d2b0b50f37c578b50ba07107b7963b7e61c3c8903965364ebd791a283c7b4a23

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 10:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
Size 1.6MB
Sample260811-mrazcsxvcs
SHA256 d2b0b50f37c578b50ba07107b7963b7e61c3c8903965364ebd791a283c7b4a23
MD5 e97cb2becb18ba77ac3247ea0db3e7ce
SHA1 0b7128d32bbaae2d0546bd15509e14c5678b8a5c
SHA512 ca35cc21f2c931d64b4ea624582923393941021bddbafd2a13a8f5af14e8734b604f19c6b2445234531b9a82c4a298b32d4b01c25bfc0e577b5f23bb7a6b63ab
SSDEEP 12288:bTco1rV3B7DTSFi14iXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/nT:b/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AF8559D02A58E9AFE353E97C4061D27AD9327C234ED2500596F0B5FD893B3B87969F20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3472	elevation_service.exe
3596	elevation_service.exe
5068	maintenanceservice.exe
264	OSE.EXE
3584	PerceptionSimulationService.exe
2196	perfhost.exe
5792	ReFsDedupSvc.exe
2520	SensorDataService.exe
2632	ssh-agent.exe
4664	AgentService.exe
1776	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\34833f3de62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000da4ef0447e29dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c9cf04017e29dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036d283047e29dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000972318027e29dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000ae65b017e29dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3472	elevation_service.exe
3472	elevation_service.exe
3472	elevation_service.exe
3472	elevation_service.exe
3472	elevation_service.exe
3472	elevation_service.exe
3472	elevation_service.exe
3596	elevation_service.exe
3596	elevation_service.exe
3596	elevation_service.exe
3596	elevation_service.exe
3596	elevation_service.exe
3596	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4412	2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
Token: SeBackupPrivilege	5792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5792	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5792	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5792	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4664	AgentService.exe
Token: 33	1776	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1776	SearchIndexer.exe
Token: SeDebugPrivilege	3472	elevation_service.exe
Token: SeDebugPrivilege	3596	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 2916	1776	SearchIndexer.exe	100
PID 1776 wrote to memory of 4128	1776	SearchIndexer.exe	101
PID 1776 wrote to memory of 2416	1776	SearchIndexer.exe	102
PID 1776 wrote to memory of 8	1776	SearchIndexer.exe	103
PID 1776 wrote to memory of 3084	1776	SearchIndexer.exe	105
PID 1776 wrote to memory of 4392	1776	SearchIndexer.exe	106
PID 1776 wrote to memory of 1424	1776	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_e97cb2becb18ba77ac3247ea0db3e7ce_icedid.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4412

