fea0b2518ed52b22a653620a29ce6784de1fcde6e7c6f98554e57e8f22da638b

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 20:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
Size 1.4MB
Sample260810-y2abcsxdqe
SHA256 fea0b2518ed52b22a653620a29ce6784de1fcde6e7c6f98554e57e8f22da638b
MD5 6b77385080dd28d9870dc8e104a15396
SHA1 402c079908b1aadb144f2b49bf2e31520f6b7692
SHA512 11e23c8229e500729ef5f307953ebd1a5675d243d73203f4b518fd4f82457c021e1d3d20cdca8235584633fc61e653928a3a9cb467f95a8388401f91e5c6d161
SSDEEP 12288:BAmZXuY20DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:BAhYvgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T13C65DF567A5084F5D0614E7086A1EB6DA361BC58D8074F9B22E07ECFFFF19D28E19A30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3324	elevation_service.exe
3516	elevation_service.exe
2220	maintenanceservice.exe
5224	OSE.EXE
3800	PerceptionSimulationService.exe
3128	perfhost.exe
5880	ReFsDedupSvc.exe
3356	SensorDataService.exe
3604	ssh-agent.exe
5560	AgentService.exe
3408	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5980a26eb05c2f27.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000059a4b3300529dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ea858e310529dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007ad0fa2f0529dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009aeb6d6c0529dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000583e25330529dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b93e516c0529dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3324	elevation_service.exe
3324	elevation_service.exe
3324	elevation_service.exe
3324	elevation_service.exe
3324	elevation_service.exe
3324	elevation_service.exe
3324	elevation_service.exe
3516	elevation_service.exe
3516	elevation_service.exe
3516	elevation_service.exe
3516	elevation_service.exe
3516	elevation_service.exe
3516	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2524	2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
Token: SeBackupPrivilege	5880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5880	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5880	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5880	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5880	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5880	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5880	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5560	AgentService.exe
Token: 33	3408	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3408	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3408	SearchIndexer.exe
Token: SeDebugPrivilege	3324	elevation_service.exe
Token: SeDebugPrivilege	3516	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 1492	3408	SearchIndexer.exe	100
PID 3408 wrote to memory of 5608	3408	SearchIndexer.exe	101
PID 3408 wrote to memory of 2440	3408	SearchIndexer.exe	102
PID 3408 wrote to memory of 1824	3408	SearchIndexer.exe	103
PID 3408 wrote to memory of 4412	3408	SearchIndexer.exe	107
PID 3408 wrote to memory of 1936	3408	SearchIndexer.exe	108
PID 3408 wrote to memory of 5144	3408	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_6b77385080dd28d9870dc8e104a15396_icedid.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2524

