140a2bcabe20c8b7b922bc8519c1ccd625e1f062607c73d50e27838504dff4aa

Analysis

max time kernel
149s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
Size 1.3MB
Sample260823-dph3hsxsc1
SHA256 140a2bcabe20c8b7b922bc8519c1ccd625e1f062607c73d50e27838504dff4aa
MD5 a700d7d996c6dd169e5c218566cc3998
SHA1 aa8ba12f981e3741b2102f4ca87f9c26eaa8e8f9
SHA512 82fc9ac520ed7e0a06aac73a65d8d93b9e182bbe4349726b08bbabc54d31073e2ff34fad3a9c1cb5fd9f4008b82538f08082cab36ff66e1348eb1bb88ab81cb7
SSDEEP 12288:k/T96jC/dXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18755026BB2A430EBD2725A7581528649BB237C7957208BDF13B105E96F732D04E3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3200	elevation_service.exe
5760	elevation_service.exe
1596	maintenanceservice.exe
5568	OSE.EXE
3488	PerceptionSimulationService.exe
4652	perfhost.exe
2528	ReFsDedupSvc.exe
2468	SensorDataService.exe
1784	ssh-agent.exe
2108	AgentService.exe
5052	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\bea12a35e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000077f23912ad32dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000076a0a413ad32dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009489c311ad32dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000012dee211ad32dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c1614e51ad32dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3200	elevation_service.exe
3200	elevation_service.exe
3200	elevation_service.exe
3200	elevation_service.exe
3200	elevation_service.exe
3200	elevation_service.exe
3200	elevation_service.exe
5760	elevation_service.exe
5760	elevation_service.exe
5760	elevation_service.exe
5760	elevation_service.exe
5760	elevation_service.exe
5760	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4384	2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
Token: SeAssignPrimaryTokenPrivilege	2108	AgentService.exe
Token: SeBackupPrivilege	2528	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2528	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2528	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2528	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2528	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2528	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2528	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2528	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2528	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2528	ReFsDedupSvc.exe
Token: 33	5052	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5052	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5052	SearchIndexer.exe
Token: SeDebugPrivilege	3200	elevation_service.exe
Token: SeDebugPrivilege	5760	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 6132	5052	SearchIndexer.exe	100
PID 5052 wrote to memory of 2184	5052	SearchIndexer.exe	101
PID 5052 wrote to memory of 4960	5052	SearchIndexer.exe	102
PID 5052 wrote to memory of 4904	5052	SearchIndexer.exe	103
PID 5052 wrote to memory of 4564	5052	SearchIndexer.exe	107
PID 5052 wrote to memory of 2936	5052	SearchIndexer.exe	108
PID 5052 wrote to memory of 5580	5052	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_a700d7d996c6dd169e5c218566cc3998_icedid.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4384

