6bbfe4a65e7c2cb6ede7383d2faed02c129893068a59d5aa98e80bea196e4c0f

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
Size 1.4MB
Sample260801-mvb1tshe53
SHA256 6bbfe4a65e7c2cb6ede7383d2faed02c129893068a59d5aa98e80bea196e4c0f
MD5 8a9d57c7d0d81174485c33901449fccc
SHA1 5a7aa807f791591ddc43b35ecfe43d476abfcef4
SHA512 5211de6fe40cf470bd6dcddab64b2b7174ca2f5e7a5bc3e4d50e36e37fdbe988c54cade4d22eefaa158f7f8cf03a250cef0484f90be8d455f061b547d3737a51
SSDEEP 24576:RAhYPl11tmlNQ2OnBdFQtP51llPup33kT:RL11tmlNQ2ayVup3
TLSH
T15565E01A3A5144F5D4614E304A62EB6DA369BC59D8070F9B22903ECFFFF2AD14F19A31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3012	elevation_service.exe
1376	elevation_service.exe
1768	maintenanceservice.exe
4976	OSE.EXE
2396	PerceptionSimulationService.exe
1116	perfhost.exe
3076	ReFsDedupSvc.exe
2772	SensorDataService.exe
780	ssh-agent.exe
5132	AgentService.exe
5304	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\227a0cdc763f1d8f.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\javaws.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\javaw.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\java.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000df33d932a321dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000195ee931a321dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ca32d030a321dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a0ee431a321dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000acac0873a321dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\explorer.exe,-22000 = "Desktop"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d006731a321dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000010031773a321dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3012	elevation_service.exe
3012	elevation_service.exe
3012	elevation_service.exe
3012	elevation_service.exe
3012	elevation_service.exe
3012	elevation_service.exe
3012	elevation_service.exe
1376	elevation_service.exe
1376	elevation_service.exe
1376	elevation_service.exe
1376	elevation_service.exe
1376	elevation_service.exe
1376	elevation_service.exe
1376	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2560	2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
Token: SeBackupPrivilege	3076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3076	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5132	AgentService.exe
Token: 33	5304	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5304	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5304	SearchIndexer.exe
Token: SeDebugPrivilege	3012	elevation_service.exe
Token: SeDebugPrivilege	1376	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5304 wrote to memory of 6080	5304	SearchIndexer.exe	100
PID 5304 wrote to memory of 3140	5304	SearchIndexer.exe	101
PID 5304 wrote to memory of 2264	5304	SearchIndexer.exe	102
PID 5304 wrote to memory of 5628	5304	SearchIndexer.exe	103
PID 5304 wrote to memory of 2572	5304	SearchIndexer.exe	105
PID 5304 wrote to memory of 2600	5304	SearchIndexer.exe	106
PID 5304 wrote to memory of 5360	5304	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_8a9d57c7d0d81174485c33901449fccc_icedid.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2560

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3012

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1376

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1768

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4976

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2396

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1116

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3076

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2772

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:780

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5132

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5304
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6080
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3140
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3028 904 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2264
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2616 2620 904 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5628
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2572
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3036 3028 904 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2600
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2616 2620 904 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8e59aaa263f4109fd8367dc8bf17a85eb64666de0302b5fcfe414fcdb5882252
MD5 6043ce2409206d37f5191449867d1a55
SHA1 2b3b5cd89bbd25781fb8111ef1e0b68636c84fe4
SHA512 6adbd048cfc85cb2754cf835331d40e0cf3619385a3349949316639a2df64acc443b22959841f7d4675ef8c46c81c442d8e8816267bfd99d18e5fc9426b5b3e5
