2e64eadc3706b3facba13c48b84f0b03267b05c26613f332ad4bf1dfd4362318

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
Size 1.2MB
Sample261027-jsnp3abv5v
SHA256 2e64eadc3706b3facba13c48b84f0b03267b05c26613f332ad4bf1dfd4362318
MD5 be81baf35dfae328bcc9db2316f0de5e
SHA1 ba5b02e0b0ffee37b86145701f6a8bee0ca29acd
SHA512 a2aeb92adfa25bda2d95edfdeafd80a37e1fd2363bce4a7aedf7538556a83e314131190c326617462417ebe018d210b976d6571ea74d34645f65d0f76f4ee47e
SSDEEP 24576:moUt7lN9cNMnAUz5DFs1jsLqmVNPEZ+OQw:moUt7lQmtDU42mLsZFQw
TLSH
T1A045E151B745BFE9D126CD3C827585529D327C870B22ACEF12D432292F7AAE75E39E00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3512	elevation_service.exe
4980	elevation_service.exe
5056	maintenanceservice.exe
5412	OSE.EXE
3756	PerceptionSimulationService.exe
4408	perfhost.exe
3280	ReFsDedupSvc.exe
2880	SensorDataService.exe
896	ssh-agent.exe
4428	AgentService.exe
5200	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a72ab7bf31e6882f.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_110156\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000be17ebabe865dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000222ef5abe865dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000062bcfeabe865dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000033b89fade865dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bde993e9e865dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a4e78eace865dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000802029eae865dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000397231ace865dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000b29903ade865dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3512	elevation_service.exe
3512	elevation_service.exe
3512	elevation_service.exe
3512	elevation_service.exe
3512	elevation_service.exe
3512	elevation_service.exe
3512	elevation_service.exe
4980	elevation_service.exe
4980	elevation_service.exe
4980	elevation_service.exe
4980	elevation_service.exe
4980	elevation_service.exe
4980	elevation_service.exe
4980	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5784	2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
Token: SeBackupPrivilege	3280	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3280	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3280	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3280	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3280	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3280	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3280	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3280	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3280	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3280	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4428	AgentService.exe
Token: 33	5200	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5200	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5200	SearchIndexer.exe
Token: SeDebugPrivilege	3512	elevation_service.exe
Token: SeDebugPrivilege	4980	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5200 wrote to memory of 4268	5200	SearchIndexer.exe	101
PID 5200 wrote to memory of 4188	5200	SearchIndexer.exe	102
PID 5200 wrote to memory of 4704	5200	SearchIndexer.exe	103
PID 5200 wrote to memory of 4572	5200	SearchIndexer.exe	104
PID 5200 wrote to memory of 2936	5200	SearchIndexer.exe	108
PID 5200 wrote to memory of 5380	5200	SearchIndexer.exe	109
PID 5200 wrote to memory of 4432	5200	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_be81baf35dfae328bcc9db2316f0de5e_icedid.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:5784