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3472

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3596

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5068

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:264

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3584

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2196

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5792

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2520

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2632

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4664

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2916
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4128
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3068 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2416
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:8
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3084
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3040 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4392
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3068 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c23c28a9d6b8fd0130a4007e17909d56e610b367175a2116dadb0c8e478bc9e3
MD5 05baf55e5e5b86191250c14e79934ae7
SHA1 acd93d456037d389a807e748705612c9187902d8
SHA512 4196bdcb45733f0f9938a7afe6f1995d122c0e86f86cb19882a9c60810d97018895d7f5172713ce5ba70c9d69ed665597c3842abf6bf4110f3df556997aa60c5
SSDEEP 49152:db+632BuPkFKRrdE6ohvstBhuXjfS4LWxnxDmg27RnWGj:j3q6sjBKD527BWG
TLSH
T19BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 9dc12ff9a63e67e55ea84af2f3a5551a7625f449d38fb40de8403d63fb1e8737
MD5 1ae793d7f2c5e67b28b206b6365bbf05
SHA1 43198e40a7489ac814f89ba40d5f00313ce83fd8
SHA512 f339ec894cafc202fbffe7b96ecb37239975eb0b11351cc80acbd5e6f099a024b303c7e996190b6beeb94b81990c8ae3ec28de2defcaeb3ff44716ff5441fe65
SSDEEP 24576:PXYfDtczAKsqjnhMgeiCl7G0nehbGZpbD:6tcLDmg27RnWGj
TLSH
T148650129A3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 292af1ce8d29e94d6d42344684372392cce6426475f5244350717df64d69f991
MD5 d96f52153e3ddca0b89cbb721e488d28
SHA1 14af972a4c16509d49ad956435a61234f4528834
SHA512 cefc8a0ae20b7332e86c8fd7c5ca32a1603a069f9c5649a57f7bc1dada16da021a76764d8f733d09badaf28e543b35c7c80c8b8b169003e526709e27f45328e5
SSDEEP 24576:W0Le5ji0hmxxrMlsqjnhMgeiCl7G0nehbGZpbD:WPji0AjMDmg27RnWGj
TLSH
T1E9859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 cfaa9f044e3181d6420618157ea6950514546ff4667d22ff2fc59613e7e7c29a
MD5 b39f7fb96b762284c6a132ab6ed6b397
SHA1 28d1feb37c1d084adcf86ca0cf39459ee3e58b30
SHA512 7e9ed60183ca16928e818b5fa112846dc0b6ecd5a688eb0c6f5b957a971e2e4cd6ee286c444e3f98fc6ef325fd39803da31f631c61e57ebd39e811540601fef7
SSDEEP 24576:6a7/ezSC6vUyD/aqgrvWn6q8wyuHsqjnhMgeiCl7G0nehbGZpbD:t/ezSC6vUzPveHjywDmg27RnWGj
TLSH
T134755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7e0233af2566167d39d5b7f79f49d6fe340c9c3946ac0a37b13537c90da1a143
MD5 a4bf2e3b6b2bf3a78adce934f40cfc6e
SHA1 0d35cf1b0f39c8bae5a52bc752a14af4e209b354
SHA512 d80f573fdf2185aada1bd0e2d8c87519182c2e304a844ab7fbf70c4116d6aa27bac10d6919817285de4d2eb95d1a36f25aa479109d718fa0bfc7e14e5b11d6da
SSDEEP 24576:LVbqPb88hv/l+YWsqjnhMgeiCl7G0nehbGZpbD:LVO88hXl+TDmg27RnWGj
TLSH
T1FD559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ae17d49c752fe4ef18fe274b06117cb329d8ae92e0f2eda5bd3774da5493189e
MD5 0a980829f4132fcc7802201aa694fd21
SHA1 9e57867f012086e97da1df7cd34e5acab01c8dbd
SHA512 e5fad15dcbaa9cd3bf8141f1f3361d2c5e3a22be1401c785edfc179f4d0a3ae0bb090cd6a166071a7cf37183b8b26b2d35d364b43043894f77d7ddb52765c060
SSDEEP 12288:RLVvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RLhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A34523BF865C50DAEB7608B5C3E9F11EAC137E56982008436A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 3700ae054f3c76dd77266b22b94b092f4b99e39297e69f805c0f2af77e68f048
MD5 dc0adb753a447915e03be7b1471d3c90
SHA1 5318e82778c08487295e604964a5c5c1fd184418
SHA512 d154e5bdd82811fced4cbd5badfd2c8b33ab4585e411772b6a41a7cbb20b1c7edff79baabe80eb78f0fb365824515f0c9f90225d62dd916704bc6a5af11b7325
SSDEEP 12288:oeBNUbTVO86U0vXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:oJIUOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16265CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f604f2f1e2407010b444c589b742fcc6616392d763cd040d2bea5fd9b729c3ee
MD5 3ccce3fcc92c21f636cbb8fe86c01590
SHA1 97d53665e789b1264b05d96fbd5f4fe7d0d58fd6
SHA512 02e892deaffe0c0a278b6edc96bf595f65e49dfddf2584d6ae23cf977f4f7f0252b12f6e574800a330ff686d52eb94d3ff7f787c7738d66a4c3aaef5d2ed7049
SSDEEP 49152:TQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THJ:TQvGAdlCEL8c/DRNw5CrD527BWG
TLSH