SSDEEP 49152:kb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnv11tmlNQ2ayVup3:e3q6sjBW11wlNQ1ya
TLSH
T1FBD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 d7d9b362b863e462455e8913fb52aebedb91cce03f30d98e902b291671b55224
MD5 fe31fbe77ae7a602a906ab34599bd7b5
SHA1 0e07802cd7eb8541db9db644302aef9f4b5cf663
SHA512 009c4faff46205680d96413b63951d84c5d23fef423a75613c52b1689d7c267e39c112e4d8a8b17db2f105a5360a26f3444036c0f97cdbb692f61d6bf2bdfccd
SSDEEP 24576:5XYfDtczACl11tmlNQ2OnBdFQtP51llPup33kT:8tc111tmlNQ2ayVup3
TLSH
T1DE65012837E508F9EC678278C8B2C511EA737C954764E69B03A499251F333D85F3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 ecf37e128b7a47485a5f191228fa3c03ef78dc0075ad100a9fd39376e3faf855
MD5 05caeb15d7f587bb0c4b7f342d9f98ac
SHA1 968d6cb4b72e92e23ce1886bd458002f721208c1
SHA512 93bac96ac222dee6e68c1c0ca891d637ca8813a07d5eae7dc434402d30adc61cec665264edf5b6c4ca7082aa9a153f9bb6bc57892b787c35cf2a9653008a59c8
SSDEEP 24576:i0Le5ji0hmxxrMtl11tmlNQ2OnBdFQtP51llPup33kT:iPji0Aj811tmlNQ2ayVup3
TLSH
T18585AE26F6748731D073C0B9C5D2A69AE97130865B3089CB4286D77C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c13cbcc6b49c59868559d1011fc7a517c18fc2ebd9cca3cd2cebc8be62d40870
MD5 6e1d4bb3d7658d8951bbecdde2c1c320
SHA1 0462e9470a7dcd3dfa039e81e1db78abb880d379
SHA512 ec96bde9feb6c9a6e49ffe6d5a3187c3c2fa5e32b057bb1b99c873c6b0e35b52038ec7552195a7594df578de9ac708c438ed845ca44d65d551b96d3174cc5a5f
SSDEEP 24576:fa7/ezSC6vUyD/aqgrvWn6q8wyuHl11tmlNQ2OnBdFQtP51llPup33kT:S/ezSC6vUzPveHjyQ11tmlNQ2ayVup3
TLSH
T159756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 388d801535214db35a0a9fd4b9c1033c6018d7b97d2738e32ec91f0079127fd9
MD5 8f0e2e48e1b0a74da43fddd365f3fcb0
SHA1 571c1f60f08f76bd8dc4b2056969028916feac88
SHA512 3ab7ed59563101ac5615b7f8c4eec53f329b61ab5b3e8eeccc19cabea5de597c5597a49719e9b410ef734013561fa73c11d848424449d998a456483d3d6ed813
SSDEEP 24576:CVbqPb88hv/l+YOl11tmlNQ2OnBdFQtP51llPup33kT:CVO88hXl+911tmlNQ2ayVup3
TLSH
T148559E65F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C2E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 2749bc9b605ff9a4dae7a0b55b2e3e3b09864db05d74274b10f0b918e0a54b72
MD5 914074f28745196412c0831f66d1f31b
SHA1 d42e23c8f8fdbe0bb76feb132576d4415370a248
SHA512 7af3629cbff0f369dc6db8daad8ed49214a24569a52512d9de3c89a64583beb161a7859bd655d0607fdd74466947d4cb9e2c52779cce0bd736f34f7149cd6290
SSDEEP 12288:KL5lnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:KL5l11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T15445230414960CE5DEA74B7060B38DE4A9EC6CDAFB9E2427470039091ABD77D935F39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 4d9c549e3df0b95c72e69dbb2de354e2b7ced420cc67c397793fb995866e0f3e
MD5 20105111359b147e03140d93b979dbce
SHA1 1535b16cab5894f6340fac2a2839b8b1fec809df
SHA512 ef5021ee3385064955cbe793742b9d7a37e6b82ccd35e044ee6216d426d735d84746a7d201308c015451a6d654890f8c815860206ed2db0020d992340ecfef8e
SSDEEP 24576:HJIU2l11tmlNQ2OnBdFQtP51llPup33kT:HJIUO11tmlNQ2ayVup3
TLSH
T14665D03BAE28FCD2C27A4DB85691C740D7B678714F52A3CBD124820EDE235E45E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 46fad3f569680fc0f79ec9609481c5c6170bc15382659798b1e2d9a4cc417c83
MD5 f105b9c08e7c004e83c09d5054d8537d
SHA1 3fe87719bfd31d46d52abafa77be3cbe48313ede
SHA512 191f5ffc6d48fca72457f1336f86b47a91ce88591883f31bd266dc6c7b3343978da447d82239dd1fcdce24a6fe873187ed7e84844d0171eacd6a51630dbf17bf
SSDEEP 49152:TQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THE:TQvGAdlCEL8c/DRNw5CV11wlNQ1ya
TLSH
T1FF267C656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 dcce608cf8bada46cb1d138c15da3f92e65bafc63c15f6b7a6ed4e7a6b5848aa
MD5 dbb0263ef66010296b66cf1150d52a52
SHA1 b13d446ef056c18e8570681c8841e958aa399824
SHA512 270900381be7251c88b2a7b022271bf61be9eb2e60fbef88e9d3378f3146295fa4b3dad85eb3ddedfe6accc41337da3579c3404ae09c40dc86efa9543c0b2f50
SSDEEP 24576:N0ewsAjol11tmlNQ2OnBdFQtP51llPup33kT:WljM11tmlNQ2ayVup3
TLSH
T12275F030FE74E436C6BB0DB21B36C716187C79604F6219C3E3A85E9E59742D2237AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2391cecf52191fedcd09560aef2e42a84c4f721701edffb0fb094f9f951808a9
MD5 fa87f5e7e1bdd9d64cdbec0d999b15c8
SHA1 a20dd2f5f97af5ef56a5d21adcb3d95d338f9b69
SHA512 936cc9095c6130a7fe05c64cf1bd35e51323b180bdd18ec7e0131c08995b1620441e658618333e2f37cf7c830416ae0cd88f0cde863eb361589355d1443db1cc
SSDEEP 196608:KUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHE11wl2:KUEtQevvqc2W1cpV2tI32IS2
TLSH
T172474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b760a3f95043de9c625633ba7fbeb89e6ff429de12051f72477a4efd4bf4acda
MD5 9b01bd0a0839fedc486642ae221ecbba
SHA1 d8c9ec6142be6b377d53cd262d0d9a9e01b99801
SHA512 82560dbe464680af73f643481c141b7fdb55dd1276f2ce40229c8a964a81c78b9af33522064ce6d0392166f0ef21590772a789ac5979831387a1f11e5cbc8d4f
SSDEEP 49152:FCbRquA/m2yL5zTfFiV+XenmE3/zs11tmlNQ2ayVup3:SoquVjnmZ11wlNQ1ya
