c3c868f10b8ed9d205345bb6aa0f122e8dcebcd94a8c2c4e89d6f3ca13676328

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 22:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
Size 816KB
Sample260910-2wh8vsxbpc
SHA256 c3c868f10b8ed9d205345bb6aa0f122e8dcebcd94a8c2c4e89d6f3ca13676328
MD5 d7764dc24163060282e7eb46f91aa2a5
SHA1 c308fea3422c39294f4aa5027420a01674e13860
SHA512 f02d1648a0482a9ea965fa4dbec955459a01a1dacac84ade59ce15fb4d0285949517d88907fcb2ffd2594dbe122da1f8062456a7ceeae54054bc98d201c4b99f
SSDEEP 12288:TAmZXuYCcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:TAhYxvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T1CB05EF0A7A4440F2D0614E314A61EA6DA365BC68D8074F9F71907ECFFFF5AD18E29A31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5576	elevation_service.exe
1244	elevation_service.exe
4964	maintenanceservice.exe
1316	OSE.EXE
4640	PerceptionSimulationService.exe
2328	perfhost.exe
4692	ReFsDedupSvc.exe
4532	SensorDataService.exe
5796	ssh-agent.exe
3576	AgentService.exe
2244	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4b195b5be62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009bf079957741dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058786d947741dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000de401a977741dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000026591bd57741dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000395900947741dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000374f05d57741dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ee7d3a957741dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5576	elevation_service.exe
5576	elevation_service.exe
5576	elevation_service.exe
5576	elevation_service.exe
5576	elevation_service.exe
5576	elevation_service.exe
5576	elevation_service.exe
1244	elevation_service.exe
1244	elevation_service.exe
1244	elevation_service.exe
1244	elevation_service.exe
1244	elevation_service.exe
1244	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1208	2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
Token: SeBackupPrivilege	4692	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4692	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4692	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4692	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4692	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4692	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4692	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4692	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4692	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4692	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3576	AgentService.exe
Token: 33	2244	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2244	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2244	SearchIndexer.exe
Token: SeDebugPrivilege	5576	elevation_service.exe
Token: SeDebugPrivilege	1244	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 4384	2244	SearchIndexer.exe	100
PID 2244 wrote to memory of 1204	2244	SearchIndexer.exe	101
PID 2244 wrote to memory of 2608	2244	SearchIndexer.exe	102
PID 2244 wrote to memory of 4900	2244	SearchIndexer.exe	103
PID 2244 wrote to memory of 1376	2244	SearchIndexer.exe	105
PID 2244 wrote to memory of 4104	2244	SearchIndexer.exe	106
PID 2244 wrote to memory of 5848	2244	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_d7764dc24163060282e7eb46f91aa2a5_icedid.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1208