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3324

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3516

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2220

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5224

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3800

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3128

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5880

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3356

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3604

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5560

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1492
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5608
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2976 2972 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2440
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2988 2940 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1824
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4412
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2976 2972 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1936
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2988 2940 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ba8a304338df9e5e81a50d313a087f79b13e69b02893248b568f5fe70947041e
MD5 920e40c6addd2e75f441130f5f9894bb
SHA1 784e8d47aa2d955677f1b78557c0814fa5ad294e
SHA512 e918ff0b5b0d2821e39792d3e09cd85ec49e6c49c993131acab66ee99196a29e1f882da639bd940b84f11aa7a115d23a2f6a46a802393c002befcb5e5637c15f
SSDEEP 49152:pb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn3e30jaNf1TWbdz:/3q6HjByU023W
TLSH
T13ED59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 8ef17e33c7c64b35471002531957d9dfb2857d191c7d26429076f45e303e96c8
MD5 89a136accd243af464dde47034056798
SHA1 f6e823a99073856b9925e1d04bf34b6443300a50
SHA512 da20a0cb948f0e6f6116eb978670155530be5e1291bd302bd542469dbcf4b5e7c602e3383ae02b880a0f9cbecde8cb8bd242039243974bd3fa82b69e0c0d5706
SSDEEP 24576:5XYfDtczAfgXe4i7ojhsP5Lgrk1TWb4AN5:8tc9e30jaNf1TWbdz
TLSH
T19565F12877D409F9ED678278C8E2C611EA737C814360EB9B03E499661F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 000e219d6e61643c3300d70822fb31944c339fa2cc4de9d73b0c3eeb8de680fd
MD5 a5d207f80ca62601efa733d27b426913
SHA1 2c9bd18cb8f12898fd39f330ac295040334afefa
SHA512 763f77a1fa71a4b52f645daa63ec5fa68f225be2d7be0eb18774fc4189c8a68701be8f1bb755f3b502b19c11f48e15a3456e3a646abafd18b33156c4cb9462a2
SSDEEP 24576:00Le5ji0hmxirM4gXe4i7ojhsP5Lgrk1TWb4AN5:0Pji0Acwe30jaNf1TWbdz
TLSH
T1FC85AE26F6748735D073C0B9C5D2A78AED71308257308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e31cc6f82374a8a20f66d99a00d445ee4ad8315eebdc8b6bdd191a7261bdea18
MD5 60936947f259d1b9b377a17205c749ed
SHA1 5995698b903f90a7bad87bed96cb4ed92152c355
SHA512 25e3bc59179c2f0452ae312ce2fc1f4c759337a9f18d21ef7919d4d17cebcc76a9b05d7db1137b8846b52abcb6a46b0407a187019d497ad0b0be071a37f52af9
SSDEEP 24576:ja7/ezSC6vUyD/aqgrvWE6q8wyuKgXe4i7ojhsP5Lgrk1TWb4AN5:O/ezSC6vUzPvxHjyEe30jaNf1TWbdz
TLSH
T155756C25F5788323D0B2D0BAC5D6AA9AFE723046573089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 70e03f8b8838a7dc47f24cad099c859c3362c7220c0e7f12f99823ff95a8b6d6
MD5 152988d73043c7e369211204e1cdbca8
SHA1 3a18abc7819976fd1c053b0730e3ec3a30bb4e2d
SHA512 34d4e06a46e6ea58077a6431cd77d679573b09e1cd9062442948d99d3e6881b8bcd452d0124a00bb2e23143044297cd52e714beae67eaaebb46d317d08bd306b
SSDEEP 24576:AVbqPb88hv/l+67gXe4i7ojhsP5Lgrk1TWb4AN5:AVO88hXl+De30jaNf1TWbdz
TLSH
T1FD559E66F5748331D073C0BAC4D39A9AEE3234425B318ACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 5f81d2b8e3eebc85adf3ad774db97771b98925d70dc7ffd80c381640ee011fb9
MD5 6b17ed3190d11ea0d1f462add80b41fc
SHA1 49e24f37be4f5adeaa3361496c2a190989e3de58
SHA512 ecd5074047f582a73bbad08adfa50f83de9e6e2be7d367e7c275ebf2ece2e2276160e9cc1ae75ffa75d050cb4110d3e77a608eaf96e5f1d0e78cce1f8c97d172
SSDEEP 12288:DRX0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:DREgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1454523A19F5409C6F38FC3F4A0F7CB91E9A11EC065448E6B47E0BE931CBC899DAD4469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 fa319ac33c215035aa0999b4c929846de2f220dd1c8d344ba116a2e5efe4c615
MD5 42aecc961f22cb38e7ff1af67e26605b
SHA1 758a4ed4dd50a3d7dc9fc05c5c5301efd0c06f38
SHA512 83df978f8be452cf934c0eaf8964a0e60b331d6806a7fd8f784974c15cdb5d976342c06d56c6762105d77b4380093eb887d5e9804f3816403444993b1deef65a
SSDEEP 12288:1eBNUbTVO86UK0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:1JIUDgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19965CF3BEE28FCD2C27E8DB85691C740E7B278704B5193CBD1A4820E9E235E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 be7b2e2cc5deef556b28be3213dec173a3887031a5a2acc7094a6f901d3aa73c
MD5 958acab961019a2e56f31dbe889ddc36
SHA1 db82c7e2564b9b459475b156e78fef9678e15929
SHA512 1ee412eca28da681d8078c6d494a726eeece07656d7a7cc49b82e7fad4941c5b5bf97430a4145417194533105991e3be73df59be58fff8ff060da74de9c3bf35
SSDEEP 49152:WQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THW:WQvGAdlCEL8c/yRNw5CdU023W
TLSH