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3512

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4980

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5056

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5412

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3756

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4408

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3280

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2880

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:896

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4428

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5200
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4268
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4057491610-3392471755-192832105-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4188
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3036 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4704
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4572
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2936
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3044 3036 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5380
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c7f0e284bccb9677d05144fda9f4fec0ca94afd8e0ce637b488c65649e8eba90
MD5 7ebf7007cf329055b0fb5b42886c2b36
SHA1 bcfabc8f297b8870a8b0b0aa740bbd3b29aac895
SHA512 c8f452df572749e61d57eb76dc64bc012687d1c71431229a1e0240991af6c889866b282dd151641aa3006ef9837019cc231caba8ae44cd24b85f580877d048a6
SSDEEP 49152:Db+632BuPkFKRrdE6ohvstBhuXjfS4LWxnhtDU42mLsZFQw:h3q6sjB6w7mLQuw
TLSH
T161D59D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 f4ed36f05147f92cf26509fc76c573609c0a73ef919bedf6e5d6c18dc29cb788
MD5 78b3d3167fce96dcce3dbf5e0c24a02d
SHA1 dd84567ea1733427a1ca86b3aec6fb1e14e08268
SHA512 4f659877ab4d2393fe44eae5a3e784ecb510292a55f0758856521333cc2f74db35a5fba1fff0e0eadbf56d1f80917b14fca3d550a697d86975a699340f345f0f
SSDEEP 24576:yXYfDtczAinAUz5DFs1jsLqmVNPEZ+OQw:ZtcbtDU42mLsZFQw
TLSH
T12205F12873A004F9ED67817CC9A2D505E672BC854760E79B03E49A3A1F377D46E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 f52ef31300cd84c7d03e11a01d5394e2ab6e203104b90960d5ba7ae4aeedd83e
MD5 55d537d77bb1755b59c25f99d1f8277b
SHA1 5dabac0affb422d84d06a93f5fbb0b095cb4832a
SHA512 88793f9b4ff3143bd4a5ce26053d43cc72f754be17f81fc5dac3c01b289cb177ae73e7dbbab4344b5acbbd73e807ac52733067b6d899a3c1c03e15fc2b4f65f2
SSDEEP 24576:n0Le5ji0hmxxrM9nAUz5DFs1jsLqmVNPEZ+OQw:nPji0AjWtDU42mLsZFQw
TLSH
T18E359E16F6748335D073C0B9C5D2A68EE97130865B308ACB4296D77C2F6BBE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f1db96e774c37e0b66f63fa17a35183cc2fe2f48fe8db4e6e38c4775bdda3b0a
MD5 24bdb5c1d6fa59db7e2cbc329fa424f8
SHA1 1ed1580ee05c4e0c1cea60fc0b3fce8ee27c3dc4
SHA512 eaec0a89f8f1b3468679854f913b0a7db8dedccc5d15161a22c3b62e52a3cfb75e9d373c85addfe47073591f31257d144fbebd02d6270c8de85160ab1864814c
SSDEEP 24576:Ga7/ezSC6vUyD/aqgrvWn6q8wyujnAUz5DFs1jsLqmVNPEZ+OQw:R/ezSC6vUzPveHjy6tDU42mLsZFQw
TLSH
T1FB755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f36b46093c2bc577053ff1e3280a6d00358a1e172f8305868c96e0d207c14628
MD5 f8a1b9710b702a3b08582e37c05fb4ac
SHA1 e6979f1e4856e96defc3bd326353f64af750ba60
SHA512 f8740788229512f62b46602eef22fa7712569c1648a9efca5b98866d33867bc680fef95680f63806e3c861db69254867f3eb6024da4745205707d3021826af58
SSDEEP 24576:dVbqPb88hv/l+YmnAUz5DFs1jsLqmVNPEZ+OQw:dVO88hXl+jtDU42mLsZFQw
TLSH
T132559E66F6748331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 9c57776fdacfbf35164c8bc67bb5716e189b64358d0bcb6bcfbddf1c140e6665
MD5 f1ccf2fb1feeb10af8bf2bd680075be3
SHA1 e5f5427bf55d137dfa310c4d672d155f2243a7e1
SHA512 681613f32a3f08e8912506288b60c57e91dff2050ba8c5ef66cc756cceab51fd850753ac9ef4f12f45bf23549ed5052a366e04c135ef00807739311119326171
SSDEEP 12288:0LhjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:0LhnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1B7C423866330A056D3572D75EAB6F94930B0EDCD6921EA1B0EE2373F05BCAD2F456243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 aa485edf11d838baa5a28ac7e1ce0314ba7ac1942549bf63f705afd194b4b20b
MD5 aa64c2ca8e06bf595cf63e94324fc035
SHA1 ade42e05641bb78759e8cf106d99fbc2d1dec2b9
SHA512 89ae198fc08f64ad7d0a079f57fa3a9bd7957f817f36b496da1004ff77e6544b947fe72fa569f43050d4331ce3df9f95373f5d5a86de26356eabd1507c124c6c
SSDEEP 12288:NeBNUbTVO86UujvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGr:NJIUunAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1CE05CF3BEE28FCD2C27A5DB85A91C600A77278704F22A3CBD175830E9E275E15D7AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8ea005515ba944aa9568cb5d43db5c6fc14f61b377124fc4460cdfe49ff19853
MD5 11532dfaa1fd761f21163ac3ff556d43
SHA1 67ce18d1d52831cc7f999772376fda86f1f1574c
SHA512 1170fe0ff4b4c586ba68e88570abebd6bcfdeb56b493a4e0358b8f6b9f1a82a6ea0b65a6f7a819f5243342de091d106ca6fbc414c844071f842b9d7860acdd2e
SSDEEP 49152:AQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THX:AQvGAdlCEL8c/DRNw5Cxw7mLQuw
TLSH
T19D267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 cd7efee6bdffe567e20a51e565235f2351e5985706ee83cb78f0ddac009de646