T152266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 b152b563ce1fdb5efce4193de11e7f5e65523d445cc59b19aa72a3efb5741289
MD5 c5b2d471aafc570d5d4987a795806576
SHA1 6e87c18ef66275179238333ff46409100537ba7a
SHA512 e0592f76319b6ad177016e4cc8111e8e01b36e6b472bde9409cf975e3bc94045997b69b134e524fae415fb90f17c0cdb0795ae11678fdb5a6180fdb1ded05897
SSDEEP 12288:NAwSfxL/2Dc3RDLLmt0LDQewsAjCvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQK:+0ewsAjgsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16A75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4d1a8f199c6dd9d668d3c744dd34683206dc02d9b701477b21d0a49a344ae339
MD5 5db757ea01556700a4001b7c7fefe55e
SHA1 1bb090c5e015d221075b941dc7ffc169c3cbb564
SHA512 17710c07ef7898ee4e1dd6da07c05068c07b581889493ebe954bd2be7de6dae41eba92bdf6de5a6dffa1a2367450fef28ae5718525208968a6e5b9550b75fe53
SSDEEP 196608:yUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH0VQBWG:yUEtQevvqc2W1cpV2tI327B
TLSH
T1AD474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 c69372399a971d7fdd2afc89ab5485226896cc0025115f135e3541d4ce6ac60b
MD5 af947ed8e11f1e4b6626297205857cc7
SHA1 61ca1843b36dbf9b75cf30f15f761eeea80a7436
SHA512 89e8e3e29c8a0ffd04c34507b0cb7e9fb7a9b7c33d84ca760bf4a38946352a80cfe2d3d977654284ffc6f12090ebb27c7cf7fd470a4d430b975daea0207d3fa3
SSDEEP 49152:TCbRquA/m2yL5zTfFiV+XenmE3/z8Dmg27RnWGj:soquVjnm/D527BWG
TLSH
T1AED58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 434b610740efc04697893065f5d79c40631a055db21790587f046df1d08973dd
MD5 eeef70813d250a13518755877ab2d618
SHA1 db8c60588e98c0eb0c079c6f73dd0d1bb0376925
SHA512 1d8deefb5fa5371907434ab5c250142995240ee78f8e0140dfbe99de60002b83105336fe160ca92ab627b3b87237e8e55effc6e627d6cc69822f329224c260c7
SSDEEP 24576:VAhGL3IFoiwtA5l7S53rsqjnhMgeiCl7G0nehbGZpbD:VAMUFoiq5PDmg27RnWGj
TLSH
T1E3359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 653f822c5c5a9ea10c67d9a8037def47efd89cf97cdc4d047c6c26d18824ff3e
MD5 0bfe3bbfc9783015ec5a690a3c181600
SHA1 9f4cd3b06f678fe0f6cd96066b8e91f48ac91654
SHA512 28daac862ddb5454be9eb7d37150376edbfdfc0dcf5f7671913c7f9351d3d2061c94e96bdf7d6832df92d77dc3ddde34aac6e1227dd83f3b3a87acc47e3bb670
SSDEEP 12288:Rmw5HEjsChNVBFgl0WDm+CfvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83i:Mwu4OW0sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F465F14A76A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 46e5d674fc650496df6a6a83f7c8c6e22abf10fb112376739ace483b41afa79b
MD5 5be615a29dda7a7eb1e202b4078aa045
SHA1 470598c67299f75408b3345bac06e681ca2c8220
SHA512 eb639516ae776b4ebaedcbd3712d0ce1009aa8c3b5f475604ee3cd1de56d71a269db298338969e9c0be7379bcdc0590e7a6c32accb6c0746219729a31697db29
SSDEEP 12288:eeZ1IyyvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DZudsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1485512AE239820FAE163417CC5E5D609E7337C62673043CF16625AAA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f936719c5873eaf472b8bd01e0f1ed3e10e8294c4a9e613598f2eac4a498b050
MD5 c1063a667995ab95fa7bdbfffb5790f9
SHA1 77fba9cd3841a98ba5b585794b5bd673765f42e4
SHA512 d17757ea86b2e88faaa60bb562071845f5f9d171186a461a5f14caf2dc5e34f06dc5547d25c51cd68ac4a6c032442900596369c29beacbe6359d463637655257
SSDEEP 98304:KQRQyi36YOcPbLvw2gAf+PN3mD527BWG:hQyiKa/X+PNWVQBWG
TLSH
T1CD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 271ee2d0729d4f1a4a063877cf4d5a3fdc446f28088a1b2d82681f84a41a83f6
MD5 c4b04f7889fbdfc7d38ddb0c0fc58c1c
SHA1 fa42a3bb0062eccd1adfa25f0c79dd64e05723f7
SHA512 389e0933bd7a6cafcab45a268485a9dedade705bb8e90a8eae4dbd171d1355c9036715453071c23a00d03bac0f17a3daea319e9e24f871d4021c4c53e4c2c35d
SSDEEP 98304:IQRQyi36YOcPbLvw2gAf+PN3mD527BWG:fQyiKa/X+PNWVQBWG
TLSH
T175667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 97f5cd5aaa166c7074b2399ddda4872ed46fc9bae3a2f250ea6c6672aa059cb3
MD5 efb52aad43fe24a31f769449e97034c4
SHA1 50026d12a120c8228d5e243f96b3fde28dec0b65
SHA512 93471e31969a8ff7b88355c821f88283e96bfd954a507312ae60b88a156025373a9e75cc1344487f704bc0c8d52e50b08c4db36e6d27fca96ec525e31c81624d
SSDEEP 24576:SwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0NsqjnhMgeiCl7Ge:s68Qg55nhceWu7PNU3/MDmg27RnWGj
TLSH
T104B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0fed204779e487e856b6efc513b32141d44e83a26583ff1932bebab0c77fc81c
MD5 30592c33f4c52c6a7237e8b55d2bb161
SHA1 a5947b6ed4cfa091e6ce94f06599a408275e9771
SHA512 4db71a1e55a4df6837a07a4b1c7292392afd228d93b0237fa4194d97ceed44926dd1c4eb991ca3020e84f86186482e6cc4a6a4c9d7e3a56d91f57ec1c6e70004
SSDEEP 98304:Ey5112gYy5azzVvt69nLKnhZ1D527BWG:FLIHEWhXVQBWG
TLSH
T1DB167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 dd47f9bbb8344ef7a79f1f8284879a42ee79eaaac7fbf3599b18e07bbcd692a4
MD5 e9b6f1371117953a21823e07e9c83ee2