T1E6267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 ac7876d490bcc9b1d1bc6d92b4357217dbd828929473ba995a41182fbb4374bd
MD5 1cfce393e070bac77d1a8b22e4088838
SHA1 3da27e82dbfd47edb82f2303764bdfd77daa5f0a
SHA512 de992345b51e2790a988d1fc72ac2c4e7f5b08d67b5608778872f8d52443ec2d963d9c6741c9eb8ca18cf08877c1c50561ac2a538ed90f0bd4fb66a7990329b8
SSDEEP 24576:fdewsAj1gXe4i7ojhsP5Lgrk1TWb4AN5:Fljge30jaNf1TWbdz
TLSH
T1C075E031FE74E032C3BF0DB21B76C716586C6A604B511AC3E3E89E9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c9e5fc22498345bc688367048517ad068f478b6abd21352838c3643b82c2d9ee
MD5 48918eb0e46b36f17ee9766399ab30ea
SHA1 13db3c747ee5c0695a7be6c2ce66e53fb1e2f308
SHA512 266e9a227431b760a9de9c669fc20b4e097d352528bba1716b43313a584abf88cd58d31a3b86401ce48013eb256e5141a8835b5a395dd69827012764d44fd0a9
SSDEEP 196608:RUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHIp4W:RUEtQevvqc2W1cpV2EI3244W
TLSH
T14F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6e1f81ac0217c9748382ca7f79ca9c8345175e6e93016daa5515a28f7e37b248
MD5 b27589b3e4157194481e40ab3b4d573a
SHA1 eea4032de9bd79e04b6f5e215106112722af0432
SHA512 aa752807fb76114394457b3ebd304205c4fec9d74569af52b5729c5bf432b1ee5fa9912496e3377c18afcb4bba343b1ed2fda03f925372643bb60c4423a80159
SSDEEP 49152:0CbRquA/m2yL5zQfFiV+XenmE3/zAe30jaNf1TWbdz:doqtVjnmxU023W
TLSH
T156D58D0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 546d99c2211be057656e1cf62558298dd2692911f215751d13e8b4beb580d3a7
MD5 3959a471c3535cae369a01042b87e2b0
SHA1 838dfbc4f459ff7aeed09ad43b451b012e2fdadc
SHA512 9d7492716f4f6cd51b8db6a81887b85212ffcfe3393ab87ec8a1b1fb133f8f5ca3bbbe5a40411c6ba72a15e65aa4cee153fbfac7dd474db324b6ee4ff60697c3
SSDEEP 24576:/AhGLJIFoiwtA5l7S53+gXe4i7ojhsP5Lgrk1TWb4AN5:/AMyFoiq5he30jaNf1TWbdz
TLSH
T16C359D81EBF955D4F5B3AAB899B68571EA76BCA65E30C20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 1a06817b7fced557bae5d4ab791f0abca5d7c36068c83efffcca8c351a3dcccf
MD5 519b38128bad245e092ff9a76b4dcbbc
SHA1 c90e19ce89c21e4bf0c29147f4f93d650095937d
SHA512 87a2e6e1440360e75edc18b36d9f4c85fa8472d83bfb652c4edd7eb87fa5dd5eae8a8db21f9e49a7f35c949b135108b457040fb4fd5435e199af88c589e0bdf8
SSDEEP 12288:zmw5HEjsChNVBFgl0WDm+C90DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1Ty:SwuoOWZgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1F065E14677A40CE9E5A78278C597C632F7F2BC412A25CB1F07A0C65B5F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e4e46766309fbe65c69918dda18710bbc6065087ed280b3010c7f092373ed6e7
MD5 c94af1276de71ed9575de8f00e1d3b87
SHA1 4d119ea0303e788bdabe9789603a81bba2f5f88a
SHA512 45ceadedb2aad99408cc1f80ed186773b921d7df60a9a7ec15f735aa0cf52991d9f828bc66fb50deadb8eea5653ca48cb7f05784323e9b8e486944bf56a3c6a5
SSDEEP 12288:5BZ1IyE0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:XZuggXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E355129637E421F9E2978278D4F28B41E7B23892233147CF02A096A71F76DD65E39731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 658f72c6bd488fa11affbfb7e12ea9524e2f98d3101961ecefb30e3d612ec9ab
MD5 087faaa6c988d55a02b7e1bdb3d8bc97
SHA1 b19740debbefecbb0cd6fe11a954b4c5d09c5304
SHA512 ac112362ca5ffe5f23d8ccd3cb9c8c2eb0a2eff9583d12b5c6a01638bdc93c713273ab540559a24b8b6e366bd6c6f6a11a07df637011d4facacc90a856186cb3
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23US:TQRQyi36YOcPQLvw2gAf+PN3uU023W
TLSH
T187667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 631235db417a91fc4be6e6af890392804ba0f90a24f16bdae4a2022fba2ef472
MD5 d1f97bd96473ca04ad9c6d420fb22135
SHA1 db537cf8a95a63f458c6d028409a2f5aa5a59cb9
SHA512 3572c004cee0318e18df5919fcb14244cfc5cefe2466b2a96891c698020fcaa36c685615bd462e1ee1d783a412c1e8c23b90e3907ca4b09ba2a365eb9f78a51f
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23US:xQRQyi36YOcPQLvw2gAf+PN3uU023W
TLSH
T134667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5f4561f6a4cb81d572d3d8b9d809520f1e2451be63d8ed32a537c2d9b8c4db24
MD5 ccba59a5a8c6fdb4350b4e815003e840
SHA1 cd430fdaff3c31bde23cee383bac173a02632297
SHA512 1f57deeebce44f837cc4eae0bf2ae550c7a254b38085f3bc9be0c6add480b860ec6c10264765071fbc2d1b3c57e7a0c97a98137490991eddf6289e0004f34171
SSDEEP 49152:b68Qg55nhheWu7PNU3/we30jaNf1TWbdz:lthWRc/wU023W
TLSH
T1BDB55933B2F60099C04DE1769F4A872196E27C718FE0E7DB855172161FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 061acc98d9478c5cba4a93527b750aacffc1493db6c60f90787d8f4e1ab4ea64
MD5 24f3ea65f162219b39fe7eb164d181ec
SHA1 3bb2fc12682331e48acd19daa0c3e153455b51a4
SHA512 7df4befc336a7874bb514948a1a0a0774802d0e8ad03e936e721b4cf5e45d510e7e9291b8aa2baff68702921f547b0fb5b087f5207424d0b98e777abb33760f7
SSDEEP 49152:V3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk998:Uy5112gYy5azzVvL69nLKnhZrU023W
TLSH
T134168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b9d9e1a83331b297bcde1c8632ed6a61e2f3453a5638427f259bdf774435633f
MD5 76dd1855703cb53e90125a60d8699513
SHA1 fce205700809aa13b916814be988666ae4cea38a
SHA512 8424746e7ec5c757bc50ac9eb79f3b9f08e54247fa833a91524474effa11c53446326142b465ca882a42148eeefad69ccc41c57b26e0d3f464f186e4a511fc71
