f2ac7081425ab34dddedc96712b3b061f9fdfc4d88642fda4f487da15558bbec

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
Size 816KB
Sample260827-prh13she73
SHA256 f2ac7081425ab34dddedc96712b3b061f9fdfc4d88642fda4f487da15558bbec
MD5 939b244293eb58e1dcda79ecf7f68a39
SHA1 d0a7c7f930d0e74c1c8ef783edf11e211ee7b989
SHA512 51db57a6535e09990bf5f94aca3b53165efd99a342660387a26239d68d243950ccb56b9e6c77b3d0ee062f7350a35a150f9d431417f6e873de022d4a31307d00
SSDEEP 12288:YAmZXuYKctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDd9YGQ6HX3:YAhYKY86e7xiAi7Q6xTNkDiU
TLSH
T19105E01A7A9440F9D0620D304A61E76DA365BC68D8174F8B22D17EDFFFF2AC14E29631
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2608	elevation_service.exe
3620	elevation_service.exe
4308	maintenanceservice.exe
5580	OSE.EXE
5124	PerceptionSimulationService.exe
2880	perfhost.exe
6084	ReFsDedupSvc.exe
5316	SensorDataService.exe
4316	ssh-agent.exe
1356	AgentService.exe
2516	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3375932bb05c2f27.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\javaws.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002fba53982036dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c0360a572036dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000debae8972036dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef0a62582036dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000520025982036dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000077313d572036dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2608	elevation_service.exe
2608	elevation_service.exe
2608	elevation_service.exe
2608	elevation_service.exe
2608	elevation_service.exe
2608	elevation_service.exe
2608	elevation_service.exe
3620	elevation_service.exe
3620	elevation_service.exe
3620	elevation_service.exe
3620	elevation_service.exe
3620	elevation_service.exe
3620	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6140	2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
Token: SeBackupPrivilege	6084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6084	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6084	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6084	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1356	AgentService.exe
Token: 33	2516	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2516	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2516	SearchIndexer.exe
Token: SeDebugPrivilege	2608	elevation_service.exe
Token: SeDebugPrivilege	3620	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 3260	2516	SearchIndexer.exe	100
PID 2516 wrote to memory of 4356	2516	SearchIndexer.exe	101
PID 2516 wrote to memory of 2012	2516	SearchIndexer.exe	102
PID 2516 wrote to memory of 2396	2516	SearchIndexer.exe	103
PID 2516 wrote to memory of 3064	2516	SearchIndexer.exe	105
PID 2516 wrote to memory of 1748	2516	SearchIndexer.exe	106
PID 2516 wrote to memory of 2096	2516	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_939b244293eb58e1dcda79ecf7f68a39_icedid.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:6140

