SHA512 09507bc69b6afff36d92e11868d7425cee862be4034673c76ea3e9e311cd933820c89c279cc6840b393e31d8b652910e8bb26ffad4b0aac11516f103db83a94b
SSDEEP 49152:USuZQIY0Be2KcRVtOnks6NMHqV6ZU6CENlc7dpJLrQWd:G5dKii61V69CEN6rV
TLSH
T1FAC5BE13F2E901E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 914d98d771868122645fc93d9242d8651780ee126c37cb4ee1470deb127348e6
MD5 28e9904f039f2a9fd23aee18057e0f59
SHA1 ca11cdd243583af05ea04b7aac3d20cacbc5a77c
SHA512 cbd806b3e35502d0b2ab17072835a05ff7d8bdf43e7390ecd2275f59f8735b37952fed629c3717b7e591914410714dd2e3b5f486e814f7f58d636a5ed101f735
SSDEEP 49152:DhtSn8EApI0fig3giDn0AP5wG6ZU6CENlc7dpJLrQWd:iX2imphn69CEN6rV
TLSH
T1B895BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 3b855fff17bfb31b3b0754f6357091657c6220675855510cbb2fb27133c69f5d
MD5 8b306eef911eba6eb276f83b17568310
SHA1 c9c0fd1d6173dfa26fa62a3762f3b057c2da7a01
SHA512 96c135d704cc1ed9a6c2f14329051aab4608830b03641685025a585e167c3c32a0cd5c4e816464fdfdb3d3d876b37e078fcb1263fdc776d40ca608d2ed112f67
SSDEEP 12288:F58+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7y:Fq+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T18A45233487AA1D52D7E41278D1A291F5A859BDDBAB005D1FF37B780F0E3A8B41C5B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 9e36f4af5fe58e339d9f6fc0f2c14c3fc12329d0ee6993c46f798256630757f6
MD5 389f85c79974f17dd5a48e07cefa0d0e
SHA1 41e4d2af5b55fb45a1dba8701357e5eb56910d0a
SHA512 14fa8a199be75f97f6f26d38e4e6eeec849256425111455b4419acd7de04a6757115c860c2e68a2d235a5b5218dc1a2b2cf21043e4d6c64fa158173b022ec9db
SSDEEP 12288:Ro8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7c:Rr+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1E645233487AA1D52D7E41278D1A291F5A859BDDB6B005D1FF37B780F0E398B81C1B62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 4fe4b21e2c2faddf0f52e4771aa7433e01842cbfd74c2ef1fd70d419c57c1c1d
MD5 bcc85b05f640a6ae8044bc2e83fb6a86
SHA1 9e110677ede3e11206244316d9993525bdace10e
SHA512 78f0a323b9909502bd94fca7d0ce1be09385351bee293b79a1cec4f93f800f658980767ffd92ea4b7c5a010024cbc39cd289f05c427bc9c6fd94aeadb1508e87
SSDEEP 12288:6G8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7L:61+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1CD45233487AA1D52D7E41278D1A291F5AC59BDDB6B005D1FF36B780F0E398B81C5B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 687f1f735f4345c77c84e8c3c3c4bd40f6e2bd094b8aa484a07fb4ff4c41cb2a
MD5 28479a3d11676aa599358edc95f373cf
SHA1 93160b6ce413b42672f4870b7c8e5a566a6a7b8d
SHA512 42ff1c7da178000ad0fff347214eb69a7082a26131ac948d66464f2ec04ca31c9ce20a4803a8910ae03c734d438b1dd18e344462266996be5f5e137d2e3f85db
SSDEEP 12288:7V38+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7c:G+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T17145233447A919D2DBF44278C1A291B1FA75BCD6AB105F5FE322280F0E31AB45C3B728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 bc9933f0048ab2ee90d8c5799add9be66c45c0d7b6783ce82d8bcae781072501
MD5 c276c098e99f160d355092493d7e9acf
SHA1 e6ac96acaa7feb0f09ee3ccfd56b65c6e7e44af3
SHA512 6325af0268af2c50b098951e52da38aa5c5ef3964d75250be0546c7077a928aabe6473d1c23f0d9b31ceede5925f797686199ee6d9c9626ace05f3732f0964dd
SSDEEP 12288:2v8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7x:2k+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1B145233487AA1D52D7E40278D1A291F5AC59ADDB6B005D1FF36B780F0E3A8B81C5F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 f5709e8886207462315cee8808f1cde6f8fadf5d9f59ef3894c215b01b3c988a
MD5 3c42f87edb455eddb7baabf6ae3163ed