SSDEEP 49152:YB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glGe30jaNf1TWbdz:yu6JmVxd2dGU023W
TLSH
T1ACD59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9ebfe032711ccb3e282eb9e72c5966ec2e33b352365a1768e047cecf25596899
MD5 555cff43c2b705613ef04fc4b0899ada
SHA1 42174dba1fe9563429dcd1b56375f4d46d4f75fc
SHA512 1dc4852923408fca0262fd59699bc5d3edad6f584d1b4d257f9a5795bf01e6255f81096b01e129f6cbfd787522e334a2953ef05591c96ddf7a98b9a71f33c1bb
SSDEEP 49152:81hpsNoJpF1A6UU44CwH7R4xae30jaNf1TWbdz:8mifPbRxU023W
TLSH
T1B5B5BE13F2D901E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6fe9d4f27592a622f224e611d94ded4b883d41e2571267c194c30fb52e8fdb1f
MD5 0cddeb0db2c9cc22dce553d88df8f21a
SHA1 2f15f5d8bea2bbd560c22c1613a57bb86cbc34eb
SHA512 147f4790966a293306a0e8a01ed6d9445c0e7931b68095765468cd90fcb2313eb780a3def7b57d5a0deef26b10bd2f2f72c5194490f737c6245f6c4dbfa1f7b0
SSDEEP 49152:VSuZQIY0Be2KRRVtOnks6NMHqne30jaNf1TWbdz:75dKTi61nU023W
TLSH
T1AFC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF068072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 96e81f1beb5ce4340f6717aebe03ce0a4fc009e72ae6372ae420fe59b29b5c39
MD5 c4aca76cd8d35428b814d1c9b8cd5a0f
SHA1 421d8b38ad179c41c2108c32fd120959ff69ac60
SHA512 8415b9ba605971c8a5821b1467b93e896c3eaac36cf4c6af657fccb9d6d57fb2bae6d728850b16c5958de2a98c74544e8545d9bbd970274fe69c2c6b9cb3661f
SSDEEP 49152:7htSn8EApI0figngiDn0AP5w2e30jaNf1TWbdz:aX2iyphlU023W
TLSH
T18B95BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 820932be8004bdf9d24d46b3972bd7fde6521c75c5faa2f6c599870d94754f00
MD5 f548bcedf0639b94063c24286a26ea4d
SHA1 86abcb1e6aa2d27d2a387e9f9261ab78ee47d61c
SHA512 7b7597cdb94bb63f9e819552a0cb975156c6f214a35539d13a971106544a55e8a8e5ce8c486c8c7cb5a2702f39e8b710211458c64f16a78b3dcba46e9fb63285
SSDEEP 12288:Lf0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:LMgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T189452391AE550ACAE34BC3F0D0F7C7D1E9A11FC272404D6B57E0B5531EBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 affe69117332dbf4c3bf003e3823f15c55e20d55f82a7100b00442f24572d620
MD5 05cf81154c3cd453bdf3bedcb65ced00
SHA1 b2d9d9f9304d343674a9d7a170a62bdd5c7a0906
SHA512 62b6a59bc908dc59169688f704b8027fb784e9441183af364d9c40bb9777f8726451ba0b085497eb1d2027bf9d6be9e130bdec4fbdb90e8bba6d36d4cc67090c
SSDEEP 12288:zw0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:zRgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T107452391AE550ACAE34BC3F0D0E7C7D1E9A11FC272404E6B57E0F9535DBCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 4cb0b474ab5a010ff2895e7bff8077f96b639af3b0d874f2cb3d6af753156edb
MD5 ae053e5ab7694394f8c777c55b168b8b
SHA1 f6c85b8c4f5ca95ce3f1acc829e1d0bfaf04efef
SHA512 6c4bdc90b5aac43660db68241c408728d85b6d8637724979e3bf78c5dcd9da9ce3c793c78e8f80d7c0bb86605c12fc28416daf42288eea3ea41d3a924d2c980f
SSDEEP 12288:dy0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:drgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1944523919E550ACAE34BC3F0D0E787D1E9A11FC272404E6B57E0B9531DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 a6443608e9cf62e08fe2d746914eb5d5ae8c4d995071ba8673bc4ddb512bece9
MD5 023936092920256ef77cf660973313ef
SHA1 15a363d317fb5c75416d91d6e82c2e50b6fea5e7
SHA512 08c9208e5541ce3ceaf7f96f3b1e14a7ef097ab469b1d5cf89ad9bc6b60910d6def4f84e826986157fa3c620f56f7805ee8ae4b43455a16b059fdf7e3b3c2cb4
SSDEEP 12288:7VR0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:AgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B94523926F6905C6E28BC3F4C0F38791E6F13DC173104BAF47D069530EB4AD96EA4A68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 1dad141d8ad5dce962f6781e2539885410488a06f5f8a63fd7ef649791630979
MD5 d0db539df6b9dd6cffaacdfeee85121d
SHA1 05f8309dbf28dadc4265194ef79c7b11a3988bbb
SHA512 47d90ca5fb5cfbc3c4d78d905be5249e586e181afb92210a49bdc716dba2a75fe9c881a1591216408a890845ba7ed73603c11db3c2e566e13fa1061d7b0cc3d7
SSDEEP 12288:Gp0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:G2gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T104452391AE550ACAE34BC3F0D0F7C7D1E9A11FC272404E6B57E0B5531DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 f202beb58512ff2e15443633eea7fe93827b94c53423dad55c19f22a35d3b006
MD5 fa18121379362e43a95f291b0c979c3f
SHA1 35475ae8864e075d6815e1af81c86dbe9f7267b3
SHA512 2cd18a0bddd2c57e51795ec9d4346a3b4e989d901cfae1156480bb7cb454009ad93bdb190265d470c61c7d88b01dfd6036c65367f27c8001126ee0ebd4f70be6
SSDEEP 12288:Jc0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:JdgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A2452391AE550ACAE34BC3F0D0F7C7D1E9A11FC272404A6B57E0B5531DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 5e0bad35d9c14d6b190c48f73492ab7a6ffc83c19b3a858c2f57cdfd6671864b
MD5 b3e4a5b5b5c58e6d7af36f7540f628d5
SHA1 fcfb5ab018f3cd787b0172e8c86b0d177ad37e4b
SHA512 cd30134c9eee38c59d632dd76fd3121abb40e20ed067b48c6719841e2f82f42cb1ffecf39862fb3d027da6317c1a34c69467ebbb56cae91293e793ca7a743bf3