TLSH
T128D58D0976B881E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 52c56329800817fd28940490ae6209b437c850294c1e0b383be76d23a001f6cc
MD5 123cc359a7e9773a645b9eb974f0566f
SHA1 a8ad3d28124fef8f58d3801cc6ad60d1abfcfd8a
SHA512 e015e6c2b1e63e59704f36b9603db3832be3c1045e93a01ef21ddb1ce370e40048b60616a568dcf86dd5576308718382a547eaf0fa4f00e4dac86d34f90c9577
SSDEEP 24576:ZAhGL3IFoiwtA5l7S53bl11tmlNQ2OnBdFQtP51llPup33kT:ZAMUFoiq5p11tmlNQ2ayVup3
TLSH
T18E359D80E7F955D4F5B3AAB899B68570EA76BCAA5E31C20F2150D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 e105b0726cc28ec71846642561398c391868f9e1e36ef56f75c7b437470f96d3
MD5 f46802756b1ad7585d71c46e73169867
SHA1 8513bb2c184513cdb4434b845c9782a50bd6b4a7
SHA512 add38fbaac5845e02a78c6f9ebd37e96f8b158906ba27f826324d67ab79eb612de0c606d27b2e06c6b0505cdc280db0cf6c3ef3c328b99e990875eb4cdd30451
SSDEEP 24576:Nwu4OWsl11tmlNQ2OnBdFQtP51llPup33kT:NwvOt11tmlNQ2ayVup3
TLSH
T19B65F14936A50CF9E9A786388597C536F7F6BC022A25D71F0720C61B6F373616E2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 3bb3321353ef7405b29a7fd1a082f2d2856409c34c5e4e242c352e0ced8e19b6
MD5 3055254efdc30071111c3b5ae0e3a754
SHA1 29d620397dac07b8df773baf5cfed90c7114c287
SHA512 347e21888a00211fb808873ae4fdc54560e62e885242eee7d410117ab976e515511a5338b6a6d0f6b5dd083ea9be350b9070e6f2de062ca3c946230802bbd750
SSDEEP 24576:GZuVl11tmlNQ2OnBdFQtP51llPup33kT:T11tmlNQ2ayVup3
TLSH
T14655124822E524F9E5A3477898F28A45E7B57897677603CF0710122A2F77BE51F3A323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6c3d28da41ab800544cd34f0935f4378f4df494e89c31aaa64a42c04c21005e9
MD5 e740663e51e6a9fdd4968edbe7973c98
SHA1 212edc0d7413985c2147eb1edc95018aef212933
SHA512 d33db3ff5b363a9c501795e01c31a6a11e3bb6ce3799157a20994d6f305f808253c67975ed5392e8d20b87161fc6a979d4e4a66f3fd233179bf4df5daf3975c7
SSDEEP 98304:sQRQyi36YOcPbLvw2gAf+PN3S11wlNQ1ya:zQyiKa/X+PNC11wl2
TLSH
T1C3667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 b0992eba1b52869d1f0a320a891891198da81a86a63d17dbdb0ef4eca022f791
MD5 10c6192481edba4c1113e681fc9459f5
SHA1 795b3567444082335ffbd5409f9fc9a5e298e2ef
SHA512 e96ca892099c91df45abd2b9211d195bf1d33d758d5709abf9a539f477a7e4641f3d1ad40a4e179e33da345536b913096e321cf753a63ae3232c84b8a9d48a26
SSDEEP 98304:aQRQyi36YOcPbLvw2gAf+PN3S11wlNQ1ya:RQyiKa/X+PNC11wl2
TLSH
T122667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b7c32eae6e866229b686bc8b2cdbbb095cbdf256e80c84735ca8ae3f49413511
MD5 7d7b9ddf97044130b1d6cd49202d0b3a
SHA1 af5d63f58e4d8a93b1677a6e75c0365f2212df7a
SHA512 26ef394f5d8141943a6fb1504d177c77c72d359d0534664695b9c3be19b0b210eb6fda2aa5f3f686f728ee3062ab15aee01841425efde7c2af1e06581e14b8ad
SSDEEP 49152:+68Qg55nhceWu7PNU3/811tmlNQ2ayVup3:MthLRc/811wlNQ1ya
TLSH
T1BAB54933B2F600A9C44DE1769F4A873196D17C758FE1E3DB8511720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 265675a145a6899bf63cbbe4cabf99ff6cec2321412fe946e2b7b3451a53c6f6
MD5 68149c5dfcf8f268b97c7ca606ffddf3
SHA1 cc1794209f9a59653a2f6edb01c790c122dba923
SHA512 d1cccf018d68e81b5f97597a1f10e85499e8a17252fbb535abc292e9b4d89bfcdebcfb0f955272f7be7e2ea7142d74a4e6b73c34a83d283545596c4bc9792d2c
SSDEEP 98304:1y5112gYy5azzVvt69nLKnhZT11wlNQ1ya:YLIHEWhR11wl2
TLSH
T106167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 59494c93e729a208240c55d1e9c9410a37bd06e9d5c7b315e12485aad71bd9b0
MD5 85bc2941e280876b66f3ecee751c28f8
SHA1 15bdb3c22803ac71b621948934da7ec79a45b46b
SHA512 3561b85e821eaab4bbc4824f549459bdcf49903afcffd45cece28673b163b6f177cc82bb28e2245638a389cc1615f44cd5169dc5765a6cb8955842e2054a0a5d
SSDEEP 49152:RB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gla11tmlNQ2ayVup3:Hu6Jmdxd2da11wlNQ1ya
TLSH
T166D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0de2f1b62f6c183fc28c891737092cdd2354568ad7713892fd274537e10d78c8
MD5 1ba1c341687350b6cc95483ae36e8be0
SHA1 7ef35bdf95a80889ffe0ba72b7cd4ff37ce945a4
SHA512 7e353c9dadda75bd408f22801b0b3d25123893e2839451bd5c29efcd1521c563553aa31f81123f49752d22a52410614fe327eb65dfcb21c33eccf6615a81568f
SSDEEP 49152:y1hpsNoJpF1A63U44CwH7R4xu11tmlNQ2ayVup3:ymifPWRZ11wlNQ1ya
TLSH
T1C1B5BE13F2D900E8D06EC17887569632EA62BC460B35B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 62b43fc045bfc9c6661a00211073822a3ce07456b56ddd7312849793301729c1
MD5 533930d3ebfdfde0caa43c9aec979ffb
SHA1 70e5dc5cb4f8e44bf08f21c9fb681dffab184bdb
SHA512 935d5672be5d73cf5a0cd1cb9d76b7ea7b4b03b7560b8258105d94600c93e795359c8dc53d8d6d03b33d57a345935b0f6b2cf0e6ce9868e2128434fa7f04ffe2
SSDEEP 49152:mSuZQIY0Be2KcRVtOnks6NMHq/11tmlNQ2ayVup3:o5dKii61/11wlNQ1ya
TLSH
T186C5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 df4b303f09adb903aa9dbf9f2451f73aa8c3397aa62150d090c96e39e4aeb6ba
MD5 39b077cde5303a38cc5da4cfc476e3d8
SHA1 0e3341b678bbd6797f9b81a28bb080da0fd8342c
SHA512 cb4a960fb074984b40765fc9be9b001924986ca623a9cef05f5f14016a579d9980a51de6b44eb0d4dd51b6a309f769b28a918d3ae6d1138818239beadbc0ca94