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3200

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5760

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1596

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5568

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3488

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4652

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2528

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2468

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1784

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2108

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6132
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2184
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2952 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4960
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4904
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4564
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2936
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2952 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f25727f73bde05783a3b33b72d48bf163a6019d0aacc7d0de1d6329b4c4751c7
MD5 9750ece3614ef07155e64b487f5da4af
SHA1 39bae80a28b50a78444f7ec00893356a099336bb
SHA512 7fb6c9f58d62c4431c082e4dc3d4a08f932d1f9080beb92b524e828084af6e99ed9ef7d7e84ca0ac75373465d29e5786b1871dad1cfb738d2ed48b709045eecd
SSDEEP 49152:Mb+632BuPkFKRrdE6ohvstBhuXjfS4LWxneDmg27RnWGj:23q6sjBJD527BWG
TLSH
T134D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 66d71ed438e1f5c7e96f83db2764c70dd3c25a9683191e8bfac00985ab807ce0
MD5 dc86f2bcb2046d85b36077323b12aa8d
SHA1 743778b7b1d26789b832024892f41572d19cbac5
SHA512 73dcf5225a5abdd9eb7beee92130aab6889ca4910e2215dd69d9b4dd6cb14644b4ecac72e6b86a7516c282f5992522fbad5e454367a95d62680a79a7aca50ebc
SSDEEP 24576:8XYfDtczAJsqjnhMgeiCl7G0nehbGZpbD:7tckDmg27RnWGj
TLSH
T1C4650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 5c4a0f1017a4cdd1a4d1c7c06f0c06980ae4872b38717f17057f6cc03ab06272
MD5 9aa33679384e1aaf531c43b8804a1f27
SHA1 c2e5ce8e219b4da1df4abe29a7bb3423c7cdb276
SHA512 91791f1a6609c722b20e424b79fc5404e355058752fb7a73aa394db7ad80c6cc7e2f6681aa9a7516fbb241b5797b787a834f595ecd586e511bdfbce203084f88
SSDEEP 24576:J0Le5ji0hmxxrMisqjnhMgeiCl7G0nehbGZpbD:JPji0AjHDmg27RnWGj
TLSH
T1F8859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 37dc7ef35f2ceb72364636e77fc51d95b581656896894fd7d3e1307a2472c32d
MD5 ccbe010af49c0494a7f3ea0eea263047
SHA1 c899b791e4ee4284683eeb4ade646ce0c4b94b64
SHA512 534d055e7fbbea628f007f7690f0651984c8ae8ffbebe6431aed8ad9d0e944b1dd207f0ac0a6461631c7fa29c910aa7eac53bd73b0fa4afbcd95df83992c2f35
SSDEEP 24576:1a7/ezSC6vUyD/aqgrvWn6q8wyuIsqjnhMgeiCl7G0nehbGZpbD:8/ezSC6vUzPveHjyrDmg27RnWGj
TLSH
T1EE755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 edcb4869577fe154a853b0f4fd01bcacb842c90fd43b15fb061ecf74eb7e99ba
MD5 9df631296a44dff94a21198ce7937236
SHA1 96780ea230aeb3220b9431325f99441c7bb6b86a
SHA512 3b2a3e8c9e72c7cfd4834d765f2ff5a57eed51f2760dbc56e38406f71c79cc57ed63dea3044363f9c9f052d2a7dbb39a75b0dcca22f89ff9de7a18116d159788
SSDEEP 24576:tVbqPb88hv/l+YlsqjnhMgeiCl7G0nehbGZpbD:tVO88hXl+sDmg27RnWGj
TLSH
T190559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 fe4bd8abb0c07fde725abb9ad64b0064c09e845bacef8dec9b7c6ef01330f93a
MD5 462e1754ae967253668cbf33bde2ff83
SHA1 983d4c34cf303f95a47bd6d5bd0d2129ff34758a
SHA512 792d3fad00f6f740000a6fe4183ee40917258688a0a28acd913822b00f6d163d69e5256e092ceeea3c6afaf414f789a89781bdd769ffb0041784c6f6738b6b0c
SSDEEP 12288:aLOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aLOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15C4523BF865C50CAEB7608B5C3E9F51EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 ad453a38225948769334ee06b68019a1b4509ca27676e98d6ffc6856f24198c0
MD5 4af41440956ec69ac1c608c91cece7fc
SHA1 dc5bfb539110bf1c8ab22e3230dd3faf8d0314a8
SHA512 e4f86b047e38583bd1e01f6513f5e94cea98213019344857165469c43ea68bb155b8754b9d508f359e1024c993424e2dc902f772d6ca76dd2de0d1c8e51678b2
SSDEEP 12288:yeBNUbTVO86U9Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:yJIU9sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C365CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a4ed3cce179b93330bf9147e6ad2bdba5383c313c6c367c44051f9a41427becb
MD5 f951fe74ea66d7408291f2ac8bab86e0
SHA1 e0940e6b65904e6100b7553eeffc69600e09c158
SHA512 05ac37258c2188df01f5208fe97ac2d4743779b985b7d088b67e821e9897875732fbe1d986b92a3aace5856ed3a49eda877e5b5943e1edf3b95cbdb979544b66
SSDEEP 49152:5QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THk:5QvGAdlCEL8c/DRNw5CED527BWG
TLSH
T14A266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 da82555b9f435d6db96385a206b62a0e33b37b2335857565551ad2f5d7476775
MD5 36aa9e28f9d81f4298a98ce256a4cf1f