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3620

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4308

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5580

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5124

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2880

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6084

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5316

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4316

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1356

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1079202589-886135813-2527035092-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3260
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4356
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2540 1772 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2012
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1532 1536 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2396
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3064
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2540 1772 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1748
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1532 1536 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ab7417476c2095380ea66c198d85a48978b6aecbf94e75a4cbeb44352366ed81
MD5 d593642ef323cfdf0165cd6f8b6bc586
SHA1 b43db9ec7221069cbe56ef106e4db1117659e446
SHA512 e0c6679bcf0f96dd307999fe3feccb43d4a4f55e98c79422cda8d1f2f78bdee0c02827d9d18b0147c7c3ce019cf56ad5072b0c6926ce33f83325cba2cab133e6
SSDEEP 49152:4b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnx864qfl:S3q6HjBAb
TLSH
T179D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 791e4cfc84a5cd8554a32cb1eb7751d11d0b1a4e4b9cf16d928646ed24b47108
MD5 ea65eb4021104e721f98b313601ea6b3
SHA1 9a167dbb12ad3411e8b1534083408171491a8f81
SHA512 e187b2acf2bd5b9ef6fe4ebbb6c1bfdb19c401b247ea79941a4024122f47548d6e66a86ce8e27b710b6130a6b2f7b8bf94a5a2e2c8952fbeeff4dffbc4c8cbcd
SSDEEP 12288:c1XLsswWkxy2lRq2czAtctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDd9YG1:qXYfDtczAtY86e7xiAi7Q6xTNkDiU
TLSH
T16C05F12863E409F9ED67817CC8B28515EA727C944760E7CB03E4997A1F336C85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 40dce4b952d48a12554f831d812ba6f0e559c5dbeeb13003c44d925e2dd2bdbf
MD5 402c9c1d7a0ace79f8062e1df20e91f5
SHA1 0a5ab6b2e0d5af4010581f3a4fe87c1be0d3e6c4
SHA512 329353d03ae4faaba7f47255284b8bb61e5cc688077c7a42b720e575a9af766d4f616d842cab0244e11c2180af8eab03fae420c532b5dc9484a6653cdab1e5fa
SSDEEP 24576:E0Le5ji0hmxirMgY86e7xiAi7Q6xTNkDiU:EPji0Acs864qfl
TLSH
T118359E16F5788335D073C0B9C5D2A69EE97130815B308ACB4286D77C7F67AE68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6d341956196dca82c34885ac1cedd03b3296808f97c03883638c8b873a402c70
MD5 ad956b9363e29cef2d73d2dd37e2c5ff
SHA1 87b83ee67968e18d491f209ebe00ff3346696bdf
SHA512 906b926413c15532a4ca57cbe947a0959d6c189fc342ce3f7b02db8b920baea56ddc8c346cd9ea1d3431bfcdadee1c150367d53eb1f714d65a5f7183567cd7ed
SSDEEP 24576:4a7/ezSC6vUyD/aqgrvWE6q8wyuiY86e7xiAi7Q6xTNkDiU://ezSC6vUzPvxHjyQ864qfl
TLSH
T14A755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1e6a8bfa5c53b2a40ac15ba52c2b6facc0936b2be71105f57211c4a9d9eb39ce
MD5 f3be617442a617156ed4dd8735911af5
SHA1 f1829ff0682356d55d6e695ae75ddd8436759a2f
SHA512 f08d4422e46f33c6ab6f3bc38648343ee3edc16b01945013b06c3a47d0e6c27f0f57db8f22edc499c0e27bb5a5c5389b66b051b9fa31acbc07a316d47a704a0d
SSDEEP 24576:YVbqPb88hv/l+6JY86e7xiAi7Q6xTNkDiU:YVO88hXl+d864qfl
TLSH
T1AE559E66F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 1a34eb162a51b7f809c307f7a34319019947e19842981112245be0d93da52579
MD5 c434079ce62e78e0a67034e5b1f63acf
SHA1 9c1d5cdbf0d2f05b0c4d3b4af58e068c44fcd881
SHA512 573fbdb0d09462023c6d0079d18cbf1df1b764b84154b9a421dcac26941827443a00d5126c510851b85c9de612113f9a5b7abd33557732b0df76b3f2cc2e1d83
SSDEEP 12288:MRMctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDd9YGQ6HX3:MRMY86e7xiAi7Q6xTNkDiU
TLSH
T1C3C4234A05DC025BDB3B1170B4F9269DAA745DE4DA594D8383D37EFF6A3AD018C3A223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 feaf266e15d2953382a63309b3bc692c3e3a984450dbcca4336bf2a624497ef5
MD5 caececa5aafe22f4ea557258c20e4a8b
SHA1 eaf74f3fefa6c2fe4804f9a8b2eda0948c5a9d3c
SHA512 8205fe226012fe348227121a2d9ab8e47b1f596cd5f01392a8ccfe84cccc53ef26c5312dd75d9606e7e3db98d0d5c35e377d7baf0a65f341bad1faac64101fdb
SSDEEP 12288:0eBNUbTVO86URctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDd9YGQ6HX3:0JIURY86e7xiAi7Q6xTNkDiU
TLSH
T16005CF3BAE28FCD2C27E8DB856A18740E77278704F6293CBD165820EDE235D15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 a5ae34969183c8ad5d8e2acda70181bf3f5846cbc5402523bb15ca4a7bb28974
MD5 e2fa1be963004dda7865d18604e22e2c
SHA1 82eed2dda3a9614282d436dc04d05028af0e4338
SHA512 be5a29d5ccb4bb6803927af09f28cb6429911469e53de6c3fead9774f30a9d31e84f4db3728e37c67a56f12cb12fd43a8175c25801700b48b4a48ef168879c47
SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THY:UQvGAdlCEL8c/yRNw5Czb
TLSH
T113266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 bc8ba14c0106937e57299edf514778bf44699e9686cecb02e5e5a66737bbdbdd
MD5 d07f964a271f2f8090da51152f9b61d6
SHA1 0f9772662fcbe5c31ae85a5691ddb4f6b6da1a52
SHA512 371360fa217f0496519d0753dea453792591f2329e2b7eb3a1cfe7bceecec416d317451dd7717539fb534e687973249f12c5d6421cdce8fa0c018f99723f5ab6
SSDEEP 12288:rAwSfxL/2Dc34DLLmt0LDQewsAj7ctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIya:UdewsAj7Y86e7xiAi7Q6xTNkDiU