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5576

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1244

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4964

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1316

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4640

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2328

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4692

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4532

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5796

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3576

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4384
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1204
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2608
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4900
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1376
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3040 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4104
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3060 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9ea53d39d265c2a19d0bef48c92d2e322c45effcfde1b905c28836bd0a81d1fd
MD5 1bdf46380b86de0cdec3927e2d3addfe
SHA1 9447cd8997ac3c371a4f691f85a9990e26df95c9
SHA512 5393234be2d7c33968fde8043b4f2e3c42e0651ca7b58a51baf9dce9a6d587a8ef26f2f2468163607544cf7da6413ec669fe3cc74f7fce745bf0e2a97e22f5a5
SSDEEP 49152:db+632BuPkFKRrdE6ohmstBhuXjfS4LWxnsSUVIk25otCsiq:j3q6HjBBVIk25Lq
TLSH
T149D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 19f293dc8850585bb1cf1466c276eca793f844f097023072d50d2d0996c6ea7d
MD5 db2bad7b670ce8b75a6736c04925cd76
SHA1 253bca79e9d10fb7b9d9c99435bc3a77fd0d4dfd
SHA512 4f9e90d422ddfd515dc00a5b847d6fbaca57d506587af7b122aba2b84cadb406c843c5a6740cba49784d2789dd058d0b25d92575c035843531c4676bfad12ebc
SSDEEP 24576:kXYfDtczAkvHqsBUVqTkmZRFh1mtCXLoiq:DtceSUVIk25otCsiq
TLSH
T1F205F12867D408F9ED6B8239CCB28411EA7378944760F79F03A499251F377D85E3EB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 2515156eb4f35a732a47b53c6d8301dc18ebd2d4508730de722279375c7c7bc9
MD5 14695355eb8af46f9fad4081131455fb
SHA1 c545950792a4bd15410ee2896d3707d1498a4d1d
SHA512 124b8030acd657d6b22e3856cf6929bc04398ed86b4626e8f055299b3596976a99507b1ed9083f2dd3fa03889a22e5fd6922bb270d8ea9790b97503c7de51480
SSDEEP 24576:A0Le5ji0hmxirM1vHqsBUVqTkmZRFh1mtCXLoiq:APji0AcbSUVIk25otCsiq
TLSH
T14A359E15F6788331D073C0B9C5D2A69EE97130855B308ACB4286D77C7E6BBE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 69ef516df1297d136ee54d64bcc7a007df14f0163bc948c59816818e2eba6e22
MD5 b18936c149508ce5fc777ce07663b4fa
SHA1 1bad25eb72feac4e7172784bd947f90f515ffceb
SHA512 c69ae3681e7a6723ea643a0e812d8e231e65ccca0e64ca72a94f4c9f679e2ac24f79fdf5e5dd997485092fd26c2994cf5585848e48dde25d69d737e6fb53c295
SSDEEP 24576:ba7/ezSC6vUyD/aqgrvWE6q8wyuzvHqsBUVqTkmZRFh1mtCXLoiq:2/ezSC6vUzPvxHjy/SUVIk25otCsiq
TLSH
T140756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 736687e8220d78ca5933af8dc9176f31d9650cf2157125b4cede5847fc53fd4f
MD5 c068ffde61c8cb54de71e80d48ba61f1
SHA1 fd3ee5000d3c258d6e826967406aa3b5d11eb96f
SHA512 f8fbcecdfcfa91eccda6492b3d529f82e42e9e92eb157949569070c7d3cc7469fc7fbe90f12c74d5d73fa7a099f1e0db177b02a5f0dcf3b5f8949f61e317889f
SSDEEP 24576:kVbqPb88hv/l+6QvHqsBUVqTkmZRFh1mtCXLoiq:kVO88hXl+YSUVIk25otCsiq
TLSH
T189559E66F5748331D073C0BAC4D29A9AEE3234415B318ACB1246D76C3E67BE6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 5dfd0715177b3f529733602830fad1ee38163b7cf97ccce23e8ae0a8a5a0eae6