SHA1 40c194b1748025456dbbb6ed496a0aac854078a8
SHA512 f6fdb95691599de367cd193316c084e65ff6ca5bac247f40784063bc63b1330a003748a25bcedc4cc0a86f908084ac7f88f8ce123b8cd631c1dfe59bfd262c4b
SSDEEP 12288:wAwSfxL/2Dc3RDLLmt0LDQewsAjTXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:F0ewsAjTsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15C75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f8b4e7184b45f7cc5d68d28d6635c2c7a605e8b8b8ab1b750890bbe8ee289e8f
MD5 a6fcb625f2b53cb0a56abd5ae293d36b
SHA1 4c9d31b720265552fc9dab1a48cb9bd150bcd5e4
SHA512 4bf07a99744b785b973cfc36743e735303ab6c9a147f9f877283903ce3c7dec6ad36667c79381d80d420ba6cf0f1c2991c95e1b6a15c62f9643b5d7ddac52898
SSDEEP 196608:tUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHPVQBWG:tUEtQevvqc2W1cpV2tI32GB
TLSH
T116474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 cc6028f49967265a634eb3849a2abe6077cdf787d291de72eb45196da44878b3
MD5 7460d267748d516913ee3a85d54e8fb2
SHA1 17633b24470c4b02fb046b37f4d02660848ddc2c
SHA512 ad41719e1f70f05c537e4a250e4b80be86643eeacaf4203ca6d99d53a188d24009f070edc9095154f78951b24702e64cfc4fd3ab1bf3f7f8ff59b2bc973a3ebf
SSDEEP 49152:PCbRquA/m2yL5zTfFiV+XenmE3/z3Dmg27RnWGj:IoquVjnmoD527BWG
TLSH
T129D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ba0d88ab2c1e8dcc381622e28e49c8c4039cd755cadfad8c5be21864933e0f01
MD5 8b448f36cb8895201e9955a117daa7c8
SHA1 f7fb7da03383e9a80e9f968ae8defaff6ed51785
SHA512 eb93046b1e3fda38a660e4d6f3d1c48c705b454023b2dc467a3b7c50241c335e9b7d55ae196fcdda0ebb91c624cd713185d166aa9933f92262fed44f0929e260
SSDEEP 24576:vAhGL3IFoiwtA5l7S53csqjnhMgeiCl7G0nehbGZpbD:vAMUFoiq54Dmg27RnWGj
TLSH
T177359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 40f57d9ef036b1b6b1e6975c46ce26cb870f234cfba5282d29b95ffcce8dec9e
MD5 d531bfe4c5de9b357a79d1eeea53a116
SHA1 7ae5772655a2dafbfeaa4c2cd560154e64b53d6d
SHA512 4b4429059b8ae6d940e07fb39b98b96912b04ea013c9d63da61e031528886bdea9cd0469f9a8f4ed0aaabb9670383b9e4c9cdb8f5f8867f0490591dcc25cbb85
SSDEEP 12288:8mw5HEjsChNVBFgl0WDm+CoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:5wu4OW3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11365F15A72A81CF9E9674539C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 37118f4b78b1782167dce50acbfe87356cee2d01d5653fc10336a9c925ffc0b0
MD5 60f52d4777dfb38b3f72cf3e6ec34295
SHA1 af15690200ae5d9155f52926fe3ff0b2d4fe42ce
SHA512 93cb59cf66d1df37b0f66e7c1b9824e686447eb44a36ae6ad6dbba4d27639097d6153ccf467c77288817fcda8002b9e6b6add6b07b819c1142f08dac31f6b8db
SSDEEP 12288:AeZ1IyjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BZuasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BF5512AE239820FAE1A3417CC5E5D609E7337C62673003CF166655AA6F73AD44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d6c8fc17f40068da4a0980ec8d0ad0bf385da529186bd3b9126ee925faa8c1db
MD5 b19069fc83afcd3f7dd7df4dd3a3e3e2
SHA1 bdd1583436d48751d97dc83c6892dd109c4f9e26
SHA512 27c7bca14c4628e3b7c6abd5edab769dcf92b9836ac7cf0cc4b68407c7629b06a99fe68f7e1838972b879f13bf0c89610a521ae6e2b4836baa07b7525f77abd9
SSDEEP 98304:TQRQyi36YOcPbLvw2gAf+PN31D527BWG:CQyiKa/X+PNlVQBWG
TLSH
T1DE667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a7d8082ca5b59484b7d03b82961ea25cdf196bc9ca41e0dec2123467fc6c975f
MD5 2e5399a4d7de3425ec7d0ddea6d806eb
SHA1 983e7d84e8d35d2dfa94fdf5494541bb49a5ab87
SHA512 2981fdaf01791d0fe5f370ceb698bbeece5950e3d8172066c6ae870b505cf2507f1b11dc44e3e751828052b19514642cd47857c5a5b5a9d795a70008f3b3a3d7
SSDEEP 98304:/QRQyi36YOcPbLvw2gAf+PN31D527BWG:OQyiKa/X+PNlVQBWG
TLSH
T1E8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 70a44541d7cba603451d0ef9ceae85c5352f6d6fabdfd20f1302b0a8721a6551
MD5 361c953bbcb96b9d2506d2bc582a8099
SHA1 bbf84f25fbe141c358fdfa17ef46d9de795e22d3
SHA512 69414d934bf93d784e900ccc17c7aae1f4834da16469fd10e5cc5e0728397e28b235bc4a638c651454767513afa82e39fa63203ebab077580f7509583f0efe4a
SSDEEP 24576:8wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0KsqjnhMgeiCl7Ge:C68Qg55nhceWu7PNU3/HDmg27RnWGj
TLSH
T158B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ce1d6705c93504e05eee70cc96a841f7133a7e84c1277aa32318198a088514c5
MD5 7507c76055965a2985ca1a79dd2e2d9e
SHA1 43eef5edf43c30923814b866e3e2fa1a360d768a
SHA512 2532143b19b1796b3bbd3ed90aa0fdf290adc78aa6d8c6ce38b0849f7969a455d9f71aedb53ea7bfe27f579fc06c130ccb95e4a3c6c13a6f5ee304915846b77f
SSDEEP 98304:Uy5112gYy5azzVvt69nLKnhZiD527BWG:VLIHEWhgVQBWG
TLSH
T149167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 df307e8028a647c5c7252be60b76404d638a2586dabb4493eb36cfd8b95fdeab
MD5 ba79896e5c8a532beb6b936416063a98
SHA1 1e1d9d546aebb489da148bda039f6d3486af8628
SHA512 4219eee0d82e766ed2be3bb8b656d40c44cfb4e6a25a1befb577b72add1a5f906bcde9783972e18d74c2521b7277c65a75d615d2921ab87f24a7ededc894ac8f