TLSH
T13E15E031FA74E036C77B0DB22B36C71A587C79604B511AC3E3E89E9E59306D22736A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 9fa794475e07e76da7b0973ca33caafed9961d70f61203d21cd67a35dacd8840
MD5 f7ec111ceda87038ae1331e52681a204
SHA1 607281f5afa5e84667d0b0bc72383a52988f190c
SHA512 cc119b15bda2308c23ff95865f225b53080e101499837a7d8851b1330bf6491951f33928468f08913c03e863bdb0eb5ccb78f22f3e2fcb739916d767e4bbcaa4
SSDEEP 196608:/UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHqb:/UEtQevvqc2W1cpV2EI32m
TLSH
T1B9474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d5d21a32eb951bdc587ecd2022ff09ed3d59d03e5007cb7411cd0db74b5bfac4
MD5 3b8563da7d3b2cb57f58d041203ce601
SHA1 5f3c0fda2a7fb76a5613eabb377fd451940a9244
SHA512 4510caf68b07a3fb2313dbfbafab556ffc941315e4eabc019c7fefaed78f724bbc67edded97e14cd0a9824b8ad3494b0794979aa25daa241108d20d01cc4dd34
SSDEEP 49152:uCbRquA/m2yL5zifFiV+XenmE3/zc864qfl:DoqHVjnm/b
TLSH
T1EDD58D0976B8C2E4D1F6C37896A2C647F37178154B319BEF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5c1c3e65ce2d0525fa65e8689714c502b2d27285e726806a88152748ebe3ecb9
MD5 30df3063be1d42a7bd7b121cb9d19091
SHA1 473de56122e2bf7d8419a488a89110f413373fea
SHA512 51f443ea9ffd1a4fb6d169b6a0e87d56f2cf6873441676d0ab2985e52a093499eeaa7897b4c9ee8caae664cb10ccf0bfccd21792965d08f4a22a98e9c65bf487
SSDEEP 24576:1AhGLJIFoiwtA5l7S53WY86e7xiAi7Q6xTNkDiU:1AMyFoiq53864qfl
TLSH
T16C35AE81E7F945D4F5B3AAB8A9B69170EA76BCA55E31C20F1260D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 3603ce27560ce13fd7aae91508903618b3c4c61114b9fe1a46bc68d4dd4320a4
MD5 8ec36a1648bc1f9eed8fa1a78933d6d2
SHA1 8b3217fde1cb3439a0f7b445a80b844a06843dee
SHA512 b73de0c577e724d8f7002f00d4412484151a77b6d7afa04e30200dc8fc32c486a4dff634352c172aea8ccf475c16751299804368cdfc51a48a15d2c3ddf7f1d4
SSDEEP 12288:Rmw5HEjsChNVBFgl0WDm+CCctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDdt:MwuoOWPY86e7xiAi7Q6xTNkDiU
TLSH
T1E205F14A36E80CF9E9674138C5A79536F7F2BC512A25CB1F03A0C66B6F376116D2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 e8a134018c0ff84493719dd67b76a937039342fe836952089348d7101c2beb97
MD5 38ae72e4354f77b9b841451bb91e80c3
SHA1 7234af9a907071f6a8f42474e65b5db79662133e
SHA512 ebe2c8d5886101c20c17af81c7024efa7c0114229b7c96e8b1bd02f878a60d2c60a28efad5473f2635a345e3cf39b915c4e01378229f5ec6a625aaea874a8589
SSDEEP 12288:1BZ1IyLctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDd9YGQ6HX3:jZuoY86e7xiAi7Q6xTNkDiU
TLSH
T109E4124A22E821FAD6675238D8F55649E7B178A1673643CF03A556BA2F33EC10D39333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 83fe9a065fcd6e8cd01c0cecbf0a4df9d38145ed2733699d7cece0aa98cb19af
MD5 9af8758eda2ad900b3ce72df5c944f50
SHA1 4c9ca761343f801ffa94137627ef83f83a3ab778
SHA512 4cebc55520a60a61bd348f46153aa106e12936ae3aa30dd5b5673d55cfde0ea6ecc869c21ce18e32f72d8eed81573bd6f2ecd709c80b3fbf8eea8ffb80cca74c
SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Us:/QRQyi36YOcPQLvw2gAf+PN3Eb
TLSH
T11F667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c03a74c44081148f88cea40e2d98ba88453bd0e101f1280070d93ab80cd94f08
MD5 34e6e038d05dc7018f4a3579a96b205b
SHA1 2aee9b1190bdc73bd1ed01e7c8fe261be2b55fe0
SHA512 fb443d82ad76920a1bfb006dbd945b2e999cad32f99c68003df146b3912db66eba8080d15e9d0f6663c7951d1bbd34c624726d7931d84410134776b5eaee7663
SSDEEP 49152:ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Us:tQRQyi36YOcPQLvw2gAf+PN3Eb
TLSH
T103667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 f91547341b03f9ae8da7f2d655df0983cc1bb3956342090c8e725cbed06a9f65
MD5 1e37600b8f31cecc18a29d4d59b9833f
SHA1 202e5c47f60a8919d8d3313cfa98e6bbb59a730e
SHA512 105d2cbf18e1d68bd059a5c088078b424b1d1530de772257b4a853562d1627cc68d918bdc5438dea71739c8c469358de2e05857c6c9bc458f01c97850bee4b1a
SSDEEP 24576:XwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0YY86e7xiAi7Q6xM:f68Qg55nhheWu7PNU3/s864qfl
TLSH
T118B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8151721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4ec61af23f0b86219c7b26433ba63da64a3167b55dcfb1ba347bbfc226f76f2f
MD5 c57b5caf1b0c61b8732577d2f8e08a2a
SHA1 1f66361cdf05a5ac950a401b8ba6dc6711f54b3a
SHA512 05b5991136d2d49c34c48a8d25b1d8b6ba8a60cbcdff73a37c32828a4bcb997bf7ad4f9a0e0b125ea9a0bf31c62e614cb168a381b4523e559e7b3f30aecbfea3
SSDEEP 49152:S3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99O:zy5112gYy5azzVvL69nLKnhZNb
TLSH
T18A167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5004c2c31cd6b919b0d9a7a1daef7f00625a8da05c039d568b92e2c5bb7fb471
MD5 b9195b3a14c98012a0df87cc6afb62c3
SHA1 f369831af81b640db66f796a6dde112a064235ad
SHA512 d2e688d698d1e929355751a9330f0f213c98c76561d171c726f5e10efe972d40f01e1be43a6b6cf097eafad8d0d956ee3b08937c725bcfdcaacc97fa7e96dba0
SSDEEP 49152:fB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glO864qfl:hu6JmVxd2dsb
TLSH
T150D59D13F1DA01E8D06ED078974A9233EA62BC490B35B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f48dea2e784fce77fc25d04f22c567cb2fb53bfb49485e85f74da2b333738e6a
MD5 2ecf4e87571227c84451ddf684d59885
SHA1 2826f09c1509b5dd617e247975b161271904f3a8
SHA512 7c1fbcc7dd8183f58bd16aae87f764e20c97d9d2180219f51be27eaeaefe47e9e3348e15b56eb062359d4e7e3dca6d8511ef8fe6971b43a0eb40c4d741b8c107
SSDEEP 24576:ehv8E1hps0+ogd2z615uCMVF1Agz6bUQ1zNOgLLwH7ReaQXx3BY86e7xiAi7Q6xM:u1hpsNoJpF1A6UU44CwH7R4xy864qfl
TLSH