SHA1 147277209a3c6d3b2688ea0c911757ec2af09829
SHA512 b3c5d4c560bdd20a32e6e1c701ec42278b4666ede16d89236829dc720305067ddc1bef70328650953f71d43b14ef57b4720eb1b0c51c4cc100862d84d2c7838e
SSDEEP 49152:HB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glODmg27RnWGj:Ju6Jmdxd2dOD527BWG
TLSH
T15CD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2e5ffc93fb5003af141fa417b5da2ccced7f594cee4e249a8c8dc08b5230fdd4
MD5 0a014cb9120d7f10efa736bee7600c5a
SHA1 5a38e26ac35861b27d083f96436e4fe44ec0e3dd
SHA512 c596da9e23c262d7cf4d59c641678599d60c6ef774c3c3506f1456a418d3684abdaa8d4cf70d46f7e959a5dc42d86e7f4df4197956e016e793555a920bd0bbac
SSDEEP 49152:n1hpsNoJpF1A63U44CwH7R4xCDmg27RnWGj:nmifPWR/D527BWG
TLSH
T113B5BE13F2D800E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f28e256ca77a5a4b03a8091ddde696d41aca05c4ce414afcb3c3e6363d292cf1
MD5 557aa62725f6690354c5fa0b338b9429
SHA1 9a9e00b58d24fb61d0db3827defb7882644d7681
SHA512 f030868f227aa8fd2b543f30b4c170268fd7981a5edc0abef76b7dc173a220fe9b7c6094c0dcc23ec22fc4b59d33e1290df6904ab9e70d3b16a3ebf604fe28e8
SSDEEP 49152:QSuZQIY0Be2KcRVtOnks6NMHqBDmg27RnWGj:K5dKii61BD527BWG
TLSH
T11AC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e565a6782ae7b296452479316c910c92d7f0c50ad4bae4247a64e5f33e7004d1
MD5 a0ffdbd212fe309c7e0c15ccd497e53b
SHA1 5526410190298fbf13e0a73c6c7c930ea51d25be
SHA512 734f11c0aaeb7212e317582eee3f9dcec5bc169aeb34384bce2cc18c178038fdd9238bf28e16906aa2443f5275e3bcb8e33563b41bd0f3316b3348bb3308b226
SSDEEP 49152:thtSn8EApI0fig3giDn0AP5weDmg27RnWGj:8X2imphjD527BWG
TLSH
T1E695BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 258252455d290f774d576a0f61cab61e0363cb4c7f9282ef5552155df71b4652
MD5 965c7a7fbf867f7c0381864e3a2932a6
SHA1 a11ed8977e14378c60b4b82e44dab9451fbc0512
SHA512 d7feb581a1b816019c5bef596f889bd3655c627e72b684a3632c094eb1127edf6bfe578417b9d446172da9113fbbb4a9a83b793bd9f79f9ac66e93a867728c53
SSDEEP 12288:FtvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1734523BF965C41CBE52649B5C3E5F10DAC073E5BE92004837A977CB9FBB24984B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8e8222d484870dc85950edaf46170cbafaaf5aa2c6272b11a128bd8b27755afb
MD5 d3ff124d9b52aae7288faca4b6936610
SHA1 1bec7fea400a5b1037e3ee0faf4540f0993bd417
SHA512 3123927287b38e60871a556068561972ec75bc561aaa383d6a5479067cc812addb3d79fd3c53e39ceccc6c0be2da834e3b89d19229e3bb43c35b616e48461020
SSDEEP 12288:KmvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FE4523BF965C41CBE52648B5C3E5F14DAC073E5BE92004837AA77CBAFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 a2620fdb8b34072f8be88afad37ab669f2929d2f50d1410f1d785ce56d490541
MD5 6ff945d555f91cbcca09d323d83c882f
SHA1 6c74a3544a8fe3465c32ca73618173218584b566
SHA512 70f2fce40504f2b9ec268d305a8c5af8ee388107c550e52c49659b90f905d43d9084cf57c5bf92d8dae25d6b1c920b4081c3340ab4b90ac8208ae71ff40a665e
SSDEEP 12288:yMvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B44523BF965C41CBE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFAB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 e9204dacfd80238850b9f01ba34c4a29ccf9f9857e572203c7150c0c5e428442
MD5 e47b5a46b6c50f5b1faea70ae3ea5eb9
SHA1 f23473129b20a87344e9b3cf3afe1b72681bcbf2
SHA512 d2dfe4435ea2ddddbb3fadbb067351ce3a2d0b31efd4a45a82394dd20002ec4c1d2d1fabccaf458e1e9f9296c40b975160b151a0b779c7d223aa0e6278ca603f
SSDEEP 12288:hVbvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18445236F675C01C6D83285B4C2F5E11DE8237D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 ead3b373c4aa45d72c1b05c83260c54ac846165ed65e403187487c838438147f
MD5 05b8841b7fcd56b999942a588227a329
SHA1 4370533f76731c7531884a11ee77ee6a07ddf939
SHA512 8186085cdc71e33f79f6efcc28b0b1d15809070012887f83d93c67421d4cc7149c2ab46da3001fce0b8f37d10a73cff11e5a2e13b3cd2ca9aeb03741a4ff56ea
SSDEEP 12288:NjvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18C4523BF965C41CBE52608B5C3E5F14DAC073E5BE92004837A9B7CB9FBB24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a917c224708d259552764b0d42393bf9121c717e367548aec015319ca0ed0c55
MD5 9842f9c1c2bc50b50cd2c4ee0b395bff
SHA1 f709ccfda6625c5e1936460bbb98a1a5a62ae5ed
SHA512 9122dbf488aa798ded0c915b474f4a9dbdf8621d9891ea08c3e20c2f834cc398c7dde45c7ce71e930b4d18aeca645ce7e0a92a16e080124b4b843b08dbaea2c0
SSDEEP 12288:r6vXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FE4523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837A977CBAFAB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 53f280bc56c51a06defd04816afeb0b4b06d09846d3e475c4cd220acc37a4c2d
MD5 29c678fc4a7bd20cfa55b3264760230b
SHA1 fede75b8078bdcee1fad03ba7f17f1beb366a91e
SHA512 458e71427cb324a4ee42f316c1a9cdecb49e681be10a77a4de366769598e9b5328c5c5e2618d9b901ff12aa82ffd8323e7fd1f45b35b9b593c47dafb4217434d