SSDEEP 49152:3B+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl9Dmg27RnWGj:Zu6Jmdxd2d9D527BWG
TLSH
T196D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9dd59c8e46b073b32233f9643b8dcf7c373fbd0aa06893b313ebb76c936bf15d
MD5 23635f286ec81abbcd45bd7550da4f3e
SHA1 93cde208847d32e76367cb91947e71eec54079cb
SHA512 14344859637d649fe66d2cd42d2ab9cd421126c2d430d1671e546f21dfad90e714449c0ff30d964991de161c139facb8431c67845a52137759c78125288740a9
SSDEEP 49152:51hpsNoJpF1A63U44CwH7R4xBDmg27RnWGj:5mifPWRoD527BWG
TLSH
T1A4B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0c16251c4e9b2f7619f1848ddcde39415ea9fbc265933c30507a7eea034eacdc
MD5 d016f34e07cae9f8dffb622866a05966
SHA1 5307da8ca497324b1c1042ca4ebec05b3074e5d2
SHA512 e222cba001ce4851b51588405bfdbfffe50c993a005667912c92cf3e57146caf8cb91aad383fbb9a5337372cfdf4fa062887aa3af5a98cddaae89b1280b195cf
SSDEEP 49152:HSuZQIY0Be2KcRVtOnks6NMHquDmg27RnWGj:d5dKii61uD527BWG
TLSH
T1D2C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2324ff30471a1919836823d5228732563a688edffc948236838e6973012e0920
MD5 34f0f9becae2b2e6248ccfa2867759ef
SHA1 c2af76648df6659949c02c37d24c9fe6c5855148
SHA512 e209095e0127c44f8196a3b3256e8a0a25e5f7826f5289f878e4050f428b1a39790f0d252cb58d0e3d2dd50e0a1e9ac4c0f76c109fa2cf8d6ba0bc89fff21f1e
SSDEEP 49152:hhtSn8EApI0fig3giDn0AP5wNDmg27RnWGj:wX2imph8D527BWG
TLSH
T14B95BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 7a8465a7937205ab4fc0b3d84e175765aa9df056631c6be1574c052b408aa27c
MD5 42f5a58f5d7cde0fd219cf0cab19f277
SHA1 69887bcdb09c2c5ade826bdd3724aa1228533802
SHA512 fe803de12a8abc7765e20d3d4020751eefd066fd261d62de871c3191e72d7e5716e07f2894f652fb1ae3c539aad224a9266df93ecb7535b075e70cf56c0c3dbc
SSDEEP 12288:rmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DC4523BE965C41CAE52648B5C3E5F10DAC073E5BE92004837A5B7CBDEBB14984B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 731a441931020ee78312571018f9f23635dbd3126e6c8cce500ea0e5c4c8d8f6
MD5 6c81be934c90757e76fc976dcd1d5213
SHA1 b2a94b925786c03098b27f4f1627f9148954aec8
SHA512 a57a61cfe8a4f702fcb49ef000a5a13b43d715f25b5a7a9e22347b7fda2f4c437cdd4541a2481445b7fc6532be09b27d35341da824e140a9efbf63dee111c600
SSDEEP 12288:U/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:U/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1214523BE955C41CBE52648B5C3E5F10DAC073E5BE92004937A9B7CB9FBB14984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 6faf20bd3d5e33a46fe4bd468fc7a926778496be80c2bfb919cba64dda0f2950
MD5 a4995f066e9126eb920cb87cb8cf8980
SHA1 a3e70997c92a79e0bbdf44b882ea44bad18b7dcd
SHA512 dc1944be3b559b6bdcd51faf76286e0066d072394505569f9b905406406eaf3e599fe9976ea8e3016f05b9649afe3e34b3dece1776cbfda09fe7eb8bc01f1625
SSDEEP 12288:eVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1194523BE965C41CBE52608B5C3E5F14DAC073E5BE9200483BA977CBDFBB14984B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 3d9c7691f8ac71869a7327c64ecfc900b574ed71b1088f1a4c6ac3b788c9df99
MD5 241fe686ef5681b63d5f5d646063d26f
SHA1 5a500ea52417f1a0f3ebf95c0a7561366dfda63b
SHA512 80c913da148ff78e12bba0dc38d6c0a322dd957901f1d5759786ece5815402b20d002adb4ee8c248eca8c81f5f2911d79b81e6e73f476f4becd1c2f4f8c986f2
SSDEEP 12288:YV8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19A45237B675C00C6D87285B4C2F5E11DE8237D96EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 ae4b29f691624e7dd5951f4bfdd14323828c4f27ef8287c6ddf975f5d0b855b9
MD5 75db4d8530ae40589f0fb994a59eb87c
SHA1 a41de5a46a4e007368b36338d64e9b4b9e26c5d2
SHA512 b387bd1744ff259ab1bdf2bce600987d4ec3eed16678c070fe2d38b36e0885afabe2eb39ec088755827585f07521c28da72cd0569bdcccaf3fb533b46c2b2d81
SSDEEP 12288:bkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1504523BE965C41CBE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 1779a67ff23f5b5d8a978c03919636fd707f02c0769a9c9ba565dec1224b9052
MD5 4db06cb4aa8f681a9e65f2a036f817ed
SHA1 09609cfd5db0b767d790bbaa857297789b23eb48
SHA512 1b16b6735431cc72d50b5ce199f2489aa8911609be540154060e15110d1cfa780074cc557f0dd096c52ec1bbec1f638c33b2dc0153f82acc846fde1f59f5031a
SSDEEP 12288:QrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FF4523BE965C41CBE52648B5C3E5F10DAC073E5BE92004937A977CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 55b69c079f518fdaf11a5087873dbd60f54801a8ffaa1e029ccb4f996eef93e8
MD5 13f377cbb279bdd969aeb41667a0bcbe
SHA1 208909e65fa52798a47b98917215c4392d2ed6a8
SHA512 d6a00995988d117060f888e10fc49002908ec5971e78e26a2d60cad245685557b3d4f1468c4babc4884432616e60e5c18e363b06b14aa96c1bf7813109a33e3f
SSDEEP 12288:pnXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pnsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1694523BE965C41CBE62604B5C3E5F11DAC073E5BE9200493BA6B7CB9F7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 f487e940a309faa4b3156f1a5f95f67419ab4e5ac532a322ed32993e4f09bb9b
