8ede82c87cdf1136cc6a213cf020a72bd96396d2ed19c88987472cde2922e58f

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
Size 1.5MB
Sample260807-tsb2dassby
SHA256 8ede82c87cdf1136cc6a213cf020a72bd96396d2ed19c88987472cde2922e58f
MD5 387c313842e848d317c755749fd3349b
SHA1 24a790d8e32341ec1bb1d436efa9a99a99e3bcb1
SHA512 fe96c2883cc7191dbd3f1aab990236f927a627cdccac0795de803de37e54103d6df742eacd513ce6ebcfec86cbd54703439ba33097df6867493e4b92fee97557
SSDEEP 12288:zAmZXuYeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:zAhYenQ/tbw/2Mkjy6Fr7g0ow
TLSH
T10865E02A7A5094F6E4610D704A51E66DA326BC58D8134F8B32D07ECFFFF6AD14E19A30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2320	elevation_service.exe
3856	elevation_service.exe
5224	maintenanceservice.exe
4212	OSE.EXE
240	PerceptionSimulationService.exe
4428	perfhost.exe
4192	ReFsDedupSvc.exe
5344	SensorDataService.exe
1344	ssh-agent.exe
4612	AgentService.exe
5836	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8111c5ac763f1d8f.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000355386ba8826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000db3244778826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d2985c788826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007663c3ba8826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\explorer.exe,-22000 = "Desktop"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000017251788826dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c72955788826dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fe1faa788826dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2320	elevation_service.exe
2320	elevation_service.exe
2320	elevation_service.exe
2320	elevation_service.exe
2320	elevation_service.exe
2320	elevation_service.exe
2320	elevation_service.exe
3856	elevation_service.exe
3856	elevation_service.exe
3856	elevation_service.exe
3856	elevation_service.exe
3856	elevation_service.exe
3856	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3344	2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
Token: SeBackupPrivilege	4192	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4192	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4192	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4192	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4192	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4192	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4192	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4192	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4192	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4192	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4612	AgentService.exe
Token: 33	5836	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5836	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5836	SearchIndexer.exe
Token: SeDebugPrivilege	2320	elevation_service.exe
Token: SeDebugPrivilege	3856	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5836 wrote to memory of 4648	5836	SearchIndexer.exe	100
PID 5836 wrote to memory of 5044	5836	SearchIndexer.exe	101
PID 5836 wrote to memory of 3920	5836	SearchIndexer.exe	102
PID 5836 wrote to memory of 480	5836	SearchIndexer.exe	103
PID 5836 wrote to memory of 8	5836	SearchIndexer.exe	105
PID 5836 wrote to memory of 5020	5836	SearchIndexer.exe	106
PID 5836 wrote to memory of 2044	5836	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_387c313842e848d317c755749fd3349b_icedid.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3344