SSDEEP 12288:NOvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:NksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B84523BE965C41CBE52604B5C3E5F15DAC073E5BE92004837AABBCB9F7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 9d274e71014c26e4f8627d8a30cc2e98e4fd0b3dab8901e7735fd5cbc35d20b1
MD5 1702e8f118dfe0efb05d7e97768838ff
SHA1 2cbdef4155dd056b7c706ae049c366c861a02113
SHA512 e2453394536d9c163a00bd13ab151d14c7e5d93d01dc7fe060f3b1c81ae2425444122fef3175250ca91b930d2782498ffd30d861756ff381222da3affbf45af0
SSDEEP 24576:zZMRzFVSO8sqjnhMgeiCl7G0nehbGZpbD:zZMRzfUDmg27RnWGj
TLSH
T1A96501A9B39018F8EC63813EC965D90AD5B37C5A0B70C61F13A5366A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 2545acaafab8123dd40ff2b7070173be740ce5602e3694d4a188dea00f1aea95
MD5 ea9252c08c6ba83a97784c8c8ed81011
SHA1 cd2d11e2a71f00330a7ea1e7dbb678c76acbe870
SHA512 89c04ca1df9415bbda2ae34f5e511dc4ebad3c6f47235deebf884d79c96db6d35a1291e27d0a0434be45fd93ebe79ed6a9f067c6dca234d17b90d091dc3926a2
SSDEEP 12288:hZvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:htsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18D4523BF965C41CAE52608B5C3E5E14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b3d2eb79be0b6188ad75bc2cf52f42915432873aab013b149539d3cac488b46c
MD5 ce79787ee2682cf7c54ae6b93ff6a30d
SHA1 dc96ffe15fabcd3ba44d6a948bbb6669d22f6f9e
SHA512 08605ed3b694ae86419e774afd63b87e44a17c31977ebf013c15c6303f39c77b4d34691765083a4a2db562440a3ec7926a74c9033e8e25055dbcb37722a7c8e9
SSDEEP 12288:qFvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:qxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BD4523BF965C41CAE52604B5C3E5F15DAC073E5BE92004837A9B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 9c3f7e9846d034384ea5426ce6da3388fe0685d728d812f07744ce74a75ef19b
MD5 87f4a7ffb3238b4d928416343b25db4d
SHA1 97712fa250f54749495839dd17081fb5ee1c4814
SHA512 9e0f063fc4c0eba885af8931d117c760e6bd0f326f556901521ca448454cb1119e5634d0c93704b30a5a3c1319103e8b31c23a7e6a91988cfe1a1c921dd5b618
SSDEEP 12288:eyPz5L8yvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DzywsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16155125B73A530F9D1368138C5A29A06F7337C3647204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 2a91044d846c1b441f252d6161676ef9cc80bb7e025f0bebb4297095c536d27e
MD5 9294fb101c8a8c183ee8e806c0538fc0
SHA1 735a3534794583a54c8395e58f5b7c3512025bb9
SHA512 36b0c397178c792e6c262dabe3a6f5b2a9b0a4fe43f953cff7c0d6a9158c11d660da0bdb4ef57e5007fec3f78ff612ab06a3fde4501a15c320b355dbee5d6a88
SSDEEP 12288:XZvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1464523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 9c16b016bb5690af36c2baf9fbb7bf0c599a5529050afe296f817375768ce0be
MD5 ccad8f87117c5ce948f2128c76075ca3
SHA1 51c0dd19a1435209cd78bbbd367f1f06a2c5d03c
SHA512 c58781e1c368d755179f654639f04e5974057e0fad579af16c7f67d49d9e282baf83c6e901114b38fd1b3c90c8120616454bb319a5f815d5a107269856eabe7e
SSDEEP 12288:GZvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GtsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10B4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 3baa511d5554236c9cf821a4b5d8468ad95b2910cb6137e3ea5cd6f22b9401bb
MD5 c7669e39bd999a4f8e86d8b7ab3af03c
SHA1 ec341c8e98e544d63f7a1f7e71dc1ba36e3e59a3
SHA512 6d8e9e171c15c299a12e3544cb82b7c893f111d31ae458f06a97859ad15d052bc5151d0e8e4f8e5032dcad968771cbf0891b681fc38b04b0be59bca5051d6acf
SSDEEP 12288:CyPz5L8yvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fzywsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B955125B73A530F9D1378138C5A29A06F7337C3647204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 1da8a771a0859761c1aeaa236206f71721f40733258fbb664795fed767604108
MD5 9a49db6dad4b369e5036ac455a2db11b
SHA1 cc7ff0d98f0f7c0d07034e95164a737c46d9b8af
SHA512 afb34ba8e8c4e823aabc48015677969ccc4a91174506ff9ff089128d733fd581e70d343a9160f8b018f1a669813487a20ec01a1431fc62e905698258acf6a848
SSDEEP 24576:6TDaLl3z0zD2sqjnhMgeiCl7G0nehbGZpbD:6TuLljbDmg27RnWGj
TLSH
T1226501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 4a9dcf3d85241f2f5f1ca71753e3415bc721680e2f488a3840cbd3d2a26f074f
MD5 bbe69ece02a48a7212de4e2cb846330d
SHA1 72c2c8e3cc73af9a0987d3c141ee8bca8b185da1
SHA512 1fa548168e5423877cde456d04bfcec22af7e82ec7363df46a6cd194f488bd33c445da332b1fdd6d2e87f4e5459ecfee98471694c28d6750b9b6e6486288f1b6
SSDEEP 24576:H3vd9CHKy7GZCsqjnhMgeiCl7G0nehbGZpbD:Xvd9CHKyaUDmg27RnWGj
TLSH
T14E75CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 c981a5bdd0d800263881cdfc0004f1d16afa410dbf93557177d77ee3cfde5654
MD5 d96af256f3ef3daa83113256e3422639
SHA1 b74af41baf6e3c0acc15442087e81c25b1437d20