SHA1 f9fded4729dd80ba7280d7d6591bb2f3cb9bbdbb
SHA512 cd87ed2a7f833d928dddba43c0a0fcb3ad05821c270c8abf8f801c8dcac546b9168c7f9f476641312aa7cc988e445ef3e20da69e2d2cccb1361b1ebf394927c8
SSDEEP 12288:IE8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7y:I/+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T11545233487AA1D52D7E41278D1A291F5A859BDDBAB005D1FF36B780F0E398B81C1B62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 30b77570c30ce758334624805704bc987df2efcc4e6a66a28636c43be9cf11a8
MD5 2a4bf0793e15eb276d59aea3c6297268
SHA1 e4b77c01a9c8f32ac693f7edaa74849d7c5f5805
SHA512 1bf680508b0ed6e5b9fd85b7ba89a3c5d2f3dc2c81d4c6df7f0d0635c958fcf24f6e8ae07537a576f783e2021f6bb8ea7826874e38fad0a01daa50ede642c3a5
SSDEEP 12288:pg8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7a:pj+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1D045233487AA1D52D7E40278D1A291F5A959BDDBAB005D1FF37BB80F0E398741C1B62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 3d5449d5245c095a10af383a910f0f57b32deeade6eb3625d909298d1619b08a
MD5 03eb4cb66b0f378b2268e44e6b08e90e
SHA1 050649d9e0bd65c9229786ecaf20c4ca014cd01e
SHA512 5c4123d614d245a48c59eaef2367eb7acf13bfe1bae0f555710d2e675af30311ba7af36fdbf74e14db515b9818ff9d2ab20d62d530e9d60d66649d343733f4f7
SSDEEP 24576:bZMRzFVSOL+L6VMRCPU6CENltmVVdpx7fLrQWd:bZMRzf06ZU6CENlc7dpJLrQWd
TLSH
T12E650265B3901CF5EDA7423DC9658956D6B2BC5A0B60CA1F13B4362B0F337A01C3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 2a585dada0a6be5d074a275f15f3c2282dfb247f66e43fdfbe7a995d0c24a374
MD5 0e0067eb8bcc5e0e7ceb8035e451cce7
SHA1 1232d5e924da69c110927fc163c3f459d53ffbbe
SHA512 296a8f9761db48dab1fa918b1f974c22b567ba01ae211e7f608cf84d44a8ab39c6a563ba7bfb959d9babb2d129ccbe3fe3a8bd77a438f2111d01cb6e4304b30d
SSDEEP 12288:e98+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7Z:eW+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T17145233587AA1D52D7E40278D1A291F5AC59BDDB6B405D1FE36B780F0E3A8B81C1F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 26353b039a475e047656f3a294ae24e2df214ef88b65565561db4ad60741c26f
MD5 268034688199f44e4a8fd127b503cb28
SHA1 7eea872bf42a4d826a69afe6e9155cbb95877e54
SHA512 3d4f7794188b003ebe72ac09a0f39914b898ea6e5e591bae7d85f87b92b89ddaa354497ecb7cbb2f9a384b5f499229ea8561af63c415d33d0f955134f35d903f
SSDEEP 12288:Zh8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7U:Zy+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1DE45233587AA1D52D7E40278D1A291F5A859BDDBAB005D1FE37B780F0E398B81C5B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 741210d47c61a80395da9496be00a6bed7409b9f924a71aec19ef657901436eb
MD5 b97b48e75058a787d1a0648ae074682e
SHA1 e5d792452be93cbb85141131d8c1fc7d11564d97
SHA512 e0cb7617cd8a392bda0a26c08b941f953659fe3156f495065cc518491d8334ad84d970bf1a1aeb1e4e0374a9a5906f995cae343ba39cafcf6d7e6f8ee8212e8b
SSDEEP 24576:+zyn+L6VMRCPU6CENltmVVdpx7fLrQWd:+n6ZU6CENlc7dpJLrQWd
TLSH
T1DD55021763A530F5D2B64238C8A21A52F776BC761B208EAF5364563B1F376A05D3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a7a498797037f0ebc3099141b4280c55f5ebf6f1c2aac11393ed410b278020bc
MD5 81292575bc17a7508694abac7908be68
SHA1 c50454af2c726e2cffc9195a483f8402adf805fc
SHA512 7ce8bd16661410e9a738d6323d52fbf523b84c13e691ba76de503400a2b604e468a931d8d73c0a6cfaa90a3ec89fef42a8173f598fc1e154bf053ba4e7f91d8e
SSDEEP 12288:098+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7y:0W+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T18F45233587AA1D52D7E40278D1A291F5AC59BDDB6B405D1FE36B780F0E3A8B81C1F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 181132f43b387250fd24080443a38b511119150719666b41d307e683eb157ba8