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2320

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3856

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5224

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4212

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:240

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4428

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4192

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5344

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1344

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4612

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5836
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4648
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5044
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2920 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3920
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2596 1040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:480
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:8
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2596 1040 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5020
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2920 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e912b41a6ce7f931016f0d65d4a28cb008c9e9dc171bb15b342d7e48b854f12a
MD5 a3f28c35533eb95dbc791cab4cb7666e
SHA1 5a3c8e7450a5519e9981e082e25d2fa4063b8e77
SHA512 1b44a11b250452dcbfb873ab4b1614aa4b4c1c5bd1a1c6e5944a582881d2f810ebcb22816b60d0ded14fc8ff3e3a26e8e3293824ed24e579a94d9561116997ec
SSDEEP 49152:Hb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnTQ/lFTjN4:13q6HjBnLm
TLSH
T179D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 abb069b76db2189744a0387cef088c858eb17a954ac69e74e6ae73d20c2655bb
MD5 6320092efeb4547e0f6cea5b95093905
SHA1 32a4406b5f40a6efc58efb29f0a29a7baa2981ec
SHA512 98d9682d11c29a01dc374c53f24436f17bdda3ef0ad7f218f8cf9c38d9b5ee9a5890078e0e84c71db3edacc5f78d335c9d65e2cddc295b0b548c43ff390d529c
SSDEEP 12288:C1XLsswWkxy2lRq2czAwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:IXYfDtczAQnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T12265F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 64f47e19ce3e1d5b4a5637aae69d9315fde0db1bf5f57bf6bae68987e82e8149
MD5 ba1676f51a07d1f77370639b44bc3e6b
SHA1 54e5fc3a852c3c1e42528cf5626fba45efb7ddbb
SHA512 d4de94d7c3840a724fe67ce65aa87c9a6e9e85e1b2bdcd6dbc67195dea64dfd730c5aa097485c26b6b28a3afd7ecd71ef5a296ed5578eeb90245a1e32fa6aa9d
SSDEEP 24576:k0Le5ji0hmxLrM7nQ/tbw/2Mkjy6Fr7g0o0:kPji0AlKQ/lFTjN4
TLSH
T15E859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d45e6618d58b8a61da945fe0e312d99758bf215f26110b806852b681e0e633d0
MD5 be8d62ca635278eedca8a5cdecf320d1
SHA1 089b55c263f2d90bf628fa9cad0a490a35dac44e
SHA512 7cbeaf9d581d0e7905326d7a5105df2bedfc9dd352030b9aa4b597f615040527b415e607576897fdfa0d64dbcfc21f15396441af305b10ca4a30580b0deef551
SSDEEP 24576:wa7/ezSC6vUyD/aqgrvWE6q8wyuRnQ/tbw/2Mkjy6Fr7g0o/:n/ezSC6vUzPvxHjyGQ/lFTjN4
TLSH
T17B755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5f6335c5537eea60925c82c9d4d9cfb403b31e471064a19fcf008aeff59deff8
MD5 d357f11fa07008bf897aaf3eff92975e
SHA1 bce6b0284fefb223ce416ed3a5447a2b18d694d1
SHA512 84750e357718187c1d4b05a1aa36f95171558ab4a5df34266afb61f7acd80397f1ca8be0e9789d2c65cc181f0487143248d7c0610ec9fbe7900965d0c404d1ee
SSDEEP 24576:IVbqPb88hv/l+6EnQ/tbw/2Mkjy6Fr7g0oM:IVO88hXl+XQ/lFTjN4
TLSH
T135559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 0b21c4fabeeda0db73f916d0477c1a48a31faf6dee298c1860485c2b4b0abf8d
MD5 5254e696feca1e42d32515e32f1017be
SHA1 69e10ed2c8f7c9fd8c14ca042554511c2ce80d00
SHA512 89cdbf8577a9f7271df19707631668458328d2e190b126642499eaf2b70024a289090dd07e5613c99eed079e60b3cc5b86d2326559d73ac8b6537ddb1179fd0c
SSDEEP 12288:SzvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:SzPnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1A45523696A14F897FF2B06B15CD384826B7B0EC1BFD4AB4E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 3af138984b0911b91507b43abea628c1bfc402e2b8f6f7cbc095d76fd909493c
MD5 a10390f0f86612dac106d236be68b6fd
SHA1 8ed785c30a374d3afc20578eed5fe118cd5fa5da
SHA512 c3e9462e348c50d4bfb8c440edb32d25af4178a377bde4b27826a62126a6c6797c1b5e1b430d6d9afb0c665e728b153495aa28eb4eaee5bf6950feff82ffd8e7
SSDEEP 12288:8eBNUbTVO86UsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:8JIUsnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1C775CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 84a2fa820cc6cce0ad8b5248fb27bc7331898017b86fe2737e13741d93f015d9
MD5 bb7c1c7eb6d395b5f81670fe1c948fcb
SHA1 0d924454f796c02a1b522e0f39d693fb7b2ba231
SHA512 81d24ce6dd1cb6186c47b57a793c85916b1ce5624514a9128de5e26f517543cd7b7c800a6a4f14077e50c6ac7db3269b46c2fda350fd12144221784ba8c67eff
SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THK:MQvGAdlCEL8c/yRNw5CGLm
TLSH
T188267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 9457b81226a9c97e0e62384d3397fa34fa311867d22b843a56e7290151cf847c
MD5 a079e433604fcac24ff0d49176659be9
SHA1 0c365d42ad8c7a3e91cf9ac369bd6bceadd7a96c
SHA512 2785aa20f2dc0cfd2b4d86c499e5c6457e11375b4b9cf693fe2c487a75fca8cbd25824649205d6596a00f212f99a95d2f2566710ec2244f937f2536d8ecc7cd7
SSDEEP 12288:MAwSfxL/2Dc39DLLmt0LDQewsAjaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg1:xQewsAjanQ/tbw/2Mkjy6Fr7g0oH
TLSH
T14175E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 0ad20acddca18edaee2ca64cc6ac9bcf0751e7cc0e059f5facf4761c823aab4b
MD5 fcf0a7b894ea4c8200d47aa7058c149e
SHA1 718e5fe7decd8840450ce92009b76365c4696dc9
SHA512 6fb4dc52f74c9ecfeb84e4b2d6ddc92d603da83903cbbaf3825f349cbfbe6b1377fa272df15b89d581e42829c8004febea87e930dbec1c4411b9670c11b6a9e6
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHdL:lUEtQevvqc2W1cpV2EI32
TLSH
T1C5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 aadcb1b03591519e257f47c2de2c30a1aaa7fec02e5517a7a65933a179c0dda9
MD5 942180bc11f85a603616a618ba4ebf73
SHA1 17d168836744cc1a85a9706523fc734fd107edfa
SHA512 7cde8be882d26cb1ac48a003005be6d37dc7548a5d89aa00d63c3e55e44f76c175dcebbda6e00f0654c5068de89276a8ba80450b42a8ac5bd4fa71504bbf2195
SSDEEP 49152:zCbRquA/m2yL5zQfFiV+XenmE3/z6Q/lFTjN4:MoqtVjnmyLm
TLSH
T12FD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ff417bbf778d9699ef322cda65dae742332253f20efd73beeb9c0a350297be29
MD5 d04b59aa8fb66ebc867c9fe3c87f559f
SHA1 272edd04a9f6c98bfb55134650adbe092b7a4c51
SHA512 6761214f2be69c56fd6f1838d65146712e8881c7a1cd072301993ef586f0a5db6c96fe8d852dd8b9170345fbf016fcc763bd48338fd617608cd51e7475162db9
SSDEEP 24576:0AhGLJIFoiwtA5l7S53dnQ/tbw/2Mkjy6Fr7g0oC:0AMyFoiq5NQ/lFTjN4
TLSH
T11735AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 fa5160339c35ed0cf51be3e9c9c3c50ed3b8f64cd722a5c30a73e463010880ca
MD5 e9c4b3442acf7b599dcef60f68c26f1e
SHA1 aebd6a794138e9dbd4ca2202691bf2c0e06d8a3c
SHA512 0af4765e1b8649c1e49d91fc0540c1f6f7c5d26793b931a068cdc5ec8a3a7f631962336f862ff024cb98fa5fb05236d487e339464e62d7a19c487fbd2740f195
SSDEEP 12288:Tmw5HEjsChN2BFgl0WDm+ChGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMF:ywuHOWmnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1F265F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 77ad8c312ffa15036db0d567eead6c7c75a1b416afb57481974d07fcb5a77c9b
MD5 0e9e78297c594ed4d37b4b89c735127a
SHA1 16b1f8dcb30af198b687a287735042f701991193
SHA512 ad24216a3f604617913e7fe77e800a47b65e38792a7b06ff25befb6663482ed8fbb2d98a81a6f002928f8fa21fecbb8a2f53c891193b48c9761632e59c2aeaf3
SSDEEP 12288:NXZ1IyqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:9ZujnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1C955126933A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1094a9d42221a54d2390f86e89d0230392dca325d5f755795ec01ed5633983ef
MD5 88d6d43f55f5c7b067a49444008b24ac
SHA1 4d7482c10b906e74a74338f2744a9c4761003c01
SHA512 fd8fe9ee901abcffe946430e8dd5ebb6b3d52ef18affc22a99d6cc4e016eff6866d32b6b2ebc03243acdf5fb5352cd72b62c4e95822d451be8eb047dbca8d954
SSDEEP 49152:Dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U2:SQRQyi36YOcPQLvw2gAf+PN37Lm
TLSH
T149667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f569ab3b60357c0052dc75fcf1ca67de7d527465407040a9616343bb1e8ec12e
MD5 4c76af7762dc182f381770f613f5517c
SHA1 d806ffdc879f6d68aa3621d4e2742b4d302a4fd9
SHA512 309f1b83fb11246543cba7d2b230da8a6f2a24cd5a0e16ab73ffc4fde0ff9e34539c038893fcf38f8b9c59537e8b36e5de24d0307eec60664c30b2566e7f2fc9
SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U2:JQRQyi36YOcPQLvw2gAf+PN37Lm
TLSH
T186667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e7955291623a4d27116920b871e0a3a1a4e17945c8031e934b69273f90e59f47
MD5 8d9ac24cc45ba7c731f97926a6dd2cd7
SHA1 0d8f359e2f0c81a6f290bdb1fa72ff0e30350ea5
SHA512 c181cacf9e7119aed29e8dfa868de77d7a9153fbcd6b317e03217b9710a55f386a645aa5e1b3c521a0f86da4a7562a638f239d0187cc7fb5705273bf809a748d
SSDEEP 24576:JwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0TnQ/tbw/2Mkjy6R:V68Qg55nhheWu7PNU3/KQ/lFTjN4
TLSH
T11BB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fc03f2be8a6bf383ca83751f41e7e9920bf28fc45c77859c7370822ff4498321
MD5 913ed7bd4d5931a52ac3ecc1d6363bce
SHA1 4a2655b6b8390bebf9234d6fdce110b5df1bf9b2
SHA512 814714e61339650e906c3802a27957c65d6b02ff9851307d309562aee7ffd1283bb5b8d765bab6416fec3fa02d7fb8581a5d665fb62cdb2e75a928079cf34f8d
SSDEEP 49152:S3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99o:zy5112gYy5azzVvL69nLKnhZELm
TLSH
T100167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1314a5cc8a314bfa4e0666d8e475d957bef0adb42ecd0cac7e549b312a9c7174
MD5 8aeaa25eef7b98e3aae34776a86ce29e
SHA1 9c6fa298bead866b2a024ec1f6c96992f05324e6