MD5 3c6f0d4175260b647059aada92449dbd
SHA1 9e852ab2c2e8a1605a206c39b47f56863fdd1743
SHA512 7fb476e58f03c81a73cb7e3778996c359aefda50164cfbb5c40411e00b788b7b41c3e2ad0063f3aca957e4270ef6f4d077e7d7a6cc324e2c1b384c69f1db3385
SSDEEP 12288:NAwSfxL/2Dc3RDLLmt0LDQewsAjsjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcL:+0ewsAjsnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T14F15E031FB74E036C37B0DB21B36D716247CB9604B621AC3E3E85A9E49742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 38b4da9cc3cb6988466ac490269d06a7e25fffb3641b90fca606eb85338813d7
MD5 0e9fc98b462ade14572fcb0bf90db720
SHA1 3f97960d113f182e959ebe076ca34ada61183fab
SHA512 4e57859517ca5c60f2b49eceab60f3d9125e841e5d194a52af8a15fb93127699144466183bddb8b80ada31d71bae6485d241a990ee77e5d183d33252a8a1f655
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHiLQu:jUEtQevvqc2W1cpV2tI32G
TLSH
T10D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 efd1b72bac15ed47b809c408981a954cd7a4d0d0310200dc0da0b9b3ff7a72dd
MD5 9b05bc94fb187ec75ca076efda4b96a0
SHA1 5348504d8aaa940976e65620cade6e62f2cdc12f
SHA512 2fd37b62269eb687acad7dc2fc5d046e2c460f7a6f7d9b53a8e48fe4f9569fa6f3cda7876d63e17be85464cf5a81c5a7d6210f86fb6a008a33c4fe7f463e44ba
SSDEEP 49152:XCbRquA/m2yL5zTfFiV+XenmE3/zmtDU42mLsZFQw:AoquVjnmVw7mLQuw
TLSH
T102D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c76addda6a879fae3ad60d06ecd0d1423a81b861fdc17e91471fd662a210446c
MD5 fe0885e52aa6f1216c1c2f6e0c87d620
SHA1 6f292f4056bf9fd318100e912238bd77a7b8847b
SHA512 0c0b1eb153584790b6fba018a6c9146d37e11fd22eed1dc7725e9016544f4b4d5e0dea0a48b2df729a3e6e9e3a6e7bb63b99cdeba6e56a89a1ff5947303e99a0
SSDEEP 24576:3AhGL3IFoiwtA5l7S53fnAUz5DFs1jsLqmVNPEZ+OQw:3AMUFoiq5vtDU42mLsZFQw
TLSH
T1BB35AE81E7F951D4F5B3AA7899B69170EA76BCAA5E31C20F2160D21F0E37E409D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 7435e8172a9ac704be73002967c7ed25845c5995c3274c19ac049289573c1944
MD5 f01a6f1d602d62feffabd628d2af5244
SHA1 39fb0dcb553b9fece99d9e4ee62706b476cada15
SHA512 cc780938fc991f823f3f9f9061194700728d672bb7ce9d3bf8d7be69a95dd003b46a955041e9f9f82f06daccb620456c6d03742f922e1f700ee3321b7444b1e3
SSDEEP 12288:/mw5HEjsChNVBFgl0WDm+CDjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHn:+wu4OWonAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1D905F04673A418F9E56745388697D136F7F2BC062A21DB1F07A0C72B5F3B261BD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 7f6d06c43999e7acb0038dea92aff01fe68ae96a8339b5cd3f5aa420ec4ced1f
MD5 0cb10b62e6ddf2f368c6a72f5efbe8a1
SHA1 8c43cb46374a0beecbe2e6ece75ba49fbf45c18c
SHA512 e1f846f701f166fd60e224b150eccb59a5596a1e3cee44a29f12293a4351c50c19a9c4b11ec3af5ff1e64d9c59550ae531ea0935d0ab26aeba8ced714513c894
SSDEEP 12288:TeZ1Iy8jvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:CZulnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T155E4128A33A470F9D263557CC9E5A605E3B1B886673283CF0665136B1F7BAC26D39313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0d69dae467a7aa5daa38ad6b1648029fd06ac93106f52a0a2a418c0b92fae1a6
MD5 37e6590c870bcee991fea637f389b810
SHA1 f3aff140570033d25316d7152074f3cc18387e19
SHA512 fa69281663232ffd709a1fa2a7562d489885fc5fc3de47b1f058cf6e2aba4d97e27e8ad4b48b7b6b39bdb86215cf5e29a81a38e92e58a9384408c03e6d64e8e3
SSDEEP 98304:MQRQyi36YOcPbLvw2gAf+PN32w7mLQuw:TQyiKa/X+PN8LQu
TLSH
T11E667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0a4a07dadaf3d6e60424f8552067fa015d051609e97a82354d2c7586898eab79
MD5 eca080169524eda8732babfc624d86f1
SHA1 9bd00fa8b9381a2abbd9836fa9fa38206b7d8af1
SHA512 212c6b4c62250dda5ad932ab4b6a10c16ff080a6d5a54d81e4169c88e41cbf2fb8e4b56ee6c85f54e9c1627013fda26e603fd3113d548195ea8002a730230455
SSDEEP 98304:nQRQyi36YOcPbLvw2gAf+PN32w7mLQuw:2QyiKa/X+PN8LQu
TLSH
T105667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ccd19915714f6c673452199c9a8767cc652956fb247962eea3774112fb4cfee2
MD5 70c3ae49813d50ea33fbf6148884ccd7
SHA1 5308df1d1c001b1e4ad0a7c0afaff1655a4593d9
SHA512 06c8545009c06e19544363b6f187762c760d7da2b04238e6662e57d0482b13e2450e7bf206251fdf60a3e0a70ac5860c8e946db34426dd3cb601bd5cba59f641
SSDEEP 49152:168Qg55nhceWu7PNU3/WtDU42mLsZFQw:DthLRc/kw7mLQuw
TLSH
T16CB55A33B2F20099C44DE1769F4A972196E17C758FE0E3DB8511721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b82c3cc2f8be657dc9c79544ac3c64ca0f36a0592e47f11a9d0ee158c77239c5
MD5 209db7d23845ee7ea2940bb961379e62
SHA1 9c931e16e8fc382489036736af8f652db45b359e
SHA512 1da9f7298e4d43646250abfe1f26a8803d22369a3a14494d7f427620ef9ffe88832a0f085b97fb42fac668249bd468067afbd8b88a4f5274fa44d684fa98638a
SSDEEP 98304:jy5112gYy5azzVvt69nLKnhZbw7mLQuw:+LIHEWhZLQu
TLSH
T143167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7391bb445c16d973eff80f0b4581df1c01d03975405e14f464f853eb4e9e949d
MD5 6cd79e0f3c4a0f4d334437d8d7bffa93
SHA1 8a0777f9ef5a1a3715c283668c9017a3393506d0
SHA512 4d64c25092840775a85eb325626e4bcb85f706e9c74427f0f6b0629c9841a1856bf3df2c4344746b84191611e58dfb977858eab9225ca21b350561099942eb72
SSDEEP 49152:kB+taZ3usBWOBr4tEGL0bqx0z+n217aau1gl4tDU42mLsZFQw:+u6Jmdxd2dOw7mLQuw
TLSH