MD5 7f27040dfa3ea693a867f961a23b937d
SHA1 c27b5ea9e6fabb754309f71a6ea4e84e757874ab
SHA512 aec233fd54b6a6e90c4e62cba3ec4a26a8f166a8498dc265d327df1614e8d2bdb0350082d8129d4fe909977b4576da7c4b095522a9efad4c65feebb86743759e
SSDEEP 12288:ORycvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:ORhvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T136C423044B4C04E3C3BF9B323DB5489896A53DA8DC88B46ED9217C255C7CA99E43F3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 e4bcf1ce5a982b33ce4d6a4b34115be39c294b350ca5fec073dbd50c11f4dcaa
MD5 751f483530dabe408b874c26270a0769
SHA1 7fea7eac993d863932a6944495778a75a187cec3
SHA512 7bfd7fcbfe5c0f4451baddf7f6b20ac6a39e9b54f0b278c03259c8dd2dccf114d808abf0d80f9304ddde553b62b410387ebfce18b4e0072ff794539285ff8775
SSDEEP 12288:QeBNUbTVO86UDcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:QJIUYvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T18F05DF3BEE28FCE2C27E8D795A918600E77278704F51A3CBD165820EDE275E05D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 fe75fcc24e42bd3feb42a8f4d3d46f113d57f36aaba6b563868106777c0a5adc
MD5 9f685c9cb163ae81ce899d357d7e8d38
SHA1 3efb681cc1e178e8d4ef56c4cfa87d90bfb98801
SHA512 0558309df27a7a276d170e3cd969a8bbaa22a703458dc1591c538bb39ea0fb158555785a13d46810320b2522fcd420ed3d694e3c152d657eab8f28cabf4d503d
SSDEEP 49152:kQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THp:kQvGAdlCEL8c/yRNw5C8VIk25Lq
TLSH
T1B9266C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 0fa0875f312839ae24e0528b87fee3dbcedac344a79507e5b0bf9530acdf29e4
MD5 1aa7f85b16eded4e5330786bcb584e22
SHA1 ccc1c2617bf2bbf9c254a69536e6cb18a0b2297a
SHA512 6bce1e5c88d2d5268ff0e6133c3c3a76100fb920f97c864f852a4edb169f672af8c9fb71a34abcee9eeeba7b7e3cb303000420c7d70b053a3593dc541a669e1e
SSDEEP 24576:hdewsAjuvHqsBUVqTkmZRFh1mtCXLoiq:fljLSUVIk25otCsiq
TLSH
T10315EF30FE74D032C3BB0DB22B36C716546C7A604F512AC7E3A89D9D59742D2277AA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8ff26973c02dbae77e82382f2f5204635e1b0eca84b1b5ce0bd4a7929e594b78
MD5 ea9c6e29481f5df405afc527e5970de9
SHA1 5c9c635416c23ad3cb56b230ef2fb4c8d121e7f3
SHA512 172a6388482532c0d81c451a280b5b910ae276727a49a71f350b30c1d02a2458c732cd2f3d33d07cfd322d1db7b608686913569aac9f87866c5199f29a50d7a5
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHr6:xUEtQevvqc2W1cpV2EI32r
TLSH
T166474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5b586cd05778cf9662702f58ee08ec55e1f80ecf83c54d6c4acbcaae6c0b86b9
MD5 5519ffdde3c362e248d13c5a22803ce9
SHA1 e478a42e62df05c04166b2647986321562158965
SHA512 dfeac2bfeea1845fe4ed9b92976788a77821bb925a2dd7fc317d948cae3e00824e13f754c7b397846309b689aeb639b6a428950f2f345c9e8649d836bdf4c067
SSDEEP 49152:9CbRquA/m2yL5zQfFiV+XenmE3/zrSUVIk25otCsiq:6oqtVjnmQVIk25Lq
TLSH
T112D58D0976B881E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 a06b69ea8dc834e55cdb591a9ec6b5f3e8799d60174b5887a6f2c3359c77ac70
MD5 1222373db62ff8ca2b301d7eeda9bd0a
SHA1 aa37f8752d7b749e0904fc0fad6f6ed18bb2853b
SHA512 61c14037f6fe3cc82a8ff36d44d8f99249ae89c4f506f7a717ba2a6eccefee4e1fe57ba0d7b971fc1fac1374deb1b5f3d7c95aefd9293ce3be57584d278921eb
SSDEEP 24576:gAhGLJIFoiwtA5l7S53XvHqsBUVqTkmZRFh1mtCXLoiq:gAMyFoiq5CSUVIk25otCsiq
TLSH
T153359D80EBF905D4F5B3AA7899B68570EA76BCA95E31D20F2160D11F0E37E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 9d063a62c3475a31d0037b1cee2bd713d6d760aa5ee0d32665dee1e52ba6bf3d