SHA512 f12a9b9aa143becb5613b1304f8af03232db9e2fb7c2d7cdf5e393fdde2952f56bdbc721727ce253459d5a260ac5093e8a99c33f1054a6d6c641f2ded75176c1
SSDEEP 49152:nB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glAQ/lFTjN4:pu6JmVxd2dTLm
TLSH
T11AD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6d48c06ec89766f4debb7accbd918b825274f558b4218ba1723dd902a771c17a
MD5 5dcd2a6ebc35e6ae0f90fbb2cb834e31
SHA1 d725a7a46a5af662fc27e8c87b3a28339715f6df
SHA512 755cb9958992c2fafa7d546d05f704ce0c2605bf4d70afe29c7f16132374644cff620d6079b9188735442ddc953c5bf1ffaafffd7d0284d7e637931be7983599
SSDEEP 49152:O1hpsNoJpF1A6UU44CwH7R4xMQ/lFTjN4:OmifPbRyLm
TLSH
T151B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e06995360908b0efed01187a34e3cfb750d0161e4ac56c256116673967c00e58
MD5 a8da882e74be6f6317bc24d9d27a2a5a
SHA1 dfca09dc959bde8d976032924c8b3e9eb93b1e7f
SHA512 17aa40e454a9f8a65b05b50915683e092cdfb9fff1b647ed23e1318c59387d2d8e76a5e912e2d50aa84e6c49af4a72c3065fe82569910f6ed62cf1f41feb9084
SSDEEP 49152:BSuZQIY0Be2KRRVtOnks6NMHqjQ/lFTjN4:P5dKTi61ILm
TLSH
T1FAC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 06a7a9f12c9f81f047a9d42f4f19220b46c8b3deb53b10a06d846d171ad57992
MD5 dbc58b174df497d689d3fd063167418a
SHA1 f7faeb0b31a6017fd4754d80fad5e87acc04c148
SHA512 385af35f5d4e37e2e2afda200f3a1dc2d53d76ea9115796e48e23ceef7b82a9232a96cdeb2e9709c9178e762e857721b7991bff0dd521dd82268a2725d563344
SSDEEP 49152:3htSn8EApI0figngiDn0AP5wQQ/lFTjN4:mX2iyphOLm
TLSH
T14095BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 5692af3bdd6bbfe15ab4216c8f43c43107c5a6eb5f8768d29664ee0a45339eac
MD5 85b909ef68bc145c1e4fbb754126c4ee
SHA1 6f4bde2404aae7148fa75e3d82893e892a5824c1
SHA512 90104c281138ab93955b4a76307af538458568f9a92c845609f9d328696d21dc19895df2639c966716d336d665f134fc7a0282bb8e49b5a08fd527958411df79
SSDEEP 12288:33GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:3XnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1DA5523697955F98BFB1706F14C828182A73F0EC6BFD1938E7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8d0376b523c9fe091c814f3ff404e4ee92acc91cf87b101b6be5930707c31b9b
MD5 066325a9d851c816d83860e714dd5cd8
SHA1 1a5964dc53ffd8e9a5bc6035405b4c2bcdd4841e
SHA512 190994747d682f9d00805506056d684074d10f3714d58492fcee3e20c5abf2276565cbc52811d2a40e38064d64653498f1d7cf2eae3297d0cab74c60bea14366
SSDEEP 12288:3+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:3+nQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1925523697965F98BFA1706F14C828182A73F0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 89e3446d1bf3cfdad1cbaabc778e458c48039e141a9ea7675ec86bc4cfe2e79c
MD5 5100b691454374d0288ce3240e609958
SHA1 6fe98b23916728ff0631c38300e2801d252c7911
SHA512 9d8c996ab2caada9cc6243aa6627f55ce23e7db7a3e0584f19cf56618660df1bbeb6d55d5345f2fd2fbac49c1d4f5f0c9eed1e7c4624afca35beb3c4fed5dfae
SSDEEP 12288:BUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:B0nQ/tbw/2Mkjy6Fr7g0oY
TLSH
T12F5523697965F98BFA1706F14C838182AB7B0DC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 dde9004b1ca6b54a0d2191943397b82e048d931756d3a973e3964e68ea894849
MD5 84dc0f3645b740a2cb5dc0d32b72a53a
SHA1 d60a0584a5c6be8bc520fdcca1467b0093187fc7
SHA512 aaec1e38cfe0d8fcfde3b7b3c76cb93e1ec2187ddb8784c72ba5519c133f4e874bd89b4a12e8c0d6e1545eaec1934306b32f9c1de8f5e2389362d49f8494ab16
SSDEEP 12288:7VdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:DnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T10B5523693B69F4C7F92742B4CC938142E77B3DC5BBA1A38F6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 570bf4292fec5faddb3f707b1cd942687b611915ebdff415665d850237dc5543
MD5 c2a390a7de5c2af9d143fe4212ea3344
SHA1 162a295a37e08454fcff7fc17b12a58b13aaff5c
SHA512 8865da7f4a5765b70d43438d2834b558a0bbc3bfe40126ed19e7e8da9eba0fb92cc9afc18564eacbf8947ac569d4b7ed50c082ba29e1e0ade0de874a33e84ff1
SSDEEP 12288:PVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:P1nQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1C55523697965F98BFA1706F14C8381829B3F0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 48048205e238da02eeddb35e203fce2154eb77e4a6019b0d04d823317457d5a3
MD5 a0c8735b5bd7e3b2015577accef15e5a
SHA1 da1e6b03d66571d52415f0a6f47517b7a32cd629
SHA512 7340ec007ca5e34d8af48f2c9cdee8a183c461605bee08082c1c0aa88212cf76de5d4a58ff31c18157269c5cf95b3590b79a676f83bbb4f5878b703fdd2a771b
SSDEEP 12288:PiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:PinQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1755523697964F98BFB1706F14C828186A73F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 eaa1824b705cf2fbc6ac9034bfeb6acaaafe08d3d5b19096a307256a30c52639
MD5 698088de98de54df6aaa814eca8e67e0
SHA1 2408d3f6de9d959408053443e8f6030e64e7f10e
SHA512 5c2ce9f325587e662b222d7de25e634e73bf3d939819bca8022e9b512ec25d64f41d8b6a788853654adb25f819e6c7fe8af390cf7abd29d50f85bfa88789f3f1