MD5 e1d1333d387416206a897f07635cb3bd
SHA1 bca1244d1ada55de2b86c25102af3f0da13e24e0
SHA512 039944fad41d229f26582d36640f3a64b8c0345535a05b21783719388068a4ed8e8e135ed929292e5201a852eea8f50055f200a9ca34edfeedbfc3385d524380
SSDEEP 24576:NZMRzFVSOfsqjnhMgeiCl7G0nehbGZpbD:NZMRzfvDmg27RnWGj
TLSH
T10D6501A9B35018F8EC63813EC965D90AD5B37C5A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f3018214d9dcf22b0dab36b13130e8b0243eb69e130f73f99a51a4f1f1c7b569
MD5 22775cd728336cb9c862e8468095a441
SHA1 4f32c1ed80d36e4baa10722eff69a6537c6bcc35
SHA512 8f07add0a1b2bf8a4c0c3054fd86bf85d4bc9feb3d9654e731fee8fb1ff8fa84bcdead7aeea92a677785d3f862703db85e71e3918bfdf3ee745faddc969c0036
SSDEEP 12288:UqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1514523BF965C51CAE52608B5C3E5E14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 5748b784aa690b3f5e93161fb9e1c1fcbc3617c5d5556650358eea38d6847db2
MD5 40869d768f2a0b37de7a06d70e7ad65b
SHA1 8d01a4c48ed8bcd7a463f95a5c2bca1becd70d92
SHA512 12838cc55690cb3ec27597561345d33d59dac57a9506802cc58de0ec19b59c7baeecb60359f185c5252571cbf320d71f3f4d05734ecda7143d1f22c43eb031f8
SSDEEP 12288:deXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:desqjnhMgeiCl7G0nehbGZpbD
TLSH
T1184523BF965C41CAE62604B5C3E5E15DAC073E5BE9200483BA5B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 939f1ab1c25ccd50deaa8d987851c3208fc614965bb3d4b6e85a3ccc6574c8ac
MD5 df252a30d9ee4bc34169944613f07a05
SHA1 09855435707d3851efd4a818f6cb63029e992b9b
SHA512 34b23cb7ef07a9782d2dc28f0d0f2108697e0c2caa85c13e1a3d17ddaa2b7e85a68e47527d5ca8bf8818bad04f2566da61f772efaf87510ffbb85a291fdab296
SSDEEP 12288:dyPz5L8jXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UzyjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19955125B73A530F9D1368178C5A29A06F7337C3647204A9F17A416BA6F736D08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 875a9975a6646f8163d057ff1f2282a64bd7d85a11b35e4b61109e023c513438
MD5 0434e9d944b440fb4417765ccbff6694
SHA1 485d2472307ca2978422f0c150aac7492a580cab
SHA512 a350d156ff2893cf5fa236a0b76683a3df0bbe6702a810b1271c8d94d9b4af596547762f08cd2962db66e5528423ed607312596bdb5a253244e14039fde64d3f
SSDEEP 12288:PqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C94523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 8a8c8b4ae56a68b27bd191d75d658efbd994f78b1da4c692dbb8e3a2c2ba4d0a
MD5 a4f793aa430513e6cb7f46d4c7b836d7
SHA1 c50bbfcf155b5a85d5c07863ebd2cc6be2afbe24
SHA512 8e2a0dc6c90746635815c6a3a38fd42b0f4d61ed84af76d4702fb9deae653c095c651b2931b4b69fc2288ff3304a4f361b2129573e370f6abfd9289257dce51a
SSDEEP 12288:uqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E44523BF955C51CAE62608B5C3E5F14DAC073E5BE9200483BA5B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 92579e983e38f5766b50737c0f914c9f3b9a284e9d18c38191896d1b429b136f
MD5 37c2b429622dcf962c87a371a15d212c
SHA1 fd9dcd56172977200cf16862945ea1bd60d8fb52
SHA512 60700333423acef930339176c38775b9d05a98cc364765bef9fe133738a8c80bfa34b38703cd48083bb53cfd5f810296790675b9f99cb412161640fb8471f648
SSDEEP 12288:XyPz5L8jXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:azyjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14E55125B73A530F9D1368178C5A29A06F7337C3647204A9F17A416BA6F736D08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 939d0a701fc96df9f740c133f2de2acecd5e8e8a96e4fd31446d895a4b9c7605
MD5 ab2242e642fbe036423bb5e67ee9e888
SHA1 99a269f9f74c8f5cd6ddedfad76a665f9f9aa5ed
SHA512 96bb26884c18a246475072d01e37cf3c2d794bef92f1b839152c337aa096acc2d30f96875550688a97825a5764622e8600fb62bfb7aea7e4714dc33d35e9a102
SSDEEP 24576:jTDaLl3z0zDFsqjnhMgeiCl7G0nehbGZpbD:jTuLlj0Dmg27RnWGj
TLSH
T10F6501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 e7b9b49d66bc23e095696cae80a6d9ef5abe921238447ea70ee3ce8b4b5787f1
MD5 0e91e21fcb4190a16abaa6e3bff2e67f
SHA1 c71cc3e79f5f50fe0e6d62043d1a1bc20caf4204
SHA512 3a41dbce35e40312f9f52b774375341358436510fd3991ca039ec54bb861b6b78b15909ae134e0729c7a833104b18977e1708a4a48d336f8900bf2d1d006a5f5
SSDEEP 24576:63vd9CHKy7GZBsqjnhMgeiCl7G0nehbGZpbD:cvd9CHKyavDmg27RnWGj
TLSH
T10B75CF90F3E810E8F1B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 f3078e631dae37c41392ae93adf84fd52bf1435cc073ce14431bcd9ff0c93afc
MD5 fd26f6ea52a0137fbdea1a56ce8fd9ad
SHA1 c14275dae52a7e9655525a8ad1f3976be1792493
SHA512 617f21e53d9266aa8231836309335105636fb0dbb6ad0fd530855250d0deb12f2575f341bc5491e76bd54c21f527f9f748d03ca88a7107f7752d9149e5a144de
SSDEEP 12288:G1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:G1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1854523BE955C41CBE62608B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 ff8f3b516a7bcbe6f8f2174e16be7689199c535c6cc619ed8fe262dcf3accc98
MD5 92b0adbaec300357ae82b779d48a09c6