MD5 656525ea315210bb1821853a0dc9adcb
SHA1 b2a358feaa3c73d1928d9373fa9b97759b0c9bdf
SHA512 14f9066d46255d9fa567d658422662480ebc5290adbfe7d91ac21de65265968017c724dacad25a40115d5006b9927a2a4387a9491a3896f2e34eea44b6d6b54d
SSDEEP 12288:imw5HEjsChNVBFgl0WDm+CccvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjN:7wuoOWCvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T1E905F14936A80CF9E6A782398597C036F7F2BC112A25D71F5760C61B6F37361AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 7c7ad8ae6c4e083da8b3d84761c390d8a08cddc2a600c7010021f028ec1ee9f4
MD5 48825a2d3fb28bdd6331078cdc949065
SHA1 3d23ecafdd4a60ac5fa7e1841f71da78a2bbe9a6
SHA512 6120d54bb63d5b81bfc2283167a3f661862aaeb64c11a4e4f0a355932db07e07019c9639297b5741ff989e344606b9d683fa552ab2f9d18e27d72abcd7079a99
SSDEEP 12288:/BZ1IyhcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:JZudvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T1CAE4124923D820F2D2B782399CF14948E3B138A56B7593CF962055291F7ABD66D3E333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a62668f7476860db47081eb28f77b82e617141d0d749a4ec29543a26a500392c
MD5 84d1d62a887707f1d939fe90288ffc7d
SHA1 22fb8f88f4c7653ebb096495957ed81c1b492c4c
SHA512 cf2f8edab5d9794d520a603d5696aaa2c50b21447572028db3c98767ce7baceefd59ca5db227e2fdfb9b1477812e7c5362e84ed7164611da723883ecec47f89a
SSDEEP 98304:iQRQyi36YOcPQLvw2gAf+PN3tVIk25Lq:5QyiKayX+PNR6
TLSH
T1E8667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5323e9ab61d7e5252bcc40ccca5a8ee05bd1b8764ddc3900515a34289cf46604
MD5 4554127a46057bf14afc4cb6affe2f46
SHA1 7f9b0424d5950efd865282db4a62ab7c788b9011
SHA512 43684324da63786b0b65f9362ea9f10d1d9aff8e665cf19c603e4411b61a643e906c1dddf8c245bc6a9a0eaa3b6d213aa2a7e40fbb9b3ebc5fe50fbddb123a0a
SSDEEP 98304:uQRQyi36YOcPQLvw2gAf+PN3tVIk25Lq:1QyiKayX+PNR6
TLSH
T175667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2be0ee40ca06828ca17220c20f327457fb7ca8b1bca8589f0bc28f066a57cc98
MD5 786c1528263f5cee308ff54933e627f2
SHA1 d44a95a7303b42c2233af716f6feb099131e92c1
SHA512 f8be657bdc6ee64483acc42be6f5c317f41b2f363f9f719d3d3f3e767732f799b502ec257d7816d9cd95d66f0f3d429e810fdf259bec67df4541bb512e67a391
SSDEEP 49152:m68Qg55nhheWu7PNU3/bSUVIk25otCsiq:EthWRc/7VIk25Lq
TLSH
T15AB54933B2F600A9C05DE1769F4A872196D27C758FE0E3DB851172161BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 cdd21b3657e68f5e7912b7f2d14c64026e78a04989cfd053f492f524bea1e9b0
MD5 d0d1e27a1d8109982b6efa505581548b
SHA1 ce2f8819f8a384a624f95a71f24a966b03dcbcf7
SHA512 b15ef1417bcf0bb763899fac90c122fe831152bfec69cc744b9b5e372c740187750e2468efe03c10bd9905784f63ffe04c3652eb044f2087efcd97231c218990
SSDEEP 98304:Xy5112gYy5azzVvL69nLKnhZuVIk25Lq:qLIHmWhI6
TLSH
T181167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7e032d951b50060a419c4cf0db6803ad65822712c7a5be73196dedc7906f563a
MD5 f93d0a52e28581a1f2961a5c6904b911
SHA1 4ee830d3177e2009ddc86000c88e60b16b27d2ea
SHA512 dfe852bec8429a460de02c56f0c05277f3ab89be6f1a11926841dbe3858997212bad0f7638fb85e262adc2dd74de8496a19b6f3edb843a8914c55a00c583efe2
SSDEEP 49152:tB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gllSUVIk25otCsiq:zu6JmVxd2dFVIk25Lq
TLSH
T167D59D13F1D901E8D06ED478974A9233EA62BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 43e12835ba5b40021d57b6e225be0d367995e73a5deb78a0b35444ac0964e806
MD5 9aca95f302cb47cd5c38f340a1cfccaf
SHA1 5cd72deb93a4295ae4dbef420f6dc8c0978a2f72