SSDEEP 12288:p2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:pWnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1E35523697965F98BFA2702F14C8281829B3F0EC6BFD1938F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 e91afb14a5acbf63ddc128f25e343d44fa1861195fc6b19ba9deb2d74db8563e
MD5 797e61456872fcea46fb80a79347b1bb
SHA1 461ff8cb215ab85988223f9a4bb0422eda74afd5
SHA512 897137d4b2077604c103467ff5920a3320f8228d91b7e3b3dbea53975e0ea5fb1509e0b58ef83a2f97a4b646eebe2bb58e4ea3928b455b29a5dd5aadbec9c0fe
SSDEEP 12288:KiZwbDzzFEoS2cPvyeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:tZM3zFVSOenQ/tbw/2Mkjy6Fr7g0o1
TLSH
T11D7501A9B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A4322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 c4da540ff80f1707c096e73f479c2454ee72170d2c6c17f324c549ec35635389
MD5 42be43cf9bd71c5c12024dff409f7855
SHA1 84f04d8c839bdd5f1de08bab3ebf65c50e7e2f7b
SHA512 0c4920abe1f51d5a06f3ac94c5c8bc440494e3e3ccecbc5b5be897729ae1590b45cf62ff57e52be456fa9aa838dc616065927a40de88f71aea583ba0bffdb93c
SSDEEP 12288:KDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:KznQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1465523697965F88BFB1706F54C8281869B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f216c30a2cd1740b675bf5db5bbca0b633066c59cff8e55972269c12e9969842
MD5 146678c2850aa815482957aad688cc3f
SHA1 4d362c28015af9454e3d7f10697c334d82069a60
SHA512 036d5cb816aaa16e68fd2a05c02b89bad819efbfdb1ef936e7be5be9e41eb5721e7218e893c2476276d004544e3bb0d8a74c38f24e57782ac817af126d0cf14d
SSDEEP 12288:f/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:ffnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1FC5523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 5ce44a9dd9742ec1d14cb97960f2b9fab297a5a345d95dcd19c399e698026c9e
MD5 ba38550b097c9d7b49017c9b3a2a6b69
SHA1 b5e2b03b847e0da83b3e27b59bbbef0e51340b6d
SHA512 cbc5c01b7c814b497248d7d2037185db6fc485c047c137fdde64a780c7fd8af78ba1a730a1a1278721c8dfba23c2cd15bb77f5c26d8169a018e513d1f93aafac
SSDEEP 12288:0yPz5L8qGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:tzyqnQ/tbw/2Mkjy6Fr7g0os
TLSH
T12665021B73A570FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 aaea994642119aae06402b3fbdf3acc774f9635def952c3957647e69fdfac9d8
MD5 1f45466337a063c2a717118b6bd5ac02
SHA1 364677542ae5df57a13058508101ca172ce916e7
SHA512 654d444717aa6ce70e914d4eac73a39c516d7e4502663c33fae031328530b980a04ca952b97ba82d79d03c54802c9ebb65c49f9182a8907ec4168c3ae0f1f480
SSDEEP 12288:DDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:DznQ/tbw/2Mkjy6Fr7g0ox
TLSH
T19155236D7965F88BFA1706F54C8281869B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 87b5aae561fb69b264efe8664af04361ad513fb59adf800faeeb636d7ce79367
MD5 f8125bab58ead406300cbd3e4b132193
SHA1 02bfec9ea7c0894563145cd772a3e3bea88b7718
SHA512 565388fceae79f1457711221f2bf289ce7135e18c71869c682905e2801c153f95a19dfda41106e301a79a039729734d7f47b8d250208ce635c18e25375b134d7
SSDEEP 12288:JDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:JznQ/tbw/2Mkjy6Fr7g0ox
TLSH
T14955236D7965F88BFA1706F14C8281869B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 5a2d2ab74aeedaf1526f40404a30dd5e60a822b343a48a5edb994fa4106579c2
MD5 46ffbc3b7bd972e15e26b29521419c90
SHA1 a9ea48caf03043e75aaaf77563c471e276622ecc
SHA512 0b32cc82a2fea1df37a03710882547c29bbc01e6e36276081cf3ec643f620e22b9d9d704629c5485b88b36e7c9a0b98da01e78a959d9bf1b973dad2a296f0c6b
SSDEEP 12288:AyPz5L8qGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:xzyqnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T19365021B73A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 8d6db5e4b71838ca3762972d19465b2a49b902167b8c4c8fcff8616f83b6f3cc
MD5 f274b270c8dfb9b9bb4975abc7a32cd8
SHA1 943881968d5f1b9f1e90c788a02abf5bd0a11d14
SHA512 381dff98ae6247324f4caa8884c2a1e032a34b45c342e10f8ce8d79dd05a035543ab7a1a5a579de427c68e9b35974ee0eb785e5eb2f8ea022057818e8f0acad8
SSDEEP 24576:hT0aLl3z0zDknQ/tbw/2Mkjy6Fr7g0oS:hTDLljRQ/lFTjN4
TLSH
T1A27501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 90fbf221540fc6adb7cce3fb119eb2d18f26ae1b490ff199484f176643aa513b
MD5 feed9cd17c26eaa4b4696b86740cad80
SHA1 4cd821271d6e3287759eb9f07acacafb3f8e8769
SHA512 ec0643dd9d3a8789ae27db6abd52b3e2e3da88b053daa04e1d278aaacc08fd2994158c2eda4e22a598b1af75b2bd21f5f245ee12d0abb519195fd34d4d4d7a38
SSDEEP 24576:v31d9CHKy7GZ4nQ/tbw/2Mkjy6Fr7g0oE:/1d9CHKyayQ/lFTjN4
TLSH
T13485CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 c48446e63f40434c53ec4a66005dd6d0e43848de91507b7113b3dc20063b0b52
MD5 8ba4885517ce11e03c02db06a8085d31
SHA1 938e087c323c26a2eefb2393a9bade1e6d22b6a1
SHA512 6461060c041fd1fbacd5e6604a56aafe4bc7680a38e929eadd0e6b29dda52f542e55f76ed599bc81e5063bd6cc2930c593a270a12e5ea1a35fc187ac2cd8c517