T1DEB5AD13F2D801E8D06ED17887569232EA62BC450B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 aa7b5bc6a47168eccf79587d346d8d5d3ef8dd3fba55a2b82cc56a97d68ab5cd
MD5 7a0b558c36fddcc118f8830de8fbb6d0
SHA1 d7ac877729a143456619b1da38b35c2e107b33b4
SHA512 078257ba14e5e9b3f8cb600eb11dbe7e4ba7c026baf65a61f2a668b0da98f68c455b973e6dd9857e0c0000c9bd91484cb7d2d8b03c45b15f110eccb520d53b84
SSDEEP 49152:ZSuZQIY0Be2KRRVtOnks6NMHqB864qfl:35dKTi61Bb
TLSH
T1F2C5BE03F2E901E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 275583e4de2d0b715ae5fa146cdfa4c3876c6f12391fd62f41bbd1fc46418c0c
MD5 ee2c08376bca273fbb26a4e792c4948c
SHA1 297e020e3f2406131849a0497b6c49d2b78ea937
SHA512 a969f470308795f8897aa98feb0b651f499962da6a9ad79882cc798964621dd91214dc83b2964ad08390865b4293077e8a495c9d68812ba95b1d370556bfe4c0
SSDEEP 24576:MhiavrPSLT8EARn+FgyUgd0fJY6Bni3iy9CTn0AP5+2QLBY86e7xiAi7Q6xTNkDr:MhtSn8EApI0figngiDn0AP5we864qfl
TLSH
T1F795BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 f9d606cffaedf670b1e1a45cfe3814b43cc1a77e9e6906580cb1b60a88acba9c
MD5 6a4f028ad04cf042e50e2322bc27b08b
SHA1 7a9934afa9d6a62f27ed668ed8b14ea5c2aa7e20
SHA512 6c8286b4b3260a75380f93aad92c8e62b23210217cdecca955acf0629f185fe772800912f0216afc9865b53f85bf666534269407316f736fa2baca882f620956
SSDEEP 12288:w0ctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDd9YGQ6HX3:w0Y86e7xiAi7Q6xTNkDiU
TLSH
T171C4234A14DD025BD62B5170F0F5269CE6A86DE4EB5A498383DB797F7B3BD010C3A223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 fd62c83682337716833744967e9c43aa1cfb76fdf15b7c95b77b033806fa1fec
MD5 953980b65f638e84cffa77a9eb8dc381
SHA1 e8300bc7fdf40173a6d7e29b65a012a6fc4d1cc6
SHA512 da2219d5629a8b2d230e5fa7d65add3c102c7e3c9f5766a1d4d883bd0bc08da7f55172557dd96df6e5bd514b75a9257e41609eb0f12a17a5c4c52f146e693b51
SSDEEP 12288:bnctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDd9YGQ6HX3:bnY86e7xiAi7Q6xTNkDiU
TLSH
T1F9C4234A14ED025BD62B5170F0F5269CE6786DE4EA5A498383DB797F7B3BD010C3A223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 5eb1c3c8f82699d19a37fb33d1820876fe96bf9631dc6a651b6745bfec5e7d76
MD5 6ccafedcd27bb06dae4fbb00fac1cb00
SHA1 fb86f2bf88d4b6cf1635272abd9fe310b62a406c
SHA512 fc8b4f9eb9bfdf081d3433456d22dab993c46088e89c49c9395aeee926d63de4f4219f6bc9186166999e33ed60ca0e17097c58c9734a75b628e4ac3840b9933e
SSDEEP 12288:35ctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDd9YGQ6HX3:35Y86e7xiAi7Q6xTNkDiU
TLSH
T11EC4234A14ED025BD62B5174F0B5269CEA785DE4EB4A498383DB797F7B3BD010C3A223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 fe1334328bb08bb57e5e00bcf6737662838f3830b5987f795e14d30e3ce206a1
MD5 bd0b67f6284a18d7939dcceb569f2061
SHA1 069eef3a6124c0c1a56bb42c81d8c64c1ca529bd
SHA512 6df5bd33392bfe34b8aeff7d2ea0fe2a39d99e146d3ebc2de8825d91d8936f70a88300a6cc56c0fa3897a56c20ef89b1b12516aad1789983280443c149f16cd8
SSDEEP 12288:uV2ctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDd9YGQ6HX3:7Y86e7xiAi7Q6xTNkDiU
TLSH
T134D4230A16ED02DAD9379274E4B5525CE7B47CE4E7264ACB878229BF1F36F401C39722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 d3fd76078b9fceaa206e42dc29c5ef1d18d44136bd893e0839bf6ced851fab20
MD5 c9c3d2fbb810721e07af2564db2865ad
SHA1 dd5286b92eb6e775ebc994c61fc60de2335cb81f
SHA512 83c0ee53cbafda368139ffae40902465c61c3c2b29381bd19ff9eed01dbabe5214c5a0149d2ccfffa9a34adf490294eb7a71ef503ac939b035eac46d1bb6c7ee
SSDEEP 12288:2uctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDd9YGQ6HX3:2uY86e7xiAi7Q6xTNkDiU
TLSH
T1CDC4234A14ED025BD62B5170F0F5269CEA785DE4EA4A498383DB797F7B3BD010C3A223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 1c43adbc995ceafc9d9abf0837abf7c1819431898b2c706e7ce7e9df384f6d83
MD5 deb9c4eaa7a0e66ee05a20afc70b736e
SHA1 7430f83abe48c85df3097d1c7e6f28ba308f80c6
SHA512 e2785377760562b6bbbeb3c5adf050a6e83ec40eb8938be6640d3222deb0e794f009f21e6d454c5a0c8ac57949d385cc7426c3bc4dcf113bbd19741f15fe6ced
SSDEEP 12288:gDctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDd9YGQ6HX3:gDY86e7xiAi7Q6xTNkDiU
TLSH
T191C4234A14ED025BD62B5170F4F5269CE6786DE4EA4A498383DB797F7B3BD010C3A223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 5c2a42c0d86158772c162d359148a142551014cefb92a7e7c1260295cb86f04c
MD5 2ecf6ad6b2827d88650baee47a82d1d0
SHA1 f3a6f87da5aacfa66f8f005050af29c95c61c482
SHA512 351695ba81ee44e89df9e70bb792cccae2b119e689142c592d3f85eed45d4b1bade1547f03994e6758378756d58021d3eed03ad65258372852a381b03b4eb2e2
SSDEEP 12288:Z/ctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDd9YGQ6HX3:Z/Y86e7xiAi7Q6xTNkDiU
TLSH
T1CDC4230A14DD065BD62B5170F0F5269CD6786DE4EA5A498383DB79BF7B3BD010C3A223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 14a998eaeb767b46e9d18934931f8ba185bc7d67849276301cee6f3e2d2f2d7d
MD5 15456d7039b1882727a9fdcdbed00fe9
SHA1 920ebdc031284195acd4092697d8ae442175faf2
SHA512 3123c2b5dd142d87f88113a4d1d11f99482a45332abe6826de614af3537fc54d3b3a2d1d69ce16a8fc5e35cde6bb7dfd0de596ed4b6df01d65cc0efcafb4809e
SSDEEP 12288:ViZwb6zzFEoS2cPvyHctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDd9YGQ6n:YZMSzFVSOHY86e7xiAi7Q6xTNkDiU
TLSH
T11C050199739408F9EC67813EC865890AD6B27C694B60CA5F03E4367B5F337910C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 c615b7e89563e6624ca57834ece755e172a1bfd916568f01717527272602a93d
MD5 a2b19dacdb3dd4c1ec6f4ce440fa5e51
SHA1 92dce172a4972a389bf4ca28557a9cf178ea1dec
SHA512 5085d8edc7a4dcde509937c05741fc7c57d63be1d470ce2a13893d951bdce22448516beac4399a863774f893a5b4cd1f4117fc54d7e7d5601ad84b8a7f7043f2