SSDEEP 49152:7htSn8EApI0fig3giDn0AP5wq11tmlNQ2ayVup3:aX2imphN11wlNQ1ya
TLSH
T1E195BE13F2D900E8D05ED174C7568632EA62BC160B39BAEF0A50B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 730348853eedf46fed40ac3659dc6669a9c30f7514b4c681d3a93928ea4e1e39
MD5 98162c3dd596c39fb75192e5a82fd4f9
SHA1 3a82e931fbe4eae8b0e119d028bda340967060ab
SHA512 ac7a85f6c72d8936d2c6ab6801478d66d26e0012623ec0b0f38daead212d696b69ce0767735af734b73295fb4ab517c95479378f2f04cc54bd37f3d1f7a70f3c
SSDEEP 12288:zBlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:zBl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T1EA45230814AB0CD9D9534BB090738AD4A9DC7DDBFB9B20675B0030156BBA7BD135E2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 99745fd2348a546f9ce541c86989d7e371a620267f8e5c5f6d0948da1c7ec759
MD5 6288d26805d3552fb1623a01a7b9befd
SHA1 87fe4343fd2183cfcf1d0b653238d84f35c16137
SHA512 775912ba0b25e2157917a83ed61d18ce262cd975d7317bda24b266dc8574d35903cf71abee4bb591dc5fa98a918dd3c380526bfe1520938feca803bd4f5e05c5
SSDEEP 12288:MElnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:MEl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T12445230824AB0CD9D9534BB090738AD4A9DC7DDBFB5B20675B0034156BBA7BD131E2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 18c03cbab8aef998154e04d79d8064185ea1077cf4ef208bd49b8980dd1cb5cd
MD5 9005083d9b965285bdc08ed43bc9003a
SHA1 159392c097fad2f81a981fd0db11bbe61015f1f0
SHA512 4d1db8cbd172a323b8cb5a9a655464d5e4d4d256636000cf9069a8951b50d1293ca7108f763486c66f63309e4c0bd4c0da70ddc18915eb7ceceab6e275340941
SSDEEP 12288:ZelnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:Zel11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T12945230814AB0CD9D9534BB050738AD4A9DC7DDBFB9B20679B0030156BBA7BD135E2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 3324606b95648388fb887ead43ea7b7d7492336eea53cb38752c8332610de0f1
MD5 71dbf2083f630c43eb335bc7dc09667d
SHA1 eb73df6e22fafd3979de03cab3448d7bd5d1d00d
SHA512 8c6f9436e3a0f6a77066aaebe51f1f82136dac4ffc0ca34f0233ea1932d57cecb5a6ae99380110023ffcf21674e2907339474ecfb89438c762732be89b24cb61
SSDEEP 12288:NV7lnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:Tl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T1E745230425AB08D5DCA3C770D4738A95E6FC7CDAF76720AF5B0024091FB67A827397A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 de51be63b2951c7ff6c1a6ed4e69ddfafbacb8dcec30278618decf9b5e78fc00
MD5 42a27403b56628d4fa9270ef44072bac
SHA1 fb64658acc73cdfd819a22174981d8d97340f85b
SHA512 ed479017b9733ce84bf73c7a1460ab03c5dfce4043df7f7a95dfd84b92fc1ffddb2432e2c7cfaea8b60f0dfb381b89f467b773dccc35c0a27cab1f127490f724
SSDEEP 12288:RTlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:RTl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T1C845230814AB0CD9D9534BB090738AD4A9DC7DDBFB9B20675B0030156BBE7BD131E2EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 628413df4cf9e7dd3bfdaaf6a8f51d955f69b645a78ef4c7dc6c8eb3034c1e32
MD5 95b81444544258856f3528f0af8ba714
SHA1 2882f6e218fceaabe35a4800973fda924db5e1d4
SHA512 1e8ea956f280571ae13d52965de1ab7aeab93f82a8ffed135eafe376c11f655a612d65bbabd8860ec2c0d816c5ded28d6e2d8133676635b7890f960b3c389dcb
SSDEEP 12288:6wlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:6wl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T18445230824AB0CD9D9534BB090738AD4A9DC7DDBFB5B20675B0034056BBA7BD131E2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 c576ddffd5253a9cd0f5e74a14eed6bfee178825e1f6252d02a342acffde9d1f
MD5 115b5635635f2f41d143227aa33bdfc5
SHA1 96dd7151610d4a6428e176923615a2e1f9354b3a
SHA512 db4b5bf46232ed0e4d3a81abdeb9fb0c4faeeb0d115c5a5c6b5ed6300c5b4e06fdf92bedd050f49e8312b5095cc0d2e8fa01d801d93723a61b06f792ed4badc4
SSDEEP 12288:v8lnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:v8l11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T1EB45230814A70CD9D9534BB050738AE4A9DC7DDBFB9B20679B0034156BBA7BD131E2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 de5a44e752de303041711ebb065c3278b45e7be1b6e046b90dca0b331c43495c
MD5 cc9d5d2e5bbb8d1a5d7b183e6275caa4
SHA1 d37054492c99f72ae261687e32240a4918d56e24
SHA512 a565fe88237058d11db2952be44f3b1428db4cb2cd3df91dbd16364558d0969f824beb1a159b705dd83f69a5a21265cc0fbfc4a11ff4c4ce79c0817d53c827f6
SSDEEP 24576:MZMRzFVSOkl11tmlNQ2OnBdFQtP51llPup33kT:MZMRzfk11tmlNQ2ayVup3
TLSH
T16465029473901CF8EC67823AC8668916D6F27C5A5B70C51F03A436275F733A11D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 45ba02d59aed972307271bab3c841a126f7942b67e5b81ad7be1d55695646438
MD5 a8d838f32f7e5fdc2dcc487243e3364b
SHA1 dbb74875b243e68e40f55f91615b09e8bbf871c3
SHA512 becef102d379c52bd03379f775bb86212e020b2adfc1b59d83a237ceff9c2d817974b9fd1506eead1f8b1c824e825f485ea56b4d8ab41d680d6606ff903f6c9f