SSDEEP 12288:H0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:HUnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1305523697965F88BFA1706F14C8381829B7F0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 c86f35986ec91fbe4807c24410ee9eab7fe08c296b736cadb6bd5b6595bf5fab
MD5 d4c6c7f39a594e518d859f499e9bed1f
SHA1 03283a991a2ea90370f46331e0fabec76f0246fa
SHA512 445e5bbb6030a92723152bd34d2836c72248afbc408dc1f9fe179684c88b4e0b2f3ae0087acd9a1ff4a5ab848fb486e2d78b983da60ed29e92f5fd59c24932d0
SSDEEP 12288:SKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:SKnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1455523797964F89BFA1B06F14C838182AB7F0EC6BFD1938F7B481129967D39406C6784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 24fbe7ec38f64f566aae9efdb8df8219c2bf9ef1cd7b85c5dca0b483528407aa
MD5 d2db68f954283e609ec2b1d7b8d6f28f
SHA1 757b7951e1bb88dfda3b63f87cc7fbc2f851a478
SHA512 d1d7adcd35a4c33df84bc26e961929caf71f5479faf15f20f064945357ef2f41e9de5457ec1b82adc7ab889cb6b1a06dcb4a17efe0da7da3c1777602219e8648
SSDEEP 12288:NZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:NpnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1295523697965F88BFB1706F14C8281869B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 f8de177f30e557479a0e2c59660d1656fe524538eca64e859ddd3f23e2bf793b
MD5 fe3209ee4dce656efb687faf8e03f902
SHA1 c76e07bd4552493e50e23139e999c4d36899a1c2
SHA512 30329a743a92af40c91fc56bca2b8cda3d3342807f10e1aec4ca2f43aea8a65c44c5fe857397bb040a6ab3ed365f68a3c7a7daa536283fe6378f9276ab61c17f
SSDEEP 12288:zDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:zznQ/tbw/2Mkjy6Fr7g0oE
TLSH
T17F5523697965F88BFB1706F14C8281869B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 458a9d5c2850b14d750ecc3c36d2368a3d1cf4ece6bad2444e5e87dcae9b8f78
MD5 40f192acb425d72ebb76eaf91e45224c
SHA1 51c8749d3f6d5e81dfae33260f98cc706d4f623f
SHA512 662a75f8d05f332d24c1740da559d0cca6f909e4f2c52550e3bdc2ea8a2b0c9ec983807ab8391dc6091e6857efc8b8a9fda84b3e11d95995755890cc8d56f7b2
SSDEEP 12288:v0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW4:vUnQ/tbw/2Mkjy6Fr7g0o4
TLSH
T1325523697965F88BFA1706F14C8381829B7F0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 395e94d6e92395a47d589115d855f0819461d2cf1b60b1a2875e0b009c38137c
MD5 f1ca06555bc5ad2dccc2c9fa01b368a0
SHA1 a954da229eb81176c233d4b265c202500fc4b553
SHA512 df1b1d2f8d0f4c0532a8fceafd171a9f803563e75ab4fef8f36b40a35ade9d429c2ef25c0f9b7c5b49873bbf44c8823b2382240436e742e556c74a1ada2135e0
SSDEEP 12288:l7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:lrnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T15D55236D7964F98BFB1706F14C8281829B7F0EC6BFD2938F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 a08fa6b977df7320d82ccf90f864cdddd2e725300bbeb6730c570c8ab5a5c934
MD5 b87e4dc49902be2b426ddbdbe5aafd2d
SHA1 d963511f6d8846a46901baa303e9ef7d6f5a94be
SHA512 532c5f30386ecc264bb270590d09abee3c8e3b761a8331785e429b750046f325ce4e511b76783631d113847173f245099da0ac89e5be58e2b328e1988c03c305
SSDEEP 12288:TVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:T1nQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1985523697925F98BFA1706F14C838182AB7F0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 06f97687ada6d1d841792587078fa6b2a589e678e9dba0c056f4805e352db0a2
MD5 a3ee4d0254b072984d6bc068958ab6e5
SHA1 eeb943e15ac7acaded8835de3ead5afceb38ec99
SHA512 17eac7177caa6728e9cbcc33ea833e3b27f21bef1d3f4b621247bac9289e801cad047bd36e6c2344d4528d0a01e7434c7d89395ce3e4544300a634ab73cd380d
SSDEEP 12288:/8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:/8nQ/tbw/2Mkjy6Fr7g0oV
TLSH
T12E55236D7925F98BFB1706F14C8281829B7F0EC6BFD1938F7B481128967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 deacf1b1ebbd4164d0730ddc69017e9cff52b4cc4bf109c3d99e35d8f8124b5f
MD5 b7a7187f52725ba517916436bd6ce290
SHA1 7fdd0d65417f518321af5ae19b8d71d57fefc6cb
SHA512 052b229e1de3250b0b9a54c40ca0062a33bafd7a8d623f47cffc9a997ce0c587257555c7927113054cef63f51de4cc1436299cf2f53e4a27147ed3c6f817de5e
SSDEEP 12288:XVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:X1nQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1C35523697925F88BFA1706F14C838182AB7F0EC6BFD1938F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 bde69374511f89083591d60a05ffdaf2cc1e9d1abb2465458ee456a45af914e2
MD5 dc3e683dbaa16d1f9b84429261184556
SHA1 fe76fb1713a4f449bc5ef58f780f4fbef220c4d6
SHA512 8aef69025a85839ca9a87fa4643a4d9951cd921cfa6eafe6bf98b44e15bf377663d1a941f46befaa7269d2e47428b1d6b6244d43210e8a11e162ac1df924d090
SSDEEP 24576:bfwv/k9RX6wkyAIvnQ/tbw/2Mkjy6Fr7g0o4:KMnYIvQ/lFTjN4
TLSH
T1A685DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3f7fb1ef88388b78c9dc1d87648b3cbd585960514886bbfe8d2e5d0af44ffbd9
MD5 e7762c217eff69bfcdf68254ea452726
SHA1 2d7ef51dffae2ea69067f34cb0d44c5806fd4d8b
SHA512 1a93b4e51166131ba48e4753c73742f70e6bdf6bd5fda958a65db350f76d43f5b4867326f5c321470648b3a4d76a64420ca030bba73d2972c4ddd829551b9543