SSDEEP 12288:T4ctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDd9YGQ6HX3:T4Y86e7xiAi7Q6xTNkDiU
TLSH
T1EEC4234A14ED025BD62B5174F0B5269CDA786DE4FA4A498383DB797F7B3BD010C3A223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 3d66323eed3a86aca6d27e12a4a45cc4846035f504e31b712e39735643eb7f23
MD5 da8366c5bb37a84f99c2d3e2c0e6c867
SHA1 3ccc0178f4c40bbe4049b4fff960d7f170cfa64f
SHA512 5a1ec893fa5cb4732e39fe885bf021702c6d0f4098683d75b4c873029c3373170b990cd95fa9d3b3d06ab52ed4c2ceb6057691165e5b3079880c2fd408087671
SSDEEP 12288:zcctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDd9YGQ6HX3:zcY86e7xiAi7Q6xTNkDiU
TLSH
T1B2C4234A14DD025BD62B5174B0F5269CEA786DE4FA4A498383DB797F7B3BD010C3A223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 37d3bb67fef4d976dc5808f7f8c325266e8567e9d1c2aae73cf2aa7e6911991c
MD5 45b14c0b6a69ba7f0a47aee71c525736
SHA1 6ce969c004ff62019e3381ab8d1ac083ad923562
SHA512 65e5e1cc35ecabe5a7162454e5f2a883ca27656c8aed21342365b9b826056b7a350d7dc83f38433985694fd9269aa6d74be5757dfea2b52df2df16a9a8401fdd
SSDEEP 12288:SyPz5L8LctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDd9YGQ6HX3:PzyLY86e7xiAi7Q6xTNkDiU
TLSH
T1BFF4020B32A921F9D1379238C8B21A05F775BC755B248A9F43A4177B2F37A905D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 c822452b404f1a706b4d417a9b42d8166dc600d4687fb1a01e062984acb3fd11
MD5 d018cb20d3391015053c53eb351b188a
SHA1 3aa3d6576117d4c2f88f3de1e0bf33c31b2de6de
SHA512 1221a8a779d5dce2ca28db8cafb647d462e8fed98ec4a5b1ad9d8aee66a8e0c9680246d98972750012886a56f0f864802acc90c17e5c70f4f8bd148446d63007
SSDEEP 12288:c4ctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDd9YGQ6HX3:c4Y86e7xiAi7Q6xTNkDiU
TLSH
T122C4234A14ED025BD62B5174F0F5269CDA786DE4EA4A498383DB797F7B3BD010C3A223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 795be92237c63c83c7e6395ac1d9289f9aa8d610e52a403285d32d63b11a1c83
MD5 58314c708548e519aafcf2654d663933
SHA1 35ea6eaa2b249fa96c12c268784c928c95f5196e
SHA512 fca2948ea966925bc48d90f6dc2c22f1b6a2817c5e41f54874e9131463b171e1b0287a5af2948d00e9714c4093021f91c25510fe739b0687789f0e3dd494e4f5
SSDEEP 12288:c4ctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDd9YGQ6HX3:c4Y86e7xiAi7Q6xTNkDiU
TLSH
T13BC4234A14ED025BD62B5174B0F5269CDA786DE4FA4A498383DB797F7B3BD010C3A223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 1f18e87c969850691945de6bda30e639284a1b727c6e992564629f07b39638b4
MD5 293b6b24094eb7fbfc8db628463e01c7
SHA1 a7f1e4341fc7d51ce5c879e261942316eaf0c1ee
SHA512 7bc3ffc1fd829ce4f0864fd0c63831ef927fc4fec8af20a404b732eb9090c9e380e66a2c0609260ab3c5949e97cee16c82c9d860787f6ced154f54873e72545b
SSDEEP 12288:EyPz5L8LctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDd9YGQ6HX3:dzyLY86e7xiAi7Q6xTNkDiU
TLSH
T1CDF4020B32A921F9D1379238C8B21A05F775BC7557248A9F43A4177B2F37A905D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 1cc642cc7ed7c65c9beb2c73fe07c01ac8e10c2593da642bc2f547f5064c49f3
MD5 cc7ed1a1beab99a58777d10ea9662d3d
SHA1 2e18008053482836ab07355173979b67d1ec1bc8
SHA512 afd92c660c9fe99a20cb18cf0d0d988cd85765e63670e4996e7e155b28cf69413a99edeb2e01652b35c6e5d051916fb45a6bcdd9fe76cef22f25f06ddcedaa46
SSDEEP 12288:YCd9eWYoaLHF3z0z04PDvhpctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDdt:BTHaLl3z0zDpY86e7xiAi7Q6xTNkDiU
TLSH
T1DB050299B39408F9EC67813EC865490AD6B27C694B70CA5F03E4366B5F337910C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 5266a6cf9dd57421216257ad6d1ca49b2bbadb2963da1b474a5be4ca04bcada1
MD5 6f279adb9551cce0e2c5eaf2493995f7
SHA1 1a9114f6529072cc11e9fa7a5d02e562c9222c52
SHA512 e01f766526592746137ab24189f41b4ddc1477a0d954d6cab34a7c43f90954be13e547acb14ed5e570a64d1c7ede92cc5a6f30f65bd54ebd00303c8a812bbde7
SSDEEP 24576:G37d9CHKy7GZVY86e7xiAi7Q6xTNkDiU:o7d9CHKyaE864qfl
TLSH
T16D25CF90F3E810E9F0779A35C8765511DAB67C995B31CE8F03A4266A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 cf50cd8f7f4c48c46b7ac495584ec4c4b9227475ca8ff95e109461b9c03dccf2
MD5 b9a3648a83f99d8f32b8112e0eac05f4
SHA1 7cf7911b0cd16b823c53e99247c50a85d9169e20
SHA512 d8b7f9cd41ccd1bf3d59c1a839bfa05ce44d27ad90682df630675c0f7186f01d555ed1c5ca75e309a3abbcc4c90081bf0a37a40b2384f3fb0b1e1362dba908bb
SSDEEP 12288:dZctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDd9YGQ6HX3:dZY86e7xiAi7Q6xTNkDiU
TLSH
T126C4234A14ED025BD62B5174F0B5269CEA785DE4FA4A498383DB797F7B3BD010C3A223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 11011d60f43c0680b1cc59f2d32dcd93f397b985c475d9a22e4697f02247eae7
MD5 3262434a4e8084ee45fa5f11fc8c7bf5
SHA1 1a2b797d0e5e29116a127d015310f490e15e4ae7
SHA512 5fa3cd041161c5f567010734e9041f94e0db5cc48a884774270a6e6db22036b0853657b4c32c82ed4b52031009835c08d1a33dfd8a7c7a69206f5785a77e34e5
SSDEEP 12288:CrctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDd9YGQ6HX3:CrY86e7xiAi7Q6xTNkDiU
TLSH
T11AC4234A14EC029FD62B5174B0F5279CE6786DE4EA5A498383D7797F6B3BD010C3A223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 f3167edc64e29e837f85117c891d289538650ae7c83e14b26343605a3d74d7be
MD5 438ddb8e66f59771f9f76db02a6fa12e
SHA1 57c505afd68757ab758538c9d93d5292382b05f8
SHA512 0e85260fd02e72614b71849a4aede21d43041cbc2536e445fd7666748dea7a2f173f647cb73a6c8056f173ebff1437bbe249f72458d1f4cb48b4a7350531062d
SSDEEP 12288:IactV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDd9YGQ6HX3:IaY86e7xiAi7Q6xTNkDiU
TLSH
T1DFC4234A14ED025BD62B5174F0B5269CEA786DE4FA4A498383D7797F7B3BD010C3A223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 3dec035306c94f1ce6aed027004162405528ed887b12f8f671b2bb70bfeccffb