SSDEEP 12288:cFlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:cFl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T18445230824A70CD9D9534BB050638AD4A9DC7DDBFB9B20679B0034156BBE7BD131E2EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 94e8122c85ffad8f631e50104032ad2e5768052aba7cd43523ab00b42ce32a35
MD5 faa9c2d45a2079fd6fd3c9d51eb06e52
SHA1 ffc774aaceeb306460984f6212eb888cab8cafe0
SHA512 5683e593d5b032795b811be8296c52166a1de92e2b977b0230e4896b9f0b67b109a311ab4d5d532069c0a9f0f8186d30ad34572ef0777832c180f2703079fb2f
SSDEEP 12288:uplnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:upl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T16845230824A70CD9D9534BB050638AD4A9DC7DDBFB9B20679B0034056BBE7BD135E2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 36a508402819e0a4f3acfdfb59bafe7d711722f44a3223ca0ed3bbb1e80fb85e
MD5 952d90ed9d9d6a4fcfe4be7f946530df
SHA1 c4c95a75bec395e4f0d1673999132edaa41f0f17
SHA512 d0d9a380e12ceed8f89495e26d380c0749a652d5070b597f80c8397d12449366dabc44a12704ee198e1ff389ca24daed3b9243cc533cb22185b1fdf6e2543b51
SSDEEP 24576:3zyYl11tmlNQ2OnBdFQtP51llPup33kT:3N11tmlNQ2ayVup3
TLSH
T1E655120732A220F9D5778334C8A20A42F7B9B8765B2559AF1710163A2F377E45F3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ef5341d070004f735b8365bced9245d0897bd9ccab7ca160a584bcbd4d32d086
MD5 86eb8f941bb0e4596feb4dbb0eaf536d
SHA1 2c299db2b97ad5487f81a16cb0a943f449ed6f61
SHA512 7fe312107ae57a72dc0051063c6f48e155a3f9582ecc83dfb70c1c6dc37db3a9a9910f42c9430405255465bc4358308fd78dbc8a56d3e3b44d30b43af7e59b28
SSDEEP 12288:eFlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:eFl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T18745230824A70CD9D9534BB050738AD4A9DC7DDBFB9B20679B0034156BBE7BD131E2EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f66083b7e2fdef2bc9d4f3483d59be51c00723015c610245b9e526078273dbe7
MD5 68538fd9594c23ffc69dc8028a36cde7
SHA1 f466ec8142305927ec329735abf14c48eeb07205
SHA512 9d4a9a40bfe98722781ad055fab71ad8b09eb3bc5f7734f57f57e38f51002fe7b02f283b0e77276886926cefa59b7427d5a02126cedb8dd7d12d6be675475a3b
SSDEEP 12288:yFlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:yFl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T1F345230824A70CD9D9534BB050638AD4A9DC7DDBFB9B20679B0034156BBE7BD131E2EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 81ed776e691ee966e50dd5651d5e45dbd631ac0c80051e8852bdd422304fe5b4
MD5 82ad981cf9ea900a79d1793766163b87
SHA1 b88c517e470701ea47e9010cb4e441c89c0b7247
SHA512 a813fbc722d3be880a162e599ec754c2130338154afb4235d6eda240326e42596c31d53e46d09f8ae6846b9acff07a8b8c472d4bae152a5b4066a8fccf17e3a6
SSDEEP 24576:8zyYl11tmlNQ2OnBdFQtP51llPup33kT:8N11tmlNQ2ayVup3
TLSH
T1D455020732A220F9D5778334C8A20A42F7B9B8765B2559AF1710063A2F377E45F3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 021ad5f3b951c8474e373ce2314bdb5d9291ef47597f65a80006f54d6a41f901
MD5 6f1babab7ecc24c0430a705a7f8b5767
SHA1 58217102f13507d11ef4b285545a773a7360668e
SHA512 e5986083282dbec36dfb931839853dbafbb52a1c4d62a7a88f339ed334ce0106c938d23882a170934d3605c30d51bf68db84dfd3ca6eacf5bbf570124b352347
SSDEEP 24576:NTDaLl3z0zDul11tmlNQ2OnBdFQtP51llPup33kT:NTuLljF11tmlNQ2ayVup3
TLSH
T1AA65029473901CF8EC67823AC8668916D6F27C5A5770C51F03A4362B5F373A11D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 bd659f0b57065f5f27e268428b263c4178f651e9c1b5acc3aa3098f7cc1e419d
MD5 d35f737e1843501d1cadc73908c38141
SHA1 b3d10dee28e35d8e201ad5b0b0b3a166f4fc3162
SHA512 3620da9ce7b6adfe295f6af8ae86d6f906865d68354a781c60c3f701637c80ee04fc2bad5b21223ca0c4afd6f6eec7871267abe437ebd3e0bb4917f32edc8644
SSDEEP 24576:k3vd9CHKy7GZKl11tmlNQ2OnBdFQtP51llPup33kT:uvd9CHKyak11tmlNQ2ayVup3
TLSH
T17F75CF90B3E414E8F0B78A35C9764511DAB67C9A5B71DE8F03A4251A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 3e5b0cad81042387c94ac36ab6d7269e6c5915953b28de22e6e4435626960a77
MD5 2ac09296220cbfc7982bc8b0a25e5776
SHA1 d8d570ef211242fc1f8e0e80e040cfc83cbcd216
SHA512 eefd612ebbe61e51e154fd33887da4b2c2f19a8455c591f6067a84b8740dc76ec66040da7b14454456a067e63958fa6d39963984b89e6e57ad7f68fa8828caa8
SSDEEP 12288:6+lnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:6+l11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T13045230814AB0CD9D9534BB090738AD4A9DC7DDBFB9B20675B0034156BBA7BD131E2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f3239886ba3849adb474892a7c80cb00480052ebc4ed5e182ac8b8d8ef851241
MD5 716a641d7a012dd7b0020806d64a1eaf
SHA1 91e1f8e8ac1cc2f9f65a6fd953dc28580cc20c28
SHA512 ae06588225cee6bdf76b7d04039174472b8d7de635baab743f2162d7506d8ee38df5b8c5611106cec97ecc2703d8c43f2a5bf267406abd22562a11791ce5468a
SSDEEP 12288:q4lnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:q4l11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T10245230814A70CE9D9574BB060B38AD4A9DC7DDBFB5B20675B0034152BBE7BD131E2AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 21f04c6fc096a0affae7c9236cebb8fc55d493263b5bb7fcdf31deb3f20f9d62