MD5 58b2bb9f6264201498a80994b6749141
SHA1 ba367b503c4ffcbb40bd9d1ea8c4748bc631db1e
SHA512 c7c7a3bcbc85579d2faf191a2baf46cec70c5760398969f161c9783685927480a9ec0f9342b37aed424f5222696b983b5f36b26df8df5803fb50377ca807fb9b
SSDEEP 12288:T98+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7y:TW+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T12545233587AA1D52D7E40278D1A291F5AC59BDDB6B405D1FE36B780F0E398B81C1F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 3aecf7aeac3c8d060c3530cce22faf6c2d4a325b328ca2cbbac11c0fa4eb9e6f
MD5 f68b19531717169bdf6211aa07977403
SHA1 e4514cbc3234d9f0362e9db9113e76822f097656
SHA512 c534db9c2f8f37876b4c071f05c7f3966d20cf572d774e3c33d31fbf3e2efac077624a3b651c25cf961ab982a4a8b24eea5e5d9727ea908460d764b3edb242b4
SSDEEP 24576:Xzyn+L6VMRCPU6CENltmVVdpx7fLrQWd:Xn6ZU6CENlc7dpJLrQWd
TLSH
T16555021763A530F5D2B64238C8A21A52F776BC761B208EAF5364563B1F376A05D3FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 b3392c90fced0aaeb4fe80b19c1a50de10e721a488e8be02b25ee64c98295cd8
MD5 313ee8057760512eb52c3eb05cc6aac3
SHA1 ef12d25392bc1edc35d0195915ab477224e19bbc
SHA512 29f96278442a4f1984f837ef30c5f8915d6826dab5518aa603181e15a519432fc70ace9dc8465da40ebb984f16c5f122e74df2ba7fa75a0e5f83c5a339a72c33
SSDEEP 24576:tTDaLl3z0zDF+L6VMRCPU6CENltmVVdpx7fLrQWd:tTuLljv6ZU6CENlc7dpJLrQWd
TLSH
T197650264B3901CF5DDA7413EC9668956D6B27C5A0B60CA1F13B9362B0F337A01C3EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 d72abad3599a8ffa3fa321a20e8bc7538da787b552410da68776172324464d35
MD5 7bc5e9fb39aad2de021916dc47204eef
SHA1 f087ca0111de3a3796eac85ab435e2aa60ad668a
SHA512 789958f244c80b3fccdea917df092daa5b847c2e0a81c1ab3e03bb7db5733bda2007ee9a4256eed6d54917277572c9841607b2b7e10c522a5b84cc1d2ab8e62f
SSDEEP 24576:83vd9CHKy7GZ5+L6VMRCPU6CENltmVVdpx7fLrQWd:mvd9CHKya06ZU6CENlc7dpJLrQWd
TLSH
T11575CF90F3E414E4F1B79A35C9768511DAB67C9A1B31DE8F03A4251A1F33AE18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 26cf83a28a1b3058f0bde6ef06ba9e7dc514fa33cbe4330e8714088ea3ac2802
MD5 43bff332cfd276e651e16b427c28bf04
SHA1 6f559c64e6f648232d2405de9e7ac337ddb820c1
SHA512 867021c39d6e07156435ec5d5b4a9434120f1b6f9c67c96a9807d59d6e78e7e2709a68fa3e2e9ff43f342aa7751ff2c10063a509271f1056610b1b4ec44f4e88
SSDEEP 12288:km8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7Z:kV+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1C045233487AA1D52D7E41278D1A291F5AC59BDDB6B405D1FF36B780F0E3A8B81C1B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 83c6ca4d88ed64ed941b8e92e6532f26feb682dc360c0a38e0a1245857eba64d
MD5 ae640e47d0549373d9b66efa412dc9aa
SHA1 a6df1f820a8b1f70676630bc4d57f660eb4f3718
SHA512 f7d5292336bca3225491145188ca3fb8651e594225c44939ba73b1d803f2d61239696f398e6de27d457daa5565c5dbf87e14bf4daec74aa3bcda5dc58b9d019b
SSDEEP 12288:bM8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7J:bH+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1E045233487AA1D92D7E40278D1A691F1AD59BDDBAB005D1EF37B780F0E398B41C5B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 c0ccfa8cf6e3235a985cd3d35706629511df2de6b61bb7c2198752bf9137b0c1
MD5 d726365e41edc087bc528bedcbe724eb
SHA1 d0bf4115cd45a78ba4587198f4f875fe8c8bc927
SHA512 c8278ce9c8718cd476b50f7e487e041d5f8750f655039733b605a547ec4f30f51b590e6639d57e9727ab5e3028919901018097d1565f97b68ddbf7b34619eccd