SSDEEP 49152:DYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0wQ/lFTjN4:HySzPbLm
TLSH
T14F066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 53f691fa7d876b2159efc49551b75f6bc99f31103e5f54f3490e372ba5c3707e
MD5 719ac44d32c8387995e4bb6c03c71296
SHA1 c5137adbb193fbb426389c7edfad31358adbba58
SHA512 1c638c4a9424616a8a18a96556bfa1dd4d9f4e0485a52fc11e4a8f8b1a26ec7d218b707f306bf7612b4c060fd9f16bfef365c7503cfc5d38457f44142362ac33
SSDEEP 24576:J47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYunQ/tbw/2Mkjy6Fr7g0o8:J47JUQj1irIhCnDHUPfF/AQ/lFTjN4
TLSH
T17965AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 011bed8134252da61a1a1c38513f485e6f8af3c55681d14aa609fff0dffe82b0
MD5 3f5a131493776c74cc5743890bca9624
SHA1 07a63ad76a5a49b9de81d7556f7dc3ed05e69ebc
SHA512 e54ead7f21414e1e75278bb9c1bd2d9fc76e3130cc2378d081578c3c49b9d4eea1af037afc1d8366f3ae070a461d63d1213c56d9d20fb2df6547d6658b4351fc
SSDEEP 12288:VssfzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:1jnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1F065F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 26f86dece91ef21f1ea031a33984ca20dd535eca1a60ac86033152f90a74a37f
MD5 a8537e32d767f4913c7297e987ff13f4
SHA1 bb4e524581abe5fabe92003872fbe970d88eaaee
SHA512 101fde19c19987658e8276448c2f3b868362b419c5f8c67b8ae237f68f3297a97e6baefaebe8b5b202d1df9a7c7779afed43ffa913ce051dccde1b75591a0c9c
SSDEEP 12288:KZrRqU3f4h/66PWHu9rTV6FDhbYzX4ckyDoZjbK:KhgUP4VxX9fUFDh0XdtDoM
TLSH
T10E351851766BC75FC6AD40321E32D1CCA7B07C45EE45AF0373C8873E9576668BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 25557bf0651abd9b2ae083337fedb7e7fdfb1256f7d853165ebee24eb5181d25
MD5 9e0f6eed53f1f05f353bc2008346699c
SHA1 132e76345f03726a226e4269028923c44ce69dba
SHA512 b64e1ea48cebf12aeea8c5bf7119b22130c0f3a9c2e47965c22bb5951ccf612c73cdd9f603beca4bef173e334fe70d5ed6a8d6904e3a6fd334f83adfc2dd9df3
SSDEEP 6144:qBrhaDXxlwuWn7i/LXplzaGa+40zp2Xom8MocWbQwMytMxpMytMxEtCnQfy9Fv3M:qGi7e5d5Z40zp2XxmlFv3i3Gs
TLSH
T19665D9815137E3CFD1FB6032072A5B4CA7A4EC56B7455F22B3C8453AD86AB21A1F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 8bfba1412342fe1fe0cb44fe4c695f35090a9c8612fdde24c4433fe984f96273
MD5 fe063473ba77d6abe7dd0571bd8e0467
SHA1 df2f85806d792e93caa62d3d6e94700d48934253
SHA512 9baf24df52ae209f4e100d46d29296354f362d35d33dee7bc4c7e039ae796507948da43d04db6740d4da6df68f2722c9f0b4b8828200ed3e9a6889f4dbb52773
SSDEEP 12288:D67rGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:abnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T16C5523796668F94BFA3B06B048928111673F0EC5AF90D3CBBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 9d4a3523ccc365343d9aea886885795abed9e251c034fa258731bf10b07926e2
MD5 b2ed45c5628dc424edfb33f456fa9a13
SHA1 d46b1e31a469a66a96bae3f0fb98f82a22f6153c
SHA512 9e977dd7e594ae65a27c47f0850a3d09e6bb2505f5de35ece9a24004b58f1bd2f462d34297de5c0bbb749831dcb0e91ec4779514e358b4483046d5c085bff229
SSDEEP 24576:Pgb6bmBIi49WNNFpg1rSvFv7bYRnQ/tbw/2Mkjy6Fr7g0od:Pgb4mBIBhGFuQ/lFTjN4
TLSH
T1FE65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 c76422480a17eddaa98b2cae7e77c37b4663465c87db7740cbafe382075559a7
MD5 79b26f00f27137852108cb79cad8b740
SHA1 154a7607994cd366756fb4cb09e7040da1ba2a10
SHA512 a946068d75dba921293fc8980334738f5c3d908978f3a8084c490dc4781546b770e0597f2da9c0db1ad79088e1e4c2120799497cda9daa6b0c3f77a62c04385f
SSDEEP 24576:IG88u8FpJqH1Qzria7/menQ/tbw/2Mkjy6Fr7g0of:r7ZFPqVva7/JQ/lFTjN4
TLSH
T10985F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 40dd83e29868ccd85142ef475ced4e8e00bb426a83cde23be89f7cfb70cf0e36
MD5 8063c33a7b6b48e5a5d87ad1b4759536
SHA1 1f9d26e9b989dfa22938bb330268670e48f668be
SHA512 d427ade3481126b6c310abd845c5e0c8103113cbb5c0227bd44178b413f546329d8051cd6b39bfea4b863f78b1b5718ff5bcd51d5c44e7e5da6958ead23091e2
SSDEEP 12288:DHvUrBFrEjwaQyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:DPUr+NQynQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1E365E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f12ede87acbb5fdccefa3c175ba8f39e8a54e2450afc9ebc704370b0ae789405
MD5 d0adb88f7ca85160cd420709a9315705
SHA1 5aaeae6f2448358c0325df1c99ae515b31208ff9
SHA512 8c27a5c5ee22f2dd96e25c75d0526027162eb01b913ee4e6e04f7f37617f624c94cefb4bae8c23123625a68ad695617af11e28098febd6a770d74947f1efe4bc
SSDEEP 49152:GBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjiQ/lFTjN4:pG05lO43bMLm
TLSH
T196D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 df62915c8436638a1df01e7cfe489ad7e172c761caed75b0403866ad09a60c70
MD5 759507bf1f1526f9a8ea979d17b60081
SHA1 3b71f6760e8268327a297c378929ef6e06ec49c4
SHA512 38ca89039d6ad46c859f0137307d8f8d81c21014df7bb274b87ba229b183b9283ef73b1318aba7408f4b93fd14e94789997e509c49a302a444f4d954993aae52
SSDEEP 24576:1fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnwnQ/tbw/2Mkjy6Fr7g0oE:Va5POZ3+Jt2pasx2+mKQ/lFTjN4
TLSH