SHA512 275f0a0298f30bfc1680546583cccfc33cbc2ff474f5f8ece9046bffda92bb724eaf850281e433c6d855d485b6d60c0f036d96fe250e2ab1aaea2a0d38bf24d9
SSDEEP 49152:q1hpsNoJpF1A6UU44CwH7R4xJSUVIk25otCsiq:qmifPbRQVIk25Lq
TLSH
T1C0B5BE13F2D800E8D06ED17887569632EA62BC450B34B6DF0A90B7961F7BBE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6187b13309deae2328c321f985b0d0a441018b364d3e40e50d0be967142ec6e5
MD5 f9ad528d2d226811d00bd676d278a89c
SHA1 6b978c57a52ae74a5285197513687582c607c612
SHA512 069bf8cd52ad829afe149e47590fff11dadd26818aabfd1e8cebb70a3a00b858db9a8e73a60dbdb967f83070b4359dfe08753146b4d57417e251685061e95321
SSDEEP 49152:nSuZQIY0Be2KRRVtOnks6NMHqcSUVIk25otCsiq:95dKTi61KVIk25Lq
TLSH
T19AC5BE03F2E901E8E0BED6748B669236EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 37802c995b10b4d4b95b85cf6cf13ab752db1775851fe18947f30869bd14db6d
MD5 aa7cfe15205942118166c3a4bf687038
SHA1 481ea6db14422f41d486e8d1a2757e4d9854e00c
SHA512 f349d20513d12002ef1c6e24ca94be6c990d1fdeee2e98ca76863d6cae097f94fa36ac0bd393900fd1330bfe02261683d8b9f85e0a50f50abc7881fbb9ca6f42
SSDEEP 49152:hhtSn8EApI0figngiDn0AP5wVSUVIk25otCsiq:wX2iyphEVIk25Lq
TLSH
T10295BE13F2D900E8D06ED174C7568632EA62BC150B39BAEF0A50B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 b9614c91dd0891eabb175ce7849f6f1b0d00e5ee65d50036af5c119a29d18617
MD5 7f3f9a31ef0d1eeeef8489f972f4baff
SHA1 e22260cceac440a249dc00d26fc396462eef9a42
SHA512 38774cce87d3054684bbc277acf69ce3c3f1cbcd214bfbb51865ea481085133187aab19aea0a36542743950ad32e3f5b6b40a527ba7f5e301939aa0505372d13
SSDEEP 12288:AacvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:ApvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T14FC423084A4C05D3C37B9B3279B14888E5A43DA8EC4970AFF91578255DBCBE9643E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 2aa52ee82c9b24db9b81937db2a50866e82431a25d0682d993793958ea0139a4
MD5 e5729d85930ec9fb3753b8549d7c28c7
SHA1 aa6fe9fdbefa9dc62f46ce7220ce7fd902370bbb
SHA512 3bdbe58bc94925d4091f26b84c0c1ce6985e45e5c142e7831f04b75e8f7707d7ba5184cfea941aeaca237651cf4efa36d0852ba3c3eafe2b7d8d7f3e6b9650e6
SSDEEP 12288:6tcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:6avHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T139C423085A4C0593C37B9B3279B148C8D5A43DA8EC4970AFF915B8215DBCBE9642F3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 f6905e85e7b56dddec3635cfb082878c316d24ac3561809d3dc00f0b9370f31c
MD5 21efe176f8174c8f7176f5a6633daa93
SHA1 1ddd9ed573d4108288b6b93c46e1fce833d99ec9
SHA512 c9848e2e9cac1fda4742acb4771e2153d3fdaf65751aa9c5dcaa89a0af1004b92e67805286828faad03a14bdde5acf185a680738d0729b664250c3df4a93466a
SSDEEP 12288:3rcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:3AvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T188C423085A4C0593C37B9B3279B248C8D5A43DA8EC4970AFF91578245DBCAE9643E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 242d1088c75b24c9949da02e87dce3288754389823183a1c647d3ec17252fd1c
MD5 f19fe90ee10cd7ad4f2a0597e4f77cca
SHA1 3bf15eed8de217a11cb436b4c07fe3955f7082d5
SHA512 a0e6eafe8a25f8fe1509af191f3be5e76b58ac58b71aa207515666a215eb8604559086e18e4d2dd9bb1c781e1c0d4d33e31de8cf6c5f2e3fb8ddd77761d9f641
SSDEEP 12288:FVgcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:3vHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T10FD423045B5C00D3C27BD732ADB28494E2B47DE8ED15B2AFEA1138251D7C7D868397A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 d7e3d55dad411809166f7e00c7d011abe9503129e3cde85a9dcf3a981dbbc872