SSDEEP 12288:a78+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb79:ao+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T18945233587AA1D52D7E40278D1A291F5AC59BDDB6B405D1FE36B780F0E3A8B81C1F22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 b1b8108cdba5eba268bf435a0efd4abbbb82f490d1feb503997d412da289e49b
MD5 c21d31d6d1d13a347d17c5884098890d
SHA1 ad8daa296a2d7327542df9575233db200609a9ec
SHA512 a88449f9bc1dcc02b9202aca4ac33dac63c8decc77f4f8086bdc5dd6e0bae63ef58f65fb74acb645384e0fa6db0bde1931921d5494d06a8b92684189d99c4138
SSDEEP 12288:Y98+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7H:YW+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T16745233587AA1D52D7E40278D1A291F5AC59BDDB6B405D1FF36B780F0E3A8B81C1B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 1e98842233c01818c7b5f124a061239bb2dd87eee8a082f20276f59638d3fefa
MD5 8bb3b94fe38176c42e96205b8f4cae62
SHA1 afbe7b1b5ace3b3c2d7378576d346e05f0dfd585
SHA512 497c1928e459bebf8fbb8b3a80c4846f228691af9a1367cfbe4c57898576224e476eecf613684d50e755bd5c87b488bf7d4e643f16129a2465c2752f89ff412d
SSDEEP 12288:Am8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7b:AV+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1B145233487AA1D53D7E40278D1A291F5A869BDDB6B005D1FF36B780F0E398B81C1B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 fef269d8bd6ffd772d7429ba8fc7ddef41fc6174f52f0a3358c78f3d9801cc85
MD5 426e513d9a58c20342c7ca3ab7df4540
SHA1 cc5765ecf6a640808b7ef187947658deb506bd67
SHA512 f462b3751795125f856ad5b581a838027534eaa97b908afe499bf4cc00bcbc361357b31d81d16b6021da5f1ccbaa9311650b283ebcb2a30f1636fbecee9cfd4f
SSDEEP 12288:QV8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7H:Qu+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T19A4523348BAA1D52D7E40278D1A291F1AC59BDDB6B415D1FE36B780F0E398B81C1B62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 079a4a3be8ce7edb087c67c49672fd101366bae568e4821cc2051bd02329a3c3
MD5 f599d93320a2c719166317000e8191af
SHA1 72c83b565fec1ef1499dd3b6e68fd4f66f8a2e5a
SHA512 287aeb90acaf80fe4b8ea961fa8a108f544e79299f5ff0ac318f70d80f2b251ac351f3a377511c8b94ba096af033fb89cf86fa90c9a1b164afbc73148e180366
SSDEEP 12288:Nv8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7F:Nk+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T18945233487AA1D52D7E41278D1A291F5AC59BDDB6B005D1FF36B780F0E3A8B81C5B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 017cd3397640bfeceb1dee9160f9d97a1ffd8851c2fdf035770dc143d40a7d0c
MD5 fca7f2f3cec90ba58fb805616164770c
SHA1 2977aa9f886e573e663cb23dfc7341c8a3c9477b
SHA512 7d3586e726faf234b80b99ce308985c8af8dbccf8ba1922634fc98340b2c4b5862ceb321c4280bd4bdbbbc6521738e580e13e685433debab01f13a2eeb51a667
SSDEEP 12288:hu8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7x:h9+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1934523348BAA1D52D7E40278D19291F1AC59BDDB6B415E1FF36B780F0E398B81C1B62C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 424e5303259f2fd1a442bec8aee4a4b2126c944859d021754372c64acb7faeca
MD5 d503a7f43b9784bf7491ea1b61e0484f
SHA1 2e5e6a1de1efcd423c5e438d9fe0a59ab6e93498
SHA512 3aa9a5936cc921ae9b14a24ff2226fcb897e27731c7056adadbcd6ed52e153328283165163cbf798c5c95ddd941073876190e1cbdf1c1c501758a8f095987580
SSDEEP 12288:uv8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7F:uk+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T10A45233487AA1D52D7E41278D1A291F5AC59BDDB6B005D1FF36B780F0E3A8B81C5B22C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 ab62de43588736f90cf2ccc84c127e4ce876760c5b16c3364be6fdb506d6eb36
MD5 2172a696ca05ad2c04d2aa8a311848fb
SHA1 395d46538e28f09f7eebf1356becca8b7f91653c