T16D65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b2fb90a82b709b8d065e10be72094e6e985c77fb62562168dcff7586c613f1b1
MD5 432a1737c9440b00b5ed82094bd19b5a
SHA1 4d0057a6f7e640cbfe36c0a758f654c50826324a
SHA512 dcd466bd1437e41e3fe6df6529ba4d8536c6989c15b59406858ee5b9505d4d36cf8585979ee45f5abc028f2ce46ac76790e2c2de88b73af23ce08866bc06ac9c
SSDEEP 24576:nNcwHdjbyQ4nLC18lb/EOjowL7FkGnQ/tbw/2Mkjy6Fr7g0of:nNc/zEOVHFpQ/lFTjN4
TLSH
T13C858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 67e6f906f887a13f631614374b30b574dccca6f606f93d2edbd4a4c68eda64e7
MD5 fbe7d24a32e2576fb0492b8925fc6765
SHA1 c825c03dc757cc373c782ab0e47b36ad4e4dfea6
SHA512 2ab5021f05343bf36dd6071675a408a363672f9a46037bfda3efb1c9afd1b6d50e1323cf67a3c548b6e9fac39dd15c29ceccd940356fddb0c6c8bdfb47499722
SSDEEP 24576:V8kNvNnaFeYhJNtmZBm8nQ/tbw/2Mkjy6Fr7g0op:V8MwBtOm8Q/lFTjN4
TLSH
T14355AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 5fb017a11df48e0300edb88ef2518d69335796057fce27d3e0acb1078ec2212a
MD5 4b2ed71aacc991ef8c05874e5f6b42e0
SHA1 bb14da0c3d622c2ff04c2da44fdd877fc43d657c
SHA512 fd8f1412c86a5ea82cbaed251615e495033276c40a7576162ae6abed859329cc53d7bfab0cb2d09373e205e56d7c821d1f6bb726f1102805df672852c2bdf05f
SSDEEP 24576:hD3FHshBIYQgA3nQ/tbw/2Mkjy6Fr7g0o9:hDVHeBIAA3Q/lFTjN4
TLSH
T19075E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-66-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/240-308-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/240-68-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/240-74-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/480-381-0x000002086FE40000-0x0000020870088000-memory.dmp

Download

memory/1344-121-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1344-371-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1344-122-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2320-23-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2320-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2320-14-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/2320-89-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3344-78-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/3344-1-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3344-9-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3344-0-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/3344-314-0x0000000140000000-0x000000014017C000-memory.dmp

Download

memory/3344-310-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/3856-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3856-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3856-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3856-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4192-385-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4192-98-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4192-365-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4192-387-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4192-90-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4192-96-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4212-294-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4212-55-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4212-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4212-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4428-311-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4428-79-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4428-80-0x0000000000A50000-0x0000000000AB6000-memory.dmp

Download

memory/4428-85-0x0000000000A50000-0x0000000000AB6000-memory.dmp

Download

memory/4612-135-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4612-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4612-137-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4612-128-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4612-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5224-53-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5224-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5224-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5224-48-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5224-39-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5344-368-0x0000000001390000-0x0000000001633000-memory.dmp

Download

memory/5344-366-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5344-370-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5344-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5344-109-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5344-103-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/5836-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5836-372-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5836-145-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5836-151-0x00000000006A0000-0x0000000000700000-memory.dmp

Download