T173D59D13F2DA01E8D06ED478974A9233F962BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e72ad91fce8d19264d74d5293992c9656145427768599e1ee9aaa1cdd34a1d0b
MD5 7bc609148f2b3829ff6a0b0e42314a86
SHA1 9f7ded1d0c7320f871066b38bdd4d0f799b6cc79
SHA512 6661613dc67b57cb53e4eb6416810819fd62f0f8ad49cd4d90cc43059fdde634201667052273f3c7232342ec22a9ae84d5feddde3524aabb0c1f6a6333e30869
SSDEEP 49152:81hpsNoJpF1A63U44CwH7R4x8tDU42mLsZFQw:8mifPWRVw7mLQuw
TLSH
T13CB5BE13F29900E8D05ED17887569232EA72BC460B34B6DF0A90B7961F7BBE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 1783bec9c087f9fda1ccd549a0b3f7fdd2019ede7e8130cf2f4f8a64877949e0
MD5 7837d7b05b37c75a69e9c6f459c915c3
SHA1 3da3001e4bacbc198726e8faaefab6814de6baf8
SHA512 0802e5dfcfbab934e5a1a487d360d69d93a45255c5caf2dd4894e12bc901cfcd9869916e6edf02d1ad7d9085132ccb163eb08148cbbda9356bcb8d71aec594fd
SSDEEP 49152:+SuZQIY0Be2KcRVtOnks6NMHqRtDU42mLsZFQw:Q5dKii61Hw7mLQuw
TLSH
T171C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 432faefc94a957bfa26633004908d3ef202c9b3b75f6a4ee7a09b74dc02734a2
MD5 7eace2eecf2cdfd6b7b1d152dbd9ea28
SHA1 ac416f3e48c3f549e48d7bd732059a468ea5ab5c
SHA512 68bf5b12cde9877f76f5191c6e19d0f74d96a4230922ddeeaa3c194d93a1c95d59d2b3a53a9aecf0888613694db8036df3d4c05261146d51829bc17dd2131f39
SSDEEP 49152:FhtSn8EApI0fig3giDn0AP5wotDU42mLsZFQw:0X2imph5w7mLQuw
TLSH
T13295BE13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 cb9afdaaf4225a3216eb525dadfcd1610bf8fc51324c8e879fd5da3e788059f7
MD5 3eb4aefbf9e40954acbdf6c3292d90e2
SHA1 c7a68194160dac5240de918301ddedb977fca62e
SHA512 5bdd2aa677d80bfb3043d3c4e6c0822d6632c1669f3fd37ec9579e2363e0050ec554d090d29fb40be8f6f5aa19d064b267fde6f72ffd7e35970791b7ac1206d2
SSDEEP 12288:mpjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:mpnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T19DC4238673319056C3021DB5DAA5F54970F4EDCEBA22952B1EEB333B07BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 a204fb0c2abbdc21bd40f0ad8acb2a2439b1b5ff05a629423e3d286763b61f8d
MD5 e200fc8d3aaf0ed4d7b5cc1ebd850067
SHA1 899a956d15ea5ef2b93af617a20c58e9c52803bc
SHA512 0e27c5dec133ac8e444659fab120d5a69ed8644b390c0876455883e3a305e3f28c2c30f33f6d55035b644b32e805ad849a087a29e9c81f0509cfa8f37580d9eb
SSDEEP 12288:kgjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:kgnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T165C4238673315056C3061DB5DAA5F54970B0EECFBA22952B1EEB333B07BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 9b41ed35a41fa198c0b0e1e1dc10cb8be374403827be97ed541e03b68709e2fa
MD5 e2f591169519e975d40d42213554451a
SHA1 7abd7745c6da0b2179f064459082c54c133b58ca
SHA512 2c01b486146d567adc68ee6cc232e240330e4b89149bbca302bb533ec6e509743c1eab97259ab22927c3e09d1aee00391c5c52c2b5e6bd1f33f11fd05af92ff7
SSDEEP 12288:mWjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:mWnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T154C4238673315056C3061DB5D6A6F54970F0EDCFBA22A52B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 cecb4d54469c6dc5a1493ca2f000fb9dddaf3d3a6179033c4ca6b86df7976745
MD5 5f99bc5231c6ab2239506b3a387d1269
SHA1 98ba24b8545f8faad357d3fc8f8491c9f6b1a6e0
SHA512 3112520ca7610fa61d1e078eab5b8e59ac7c51b6f06520199c53743ae4c3bf009ad687ec2d4177e4a76cfdd773e412b1548c3d2a1695543b311aa24694a576f9
SSDEEP 12288:DV/jvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:dnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1AAD42346333550D6C1269975CAA2F145B1F0FDCEAB32A66F0A92272B0EBD7D1B835343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 98aa3047494fb6c2a514f9906b2a90fb9cb3a97014a948e724c2c17f323eb394
MD5 560bde622bb4973c6d9cc58b7b8aa7a8
SHA1 75ea93ad8c6bd025efeba96d432918a817aab3a0
SHA512 84edacb9e3dacefaad9dce3696f4499eaae730a49c213dddf88f1073ec47e53a476ec5420b3cc865c8e096da67b8a7331d997be694171619c65c05dc0ab610b4
SSDEEP 12288:yXjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:yXnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1A3C4238673315056C3061DB5D6A6F54970B0EDCFBA22A52B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 6976da2be4d50a480832104139ba1f7623bf882b8569a8df19fc781dba044eda
MD5 42c744a0c6beea5c8b72ec146a7bf8f8
SHA1 514e936add70f366eafdd3bdab11c000f8053f22
SHA512 037879e2cf278c14bb483cc3d0df9af61ec18de66edffde165127709ae6aa974e269dd51d6e8c9d9b6ffbbbd67b206daa16929d99550ab2e8d04c93cbabf122f
SSDEEP 12288:8UjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:8UnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T14FC4238673315056C3061DB5DAA5F54970B0EECFBA22A52B1EE7333B07BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 a330908ee4aab5f079c00b7466d37e31f5cb7409d324b9adefc26972068da22d
MD5 7847978127c5c749f025d2969107821e
SHA1 a19f5c1bbce9c41e9bb09cfe5e2db943d346a9e8
SHA512 ee8c36ec7130f474affddfda5a83f40b904e9f86bd2f0931fb8962af0ecdd6ef61494e7eacfa2ef6d6ac03ec3536420a2eb0b2736566c71965673d3d224f7be5
SSDEEP 12288:8YjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:8YnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T15AC4238673315056C31619B5DAA5F54870B4EECFBA22D62B1EE7333B07BCAD2B416183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 32b101360d6cfad68b05a47c75daa6cf68f0b665aafc292fc9a3005a41424db9