SHA512 671b2f9d4483998d31007816e50300ef566d3c543d8f4cd498c24d9596c554ea4d92624abca7d3825dfb2f0aeb8daaaa6677ae2edcb23275fec23d2f36c2f3c5
SSDEEP 24576:qfwvUk9RX6wkyAIi+L6VMRCPU6CENltmVVdpx7fLrQWd:6MnYIZ6ZU6CENlc7dpJLrQWd
TLSH
T15985D029EBDC08E1E1B7923C99B3460AF6B178591B31C6CF125A536E0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ccfd5504f9a80062723050e436979b22a497c3058fac04fca5e625a9d82ac32f
MD5 2713b33dc439a9bda95ca2159a884f2d
SHA1 709075327307cf5f32e6c6bfab0212a4db0d8c8b
SHA512 fa0dc01ad60c3831dc507401cffca0b22ff6f612c92d14f7b541cf847cdf80dd56d41c462c1a7412a22368776536ae55e59da192a229a72638309738c301b1e5
SSDEEP 49152:QYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0m6ZU6CENlc7dT:3ySzPe69CEN6rV
TLSH
T150066C56A1A801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 47e1dfd5becfbf6e78c0cb7a1e9cf7a20d00a81f6c9addf529c038c4184989bd
MD5 dcc9bdd484326e5872eb1d9ee040959d
SHA1 1d5132be7218fa5be846e00d9f8f048a3e4c272d
SHA512 b4200620267dc310aeb5e7b6992e56f022556a22fbaea3336fbfcbc309e9275461a72dbbeec65b86450e802e303bbfa5e774971b74e4ca6dac837f9b4b6d934c
SSDEEP 24576:L47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY7+L6VMRCPU6CENltmVVdpx7fLrQWd:L47JUQjTirIhCnDHUPfF/W6ZU6CENlc5
TLSH
T11465AE1DA3EC01E5E1BA927885154A5AEA71782E1F31CACF2270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 398f92cb8240adf069da03ea01ea5b2ac6cab853ea5a44a94452ba0a9dd3be5c
MD5 1a193501b5065b6a903af8be2ed359b8
SHA1 01615038d51414fe8faf0d3f1b3cdca5e4c157d4
SHA512 2b4ff966e4adb60be6a8a83e8072ceaf2b0064e1b6eda65870e145373a60c03a0fc582ba454a2ed77820b4d7e8e3409abda42e64bcaea80c8b1ffa2876bba4ac
SSDEEP 12288:zbsft8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7h:Gm+L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T1EA55F019C39802E5C1AE2278C7928691B7337CA597E1D7CB62D1F43E0F366A05DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 fc2402f59e6a7694bbe158477513ee74ea10528b50c42f483a3d61a44f0ca9b5
MD5 a21cce49144363a4f06d2400ff00d345
SHA1 e7de52c23b4bee04fb487c2df47734dd34754f55
SHA512 f45c61fcc3cb4eb198ee95bedf5e2a947eb576aa8354469c3fa526759669b1aa2643f7445bdbc0add7d2f507dd919c513eb480effba138b98669de3a6a4d5831
SSDEEP 12288:9asuV+IU3f+xc8kcgUiGGvLtwcHFDtWKgDYK1F88:9as8jUPzcgUmLtwcHVtWxkKD88
TLSH
T141352950766BD75FC6A940321E32C2CCA7707D41FE05AB0372C8872FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 0f7d9fd021883a513f8d482e183bcbd6710a3326980e669006c259b7e76d7ed1
MD5 5c3c246c9d5ec6490cc71152089bf963
SHA1 8f48f018fbda17731b885c8d233a6067f736332d
SHA512 ddae950d3edd8d6a982827d29a4fefeb44f05973228fed657d3d31e5e3b0d02e138ac4839cd4199fdab5e26b3176e9e458cc25ffd39404915c31c3962bb75e88
SSDEEP 6144:X9D5X8Eve9/+xmMNqtbz26tMxhD26tMxcWq3ln2qxpyTMl+BIK:XHqtbOkqFpaMgiK
TLSH
T13B65F9816537A2DFD1F62032072A5B4DAB64EC07B7456F27B3C8053AD82AB2570B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 541b57b01e2271a80496c6086a9b26c72f76b25e5a1c04eb6b1a53e1a0d2a853
MD5 c39e8c3abc7d839bbc9391e84899bca8
SHA1 4f203a5cfcb3792c03b527e694cfbff2a940c08e
SHA512 d7988076362f91b0cf65fb9ac3be7f9c97852abe92555052479f0fda9b436fb83669736bf76efe631c718ffe5f04077f9d08c5cccbce2c99612db0cf3b26f7af
SSDEEP 12288:D07F8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7R:o++L6VMRCPU6CENltmVVdpx7fLrQWd
TLSH
T12045233187A92D52EBF8127890AAD170691EBDEA5F0099DFF226750E0D39CE45C3B31D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 40c55bc2130bb8616828e38d0156726fe810adb60085c7257f2d2b5d4faf851f
MD5 35fafd797524ed90ae549694ca591259
SHA1 9849f1f8a475311c67b21115de528e8d1085ad30