SHA512 8d6aa20d422cb5887577919b5f9ff7fd5274ca86f8d2e0c170f2d0ac9f5373c66285378c62f2a1ed2959af643cf0efb3c7d625f196f364975d563b353d371885
SSDEEP 12288:SsvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:SmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15B4523BF965C41CBE52608B5C3E9F14DAC073E5BE92004837A9B7CB9FBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 05c42ca6975a62fc4f8f9f094b14fb7139aa3932ef6444c4fbe7e2323fcb41d1
MD5 5c5e39cc0225b46828a6653d757cea2b
SHA1 da38af73b2a8522cb950f1f572271ed7e18550f2
SHA512 c79db892df24303175318f4fd39759a691aaf3e796547e2e9ba5d786eb10336654976dcf2822eb349c5ce74e07c2b22e5c84f1521286d434e4c0fb46b092dbb9
SSDEEP 12288:9SvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9QsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17C4523BF965C41DBE52644F5C3E9E10DAC073E5BE92004837AA77CBAEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 51bf29452610f555a8fd8af02713a4bb13c12e91390848d52488d40eb8886611
MD5 3d9e9908c92ddb47bac6b30bdb3327a7
SHA1 1da61e56e52a25fee111d65c8320f56bba234b6e
SHA512 713c0a4c620a686d30d30ffa4817d08d96770dc0de61d32616c537b0cf4db7c4e1bf6d7ac43cb803093173ab07d5a239ef92d250390daf49f390f0f8705616cb
SSDEEP 12288:JHvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1304523BF965C41CAE52608B5C3E5E15DAC073E5BE9200483BA9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 0d054593e0f4a06a19252b330d1dd696adbce88a4ab4153afd6c956a25219156
MD5 f43371ce110ab6b47ff25735f1200e21
SHA1 b03f2bb7d769f0197f56b77c65e8df6fa7bea98d
SHA512 c9c8f416eaa9a8959d741570c00d1de417c599250f276c4ea7906e0edd10d48920b9dee6c11f48d15f4750eebe1796e8acf9bbe0ea92f09dd80ac9eb95b1e328
SSDEEP 12288:IZvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ItsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11A4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFAB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 21b89af0609cffa0a6740b935b5a925d10a6949aa147b29d524cb65ed1ee518c
MD5 c178d7fcc6c3742575f79953f6299db7
SHA1 3c4a820b35252705768e1c5cec180b62bd9a58bf
SHA512 398531ef722ae1624c1e88fe4475ee161687733974ec6e5f81b693c86fad3d8dd5c822d5ed41e702958c539ea7e7b1f53cb7ca57b1cc808ab8d28b286f64562c
SSDEEP 12288:vsvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C24523BF965C41CBE52608B5C3E5E14DAC073E5BE92004837A9B7CBDFAB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 f97ba8eb539e01bb9c241fdfbfa0d35144b72e86614a37d0424077cc8254e244
MD5 c6c5ee68e7d698b0d57e2745c57eb7aa
SHA1 d8f4df08263bfca9849727b8ba3d0501ff9b2fa6
SHA512 ea9ea686891bf1bd1e29cf5ca5afe3922aae0f5ef5c999e6d753eb2ea61de3d222a35792bb12cd14c5ab39e3f4b7955643f92ef31a3bbd533f9dde42718e268c
SSDEEP 12288:TBvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11A4523BE965C41CAE52648F5C3E5E11DAC073E5BE92004837AA77CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 9e2dff3a95b2beb5d1772e670d0b1a862ae39bdd9dfc7226610cdb0878d80849
MD5 124ef46e852f754ba94423b8476410e6
SHA1 2092e045597936f5a3da5e8aa75fa7d72fb56083
SHA512 6edefbc5d68474042fde1ca52bf0e7e5d599a9489390272946b84f5c83682d3614c7b13f1a76012a0af6ecb98fc5786a61be8b8c5955ad812230df35417d2ba2
SSDEEP 12288:AjvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1784523BF965C41CBE52608B5C3E5F14DAC073E5BE92004837A9B7CB9FBB24584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 86bd1cc4339b4b16ddf8bc7cec071e12d243ae396d4b5dff3d00dd217389f12d
MD5 bdc8d6b473b9f8e37704fa1ca800351a
SHA1 d9c3d621c6c9d5762628c492b3e65c124fd4c0d6
SHA512 6af7c53ebd16d650272645c67c96f2c4ae83fadadf99a8818b9a98b48dada3ca6d783c9bc1ecf0bb4f14554c629762e28f270fa13adaec4ae5346e91918f555a
SSDEEP 12288:lkvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:lesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AD4523BE965C41CAE52648B5C3E9E11DAC073E5BE9200483BA977CBDEBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 1d647c65726645664d005389fc2c844594766d78e73edcbe9e167c6906cfb713
MD5 4ce3b3e9c5dc0457b21b77fdb1eb37c0
SHA1 7ccd90af36dbd1217ad0042a10fd8c5376de9c0e
SHA512 cc6ddd73aba2d89684e5c95addfa70b468c0f0fe06193341d75605d7d1e8a728a54d9213296544bb57204132454179e8edd35fa59a4e42c3a0cb6b8d27114bba
SSDEEP 24576:LfwvUk9RX6wkyAIBsqjnhMgeiCl7G0nehbGZpbD:BMnYIVDmg27RnWGj
TLSH
T16F85D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9c6754d2ed2073deb553751a029bdbed99278de856dcc24958f6f10eefb3dd03
MD5 cb2d29cc39e0269b356f664c693b70d8
SHA1 26ae4937435de38759439a5ddbfe1be20eacbd8d
SHA512 3bd56f91b45792d023cff99ac762dcc900af24cb8383f04065647646fdb610b99e54dca2ce16a966548d45ac15f0cbcdbcbaa4b27b8c23997811f93d1c1f5aeb
SSDEEP 49152:EYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0+Dmg27RnWGj:zySzPGD527BWG
TLSH
T17E066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8f80d8ac149acb3acd74c45bab58b4c71be10a1884dabc83cac681baf61c2ac6