SSDEEP 12288:vo0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:vJgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T18E452391AE550ACAE34BC3F0D0E7C7D1E9A11FC672404E6B57E0F5531EBCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 ab2964738a89f55c0ac4f5575372ae081eaba2985865fe3b5cec17fc18e0e5b5
MD5 716b696324c39330b1df30852a2b74fa
SHA1 5798ccbf02a0531e8281d7ca4722924b0e0f8059
SHA512 5926344ee8b02edc21f9ae43113c4d593ca32291bda74ce5bee5a431f58576bf23c4314353eb251b23dbc94b28acf46bbd101b0a40dfa7a9c2077a010454066b
SSDEEP 24576:zZMSzFVSOxgXe4i7ojhsP5Lgrk1TWb4AN5:zZMSzfoe30jaNf1TWbdz
TLSH
T194650195B3900CF8ED67827DC8A68A02D6B27C561760CA1F03F436671F733A11D2DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 29cf6ae50b469da7950ce3a75749a54239035e8f3f3392751b0e13e51da29a51
MD5 de0463ec9fb8470b10eb704e41659ace
SHA1 c5a2f4bf8ca88f05c1fc7eee5d3b25613671036e
SHA512 9d1d2114de734130821e094df7ce95c0708577a645341244a6278baaf6450029133690e896c7ab9d456b65872956f6e59e0c068e53fcc5b1467e2f0f667421a8
SSDEEP 12288:zz0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:zwgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T191452391AE550ACAE34BC3F0D0E7C7D1E9E11FC272404E6B57E0B9531DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 625ee50866dc815cb3357a9621b1cc973e16a170da18351d50472327cb79eec7
MD5 130ccfa40054b544eadc89c179fc35ac
SHA1 59a2aeb1a8d7d03cccc41c6a2af12f0e1bea3cbf
SHA512 11cf6b8b51486e5dc57ef20d175bfefd0c7811e31258c34954e1a009ee25ea850f46e34086d764f4f89a84625db3f393388c859a38a90dec3d5c8e649c368a98
SSDEEP 12288:zH0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:zUgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T17D452391AE550ACAE34BC3F0D0E7C7D1E9A11FC672404E6B57E0F9531DBCC9A6AC8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 daaf446be75fa828db6b8d4781500b0465017686c5f937f46e32dba7ce42cded
MD5 f54dd56611984c3ec023d7e1af88f012
SHA1 91e30154a35ea74a4b90e65a99ca358b70728580
SHA512 23d2b50b56e47c412f5c8b883fdcc8a7173bab0cb485cde2054e862ed8b3415ee1dad3338c4f40fbee4c4c541c4b0380d1e8a718a2ae55b3c04dc1065f74e25c
SSDEEP 12288:cyPz5L8E0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:FzyFgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E055025777A120E9D16B8278C4E24B42F7B1787217208EAF13E057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 b8f5c7ec9bfd48b827295f9b489afcb6ca32a73c83af8ef93714f49df8929eb4
MD5 bfd0413d1564668332183c7780823c10
SHA1 926ae89a700426d7b6f601f5fb891b52f2144226
SHA512 d61c2ea87c99821b1c73325e9a79682d5f6b651c5b6851389a9fddb8d9a47e065142e1d5c6f70d1c3d48a6b326f66f279e434de7c4d542ab4f7953cf134496e5
SSDEEP 12288:sz0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:swgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D5452391AE550ACAE34BC3F0D0E7C7D1E8E11FC272404E6B57E0B9535DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 0222c6b3869ddd832117d51f6a4ea80db3e3441a64c89a24c5002d9228c5a3e2
MD5 fe7027679accb1b7e82d715d732f4db7
SHA1 346d29dc786778a8ea26940c7efef0f93aecb951
SHA512 678cc0357e515e82f37e99dc17241f3abf98244f78acfd9298a5387051de9f830f49f42adf936c05f9fe93e6fb82f7b555b74ada7238b9455e9086cc4e022082
SSDEEP 12288:Iz0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:IwgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E4452391AE5509CAE34BC3F0D0E7CBD1E8E11FC272404E6B57E0B9531DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 7f1023858367ba09ba8ff086e8ed7df536c9e5dae2aed7a3aecfdf4f19afe7ce
MD5 82d8f9b0870f83c71588b5dd899bf755
SHA1 9b334d0a77743309fedfa0485fb1fae48bbd8278
SHA512 fd9a34eda8f17a5ed2b72fb41eb4278f8f06d98e0a8228b6fd50ced06d524d5545944ea106e095c3e153b8e25c7169387eae833a3e7f5eb27bf40eaaaf7169b9
SSDEEP 12288:gyPz5L8E0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:RzyFgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1D455025777A120E9D16B8278C4E24B42F7B1787217208EAF13E057732E376D19E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 df9907eb17b2a19c90e9caca32da238d778b959199a73ff2cc17345ced4fca06
MD5 dd41fdf791f2a75b05b5f013bdb76dc9
SHA1 4be19e7f5946fe9bd4d16ff3768321d07553ebb1
SHA512 bf123253444e5edc5418d53a9b2d49afce2002a3c329bc27312d9deaee5baaa5c274cc1cd616b3a6bb2fce1ecdd4ac7dfe1f052f50c7887b400c2402e96318c2
SSDEEP 24576:STHaLl3z0zDbgXe4i7ojhsP5Lgrk1TWb4AN5:ST6Lljte30jaNf1TWbdz
TLSH
T1EB6502A5B3500CF8ED67827EC8A68A02D6B27C560760CA1F03F436675F773A11D2DB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 b6257baef58caf995dc50051cdf8c706872c8b05b1b09b60db01f8a2bb91ed7f
MD5 24e02cd62d68ffbdbd897a91a3399901
SHA1 b5e4da4a3106a5bccf1ae3aa7b5cc51a4ab62969
SHA512 56ce61b712acb7c3c4ed3593b3abca27e2829e0f18d58f52387627d0c6dd22ea8fc931d0abe9e979e5056db9a9fcc28ddcf9e1708f7e400bc91e5f982cc7be8e
SSDEEP 24576:Q37d9CHKy7GZngXe4i7ojhsP5Lgrk1TWb4AN5:a7d9CHKyaoe30jaNf1TWbdz
TLSH
T1C075CF90F3E414E8F1B7CA75C9764611DAB67C991B21CE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 f7223ae6dc44e13adf14981640acefad82b6416d3aef40f0c3f8fe1f0cea3577
MD5 3f6e55c1513e79cf50a535fd61a6caee
SHA1 502e9108ec8b4e78d913032ab0373423bbc9eb07
SHA512 5eef53643f063e2e2fdd9d727db3a46ae8ca01e11193f19a474c00850b313ebd9e77b4f1d310ac64c622009b11803b799e6e70cf7ea2daf4dc9f9936f936d398