MD5 3aac99cfbc9e6133b4cab0e0295110bd
SHA1 48da6e3b9d10d871f2701d0f35b56eb53b3b360a
SHA512 fd2df3b693482f7fd282b2289c0ab260ca3ea32107071de4aefd5c2ad943b16ae276d20b37056ca3c986c23030b997443ad28998ef9501946ec6cbc11466dcac
SSDEEP 24576:uZMRzFVSOAnAUz5DFs1jsLqmVNPEZ+OQw:uZMRzfetDU42mLsZFQw
TLSH
T1B2050195B36018F8DC67813EC9659906E2B2BC5A1B70C61F07E4362B1F773A11C3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 22b65452a01f74f814a1b97f534e35209ded0d088ba7d2bde9122d67290ac859
MD5 e6d14482ba4a41b9a9e7d1a32396338d
SHA1 d8f09b6c8f66a656ace0b3700fa3251f98676e3e
SHA512 f1861464887794d97d0e07f08225e306701c9705ce510d59a2b09a2d1ba89cd43af36035a7efb8c82bdc7b91973ce0c6aead1abc007011e632937a965e3f6161
SSDEEP 12288:s1jvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:s1nAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T18CC4238673315056C3061DB5D6A6F54970B4EECFBA22E51B1EEB333B06BCAD2B416183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 5fe99b91255e0ae701eaf453cb36822957cf61b1a40e7ebce6b19081f53b4b00
MD5 2a25e09f3f04c039839471272e460cb6
SHA1 a06b23fd7489dbe8a2a6ec19ad0755ca8e6c65b2
SHA512 4c099cc3cfbf8a53224d0292e4d335bd0496b191d591f53407053a4cc588f648d6f068b4fc7a910710f2aab2b7145a63374e97a4a68c98bba223cc17f879a324
SSDEEP 12288:cxjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:cxnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T11AC4238673315056C30619B5D6A5F54870B4EECFBA22E61B1EEB333B07BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 8f4dd62f4453fda7354906a1034a09e75ba54fee7aadf191cc5fbe548ae0fae5
MD5 345c2cbc6d74e845dd0dae08de5b9b51
SHA1 2c92f17b296a63ae06db046db7f21804f7ab437b
SHA512 92182ffdce8f7ad10ca1c925feaa3ef0a5b86117b1e81e103d676b42c0b9b9fe8b19b4d521be8edfaef09f0bdc33bdfb715677e61b51aca0e85bc99ab8561b78
SSDEEP 12288:8yPz5L88jvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:lzy8nAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1A3F41247736130F9D1275238C9A26A01F3B1BC765B208AAF17A4173B1F3B6D1AD3A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 6a46573298d0f974cc578928ca5eff7801a70e19afd49c719331c1a10496fb03
MD5 11d426234dc2ade279961f597cfda6ec
SHA1 04ed6651711f9e4c8226b2cb82e97b4204c189bf
SHA512 a65a343b2dcdc9a3de7e97068d1714cd92348d0c534c3ab1e21bf7ace3b9a2b53e3ef58e662a354506295ea80749b681464a31295cbef0f5e018edd36f868fb0
SSDEEP 12288:h1jvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:h1nAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T11EC4238673315056C3061DB5D6A5F54870B4EECFBA22E51B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 c1a008ef37c1be99a011087a2b7a3ba8e9a4003613ddf87468161ad4c1dffa1f
MD5 4687c803c5a1f34500da62d1ffe2e100
SHA1 70b1fb2e21881ff9933849f773b2993306ae9378
SHA512 40ba21d4bf0511b4c07ebbfca0ecd51cc12257e6e4e31d0833d0fcd343946b4220afd6e815fab0a8eba8beca3623c57e366b23a5436aebc68c7c2620a10bea08
SSDEEP 12288:H1jvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:H1nAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1A9C4238673315056C3061DB5DAA5F54870B4EECFBA22E51B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 5efac993241c674627343a6c5c45c9c5bcb673e3515a72756b29c673bd2ec53b
MD5 47c68c892a94d65f347c8cf80d911710
SHA1 fcb1188ef244e338c3664142a4deff8b729d70c7
SHA512 9a111fb750faade14ebaa9de54f97200a03b38eb77ece0ea822d929b2e574d4cf445e7318170f135484a6d8104df5c8b9ed57557c164ee1574bd1566a6490f7f
SSDEEP 12288:hyPz5L88jvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:wzy8nAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T170F41247736130F9D1279238C9A26A05F3B1BC7617208AAF17A4173B1F3B6D1AD3A761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 b8e8f3eed222e41040a2e99aaedb12d4094fbbbd66f455a432b404ac7714f014
MD5 1cbcce47b608d738a38d919cd91e3e65
SHA1 c909d2835612c5fa3a6cb7c94fe0254367a5a79b
SHA512 a4f39dc6a90eca38e72dd295b8befda9703e043b5d60c0a5600573ad2c6f535b166b5b67480fb641a5a5c5673d3528f64ce494e79b8a0d8fe9cd61310d58dede
SSDEEP 24576:oTDaLl3z0zDGnAUz5DFs1jsLqmVNPEZ+OQw:oTuLljLtDU42mLsZFQw
TLSH
T1D9050195B36018F8DD67813EC9659906D2B2BC5A0B70C61F07E4372B1F373A16C2EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 02f1bef2491249578eff921aa50650a15a552105c4144d19e09de79783b6bd19
MD5 63228867bc4d242a0ca0989711ac4b71
SHA1 6096af0059c60f1a790522efbd841920d82928e0
SHA512 8fb692d2a1900eaabc490dd8edbd7ccb377f3716167f414ded38da8124c7904b4423843457fd76d55ec977a7394fba9f73a11196cb2dd89649694ba9e1b96387
SSDEEP 24576:h3vd9CHKy7GZKnAUz5DFs1jsLqmVNPEZ+OQw:Rvd9CHKyaetDU42mLsZFQw
TLSH
T14825CF90F3E410E8F1B79A35C9769501DAB67C5A1B31DA8F03A4261A1F33BD19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 0af1d16cecaca31613cac5774897d30a1522028ab7027c2b913d037e55f60190
MD5 9e1ad9834c320de6d28b3e376923be5c
SHA1 5d88d57e2c74a7b7e04192c017ca7ea7b281ebeb
SHA512 244f07faed973b0c4f9d3eff7c46b5199e5d230907819fa86c55fea248a52211276c2d035831d26fb67a6fbb6b66462d83a584f2414534878991806a614e2304
SSDEEP 12288:c2jvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:c2nAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T186C4238673315056C3061DB5D6A6F54970B0EDCFBA22A52B1EEB333B07BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 226b36e50ab01adcc8fb1c951519ac05e8b39affbafcea9e41af7f4e7b41b917