SHA1 6d12bc76092bb9a1500977374c1dc3b054a0c17c
SHA512 667aa22a4b78d4394c78108450f6c0b447430ab71f5e20e5de88c33e955b8bd270309ff2a68fdbccc896226d64b739ada4ebf5e220ce7add3aa37600d4a43ad4
SSDEEP 12288:XDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16B4523BE965C41CBE52644F5C3E9E10DAC073E5BE9200493BB977CBAEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 5b174d1b213c7c8cdb17a6787976e7ee8e2d34a1222986234e2c3ab73777cc01
MD5 3eff7c7061931cb506c67d6bc8b7252d
SHA1 35fbe6fe321f8e0b478dcfe75bbdb5e25e425dc0
SHA512 b27c09a10c278d7707c11e695af21c5b74c050b9319288acaf7efc0a7455964fb970e181d27fe4a5e928febc8965e008139194caca396c7ae2fb24d12152b7d6
SSDEEP 12288:pQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:pQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A24523BF955C41CAE52608B5C3E5E15DAC073E5BE9200483BA9B7CBDFBB18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 e3f4f8ab439c379b0408ca357084993f2a0c9336357b5ca4d5089ca93fad561d
MD5 a674ae172179b8958148ddc0da087ba5
SHA1 65b1cb79baea99287b9b9f6dfefeabf2331e821f
SHA512 d8993d2f63323bbd28528938c106026304559132fce2bd05b446f12c20fa586e6d2fee9ef8b156b8bf8da5ef234c01e16e0f0491db73f1a6cb9baa715fed4d00
SSDEEP 12288:gqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15E4523BF955C51CAE62608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 ecb9742d5fadabd5ed896b872154090040474f3ead330fad7137720c199bee09
MD5 c1bd994f262d359e12ba2884f203f279
SHA1 fe0f20afad4ea682c7aeba3b938c29978567e24a
SHA512 61f37389b030a2e2f379d74346a845eaf215e2699b3bda1e73d0aa8ee1953fec243092e04c061ad5d83750d77b23364c631a422b213e2ba183d8bc7968c7c7e6
SSDEEP 12288:u1Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:u1sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11E4523BE965C41CBE52608B5C3E5F14DAC073E5BE9200493BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 551d81af3ef98a721dfb28446db8df2f25a67b2e7e2c53b3b777fa3b0cee67df
MD5 dd62cf83486e6de439d3d810e64d7bef
SHA1 49160063fa96ebc874f41569b46ad62db56fcd32
SHA512 b65f010efe33a039c66a1936a86f279a5f290b6a4ac3b34bc68b4e3584d86b8850083e78881f383cc89e69fc09e4cd1953bc8422fc450e88204a0b91e6a776f9
SSDEEP 12288:kSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:kSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1094523BE965C41CAE62648F5C3E5E11DAC073E5BE9200483BA577CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c49879debb2d5fbe70855b909fe7d9408e865637912dc4f69737a2bf6878c20d
MD5 f807b348277b90b54f96ef89257ad05b
SHA1 86a0b7fdb6986dba97de986d1d8c27b1e33b3da6
SHA512 efeacf2896b61042057eb7e8ba58a0e13095217c8eae5ae5cc88720fe0565e293dfc15d1e8b72189a57e1c8413039ac4891dac39207ba7958412d35ac47c2eda
SSDEEP 12288:AkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AksqjnhMgeiCl7G0nehbGZpbD
TLSH
T11D4523BE955C41CBE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14984B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 9b11a58cb209c4d6e7de330ccd798e7eeb9a01d0c4e4ec31536aa1efaaed6570
MD5 e57b12ae4b58cee3cfd10255100cfc68
SHA1 d6ba12a46e657b3949cbf36d7f0efe16dccadcfa
SHA512 3d24ea75fb31f221b80750912b3345dcf853fa706af686632b041103c7be672e6752f9bf7dfae8d75465611b81333f265ed2fc103bb0f74e85d31af3bb0ae227
SSDEEP 12288:rNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13B4523BE965C41CAE62648F5C3E5E11DAC073E5BE9200483BA577CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 f5955662a618e979f455f368ff6690820f6189f2d6a51874d04b525b518ce581
MD5 5ce63493626ff93cdde2bfa0839548a6
SHA1 0c325db7421b89e6b9ed0a9f4f4719d4ab58e958
SHA512 648b639bc3e274d76732174d601c037e3d76c5a9334bb44836fabbf712410c6db0a29010d6d5e81b72b81f3f978c59870a7b22cd77113e656883756c4d411de6
SSDEEP 12288:/kXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/ksqjnhMgeiCl7G0nehbGZpbD
TLSH
T19A4523BE965C41CBE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 96601401c52ab7b4b0841df4f8a7873cdf1e83240470f735c59cabcee1cb9b95
MD5 2f0d7fe4a56ebe7ea4399e3e3e5e2755
SHA1 b760eb7a0e786af1614cb7cf768f6c19bf9d4139
SHA512 a79ecc964aeb4dd50eba89330c0210538cc36ebdec242d19aca6b237bcac1aa07e084627a9582693c0eb969cbf71118dd261e2bd90def5e84bd7e1a83ca21fec
SSDEEP 24576:ifwvUk9RX6wkyAIusqjnhMgeiCl7G0nehbGZpbD:yMnYICDmg27RnWGj
TLSH
T1B785D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e5169eddfc0b41faabcf0991beb8ff101627a34d90db2cf803bbaf726b0de5af
MD5 2827811a5af19877c41a18204e3af983
SHA1 b2b86a97df967eb2df63d8dfc78a06c5531023b8
SHA512 8ed1ebd1caf362a360d4fd8c066bb7efb6a69cd29f47f6190727163a980ff6442a60bd89bbf47759833faa4ea5b539639ac9e29c82457ec70ad84908ee7f4c87
SSDEEP 49152:lYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0tDmg27RnWGj:IySzPVD527BWG
TLSH
T1AA066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 041e3a1b7f9046697389d21a05df0caf0b18e28a32225a4c565cb8eda2dd8e12
MD5 52e1b7d00a51888123355875c6bb6ca8