MD5 2dcae90027d119a605269b0b7ee0db8e
SHA1 119222aac90cbc494524537ba895eb2dbb1bc267
SHA512 e16ecf15876aa1de22b0cafc3a143b19b09e481b28e34396d76de1053005995a51e8980df0b9185aac67586890c61d11e4ae9fd4f44c072f1153c193455807a2
SSDEEP 24576:Z47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYMsqjnhMgeiCl7G0nehbGZpbD:Z47JUQjTirIhCnDHUPfF/ODmg27RnWGj
TLSH
T19E65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 9dac95d8a71f5aab41219c91b321f6f563c7f805c300269cdc9ff9c67a4e53ec
MD5 c3b9ecd426e739a841c52c228a06a8b9
SHA1 260cbe2ed036bc5ba2d74bbe839f8a0b3f64b6f4
SHA512 59dd33e2e1bf0c682ecffb2da28adfa0e93266f827fcfdbd65deb48b44813b41f43d44dfb2299a9901a93a2992ecea0600d0c11fe9d501f1ed1913030ed95629
SSDEEP 12288:bbsfpvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DA55015AD29802D9C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 3f58efaf08ffe6dc9a09af7cd87ad08f15606e107eead483e7f022a6698fe0b9
MD5 5a2daa641d2803c1c35dfdc931170255
SHA1 d7c8cff31b6fc0a13495b055dcc50581b5452b96
SHA512 3e6326d584ede98b20ffa482b287fbfc2cd514349ebfcb7467df4489c6bb4086baf659a3d206899727c0297b00ff9c14075c5ef199778d34a3982d6662e33f59
SSDEEP 12288:bi+xd6U3fDtIZYsYn+6A6Xuhjt7oOJz2FWWGUX6oFDJFT/Bb:bjxcUPDnc91t7osz2FpNKoFDJP
TLSH
T139452840726AC78FCAA940325E36D6CCA7707D01FE056F0773C9873F9476668B6E6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 95f782fa3203d9ce8bd1ea3233449d00445abeb6da1cd7f3e7baa5b1d86f6f7f
MD5 ea477604dbb617821b01f9c9de56fc53
SHA1 634ffc0931296de31771682069f6216dce1280e2
SHA512 3adf1f24a27bd67ccd450549c01900fe61e9dc787fc320aad1d346b03625b774352044db6e78c1871af6179e8dfac23ae9a0225fcde8d0c404193848a37c412c
SSDEEP 12288:b4K0KuRWaK1shKCwBu4FXyCbEplHbvjw80f2aIl0yRi4n1:b4K0KIzESj336tY0Af1
TLSH
T1EA450940A5A7E35FCDBD9037073286CDABB45C02BB453B0573448A3C98779BEB5E6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 23230ec03414c2174df6b6d9c249c0ee6b2489892465d0df8b695e6ca3be5100
MD5 f21d66a21b65547bd558457fcb37ec9a
SHA1 05743d8ca9343cdb43506c46510b5befbb648db0
SHA512 78e47cdc271e1f22a5f859f5e15729c9a16a910ee333163f6ec35a41ca543140b29f9d1fdf52381c0fb4ad09757b71068c9bbc7725fe2bab3fa8540048fefea7
SSDEEP 12288:907RvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2FsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15945237BD34C518AE83609B482EAE12D681B7E669F1044C3B91778FDF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a5f464df5addf57f13c81829c94402dc2ee4b4cfe559a9106f6805845e13fb0c
MD5 4aca0a61cfe74fe9d62223fd076ba22c
SHA1 eb1bb4e72fdc8fdb8166a44821b6c66247f22b06
SHA512 3150e9dbd1cf8c15c25a19237cf2f1d449655d2636e23997f89144818359a0dc46651b72900b25dfdeff2afe3b584dfcc4e0cca4588ffd83e258eb364d00bbd8
SSDEEP 24576:Mgb6bmBIi49WNNFpg1rSvFv7bYHsqjnhMgeiCl7G0nehbGZpbD:Mgb4mBIBhGF4Dmg27RnWGj
TLSH
T1BC659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 c50625deb597d60cfbfb3bcfceec50804caad16794f2a5d66996ef86d3579800
MD5 8a841d5d5f71bb6ee2746e9938dd8257
SHA1 f15293de3395721e1e839f4aa3b4e361f170634f
SHA512 e2a2f0cf4aec2d8aa1b714b83c60118629fb1b3d2835e322ef11abf598b0d77cdfd8c280fee529493540fa070f4dd1f1cb5fc68b6b0082c0bec6e5d24b06745c
SSDEEP 24576:LG88u8FpJqH1bzria7/m8sqjnhMgeiCl7G0nehbGZpbD:K7ZFPqVea7/TDmg27RnWGj
TLSH
T17E85016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 e3f746795a76585f594eb548fc8c70bd41d3bd8c47ed98d46ce15a2351b7f4f9
MD5 bfe4b85c830c571d982336176dd5c32b
SHA1 ba7f3620e0b49ced4bfef91a4ca8040368c311b4
SHA512 d16dafd10b7a6d4ee552ca666a24eae22da8a2e998874adcc8b319567aba1e1b7dd3631bd1f15f1b95b8588c66c8be4e0455ac36bf981d274b8c6f7ec3ec1b4d
SSDEEP 12288:DHvUrBFrEjwaQqvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DX:DPUr+NQosqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C465F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 bb06208b9f275e70ffabceae9376c59b0e43767e9f2f345ed0d0af12dccf7af4
MD5 15a550b51623fc31cf4c0bba6bfa3adf
SHA1 bea15340263655988924c4d00b2ec172c4ce56ed
SHA512 ac17bdbfdbe82248a1d08778faa151571cafc71340fc7e3dec4978636e0fb35d496e7df00c8fbc3e72b6f44b3b5e2d231c874608b3dfcfd3f2abc7c508b4d86d
SSDEEP 49152:eBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjEDmg27RnWGj:hG05lO43btD527BWG
TLSH
T1A2D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9bc6676a2652d83a33b4596a20e83f9fc594df6d891746b228d3e2e8bba0ede5
MD5 aac1e1e78f817be823c8d16b41532c13
SHA1 96aea2a16394de3d34958376e0684049b3080ebb
SHA512 37c00b08762067cf071c52bf2f795af186112756a26f37b6dca451146221754cd434555e517b3dc2bff365d84e25a1842d1654eabe0e6d5600ef7dd2e84e0d1e
SSDEEP 24576:bfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnqsqjnhMgeiCl7G0nehbGZpbD:Da5POZ3BJt2pasx2+mMDmg27RnWGj
TLSH
T11265BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 277dffa9411e2c7c98dc441e6d1d88e614888f8bf6fae27776442266161cb866