SHA512 97836f22f7e36133687a6370102085bf9dadc428d61d9fa92bb6a3bdf9197e42364cd14c319108672ac7b85ddb6dea236d785a7ff5d968e84d428044617b9862
SSDEEP 24576:pgb6bmBIi49WNNFpg1rSvFv7bYQ+L6VMRCPU6CENltmVVdpx7fLrQWd:pgb4mBIBhGFI6ZU6CENlc7dpJLrQWd
TLSH
T1A465AE1E22EC02F5E1F9D2B8DDAA4417D6B278160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 f8cd86fc533a9f4864a70f7c4d0dd61dee3f6c75133a99e57887d74cee6e439b
MD5 d75cdcfd19f4cd847025405cd28bed50
SHA1 5784cd42ad690a1e8a7f167c04e28bf1a62a8dda
SHA512 981055ab3b34dd22fb9fd12360466d6ded49889295d3eec343be42d666be63269ca09499a83550edc1c2ce793688eeb88517a64f70cfb39ff2016cc97b409d58
SSDEEP 24576:tG88u8FpJqH1bzria7/mL+L6VMRCPU6CENltmVVdpx7fLrQWd:g7ZFPqVea7/36ZU6CENlc7dpJLrQWd
TLSH
T10A85F16567E101F1D47BD13889864663F6B2B8251360EFDF07A88A560F33AE44B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 48670472e3dacdb80b7089f5b45dcb55b1ccecabc2ca48fb4ecf6ccd50bb4169
MD5 331836370ef05203bc25bbf6c9cc6bf9
SHA1 1516e8be2ab9136c17c4a86c25cb687e62fcea10
SHA512 b5d449f4162bc3565583a61a4c19259ec3718a90f4e351fd3bcdc740be531d97c317f3ee50333f57796342298913f568bff5ed748163869fc5401f87dc53ab63
SSDEEP 24576:tPUr+NQv+L6VMRCPU6CENltmVVdpx7fLrQWd:tJQ06ZU6CENlc7dpJLrQWd
TLSH
T14265E12E63AD1CE5E676A17C85828619F771B862171196CF02E1817E0F37DE8BC3EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a16fd4050e8f8276c30a1e4a1eaeec4d6208ce2f6a8e1c313bb5353ced2708f1
MD5 e7a71702cc61a8e4205099096a6788e3
SHA1 3aeba669c502155554ef8f371ab5f4ea1b5e269c
SHA512 1fedb1950fb40ee3d1fc8453e2140169c9bfda944e28b663111f8953ff197a6c05aa20b4e4268d6cdb7c3c26a604b65883c803f76523b9f1f369ddd8a3d16130
SSDEEP 49152:3BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjE6ZU6CENlc7dpJLrf:oG05lO43bh69CEN6rV
TLSH
T14FD5CF6E62EC11F9D1BBC17CDAC6860BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a2ba9681c6061b3337019a1722ed9bfb58c5f0c39cfdf6fe07b3fbc053f707c2
MD5 5f7c8496583a1947b06856673a8a4b6d
SHA1 a68cd40b6e4f9895c2251b9adae5e9e4d442e9be
SHA512 8de766b4079883170724869caefe6d23750089cbf3ce0ca0e3befc8e31c3404e5a33926a0da80de1f3fd8a4489ed4af86c116aa3790e9438924a158a4264b265
SSDEEP 24576:Gfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnR+L6VMRCPU6CENltmVVdpx7fLrQw:ea5POZ3BJt2pasx2+m86ZU6CENlc7dp5
TLSH
T19865AE5EA7FC01D5D5B9D17CC583861AE5B1342653319ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 400a821c65b84fec1b6c3a2652212130ced414bc6ade74ee2135881c11b29c44
MD5 f24bbd2af303cbc5b1c52eb64f068008
SHA1 b6b119dc58164c5dc3c19eccbfdffc5546a3d7df
SHA512 6c08e57a4e4559a82845065adf943ccd4433f15ca1c76f564798f99ae79ae34fbedf5a204b29aee6f18436499ba2636e0890e832a3e08caef00714e20b805fd2
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7Fkz+L6VMRCPU6CENltmVVdpx7fLrQWd:SNc/zEOVHFX6ZU6CENlc7dpJLrQWd
TLSH
T11E857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e5c20be6fff8342e4c905fe23b23493336953f1d90d7296184578b49df0d4d6e
MD5 06a3e3154361b760b842bd966b3a0bb4
SHA1 8cd1d69fae349ada27c9e30a11debdd604d6ced2
SHA512 cd265d68a0c5750783493c7204731c80b851b86048d29c4b3116810e4d65feda3637dc668886e5f26a1775b7a59f5ce29805149cd27c1c21523251ecfa875c1b
SSDEEP 24576:QTkNvNnaFeYhJNtmZBm9+L6VMRCPU6CENltmVVdpx7fLrQWd:QTMwBtOmK6ZU6CENlc7dpJLrQWd
TLSH
T15855AF6EA7B806E4D1FAC6B4CD238512E6727461173293CB5390C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 6c022d7bcf19f65d73b818342be36a7e48deb72319b66a6ef9ccc714f4301f85
MD5 f5cf69a4028a0c9cf6877d84ac7c83b7
SHA1 26d7ca100f8ec3dd555ae26d31d91b819c5011a0
SHA512 a0cecf403ac378161b321528477302371c8f696f095cf628f9f5c243fa80df773e043edc442673dc61159dafc8a438f87b84231b08d3d20198a099f823930274