MD5 85f1283474970b1df2333df1a0eb57f5
SHA1 7dd7d42e397cc82b7beec13676c21dbe2b8ffa09
SHA512 6f1b1338a9023394fe603eff7f1c549d87c3415b0a11fa74f2399056108a555a565bc659d8dc23285bbcc8f121ececed751ae93d40c95c57db4914ca14b4ec70
SSDEEP 12288:lflnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:lfl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T13E45230824AB0CD9D9574BB050638AD4A9DC7DDBFB9B20675B0034056BBE7BD131E2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 aa67301380dabd2e38bff1d870124f27dcfb57fde1c1561b36439f9cf64bc8a5
MD5 9c1980c11c6c111fd99d94034cf19dd5
SHA1 0b7ea7c27a74f78cb967b6e9a7ec7b70def961fe
SHA512 7406fb8de3bc43839cbf399a5314612fb9a0ec787840f493a11ff02003aadb5cde13207556358ae914f06f797b12a21396f64c730bca3afdcb63e2257407033b
SSDEEP 12288:sFlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:sFl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T1D945230824A70CD9D9534BB050638AD4A9DC7DDBFB9B20679B0034156BBE7BD131E2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 16f0d7d77b53c9dfff12fdeab1078c4eeed7e310efff3a15efad52877d73c7d8
MD5 9a68d0e1da44488f79eceb69ab554f8a
SHA1 9c8a2412c53cfdc706db1ed55714b8e5cea28628
SHA512 379f20024b1380d73de508f8f4e0327ba0b2f61943e859be1b06208bbf6369677bde2ae3c2e737ddea1344099bf1dcaa596ed5a899275d977bbe1cef60c35210
SSDEEP 12288:D+lnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:D+l11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T13145230814AB0CD9D9534BB090738AD4A9DC7DDBFB9B20675B0030156BBA7BD131E2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 ccf494e254ef651f189b230c744fd7ccd5f3875a31cef89073beaa4e8cc83fe6
MD5 ae05fcd07047359e25adc0683fabc3d0
SHA1 1fa90430cda5e75932b0264b5f5af93e275ac4f0
SHA512 fe37bfbede6786b7d21619d97d6675376fc483031eb655beed7d0bd748ce90e3f25eb95058dfb8fb3dfdce079d7ea1a4a70f4aded20e92a8805a56d6d060dd8a
SSDEEP 12288:h9lnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:h9l11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T15145230818A70CD9D9534BB090738AE4A9DC7DDBF79B20675B0034056BBE7BD131E2AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 a991e2a9cdfed731253c5e4166b1ad5f25ebc6ce7266eb4909772339a5189974
MD5 5d857f6777fb48fbfb5cbf9082102319
SHA1 9b0196d778d3c03b44fa64bb9d1d7f9a95f60ff1
SHA512 4895276c035e7fdeb170645da049f128b59bbf4036e07191157ac42a04a995b1efa64fcbe4aec57e06404cab46d7283db675e6141735d1ccbe2eb3a713e4b88d
SSDEEP 12288:TTlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:TTl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T19945230814AB0CD9D9534BB050738AD4A9DC7DDBFB9B20675B0030156BBE7BD135E2EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 e984057646128781755c1f7eef7690b8042d82b6719bd6a86b3eba07f0185eef
MD5 e74e6aa667e5e91ccd977f39344e68ce
SHA1 a7cfc0331ba13f618e8400c456b1d6aa335dc258
SHA512 83a433ac59ad2717f00e2e7e302217fe23b5304cb59e8074ec902399365294e0b4a2fc4d9f3f4201ee3892b8cf35bd37fae0a7c6c4eb1681c08ff0b67d650a9f
SSDEEP 12288:dmlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:dml11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T1DE45230814A70CD9D9534BB090738AE4A9DC7DDBF79B20679B0034056BBE7BD135E2AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 465c9e977e7df2b6531368a4c29bdab7ec83715978a8ac2c1ad0aaab4d8d71a6
MD5 8fdf569af73b3fe447dc5db5cef47969
SHA1 f33e8f2d4e43865ee3b7cf398568441bd40120bf
SHA512 46c2e170a06fb79a22496930caba167a8d2210c63ecbef1f6fe35e0859b4df06d55acb5e58406f339499f20093bebb801958437b81d63692b7d0406bc743ca1a
SSDEEP 12288:NTlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:NTl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T19745230824AB0CD9D8574BB050738AD4A9DC7DDBFB9B20675B0030156BBE7BD131E2EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 593e12c1bff75145d6f947d0dcb4eec9b01ee73717415a5a52aad12cf73ec632
MD5 3d9717ae1df389850678135d7b2e1b2b
SHA1 6c5db09be98b3487864b24e3cf5b5bb3123e8547
SHA512 8558e55085900faea9444e1a782a052ced132374765577af25d7fe469d5f9278acb927f4ae977d1057f9a8418ea688b43e58c73a6a2a701d1f75c25b730cb13c
SSDEEP 24576:NfwvUk9RX6wkyAIZl11tmlNQ2OnBdFQtP51llPup33kT:fMnYIz11tmlNQ2ayVup3
TLSH
T19885D029EBDC08E5E1B7923C99B3460AF6B178591B31C2CF025A536D0E37ED45E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 dd0628cbc9fbbbcd0472bbf01716290d5f976f9ab4f022185947ca46d0e619a5
MD5 4a07c4b0f2525352783092303caad72d
SHA1 b0cbae374a1c7b89b30422855136a1185e161049
SHA512 3967f3aba6df05a1c217b23954e503719531af47ffc74c8d8af98ebd9fdcb0ec9ae14e5e5f2f9c95b02ebcf75de5834b9eb8121be7a462dc17b3a0a3863c6446
SSDEEP 49152:+YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0K11tmlNQ2ayVS:NySzPy11wlNQ1ya
TLSH
T185067C56A1A801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7597fde781d4cd378fbce02762ae45f55478957b5454e5b752ef68e12cd17227
MD5 c4074610e6110c72c64fd901c9b7839b
SHA1 8e96b517acd841886758052138f7513deff73af0