MD5 2aff8f7bc12d5be709738d9a2086e263
SHA1 162cde5ca38cb3950ec7d6e084ffa37e5341c9f6
SHA512 a09bfc4499211dda94415052d4ee6560e581da719a0ba809fae328f9e34fca72070854ce38a2f3bc2c23879860a97de00272c96f3bc300937e49c7ad7b02cc28
SSDEEP 24576:eNcwHdjbyQ4nLC18lb/EOjowL7FkUsqjnhMgeiCl7G0nehbGZpbD:eNc/zEOVHFzDmg27RnWGj
TLSH
T1D0857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7fcb48be0b27b6cd5c904de0836f6b8116f8b40496c36ecef721475ac17aad4f
MD5 54860ddfcda7827e5ecbcf74684dcb1b
SHA1 ce8a04b35f6c339fc7cc5c111d318cb04053950a
SHA512 4b14ac7bb03134dcf47a3614f36333fb11b2769e8f77d3810b41d2e4678ceee366512e49c86fef4673e0cff45f05e2f9c3f64b6976cb4fe5ef05ea5762ca1225
SSDEEP 24576:KTkNvNnaFeYhJNtmZBmesqjnhMgeiCl7G0nehbGZpbD:KTMwBtOmyDmg27RnWGj
TLSH
T17255AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 6265c4da5960703ebbda49e07373cff52745fca56158dbf9f6e3c6a1350fb1b2
MD5 f6fb9991e208048c7e19ec937dbb7b6c
SHA1 01d4ee491be4977dd562c68ee26d25517c05c573
SHA512 6e536118f407fe877de0bb58aaaedb5cf87ac1a517d5b58da22daa1316c993756a3463360162c9b864fcb3e0e529e8c04c80beb5856f8ab8b30c17e6495f9a94
SSDEEP 24576:GD3FHshBIYQgA5sqjnhMgeiCl7G0nehbGZpbD:GDVHeBIAA9Dmg27RnWGj
TLSH
T1C175E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/264-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/264-59-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/264-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/264-286-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/1776-309-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1776-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1776-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1776-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2196-77-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2196-302-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2520-92-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2520-308-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2520-306-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2520-304-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2520-99-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2520-93-0x0000000000830000-0x0000000000890000-memory.dmp

Download

memory/2632-305-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2632-113-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2632-106-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/3472-15-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3472-21-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3472-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3472-105-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3584-301-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3584-71-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3584-72-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3584-65-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/3596-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3596-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3596-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3596-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3596-134-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4412-6-0x0000000140000000-0x0000000140248000-memory.dmp

Download

memory/4412-76-0x0000000140000000-0x0000000140248000-memory.dmp

Download

memory/4412-0-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/4412-8-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/4412-7-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/4412-310-0x00000000020B0000-0x0000000002110000-memory.dmp

Download

memory/4412-314-0x0000000140000000-0x0000000140248000-memory.dmp

Download

memory/4664-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4664-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4664-130-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4664-125-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4664-119-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/5068-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5068-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5068-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5068-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5068-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5792-87-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5792-81-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5792-374-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/5792-376-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5792-80-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5792-303-0x0000000140000000-0x00000001402C9000-memory.dmp

Download