MD5 8666d653d997bbd388b66b4aaf1f8fa1
SHA1 00de64fab7f8afcb8e5f04eb189c037112f8aa77
SHA512 67e2f500c67b58812830bc3862fd6addbed858ccf3ad42df3cc70be6788d74b4d4cfd10baf0907d0dbcbf13ab0917836ee69f01620b0c27421952c52e552f82e
SSDEEP 12288:Y4ctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDd9YGQ6HX3:Y4Y86e7xiAi7Q6xTNkDiU
TLSH
T11EC4234A14ED025BD62B5174B0B5269CDA786DE4FA4A498383DB797F7B3BD010C3A223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 54652fe9040ca91b0c033bd22e51d72888748cfff0b75a0190132b58aa4c4894
MD5 2f32574e59c9fce04ab74c5a8b15e5a9
SHA1 9f6d175abea4e3de814c88f042c1023de26771df
SHA512 22f831fd72f0305e389b91ce96dadd2f0ffe4220c6f0c4d556bb35fa0c37bd39ca2564bcd7a486c09dbe40635c80eb14de2926a9f155f148b00c4f274a253361
SSDEEP 12288:gZctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDd9YGQ6HX3:gZY86e7xiAi7Q6xTNkDiU
TLSH
T158C4234A14ED025BD62B5174F0B5269CE6B85DE4FA4A498383DB797F7B3BD010C3A223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 d7677a3f3072339861f1346fbb015c3e278932b62530f148fd0e13ca5ab5aa64
MD5 d6ca8621a373cbeb4b7b6cd92e85fbb7
SHA1 e61b0f00ceec799d57eb5a8929683c1b7a650fb9
SHA512 67c9b97b51470d36e3b6556a8e38ecbf78624d730cfdf2b6b1885f48911b127506e81e26feb9de4c8eb38b836f39da8e2f79ddd1febef1da2fd9cb099d99b54f
SSDEEP 12288:WQctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDd9YGQ6HX3:WQY86e7xiAi7Q6xTNkDiU
TLSH
T1BFC4234A14ED025BD62B5174F0F5269CDAB86DE4EA4A498383D7797F6B3BD010C3A223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 910a5f80f9c78e1a21b3b73ce858831795e902ffea71d331ae3cfa591a7ed034
MD5 5907e06fecd524a903381b408866c790
SHA1 ed66a2ccebdb5be31c6c832eeca83e1d27afc9ee
SHA512 1e5c2e4bfd8b632c266066cc0d504b0d516c6253d6be2b5a948ae45482f7b5d9a860ba9add99bbe156f26de50bf3d39b8d7cf3b198e26c0a27e51e613be53432
SSDEEP 12288:3uctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDd9YGQ6HX3:3uY86e7xiAi7Q6xTNkDiU
TLSH
T1C5C4234A14ED025BD62B5170F0F5269CEA785DE4EA5A498383D7797F7B3BD010C3A223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 2c8213d35c68216db17682798d0fa6038fce0c9efc4c5c99bbc64633e1475f0c
MD5 41a2d24a0c92218d491b3e20a902f84d
SHA1 7d1e215d43c1fca657742334b9448f85e8f30ff2
SHA512 724d59449653e875567cce1cd08cb79a8ea3d1bc5f4c74351f8496867f259912b9bc3f3b98442ac0a5165ad5de069adb00d744a86b00d2997f74f4b4fe598b98
SSDEEP 12288:qhctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDd9YGQ6HX3:qhY86e7xiAi7Q6xTNkDiU
TLSH
T146C4234A14ED065FD62B5170F0F5269CDA786DE4EA4A4A8383D7797F6B3BD010C3A223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 c64d97fdd4c68c3bd4c02399c7b1959ad1d62df7fd5884faee425a41128485f3
MD5 78e09c74c73cf88e4ba9e1a2bcbcee93
SHA1 c06605ea7e12f21dabad74339231247306d94810
SHA512 db14cbc2a5a42a0d426a025b5e01d15161d2dea8864323fdb5ae39372fd1b4e5fbed42553dfdaed79dd8ee6a49baa845a87cd01f40e033569fbe789d76f97ca4
SSDEEP 12288:buctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDd9YGQ6HX3:buY86e7xiAi7Q6xTNkDiU
TLSH
T1D1C4234A14ED025BD62B5170F0F5269CE6785DE4EA5A498383D7797F7B3BD010C3A223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 6fbbfaace68400847c1166e63b9f6ea4aa7f5ac925c5bf0480e72d8d2d63adcc
MD5 b1d6a8601647b1624b282a6d0570ca13
SHA1 974fdd337fbf8006518413713a41b2d74980169f
SHA512 b92dcadec07c0c6e805882400692640910369cabe108ae6d4d37183a3e0dc7800686a6069c7deb76b9b8a9bc0ebbfc4397cb1f5351367000b917864eca8f493a
SSDEEP 24576:lfwvok9RX6wkyAIsY86e7xiAi7Q6xTNkDiU:jMnYIF864qfl
TLSH
T16A35D029EBDC04E5E177913C99B7460AF6B178681B31C6CF029A53AE0E37ED05D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d787e081e8dfc432dc4654740b4e61e9a7f4265d9d522b6498a3d5b52e56da56
MD5 884f5225771b206382c1194ccc9136a9
SHA1 267d182a4b9a3fcc98f409cafbffdb5584ffc934
SHA512 2b86ea310315d6a7606ab51125c301db61f356cd1b0663a52ffc02e78224be86437440a9094f813b96bc4ae98a719bc6cf1ff701bf73e3911cc511fd14c18212
SSDEEP 49152:SYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0+864qfl:MySzPkb
TLSH
T1D1066C56A1A801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 edc1f303e096b5a292347932bb6b968c49ed0611a18719ae3576e0d86ba59979
MD5 246873cd4080ac3fb42d896c16696a66
SHA1 c51985e1aa21292492d9b79caba56994a0c09be2
SHA512 82205e93d3fcd99b7fe555fd1684b2622d59c62192fda3b3aa37b997f0325585165daa567f776c69a19ad47de997cc3040a583e92f694069ec588dde441de971
SSDEEP 24576:747Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYXY86e7xiAi7Q6xTNkDiU:747JUQj1irIhCnDHUPfF/O864qfl
TLSH
T1BC65AE1EA3EC01E5E1BA927885154A5AEA71782D5F31CACF12B0837D6F23ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 c620c9b1b8619fa9449f10e8ce8cca5c1e95ba290532e99c0b994de1c65de771
MD5 164aa9dd364ae1859f788a2df9074fae
SHA1 2adce49da296762d1ee3bb7a90bd11b6e8db93b8
SHA512 bfe1c3c0e51e8f681400e7e2393193d47f36065861bb041ebacb7d69582f0b518cbfb0331a304956e02e8fbae04f24cdbbeb382ab9d1afa521531316f30e0699
SSDEEP 12288:ENsfoctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDd9YGQ6HX3:VoY86e7xiAi7Q6xTNkDiU
TLSH
T1A4E4F00AD29802E9C02E6279D7A65A44F3337C6497E193CB43D1F97E1F36A805DEA713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 1da5731c1184f283679bea82b47b955280f74d0e8a4904eb62aea31c1e998be6
MD5 5789bf107fc2a1633ffb777f13d70af6
SHA1 665d42e8540cf0f542585b450ce4fb7160a29a1a
SHA512 78e77e3647208d05ca7bd6c208855441291280f9ab42cffe80132060763376c717c6e24eeb3e53e96fc226d2c388ee7788b9f51b4814d1f55a7c5dc738db97d5
SSDEEP 12288:A8BEXcKWU3f8zsKM2pcSUsK6sKLUkgEcE9UMCwd8:ACCcpUP8eSjKmQbEb9Uq
TLSH