SHA512 04cb4f304a48bfee3fdee83c0330bde94d264641fd823a783afe04f3ed7024f8430325d8c5a273f2076df8306d3a0676acd77e8737c30b30ce14d19e9b66bb78
SSDEEP 24576:n47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYUl11tmlNQ2OnBdFQtP51llPup33kT:n47JUQjTirIhCnDHUPfF/a11tmlNQ2aJ
TLSH
T10665AE1DA3EC01E5E1BA827885158A5AEA71782E5F32CACF1270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 33859da7c5b0aee36984d76a52258cb2cf0c6900f7511fcc420dc363367fc4a7
MD5 3aff0306f79df9783dde93e34c4dd77b
SHA1 82533196205f117f238446eec0687e0b531c14f3
SHA512 be3dbd041616ef4d571f46dab2ddecea0e1c4142195a1cd7fc430007f8afb93276dffd9b0911241e51a53556f961a5bc76281b1ced8cb08156eead3c186a7788
SSDEEP 12288:YbsfVlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:/Vl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T154550108D29801E8C46F5270C7628A40F37B7C6697E292CB57C0F53E1F7A6A45EEA753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 647e92f52f6062de3281d43189a7a44b905163f9c6f10e2862a7205a6ed7d929
MD5 e4cd22cdbd0301e8499645daf03ca080
SHA1 cdf26f55696c522dd7269815ed0930fe3c509d86
SHA512 3f6cb4b6de9db69c7eb2b77b4ab6c3451d15f3b9f682f72978f98a5ee0844f04991cdf50d9a23f808c350510ddaf1cedd204865aabc61854a4dda9c13d5ac31e
SSDEEP 12288:VKR7U3fycg9v6w9GLB1kZ9jFkudnvixaw1b:VKlUPd+v6iGudvixaw
TLSH
T10F350651766AC75FC6A940321E32D1CCAB707D01EE45AF0373C9873FD576668BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 91ac4e06cb2ceb1c1b5be3192437f5229664597c74cf5224e19993a528862e3e
MD5 61d5e9b096322d7d8c72ad2ce3ae0d4b
SHA1 4bae89d56bf18446123fe9bd45f17c5187089f1f
SHA512 8a685a2563586a363e6d8ae2b07917dcdf36accd05fe1fa48411511952a71d3b8b27cc40dc48e6e68e7db268064954f1844cda91f6cf541c119142790f2a46f1
SSDEEP 6144:INibnUrdg2puXWsGgTMytMxO+pxGydcxQNhCXMytMxsLMqX5NVc+0si:MFpu94GyKxQuJXtZ
TLSH
T18B65D8816437E38FD1F66072032A6B4CB7A4EC07B7055F66B7C8453AD86A725B0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f958691cfb21d6fa2236e599eb26ec5a23eb88c34d67a0727175e3e50b7adafe
MD5 368fb7fa2257c7004090c990fbbedfba
SHA1 e572d7c650847ee29304956055f16753c0b45203
SHA512 6300cd8aee4362a4abd385a0fa2f65cff36c9604b99bbb64980a500db6d8a971804f7c125606d38bb4a7e02eb510e9e6320aec460f53dd28d588519895768caa
SSDEEP 12288:a07NlnybqL5tml0aTcMjN12xdUb6pSsFQHNP51lK9+Prapve43kT:bNl11tmlNQ2OnBdFQtP51llPup33kT
TLSH
T13B45231415AA0CD5ECB74BB05077CA70659C7DAAFF4A10E7A70031092AB9BEC1B7A35F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 eec3c4dfce4d35d397827de0c64f549af1b122def85df82610f72ef3a04b20bd
MD5 11ac9ed151d20bef37ca0439b94761f6
SHA1 5cc001567164f567b9227305867b640db67c44f2
SHA512 e9860f743b8e56affb0c96bf1b1e79fdd14c0110834353a4bdb1f6c8cb97b079dbfbb9160f7b87d5fb995cf6e7619e62fb6f97a913f75d09ca039c31ca5b7553
SSDEEP 24576:pgb6bmBIi49WNNFpg1rSvFv7bYHl11tmlNQ2OnBdFQtP51llPup33kT:pgb4mBIBhGFY11tmlNQ2ayVup3
TLSH
T15A65AE1E22EC02F5E0F6D2B8DDA64417D6B278161732D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 cf50108aa0d092ff3b7acfd32f4828da8313bf4170c8f7d2ad7cc2be23d0eede
MD5 f994b863d0c364b60ec85da4ab6f47e8
SHA1 8a6b513efba2528645e7bc9f8185d2bf4fb46407
SHA512 db32b89a1a0445c1797866a00e374c7e57f8ad32946f27b985718a0fc353341e66be47f658d2076761f42bebc8aa08c6fe7f24ac1f995765324fbfd46b09aefc
SSDEEP 24576:hG88u8FpJqH1bzria7/mkl11tmlNQ2OnBdFQtP51llPup33kT:k7ZFPqVea7/911tmlNQ2ayVup3
TLSH
T15785F12576E101F0D47BD138899246A3F6B2B8251364EBDF07A88B551F23BE50B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 e89460cf458154195114439200ed9e06f01eb4f20d1b36da82d5a878cffda494
MD5 c34c3a80c01f859bfc01b285c479a100
SHA1 08792a482ad7b6e0476b7ccdff564d89cc65f5ff
SHA512 b63964b7ac808849204f9bbb958a77fa7f37f3612bd8c579059137aa10c9d12f12158a718c52161a21ceeb2c93ad013a615345333323a6f75b09b266725b8ef8
SSDEEP 24576:ePUr+NQgl11tmlNQ2OnBdFQtP51llPup33kT:eJQk11tmlNQ2ayVup3
TLSH
T11765E12E22ED1CE5E676E17C85828719F771B862171291CF0290813E5F67EE8BD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 31fdebcff122560aa71ce17058b4254a870e7b5adcaf6b243545d906ad9c021e
MD5 87b71a626da52c0a5ebdae1e7a766c73
SHA1 ef94f2cc56571097fa89fbf7c794d1b1f3551704
SHA512 0b3f220c894e17658897cb8b5411b925af18653a43863e2211ebb61cdf2e8fbf03a1cf3ec64d4c9a7e0c3cc7bd6f81e84b6a512b7a1bc071352e5d3cbcb6e910
SSDEEP 49152:qBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjU11tmlNQ2ayVup3:VG05lO43br11wlNQ1ya
TLSH
T1ADD5BF6E62EC11F9D1BBC17CD9C64A0BEBB23815033556CB02A486A91F27FF4567E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 321c9795dec77577312b39700a6014c42a0e7d6b4ee1b7cbd512b093903ff13b
MD5 e1cfa1f7b14d294ef66278d348953e93
SHA1 5450301b3628cd8409a795dbad27409b0e4b1941
SHA512 e7ee58304edeb3255f288764beed5211230462010484d8a55f451ad00b23bb12591d16b5e7688ea85ed1a7592cc1a4cd60d7a835d3c8d75e55aba07bf41fcc05
SSDEEP 24576:ufa5POZ3dpuWVM50JicR2hG0lasx2+47eidnil11tmlNQ2OnBdFQtP51llPup33Y:2a5POZ3BJt2pasx2+m811tmlNQ2ayVul
TLSH