SHA1 84c8de728d14329ab62d7426111744b86639a56d
SHA512 b417664902dbb1b19ddd6a12d3bfbcfad9f6f83cac3d771ac554f9c742f0784636340f468bc9d5ab1b2bd54426a9d2c2c928d55297a04b37035d6c0f527cef77
SSDEEP 24576:+47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYvsqjnhMgeiCl7G0nehbGZpbD:+47JUQjTirIhCnDHUPfF/9Dmg27RnWGj
TLSH
T15F65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 712b369e135a803c5f168c70fa4a089389678593ebe7a0261752d94e625e4ce6
MD5 f533acf42bb00faab31b39a222bd593f
SHA1 aeded111c23fe98044096f9e8a233bec35e74f6e
SHA512 46530f4fb2a818835163a8b59093d609925bb00e60dfa069327a3d53cf3b07a6f01501b05f4f181fff64531b4f66b5ef81fc9a55739b8dd316439d0e1f5a8b88
SSDEEP 12288:DbsfaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WasqjnhMgeiCl7G0nehbGZpbD
TLSH
T15055015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1008KB
SHA256 28154eabd1a8166d0e39e71c6778001c97987759db7e3398eb2f8262e5059ead
MD5 ccb38b5a7a40b69b49a0ac48741379fa
SHA1 958b9ae974908225e3703ad868b2d5caced7c7b9
SHA512 d0bb7de544fe3af2165296b4b8f3fe6aaa912e79cb1519077afe03478c5fce261e43b058f3738c529662ec97d6f3b25d67af02f5d6875dcea738069c0d08edcd
SSDEEP 12288:ua1+WU3fIkiA41F1QrlRWraa+bJd91Kx:uEtUP6iJRKD+bLvK
TLSH
T17B251850766AD75FC6A940321E33C1CCAB707D41FE05AB0372C8872FD576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 5da04f5709091e69054a99d8ef7690b37474d087657835c9992907da390177f4
MD5 d6a3e5fecafb8bd59897d036458ef923
SHA1 93d5149415df73328e96f7ee89665278dc676892
SHA512 99c4f1145c1c6b5443dc3299e3bba6ce55808c9edd06d5c6f551f6a8a197bc5bf56ee117a8fe3874533a1d6f4793b94b19fbed77793c1e09bfa20520c69c1356
SSDEEP 6144:Mj9D5+/JQFFQ9XGCL0quI1hFld26tMxAeb2uid6rq26tMx+t9uGA8JxEC3VG:onQ9XGCL0koA9uGA8JyOVG
TLSH
T17865D7815537A3CFC1FA6032072A5B4DAB64AC0673496F26B3C4453ED82AB25B4FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e05217f5e2f5c4e2108d297d7ed1f2069f61bf61df7aee7d521806564081379d
MD5 e789ac049a1f9eae36b7a8c5e64978ed
SHA1 5ba945938fe2838235bf811d5067f8773ef4a053
SHA512 00c367933cc1304bc500ceab584a3a96eb56a14a9fdca1f0a96ea465f719603d9fadbcf68e14dfbf4407a079da34fee41c4c7cc782b48693e2122bf47bbaa624
SSDEEP 12288:b07CXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:QCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D445237B934C518AF93605B482EAE12D681B7E669F1044C3BA1778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2c67853187e78564a117f4262ab00ce63b56d235c45fc771b318d15b18d50291
MD5 e80eb89dbac1df509ca1e41d3487c876
SHA1 8a164c61f07623cbf0526a47b2e100a02d25d627
SHA512 5e273a34fa92a31efc7e2d039e0ff6e9fdaacb26c99ccc4b24c1ff2003c0cff5d2b34c9bfc7f6aa1446d77c15afae8e8895aba4c2b627e5773a1bfd6fc528ea7
SSDEEP 24576:dgb6bmBIi49WNNFpg1rSvFv7bYIsqjnhMgeiCl7G0nehbGZpbD:dgb4mBIBhGFTDmg27RnWGj
TLSH
T1D3659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 a8c9454009072194ba1605ef3cffa8e5e6a0affc5fdeaa4eb81aca9ae68bdc97
MD5 123225e26c00d090c25ad8b164a8496e
SHA1 b7e4d5823aee10a476250b23ca863e4df41fbb0b
SHA512 733874f63cd67901f4b95b54f2cd328143da3f9d3e05df07f4cb46f63e513e0fa6fb55ebf8911b7cfbec86c53c56cd812e218d67240ff2a6b916f1ce9d338f54
SSDEEP 24576:+G88u8FpJqH1bzria7/mfsqjnhMgeiCl7G0nehbGZpbD:V7ZFPqVea7/sDmg27RnWGj
TLSH
T1F485016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 1e52e866148d07b08173d9fc87c1009fd6cbdc120ee29b679028e8f0f200c956
MD5 c4df89b20948601145de8df314a59621
SHA1 f33b7f42300792a0d2148f8e45e517bcbc297be2
SHA512 67ec5d15d902704dc036311b6a8830c40e090068123bf276b86aa5f8be63117b3eac6cdbcca7fe2eb7c637be7115a33a6865c1ef682153fc929ee149d60024d9
SSDEEP 49152:bBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjfDmg27RnWGj:kG05lO43b6D527BWG
TLSH
T12CD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4a8865417bbe0d410fbed223c8168013d8dae2e21b9daacd8189284c94d8a80b
MD5 a15c844ad0e89801b0bdb464da6a541a
SHA1 128d7a9806143a52db23933185b4a2cc474b2f1a
SHA512 37d563750589fa5fbc6b5d8bdd082c8b619634c7b503ec0d56a0c633df0ca68c0460b5f7aede8890c694d1b904ffb8e089d51838636860a970d933419c1b8932
SSDEEP 24576:Dfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnpsqjnhMgeiCl7G0nehbGZpbD:7a5POZ3BJt2pasx2+mHDmg27RnWGj
TLSH
T14065BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 36c75ef61f7279142994298d681208ec615af948a2b498b216d0aa8fffcfdcac
MD5 dab7bd48cda565c90dc87406c01feab4
SHA1 d302be07e02aced20eba8c72c3348663c29432ae
SHA512 0ca8c085a7855fb37dd9629ba61c7d3f21ade3186cb183ccb28ad783182b090c6228bd4a9d25f2345567816575c0121806aa925587d5ae9fbaa33b269bc4d8f7
SSDEEP 24576:pNcwHdjbyQ4nLC18lb/EOjowL7FkXsqjnhMgeiCl7G0nehbGZpbD:pNc/zEOVHFMDmg27RnWGj
TLSH
T19C857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d5e0e93e38e56c3ed669e7e0603e5e6f542af6faabcbbcafc4bb1c58732a6864
MD5 36e80ce6c5074a08685daa8656581c97
SHA1 8ff66650f184f2710890ac5e3e6f4eb4831f96b6