SSDEEP 24576:DD3FHshBIYQgAK+L6VMRCPU6CENltmVVdpx7fLrQWd:DDVHeBIAAR6ZU6CENlc7dpJLrQWd
TLSH
T11B75E13DD79C04E4E57AD1BCD6638606E77138A903216ACB12D481BA1F6BEE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-285-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/256-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/256-54-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/256-60-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/468-361-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/468-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/468-135-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/468-134-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1252-72-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1252-300-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1252-64-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1252-66-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/1516-16-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/1516-21-0x0000000000DE0000-0x0000000000E40000-memory.dmp

Download

memory/1516-92-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1516-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1612-49-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/1612-45-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/1612-39-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/1612-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1612-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1924-372-0x000001EF4DFE0000-0x000001EF4E110000-memory.dmp

Download

memory/2840-360-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2840-113-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2840-107-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2840-105-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2972-119-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2972-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2972-130-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2972-125-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2972-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3160-77-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3160-301-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3180-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3180-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3180-117-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3180-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3180-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4808-306-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/4808-1-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4808-76-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/4808-9-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4808-0-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/4808-302-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5736-373-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5736-81-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5736-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5736-87-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5736-375-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5736-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6044-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6044-359-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6044-357-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/6044-100-0x0000000000720000-0x0000000000780000-memory.dmp

Download