T15965BF5DA6FC01D5D5B9D17CC583861AF5B1342653329ACB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c362f32194e681fb25900f80830a474c18274bad36d53afab7dc5a6a22ae181a
MD5 e1867387d213daf0bf4e319668467170
SHA1 1b7424fd6087bbd08a8bc62fa576f06f96137677
SHA512 bec365abedf04f0385bf165b3d4671bf20f6e880eb7fefcea87147a0964a7f7c5f76b86ce9ed998bd6a652819e7df6f34e1f158e89408d8f43c42033d5702622
SSDEEP 24576:UNcwHdjbyQ4nLC18lb/EOjowL7FkMl11tmlNQ2OnBdFQtP51llPup33kT:UNc/zEOVHFd11tmlNQ2ayVup3
TLSH
T1D2858B1622E901E4F5BBE1BE89779546FAB17869533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1b8fca62f85d7a7dde639a20847a1014258b6e7d67b7d96cb4841257debddf92
MD5 04d0e9156bb8af28c71c82df40a15331
SHA1 414d2689d9c4b72838de7d97371d95fc06e41dad
SHA512 9008aacaf769e37be2e79446ae098756f61c2f0ea496d8782bf9dc3d62ccf13565c8e9253bce48e078384a143f44a207532761114fce1ff362623dc81f324db6
SSDEEP 24576:9TkNvNnaFeYhJNtmZBmml11tmlNQ2OnBdFQtP51llPup33kT:9TMwBtOme11tmlNQ2ayVup3
TLSH
T19B55AF2E7AF806E4D1FAC6B4CD238512EA727461173252CB5390C13F1E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 b20b8e8301c44882c44dec4aef17c02342d62ebd9b6e74cfcdf525c91efdf0de
MD5 413ae01158ef0c56061d29090380357c
SHA1 1cd6a6e00717c6f69e08915bd1a13f5767e2f955
SHA512 e23757524bafa8b54490e4ee1540ffa88d584adbd3c1ad32dc45404dfd124b9dd1ee52fd1d69e7af99f05b5e914543a44643c3d948b4e749a7dd523639b9298a
SSDEEP 24576:rD3FHshBIYQgAhl11tmlNQ2OnBdFQtP51llPup33kT:rDVHeBIAA711tmlNQ2ayVup3
TLSH
T10B75E13DE69D04E4D57BC2BCD6638A06E7B138A9032265DB0294817A1F6BEE43D3DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/780-109-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/780-115-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/780-361-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/780-108-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1116-78-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1116-359-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/1376-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1376-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1376-94-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1376-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1768-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1768-52-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1768-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1768-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1768-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2396-73-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2396-355-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2396-67-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/2396-74-0x0000000000BB0000-0x0000000000C10000-memory.dmp

Download

memory/2560-300-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2560-9-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2560-0-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2560-5-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/2560-64-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/2560-303-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/2772-356-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2772-358-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2772-102-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2772-96-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2772-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3012-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3012-22-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3012-15-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3012-21-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3012-81-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3076-375-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3076-374-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3076-360-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3076-83-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3076-89-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3076-82-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4976-271-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4976-54-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4976-61-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4976-55-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5132-127-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5132-131-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5132-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5132-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5132-121-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/5304-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5304-362-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5304-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5304-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download