SSDEEP 12288:lS0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:lLgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1AC452391AE550ACAE34BC3F0D0E7C7D1E9E11FC272404D6B57E0B9531DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 33dfa582c9347437e1dfa98e3b361060ae099779763d076248e2383e889af177
MD5 359ebb840a6bdc208428f4a54defd48f
SHA1 1e1346a64c4516b1c6c1c11518e2646ef952b809
SHA512 98b90bd63b7815bd21d5cf6e291c20817a26a0d64a518b8e2289a7241136279647f68e3ae2bb85aad71db33b903ff937889b86c6454e7f5ef9aacfd8496e6b4e
SSDEEP 12288:9k0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:9lgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T19C452391AE550ACAE24FC3F0D0F7C7D1E9A11FC272404E6B57E0B9531DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 b6dcab6b636fab269ee92fe870ed29c14694204f7d8d63d5c4d868c78edd6468
MD5 c5bd3e5cd230ac10d949d0602af2059b
SHA1 ef43a6c7d04ddc87d911f2c53fee8642a80ccf4a
SHA512 45da7c0f86bd1d32c0536e9436b0108860355d370d903fec399ba55401403f96f892cc6b6e2d53f69d8744bb43388b3293793e72689763829507447a9a16deb9
SSDEEP 12288:310DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:3CgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T12A452391AE550ACAE34BC3F0D0E7C7D1E8E01FC672404E6B57E1B9531DBCC9A6A98468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 a091a4943d43e515903d090c8b44dfd223220053cea0f68aca6f99b08996f5aa
MD5 dd13320255b8fe171378d1a976458064
SHA1 f93614ca4771cb7ecd1982215a06e80c38a5c341
SHA512 9de374374f1eac51dfa271b43f0d92f058cc080e98961472a7e430686ac0195ed8b3f7bb678b38ac10e7d6f457e6532691d0a43ca4af3580731666698420ddce
SSDEEP 12288:dz0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:dwgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T170452391AE550ACAE34BC3F0D0E7CBD1E9E11FC272404E6B57E0B5531DBCC9A6AD8468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 d812895ec6973cc5bb908216787ce794c9fa5a0fce6d5bca42f56d2e83699555
MD5 a7147bfd865069fb97e8a10cbfb4e70f
SHA1 8359368f8084ad839a18582e275b098868de7bff
SHA512 3422752108cbdfeb8b3588a81823ddcedefdaa33748a99b126b90c6a56c21ff37426a0f9a16d43b7c8dae3d5939cee1774b76807ef39730aa98d3c78cb49052a
SSDEEP 12288:IS0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:ILgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1B3452391AE550ACAE34BC3F0D0E7C7D1E9E11FC272404E6B57E0B5531DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 edd8716eeb95a3b3ddfe83b4badae13d58e117b37dd0de15e7836424f62e7b2d
MD5 9a71e9970960a38b675ee680e3be1909
SHA1 aae348fb3d46dd7233db91ec392351cae8c2a5aa
SHA512 8d80d067c2901bc6154854cca053ea839f8cc1a16dd2b642a9b748076214bd0344e493e581d6cdb4dbcdc36761ca5fe6301da9d28f02d3fbefeba6abafa0a560
SSDEEP 12288:mL0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:mogXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1A9452391AE550ACAE34BC3F0D0E7C7D1E9E01FC272414E6B57E1B5531DBCC9A6A88468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 66a991a27e50e6ad6a980724a8a122d759f9c5e2bec56130ae75aceba4c05c7b
MD5 70e983cfb8b9c67240634865a1cda4c5
SHA1 bf8a0fb84878095d4937abafe6cec70209ed8baf
SHA512 5dff4e8edea7700a9b4b240365d699e9c487525b280502c191dd99e8447c87c3077ded7e94233d10bb928d4973392a657a10df5da6358ce33cc719dd845ef0ab
SSDEEP 12288:Sp0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:S2gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T14E452391AE550ACAE34BC3F0D0E7C7D1E8E11FC272404E6B57E0B5531DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 31237fcba087edd6e3776ee89808f771cdd219b3b90f4a3c75c5b8621805f841
MD5 376861d12096a5652b6463a566f9e491
SHA1 529c50ea6e3b012f3a7752e1b612796b84ec315f
SHA512 999edda223d0e77cd03cd2e4c526235d94a6bd1ef16f229f6dfba931de76d70b9df1836b43be1e7652a973b40311c0a93726a5d9322a5ee6e2bf158e4e14a44d
SSDEEP 12288:360DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:3TgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T160452391AE550ACAE34BC3F0D0E7C7D1E9E01FC272414E6B57E1B9531DBCC9A6A8846C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 42509a7daf3941d6391f8c911a931e5175b7b39bca2733c4d8e76c6ad89b5c94
MD5 38dcff6ab58520066905236eb73d9ab0
SHA1 4be763a994792d546a51ef627bef702bc667b5ce
SHA512 713abd5ff2d3a314114910b8a5c4abadac3add339a2bbbc65856395dda75fdadf8e637674907129e1181c021cc4fe700834165c41d8945ae03ab4c5ddd84c335
SSDEEP 12288:np0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:n2gXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T178452391AE550ACAE34BC3F0D0E7C7D1E9E11FC272404E6B57E0B5531DBCC9A6AD84A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 abf5ef13965d910c5335f0d3dd144fcce108f7c4297ecc766fc0bb194fe1b0e2
MD5 4e3e4f064d97a25e7c97797e9a40f96b
SHA1 16a219e54084c359948ae09d569d51b86c7b853a
SHA512 90ae81df92de865813aed18c437ed898d2068d0b7a01d2f8eb3d3534fe36479875886b600f3cf67b58bc8b8ad9e98e3e2c05ae448e4e6cd14fe230cd6fae04a7
SSDEEP 24576:afwvok9RX6wkyAIkgXe4i7ojhsP5Lgrk1TWb4AN5:mMnYILe30jaNf1TWbdz
TLSH
T1A985DF29EBD804D5E1B7923C99F3460AF6B178591B31C6CF029A53AE0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e5915ef78ac93367197bdcb548a9e34e9422af508514d8c54f994cb7e45d1c82
MD5 52578522c8ab8e5184ca3f4ecb4969c1
SHA1 a0075842c4cf93681a1aedf3bf6bab51f5916bb2