MD5 75ec9db0dabd6b2d979b9a4262fd05de
SHA1 504618dd21f82d65b34e91ca1c3756789642a1d8
SHA512 047742b17d2edea683200f618e9979993c2f0e521f00c1c9c3ef89b9a1d9eaff76e82b687a3ecc3b031da804de5a3d7be773a33f72b256f0872f525888c8758b
SSDEEP 12288:IcjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:IcnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T173C4238673315056C3161DB5D6A6F54930B0EECEBA22E61B1EE7333B07BCAD2B416143
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 9ade122267f0b8d88ef424c9547e7a85baee0c93a38aef812a0c0de10fa27165
MD5 4f3241503888a8587f14ca4f6aece751
SHA1 fd8f625a2ab470e4296f5f86927512e19f0d7eed
SHA512 7d9ac17502f438880b483cdf21a47b1c493b40ccb772dec01818906879d74cf5c11fa210c8bdd3f7caa06ddef92e11b1104976b2c1d30a0d5ddd2a5db6885198
SSDEEP 12288:pbjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:pbnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T10DC4238673315056C3061DB5D6A6F54870B4EECFBA22E51B1EE7333B06BCAD2B416183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 81814f5eb66d620e0e24476b1f16b940d3ba1f79c6be2c17493eb22d88548198
MD5 9ca615626ec14a6d68aa12941de3f540
SHA1 8fe4b78515ce478feb94022e14730a6a3463b29d
SHA512 7679cffe81c1ff79851769923ab111d46a7581951a464c8bd22c21b7aba6e45a699355e340a3670c5ec0f4a066109c023650d4656966583cdc8298e47ee16c09
SSDEEP 12288:q1jvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:q1nAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T11FC4238673315056C3061DB5DAA5F54970B4EDCFBA22E61B1EEB333B06BCAD2B416183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 49119e74de9696fa165b1e6c31ff7dfe205e03ca8310b715968aaa3dbd251031
MD5 8142943dbe267646d81bce0babb63366
SHA1 870642af0d9cfc7dd3db39c995998cecbe642a8a
SHA512 3eae1e2eda4ff1e97707aba09e3eae713544e6633b47eca690e43a907eabc27dd888fd82813ecb39a915a5dfe6a79ef3854a24ef4d00c2c72e7a9860e8659b8d
SSDEEP 12288:M2jvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:M2nAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1C3C4238673315056C3061DB5D6A6F54970F0EDCFBA22A52B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 05a9a8bae69bf7c9a66b514e6acc936f2e412875e39c37430608f3d563147ffe
MD5 fed9392b0b2c539b7a40bb26fec1e70e
SHA1 08db3a80659ec0cbe4c06cd8a2d1f8569b973394
SHA512 453b6c7ee14f052c5aac949ef196b47dc0be9b5c390e8bc3727ba5c37de2d2dc523cbbc584764694ab79b3bb548b5b5726c16e3d53d28778e5e802588c86a1a8
SSDEEP 12288:/tjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:/tnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1A9C4238673315056C3061DB5DAA5F54960B4EECEBA23E62B1EE7333B07BCAD2B416143
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 67f99a29feb057bca3ca00a6a88718a9c69b5812ce6c141573f27d1459164266
MD5 082442e1474451f720b932eacc368085
SHA1 4b9f063c51e3eafd6ae0cca8b63eef629fd5a668
SHA512 f437aeaf2c664b174a5cd04f5641b00a838fac8211bb9bbb1b566422fa9c617c6c7e96dc2bba2765c6f6cf353cda2d3b4f9eb59449dc52d371fa64b09831f6d2
SSDEEP 12288:gXjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:gXnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T178C4238673315056C3061DB5DAA6F54970B0EDCFBA22A51B1EE7333B07BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 7b6d78422cec984e4ac6210573920bd936f7ffe75d1cb88a803045214f924e22
MD5 fafb396af9c36a32524700c6e49b69d0
SHA1 8d2085cf4767f612ec5f6775b436b23439baed3a
SHA512 5f500d3c9b79bf044fd3223a3c2b95b0cb9c0b5b8674f9f2be41363293f075728fbeac31093037c2856724780a07b29a3fffa8729d2c5c50ff3a66f75e55c24c
SSDEEP 12288:U+jvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:U+nAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T130C4238673315056C3061DB5DAA5F54970B4EECEBA23A62B1EE7333B07BCAD2B416143
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 2eae4214c9ca7917e2c2bdb860a88a1014ccecd6427ef4a896f26bf674b3181a
MD5 2a5554e8adba6399f0b7c52a7de40b12
SHA1 978400bcd0a14f93c83b3ff5843cf62670c2196f
SHA512 11bac7c5807a8ad2d005817c4ef1240fbd22d09cbe96f61fe91d6ea85c60895e9a8ca8b466a81446c23f568592d6c400601690be2a236eb9ade16ce75bb00f0f
SSDEEP 12288:pXjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:pXnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T198C4238673315056C3061DB5D6A6F54930B4EDCFBA22A52B1EEB333B06BCAD2B456183
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 978f5860b57bae0cea474e8068a2a621e8dd89bf0c1becdaf3ec84b6179fefdf
MD5 4a6e992b46b96764fea0c1f62b33fc21
SHA1 bb383b4863ece10bf91e54d6ff24f61ff70ac002
SHA512 aebc52b2b265e9f74d5f9264001dc9da461f174b0edbd0c889289797ccedc5675655fb1366ddc4fc9e3850ad7d5a798b8d4505f84b9cff8d6d52413645768c5a
SSDEEP 24576:jfwvUk9RX6wkyAIBnAUz5DFs1jsLqmVNPEZ+OQw:5MnYIltDU42mLsZFQw
TLSH
T1F635D029EBDC44E5E177913C99B7860AF2B178591B31C2CF029A536E0E37ED0AD3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 87f621df4c4d447e5ca1e95cf0fd7c67db4e49610babf9b6272d5505ff9edcb5
MD5 d08ef4d444e719551b4c4c0c62ad09fd
SHA1 f7150528a9775b12c0a727e9058c9c1c4b9e219a
SHA512 cdcaae21736da223152d04fe89b4433d097a203c22b2d6faa0469364ed96ebd835e35848863c133321272399dc5674819d8b5ce009c3147a452b2b04c59e0906