T162452841766AD75FC6A940321E32D1CCAB707C11EE05AF0373C98B3FD576669BAB2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 f95a1517c074ead1d474c962ecd4edc761e1faff815671d18608fd2ab722658d
MD5 8445f5df621f128a75160d99841cdde4
SHA1 b0815a2e93b6e085c736edc587800e39811c4d55
SHA512 aa4579515a8bc2a9ab3c1e0656c98d9132e3fc46cc41a6b10f9f98fa164151f20c7c4ccf7c9f35ce0c41af09f62609151dd21c6fdaaa10bd7f31b59cd8dd8ac6
SSDEEP 6144:jPGAmzeO5fdQtJhgLrvL2BN5hM31dDdBYwC3tMxjMMbGP+zBRa3gQv3bi2n0BoRZ:jPGAmKKfUhgLrvL2BNoGmCbADLV4
TLSH
T1D465E8819137A2CFD1F7603207255F8CB7A4EC16B7456F26B3C8443AD86AB25A4F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 0c7e87877316b30e0ea8486efcd714489e7723b6dd9fc3cdaa02d28cebfb7f32
MD5 13491b79a79a62d8442e0306aa80877b
SHA1 b4b659fe644f276f31a8787a2a283604c9ff8f5f
SHA512 f3d51c8bc37c1c000bbcc1bbca81114cc3901e6970350bb725511e7a2ba1a9b3d5087e8b63a4a66e5ebafc1d43fab0c1da240d52156e2edffce17f89c5644e58
SSDEEP 12288:ez7ActV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDd9YGQ6HX3:MAY86e7xiAi7Q6xTNkDiU
TLSH
T11CD4230652EC065BE93B5170B0BA622CA66D7DF49F0585C383867ABF7A36DC14C3A317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b0c569dd9972d2a565106465dc5b00b809e9d69ebf9fc548a9bfe221ff9f2313
MD5 ef63df6461d7509d6ac16d12dd23d5fe
SHA1 00debab471cad98e5cc291c62fbe7b2bf30ac82f
SHA512 27bd3a9c6f185ab9ab21b9be9ac6816c52bc2eaf76840a2a5683cc4e9d0da7a0f9b757f354edd8f0313354636bb33983feff4db146e28b34ca868b93bb8ead4d
SSDEEP 24576:Kgb6bmBIi49WNNFpg1rSvFv7bYiY86e7xiAi7Q6xTNkDiU:Kgb4mBIBhGFI864qfl
TLSH
T1CC659E1E22EC02F5E0FAD2B89DA64417D6B278160731D2DF1251427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 4c109e653e229793e83399a5d1a653f83a45450a1fb274c32f95243cb2b54f80
MD5 47800494adee069a166790cfc09088bf
SHA1 a395a562c25e2d10be484a4a723dd477aa175a1f
SHA512 2a905681e895a29b908478a73adacd419d8b37ebecaa5dca385ece0a5785d9d6d26cafe0cddd959446af7ed9b462add43e20eb7d1f1c7db8ed39f0e7e6272093
SSDEEP 24576:BG88u8FpJqH1bzria7/mHY86e7xiAi7Q6xTNkDiU:E7ZFPqVea7/7864qfl
TLSH
T1E935016576E402F1D47BD13889924667F6B1B8250364EFDF07A88B661F23AD10F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2a7b307bf986a9165e13d6085dcbb1dfa30c909f33cc3a3ec96aafe2383da61d
MD5 65ec210e091b2d9f029ca4c09b15d213
SHA1 ca462d4a319fdc68dd9a05055f103ab4bfa5f378
SHA512 b8cbcad421bfd1196746ede2b041e8bfd043f321be889f17f134c6194ba448197d615987ef33f8a11c7e2b15af1e6fc4c378052fe71d605b8bb2b6190b00457a
SSDEEP 49152:oBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj0864qfl:DG05lO43blb
TLSH
T1AFD5CF6E62EC11F9D1BBD17CD9C6460BEBB23825033556CB02A486A91F27FF4593E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9ad23a5a5c9ea236ed6cbc27bcffd82375fe4855530b59871dedd9754bbfc73b
MD5 2896e92aa89088fddaff0793ce78b761
SHA1 3f3ecfa33c83b48ce4a6831f47d60be5a58699c4
SHA512 35e0460cd9f44d49164d17183eeabb05f270a698ca10ec3811e6f149b283b82181d646837a9d7cdc1f89c28b6fc007acdaebfa5aa9bf37565ff8134699bb2b84
SSDEEP 24576:Rfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnNY86e7xiAi7Q6xTNkDiU:xa5POZ3+Jt2pasx2+ms864qfl
TLSH
T1AA65BF5EA6FC01D5D57AD17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b743c0ebe78010a726faa48ddfe243fbe6d3fe786a7fee19865c99fdb2d79c20
MD5 b3b1454ee5b4b66915ad07a4eb6d5ebb
SHA1 fd2b7790e5dec6f067bfd758908e7182895cb25c
SHA512 ded335cd63cd919699c10c7c51503ad76b499239795dd27169e688037960c5b13ae085d03d201bcb5ae0d9006f13cce5f16f494b84938f338c40ea34a304ac89
SSDEEP 24576:GNcwHdjbyQ4nLC18lb/EOjowL7FkvY86e7xiAi7Q6xTNkDiU:GNc/zEOVHFb864qfl
TLSH
T1DA858B1622E901E4F1BBE1BE89779546FAB1786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a25c00f1eb637fded60b2711cb078eb6f2b4d2c3b381dbc1de68cba94b073585
MD5 1b1c38e9f8d34798cad59bbc036f374f
SHA1 169ab14b3231fab312082da99125ea6f42e37060
SHA512 d3c6ab30743794014027fff8279dddccbaf32bd4f3232ce7043386483a023109637f47774c5f2df782e6e3363ddcf9df9cb236fbe5fbff115c9add6c60857be9
SSDEEP 24576:C8kNvNnaFeYhJNtmZBmhY86e7xiAi7Q6xTNkDiU:C8MwBtOmi864qfl
TLSH
T11455AF6EA6F806E4D1BEC6B4DD238516E6727861173293CB4390C13F1E279D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 81bb4d9187fa7283fc85303dcf7bcc3ab7dc8e2c66976843c2bb83f64d0b5b15
MD5 fd91373cd3aa22675b9197c23208b935
SHA1 5981688294305c2c7c0354e46827547676e6c025
SHA512 3aad493a233266787af851593cb9fe37b2b3ab70e9aa104c1170b52758f18b8472f7fe035171a580aff1af8ea24fc9575ba18818c1bedeea1d2d6023e504407e
SSDEEP 12288:RHvUrBFrEjwaQTctV/8OrB0NXL9CsiqdRnXzeD9FMvR56xTIyJhEDd9YGQ6HX3:RPUr+NQTY86e7xiAi7Q6xTNkDiU
TLSH
T19C05E11F22EC18E5E67AA17C8592471DF771B861171292CF02E1817E5F27ED8AC3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 369896d7254df2b64f2d267fad19ea0366a7c94374045966430b317f9401a719
MD5 f62a4fe362eee32499647ba1d3038635
SHA1 330810267f24dc23e93e1e59958cd08235df1a41
SHA512 20436944facf2f473f351cdba66d8c9edf19f527ee4a7e033e9d48a332b2dcebd2f751beb1e9ba812e5c8bcd9aa8eadea1281d218561f7e26a226d22a371e35a
SSDEEP 24576:/D3FHshBIYQgAUY86e7xiAi7Q6xTNkDiU:/DVHeBIAA9864qfl
TLSH
T1AB25E13EE69C04E5D57BD1BCD6638A06E77138A8032256CB02D591BA5F2BEE42D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1356-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1356-133-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1356-138-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1356-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1356-125-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/1748-408-0x0000025747E50000-0x000002574807D000-memory.dmp