SHA512 0adf96600201c4d6d6b400ce39105162fa6a35b745f0769f26ad16d87d9114c04f0035b72bda102a62a74c16bedd174635dfc3f4837608a82fd146fb13c22368
SSDEEP 49152:JYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0We30jaNf1TWbp:xySzPOU023W
TLSH
T173067C96A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d83ae1f22d216c195c83ce6e506b9c7d0419795696c5f443a1037e2beb1f1658
MD5 af8f200145fae252a688711c97dce126
SHA1 6be3ae2be93ce174285407cc24e4ec6c09870883
SHA512 fcace12c83a273f8f92a141869b757ce1733895cfd618e631f16c2fb170d119d819fc85d381c750893739e6724cde9ebcb4c08de0783a1d25b8b7bdcb139ed0d
SSDEEP 24576:o47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYBgXe4i7ojhsP5Lgrk1TWb4AN5:o47JUQj1irIhCnDHUPfF/Ge30jaNf1Te
TLSH
T1F865AE1EA3EC01D5E1BAC27885554A5AEA71782E1B31CACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 cb9540a636732de97418d1e8ea8f803f54fc78c97cf4a28d2077a31a6e6ac3b4
MD5 a53bf4f214395bf14ee3e9b35b29de4f
SHA1 65034f531b75481538ee9cb9ef995182f52c759d
SHA512 eb7757fa26f24106fc51463a5ba9734e8917a557a1ea1c98872b7e94e85eb014ba99ba58b978fbb3062014325e1a45009eb21010c1f5bd2cda8afdd787c38e8e
SSDEEP 12288:2NsfD0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:/ggXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T15955F15AD29802D8D06E92B5C3968A41F3733C6193E1C7CB13D0F53E1F79A949EE9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 51b04ff3c8b1d2e13b8b310b16ac460306a2d1f283dd9db6252ceb572d442de0
MD5 55fec21709fac3ba0c9bf94852a44bef
SHA1 31e462b9bbe562e8694c37654b5c917cfdab3069
SHA512 aa675642490384b7e1868d21349e65119267d903a5a32a813c8c8a11af6f66298084312ecef978b72da7924cac276418569bef8aff49b62b6e425fb67cb55f47
SSDEEP 12288:yOg7uKTU3flnZ7AFEGSd7Y+UYAYzE8Mkwble0:yO2uMUPlZ7DpJPAYQ8Mkmle
TLSH
T17D251701766AD75FC6A940321E32D1CCA7707D41EE05AB0773C98B3FD576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 79c11bcb9b81a94f6c851c4d70d21a54aba0efc2c5c2edf42f5a34227954e835
MD5 142d0a1ff50a4b3fb6d7e65c445f9dc4
SHA1 6e2b1322018d12d920f8d546475aaa881b907937
SHA512 4eeb7af289a906b63a6a1b50cc35ec517b8de1063a8df7e1778ab799d0eecc34a4e473a9ee3cf5f56e4f9274236b5292767b9b3f418260246db7d84cc1a75dec
SSDEEP 12288:MkfWInIpi7AJEQxReuaj51TesTSsFQSluRMF0IX3479c:MkfW3pBJxRGj5NersFQSQMVX3Qc
TLSH
T1EC65F981A537E38FC1F76032072A5B4CA7B4EC17B7095F2277C8053AD86A765A0B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 7fd55113528f2d405b2c5e1ac886819acd893dfe1fb7c40077f602a767e55b5a
MD5 f3c0d95eb8c14bb4dd5576a34ae16ff6
SHA1 5dcab3b819bed76c27bc13a48859c69f09b9c838
SHA512 1c1a45050b4620e995dee8ffcfe65028318028450eba5183761c3b0f004115b0bc7df5ea81fadb63cd630406de1571f37020a99969a311b1f3d79b0941ba12cd
SSDEEP 12288:vM7b0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:EYgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E74523629B580DC6F2AFC3F090EBC760F5653EC0670089EB96D0B69319B8CD99EB451D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5f2e41da9ac0ebd96f2c74c38898de9488a3905e9d3cdafe10625fb3076efc95
MD5 a5b41fe905b3b4d42a950feab28af50d
SHA1 85bc09306913ec69e915ebd7010fdf9404b4476b
SHA512 b8c4c39e2e99264f1be84c38fb71a304d2caf1ac9cd0522304a532bc9ef9913a75b23a88373d1f952e63b001a10c374542bb682154fa82da0c912ac78fe531e7
SSDEEP 24576:Kgb6bmBIi49WNNFpg1rSvFv7bYKgXe4i7ojhsP5Lgrk1TWb4AN5:Kgb4mBIBhGF8e30jaNf1TWbdz
TLSH
T1AC65AE1E22EC02F5E0FAD2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 b9fd20bd4d3b35dc81766abd38488beb783649b86fac82089257692d8f5e3e89
MD5 51a538df51834fb26ce20ed4b776247d
SHA1 ffdf4fa3633f582d71083ed0d4edbe4b1d0b7119
SHA512 26ec527a1abafbb2a27b73db2bbe2b25c9f5d7342488a9a9cc0f361e30d397dc5ae7c127595af8169cf20d2b64f6414483e2102f6abe62c45af6fea89203c6fb
SSDEEP 24576:RG88u8FpJqH1bzria7/mxgXe4i7ojhsP5Lgrk1TWb4AN5:07ZFPqVea7/1e30jaNf1TWbdz
TLSH
T13985F16577E101F1D07BD138898246A3F6B2B8151364EFDF07A88B521F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 93aea81606b6b92e79f7d5e0e53461fb1f4c6555d375aadf78a95d92d1847d12
MD5 8c8bfc678b03a5ed76d957fe5f4a2f06
SHA1 4ee1052fa9ca445d3112538995aa7986a7e3d011
SHA512 fd1051390ff22b34dc011594498eee7a08e1fe8a23ec5ed6162d3217ad4179051ec29cca76cda1425459fddab33b36a26991675da177506395e2931119c01136
SSDEEP 24576:APUr+NQtgXe4i7ojhsP5Lgrk1TWb4AN5:AJQoe30jaNf1TWbdz
TLSH
T19F65E12F66A818E5E27AE17C85828719F7717852131196DF02E0817E4F77EE8BD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6718bb953e731b1fa483fcdc1ac1f7f7a3cf5f40c8fc45af3c1f77e1f36ca981
MD5 3772c4ac204d495e0ee36f4b8c972dfa
SHA1 2de7532f84209abf2140a0fbcffdd71368144d41
SHA512 b55b44a05088044db9e746325ebb1eafcdf57644f7227d3873472af2703b84cec793a4c6e6fc4a6b65c20732d9397d1ca30d869a6d8a162e8a77cc1f00e74a7b
SSDEEP 49152:sBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj4e30jaNf1TWbdz:PG05lO43bzU023W
TLSH
T1FFD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4d2a86aa6e2aa23c673612b1253de15671d68c1c18896e9936718838d5fcdc8d
MD5 5447a75096208865d9bd9860638c55e9
SHA1 85f1e1520a83f3813fc838c8f9337d5bfebaa048
SHA512 977729b565184a46b06d88a504eb43aadc9314e360f10921e48924f723697c55c19ffe7e1544293d7e362ff31192cb8d8ccdf0b1689c2a32ad8ea4775fada4fb