SSDEEP 49152:JYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ItDU42mLsZFQw:EySzPWw7mLQuw
TLSH
T152066C56A16801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 463aa7f6c975a5ebc62c2db1e1200e7cb77824f8442747491e67e79b943a6456
MD5 8bc9b6bc74b395d81860ecd7b6f72c08
SHA1 77c6f0a58815e158d9a542be1f3f8ae4d17cd82c
SHA512 a5756824d7940ce2d9a5d9d571109064d33648919a525dce24f97bc7a61124e7b59e21d5850b6528cc97c8a498dd31e6421533368972e53d95b51eec674f853e
SSDEEP 24576:947Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYQnAUz5DFs1jsLqmVNPEZ+OQw:947JUQjTirIhCnDHUPfF/4tDU42mLsZl
TLSH
T1AA65AE1EA3EC01E5E1BA927885158A1AEA71782E1F31CACF1270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 1446c8231e78f6c8cd9af7b9db69e1bad631f5d6c307f6cc1f59ee2416196703
MD5 103013898a49668855d64ca662926c4a
SHA1 a6f51c5ad4ad0990c4d1ea4b707af40149ea4325
SHA512 4004677036de5fb300f314395f2fb6f65e56a1a1cf87fd8059bb343b832d277a8f952e8d7531ded9507ab135fbdd5044a1eeb739111056eb39faca8cfce68bba
SSDEEP 12288:mbsfljvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:NlnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T1CAE4F00AE36401E8C06E6175C756AA41B373BC5997E1D3CB16D0F63E0F7A690ADEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 7c250027ee3cfef07c9800f23897c87f48a89376a52f309b4f0a337c58b8c4b7
MD5 521da5ebf3f48e25b47c04fabe25d6ec
SHA1 f3ff46dddc16641c44c45386e10b708ceecf0eed
SHA512 59b235ee5a3c4878872ab1aa63e6229f7fb12480fa25876069eee621cc914b26f200278a5d8659deb9aa3e3223123f5c382ccefa7a1cea6adaf3843427d1c7e2
SSDEEP 12288:whrnfkU3f+RfWbXXw04y6MbJb5nNn2OQZxMi15qcd:whzsUPeWbXXHpDJb5nVXQ3Mi1nd
TLSH
T18C4528407666CB5FC6A980361E33D5CCAB707C51EE846F0773C9873F9476658BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 681ac699a9b3b30f39894f2158145b60e1086488553778009a01d6c571841c3c
MD5 0ba3e8e15864b86ed097133a3381bf56
SHA1 ded86a05d607d4215fc1aa3325c5c32e8fdc93fe
SHA512 7a56490815720f93fddea4b45be6a6977ed6a291b2acd077d3359e950a24a59916b4df6ed3f950f57d50ec750a4ffc632900978360249b138704fd7834c97fbb
SSDEEP 24576:DwYshBts9hYH90HzXUXElaJIdHJ/o80vX6tMR1M3:8hBts9hO9q5laJIdHJ/o80ftRG3
TLSH
T169750A406537D78FD1B7603203266F8C77A4AC0BB6496F26B3C9493AD86BB1594F93C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 7aa08c99704969a46622bf7b583540c89d024db48b6a6a67c9d7b4cd3cd7bcde
MD5 f1d6852a3f75df2a861e69228915239d
SHA1 08b4923654401f4cfe50ff9b2c49c6f2be81640b
SHA512 3fe7f646a7f9ad0fca73e361efe87d1f27c23fbbef70c6c755d9574bbebea7dfa69e75ddb9ba59689b2c7248041b248891d9e2150c7be8a64db3dbd9a02e8fff
SSDEEP 12288:R07djvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhgGYA:SdnAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T112D42342A324A016D236297495AAF1183079FE8D6F21D5DB6D96333F06BCEC2FC76247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 dd8fb9366b024330fc2495b22c9238db5a11288337d05f27159348a0565f5528
MD5 78bfae9aefee8061a5897a2a26827fb5
SHA1 7688a4bb0863f13d1209b2b48ce725a99e82b731
SHA512 825d97f23b9ef5761ee0eb04b0aff39cc1326e8f9d52552c980e7eb0f983f10c7d3f49e6c1634abaf6d9ff3056ad182cfdf097d2d01c7414394e8829cf818af1
SSDEEP 24576:Ngb6bmBIi49WNNFpg1rSvFv7bYjnAUz5DFs1jsLqmVNPEZ+OQw:Ngb4mBIBhGFCtDU42mLsZFQw
TLSH
T18D65AE1E22E802F5E0FAD2B8DDAA4417D6B278161731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 39b680564a16148709a4698d9b33065eb27be0c8837e54996c0fdf370b066225
MD5 e1450d37d3d58cd212eaa33568ed8db0
SHA1 aceca643db7ffad0563fcc34c622fb229f95773f
SHA512 6190fb9ab71f3afe281d83c80b1004fd5155d5334f75fb08bc365e02a0ae35b62268205a9733b59e0bc51b95b447859e50d71199e2e1e3e3e0971d901f432f27
SSDEEP 24576:FG88u8FpJqH1bzria7/mAnAUz5DFs1jsLqmVNPEZ+OQw:o7ZFPqVea7/jtDU42mLsZFQw
TLSH
T1E735F16577E101F1D47BD1388A828663F6B1B8151324EFDF0BA88B561F23AE14B7EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 d9694d48d12591383cbe64410bd56e22022bd78568a16f7959b5dd76a5021b17
MD5 50c25bf1187e1b31a07a3e3db790d550
SHA1 36319218b00b06f6f8b5005dd0c0d925e4caabfe
SHA512 73956c5c701adad7e022e50418cbdbba3fccf667f39b70ba2f1654e3b15d91d4b3ce9563f0040f03a85e60ae731c31e2f408db4011808ae6a82f740847538791
SSDEEP 12288:+HvUrBFrEjwaQkjvTtZXQGf5FJ5JZ8GsZfjsDylKjzqmVNPOcOL/AHEBR+O9mhg:+PUr+NQknAUz5DFs1jsLqmVNPEZ+OQw
TLSH
T10A05E11F23A818E5E676A17D89829609F771B8561712D2CF02E1817F0F67EE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 5385187f4e654a55010d749de0e0f58a2067a331dbc3590d90c79e5f34928217
MD5 440f541780b67a962d0cb4cb84dff607
SHA1 2cc2dd46e45c1e8e7a6294174b656e9754eeb785
SHA512 cf192b28b066cd333ed8ed9a937e8376ad1cfd558241199e7af3d8c62f64f0cb8699490863c661e46723b280777d83e8e3d46e0bef175a767b065180c97ab84b
SSDEEP 49152:OBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjutDU42mLsZFQw:RG05lO43bjw7mLQuw
TLSH
T11ED5C06A62EC11F9D1BBD07CD9C6860BEBB23815033556CF02A486A91F27FF4657E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e4310c6c1c4c4ccd9592ef64d9f88b16be2682b2f9909cb6055b0f46c8281bda
MD5 77d0fa701d1b2ec9198e511070c18c2c
SHA1 94bb04894cad63aa4680ec0f54b836a657865b3e
SHA512 ac8b9a1929451192243d73e7badd212519b4b5907a7a2e8b276785b4bca34aaf3e16125dae68dc2c09b011ba1cd83847c633068e90941a573e7e935506d38a3a