SHA512 f98b5f27c1f68382cf35233454bd4137f16a6a80dfecc9adb6b5cf62b5b4c930efd43c5ef745021421e90965486e78265f3b22108f295d32fa492aab0a859d55
SSDEEP 24576:jTkNvNnaFeYhJNtmZBmNsqjnhMgeiCl7G0nehbGZpbD:jTMwBtOmxDmg27RnWGj
TLSH
T1DE55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 3eee7c94c9ae65c365f638d395b21577b81e96fee258274a9ec1cfd6b4325c0c
MD5 9e7c009557c6be712630ae3f55e872e1
SHA1 4e778921bcd76d22c7242eec5bbe187429e9d653
SHA512 5f5199fefc2f51230716e53b205fe2912b0b02e70ba0ae04cd2d4418e5bf3eaed479f085f5f572549aa97c23f7a782f763422869e0a2dbe594943558f8c27744
SSDEEP 12288:yHvUrBFrEjwaQ7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:yPUr+NQ7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18565F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 a0fc95a943ea24a4ae75d766c13ab9c5e327f48f7740cacd33a4acd18947d97b
MD5 63c24ddc45c26641ee2e4a38ede823a8
SHA1 7053a9febafb10ff8f7a12366099183bc65a3878
SHA512 04c0dbb9140d86f71ccd208e1fa0f3983307f5cdb7ff45919fe2d3e0aafba45c78d33ee6bdd8b7a0f67fc324c59425a246e9bcb5c905e1d7624b61f0ebeea0f9
SSDEEP 24576:XD3FHshBIYQgAGsqjnhMgeiCl7G0nehbGZpbD:XDVHeBIAAKDmg27RnWGj
TLSH
T1C375E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1596-124-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/1596-40-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/1596-46-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/1596-39-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1596-47-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/1596-135-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1784-363-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/1784-112-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1784-106-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1784-104-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/2108-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2108-118-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2108-132-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2108-126-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2108-116-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2468-98-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2468-362-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2468-91-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2468-359-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2468-360-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2528-375-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2528-79-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2528-377-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2528-78-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2528-85-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2528-305-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3200-15-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/3200-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3200-22-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/3200-21-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/3200-90-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3488-64-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3488-70-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/3488-288-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3488-62-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4384-308-0x0000000140000000-0x00000001401F4000-memory.dmp

Download

memory/4384-1-0x00000000020E0000-0x0000000002140000-memory.dmp

Download

memory/4384-7-0x00000000020E0000-0x0000000002140000-memory.dmp

Download

memory/4384-8-0x00000000020E0000-0x0000000002140000-memory.dmp

Download

memory/4384-304-0x00000000020E0000-0x0000000002140000-memory.dmp

Download

memory/4384-0-0x0000000140000000-0x00000001401F4000-memory.dmp

Download

memory/4384-74-0x0000000140000000-0x00000001401F4000-memory.dmp

Download

memory/4652-303-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/4652-75-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5052-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5052-138-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5052-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5052-364-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5568-272-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5568-51-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5568-58-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5568-52-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/5760-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5760-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5760-103-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5760-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5760-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download