SSDEEP 24576:Ofa5POZ3dpFWVM50JicR2hG0lasx2+47eidn/gXe4i7ojhsP5Lgrk1TWb4AN5:Wa5POZ3+Jt2pasx2+mwe30jaNf1TWbdz
TLSH
T1B665AF5EA6FC01D5D1B9D17DC583861AF5B1346253319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 915fba0dc7949624b500e297a9afa2e6d3d342c1f717099da9a15f5377b80799
MD5 179087c175da47f4d60142f80ac38a3d
SHA1 23da9f9e739fce1d404134d0949adeeda35cb003
SHA512 6f944d765ee8f0acb89ea5b47e305d9f612441d6a2eb16f4f5eb6cf1f623e4bd49788e2c884ac905e9b4f9d91ef2f9621d708f1899f9f49e5de6cb1843eadae2
SSDEEP 24576:nNcwHdjbyQ4nLC18lb/EOjowL7Fk5gXe4i7ojhsP5Lgrk1TWb4AN5:nNc/zEOVHFVe30jaNf1TWbdz
TLSH
T1DF858C5623E901E4F1BBE1BE89779646FAB1786513308ACF0291851B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f75bc5fb0c8d83c2cd3b6e5e192eb063d60bae25f58ae4aca452eba42081cc5e
MD5 b3b9739e21e51233b6447edf9ece1113
SHA1 e575109986e2b8d645a4b7356f31af4f88a1369a
SHA512 f8d6f0829b9babbb3f705cda9a7063872ac945abaff86984d9031d0be0d4e454acdaaddf8a6eccb02fd84292b81616cae6c6cb7e09ba57193f5a5396915b9c46
SSDEEP 24576:U8kNvNnaFeYhJNtmZBmTgXe4i7ojhsP5Lgrk1TWb4AN5:U8MwBtOmqe30jaNf1TWbdz
TLSH
T11055AF6EBAB806E4D1FEC6B4CD238512E6727851173293CB5290C13F0E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 7c81fd0590b3d96d19dac44e15de7dc889437935902cf81687c4bdd0b5967e86
MD5 308d0d0ba0bf7f6861de4226994e6de0
SHA1 d03f9ea002fe2aaaf709d9e18bdeb70791a29fb6
SHA512 77382fab828e82d9f5358371ef16f95888a06b54555f3cd9a0a0e607cd48a950f4ce42662f0b87b860e715098165bef527b4ef3b6dad6f766c7e3085d83bf24f
SSDEEP 24576:kD3FHshBIYQgAsgXe4i7ojhsP5Lgrk1TWb4AN5:kDVHeBIAAje30jaNf1TWbdz
TLSH
T13575E17DEA5C04E4E57BC2BCD6A38A06E67138A9032156DB02D0D1B61F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2220-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2220-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2220-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2220-52-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2220-54-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/2524-305-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2524-1-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2524-0-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/2524-9-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2524-308-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/2524-65-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/3128-84-0x0000000000A80000-0x0000000000AE7000-memory.dmp

Download

memory/3128-361-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3128-83-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/3128-78-0x0000000000A80000-0x0000000000AE7000-memory.dmp

Download

memory/3324-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3324-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3324-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3324-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3324-15-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3356-107-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3356-110-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3356-364-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3356-362-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3356-101-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3408-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3408-367-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3408-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3408-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3516-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3516-109-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3516-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3516-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3604-122-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/3604-116-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/3604-115-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3604-366-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3800-67-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3800-68-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3800-74-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3800-294-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5224-61-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/5224-277-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5224-55-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/5224-50-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5560-128-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5560-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5560-136-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5560-134-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5560-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5880-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5880-90-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5880-378-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5880-380-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5880-96-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5880-365-0x0000000140000000-0x00000001402C9000-memory.dmp

Download