SSDEEP 24576:5fa5POZ3dpuWVM50JicR2hG0lasx2+47eidnCnAUz5DFs1jsLqmVNPEZ+OQw:pa5POZ3BJt2pasx2+mWtDU42mLsZFQw
TLSH
T17D65AF5EA7F801D5D179D17DC583861AF5B1342653329BCB022182BE3F2BEE89D39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ccd90601378bcafa8d4a29b2694cfd550b467f32ac0e0887f0fa3ec4faf6327a
MD5 778c54fcea1b38ca0816b106726d037a
SHA1 e755ce1c467c87b3f62511f04983a00da6a15dec
SHA512 e7823ef2db234f5742c5998df8425f1f4e6ea2652a40c9dbb82174b3fa33920dadd057d5667da06b361b76cf7fd607ce2893f732e9c91b96cebbde2c944e3dae
SSDEEP 24576:5NcwHdjbyQ4nLC18lb/EOjowL7FkInAUz5DFs1jsLqmVNPEZ+OQw:5Nc/zEOVHFDtDU42mLsZFQw
TLSH
T11C858C1623E901E4E1BBE1BE89779546FA717869573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d83d3d469ab876e37110e9ca56621e2d5738a96cad2987519abf44435d8c78e2
MD5 9253a5a194e6e9ec23eb385a8c41ebd5
SHA1 12d96ca05ee6b05e688f1d9601a9d58ea506d9ea
SHA512 2459e789d7b6dc117b8dd25d447c7611caba4c91072bbe9514f4a4eaa66993e54a400abd49c89217b330b88f69de5e5ab75742a0c4157fb9e202651b4139c56e
SSDEEP 24576:OTkNvNnaFeYhJNtmZBm+nAUz5DFs1jsLqmVNPEZ+OQw:OTMwBtOmMtDU42mLsZFQw
TLSH
T12F55AF6EB7B846E4D1FAC6B4CD238512E6727861173293CB5290C13F0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 57743141daa7498dbc5619668571ea23d6998665ddcd5359c09a0836f8ded9c5
MD5 c674e402a613b821fcf198497361672c
SHA1 6fd3f551845b0bf0069aa0c56983506f0ebd822f
SHA512 ad7aa8dbf95ab6d9bb5db78f535d1374861af573cafb2277e28dc735edd5ddef9ba427c16e619e759c18dc5eba13e03c859d1e18beed7d372127c1e75cc000ce
SSDEEP 24576:hD3FHshBIYQgAJnAUz5DFs1jsLqmVNPEZ+OQw:hDVHeBIAAttDU42mLsZFQw
TLSH
T19325E17EE75C00E4D57BD1BCDA639606E67138AD032266CB06D481BA1F6BEE47D39B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/896-109-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/896-364-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/896-111-0x0000000000EA0000-0x0000000000F00000-memory.dmp

Download

memory/896-117-0x0000000000EA0000-0x0000000000F00000-memory.dmp

Download

memory/2880-97-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2880-103-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2880-96-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2880-363-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2880-362-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2880-360-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3280-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3280-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3280-91-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3280-376-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3280-378-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3512-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3512-23-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3512-22-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3512-15-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3512-83-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3756-303-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3756-75-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/3756-69-0x0000000000B70000-0x0000000000BD0000-memory.dmp

Download

memory/3756-68-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4408-80-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4408-305-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4428-122-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4428-121-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4428-133-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4428-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4428-128-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4980-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4980-108-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4980-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4980-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4980-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5056-40-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5056-41-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5056-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5056-52-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5056-54-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5200-138-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5200-139-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5200-145-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5200-365-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5412-63-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5412-57-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5412-288-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5412-56-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5784-79-0x0000000140000000-0x000000014012D000-memory.dmp

Download

memory/5784-304-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5784-0-0x0000000140000000-0x000000014012D000-memory.dmp

Download

memory/5784-308-0x0000000140000000-0x000000014012D000-memory.dmp

Download

memory/5784-10-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5784-1-0x0000000000560000-0x00000000005C0000-memory.dmp

Download