Download

memory/2396-381-0x000001B985480000-0x000001B98570B000-memory.dmp

Download

memory/2516-370-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2516-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2516-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2516-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2608-88-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2608-22-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2608-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2608-21-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2608-14-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/2880-78-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2880-79-0x00000000006A0000-0x0000000000707000-memory.dmp

Download

memory/2880-84-0x00000000006A0000-0x0000000000707000-memory.dmp

Download

memory/2880-309-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3620-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3620-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3620-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3620-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3620-131-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4308-58-0x0000000001620000-0x0000000001680000-memory.dmp

Download

memory/4308-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4308-76-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4308-40-0x0000000001620000-0x0000000001680000-memory.dmp

Download

memory/4308-46-0x0000000001620000-0x0000000001680000-memory.dmp

Download

memory/4316-121-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4316-369-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4316-113-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5124-73-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5124-67-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/5124-304-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5124-65-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/5316-108-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5316-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5316-102-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5316-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5316-366-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5316-365-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5580-278-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5580-60-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5580-52-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5580-50-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/6084-96-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/6084-382-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/6084-384-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6084-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6084-90-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/6084-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6140-8-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6140-314-0x0000000140000000-0x00000001400D1000-memory.dmp

Download

memory/6140-0-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6140-64-0x0000000140000000-0x00000001400D1000-memory.dmp

Download

memory/6140-6-0x0000000140000000-0x00000001400D1000-memory.dmp

Download

memory/6140-7-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6140-310-0x0000000000730000-0x0000000000790000-memory.dmp

Download