MD5 3f641180d5ed7fd867957cbf7feb8c51
SHA1 0151c8a3bb469b7df4cfbb13c1866a2950094c15
SHA512 a14755be0c6b11381e0d3650078a18d77c5d63d73044436338c9f8d37b126414f034a1b2144e23c7381709907d0b73361c6b4bbc0c387f13d9219cde7fbbd047
SSDEEP 12288:XYcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:XPvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T11FC423085A4C0193C37B9B3279B244D8D5A43DACEC4970AFF91578245DBCBA9643E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 23e47119f3a9dea435bf7a7b9e8fa567cdce4170ca000341a6c004b620830fd8
MD5 b40cb58d11295c4d63998c111d0a7401
SHA1 cd7a51dc6502bf359ab9b14c83fe36dbe47dac83
SHA512 3c7fe69dacaa161d04e212ee564f930a1105ac2cca1829bc8f26e3adaf5d993043c479909c9cc4457b8a4dfd95791937f3257193cfb71b57b4b7fbe29b0293b8
SSDEEP 12288:Z5cvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:ZWvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T11CC423085A4C0593C37B9B3279B148C8D5A43DACEC4970AFF91578215DBCBA9643E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 b12a2195708a4c1ec5102192aefb7e97cbcd5d321975d6a56feb117534a70c94
MD5 1b93a7803b9b0bc433f85688903914ae
SHA1 295ea191aec4d6477112c761ca40a3ff9b1aef4f
SHA512 25976dcc310cb5a5c1cc4f4c8297143223dbc4c1ec9b2fe4641306fa4995a45792fd39bcf374d955675cbf29b6e8dafc952fdf9221b484902f1295efd6e01f9a
SSDEEP 12288:PFcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:PyvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T13AC423084A4C0593C37B9B3279B148D8D5A43DACEC49B06FF915B8215DBCBA9643E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 5603d3d608122858f588305fd491fb0920c477e0ecbfc2eab3c13791c66601b4
MD5 941338c7ba4dffaedeeb5facab925325
SHA1 8d17e788e76d3acf664782198673a7d8c6cd8a62
SHA512 8919f3d0dc35e46ff01264de997deccc1d7433a94d23285883b38b3fee2ff4eb0f121d803ddf764b0b0cdc2612d6218c1263bd0ef3bf9b2e8df4fa65f671672b
SSDEEP 24576:9ZMSzFVSO6vHqsBUVqTkmZRFh1mtCXLoiq:9ZMSzfjSUVIk25otCsiq
TLSH
T1AB050198B39008F5DD77823ECD658906D2B27C694A60C61F53B436275F373A11C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 d15dc01d80625417cb6f92aca61ce2332d4cd0ef000e1825a63b21fd0740cf8c
MD5 80b77e2c8cf9b66bb1f423b0818c0c07
SHA1 15dcde026bdf60faddeac220bce7f119cd68a725
SHA512 1e9969694032b76fe2ad371cf83206d9d2d4079e5b6ec01ef7826c01ce596b7585b905c31d91fe36926cecda3ed389601556fb66378f0df6aab07dd5c4dbfe49
SSDEEP 12288:y+cvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:ytvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T1FCC423085A4C05D3C37B9B3279B148C8D5A43DACEC49B0AFF91578245DBCAA9643E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 a1bdba2840f01fc4846492e24c5444f96e4fb2d6393326431dd042a7d6513c8c
MD5 32c50c465fd1be37b8eb3a52cad28dc6
SHA1 e5a9facfbbbf9848b41f8fea6d50ba0355270806
SHA512 89c9898caa99152fa4d1d88f3ad65435078c88797e7c1e6f6b1e1597de333d7415b6b0537ada1d3cc785951703231f699064bbaad14baae994dafa6c929202c8
SSDEEP 12288:XCcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:XxvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T152C423084A4C05D3C37B9B3279B148C8D5A43EACEC4970AFF91578245DBCBA9642E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 92509f2f3ab66c489b729382381155cf64062929ae55c5445669215d2889c781
MD5 0f4e2f96c2b091d333ca49430e666dda
SHA1 c75148e23662226b91af3ed11d62f793d22a9721
SHA512 e671f6aef375a0a7c29d1d094a76329530a00df0cb71df484fe64afcafd3a8b4f2abffbb634b3d5bcb64a16780113c0d8a525ef32c7221548f674feb003d6609
SSDEEP 12288:GyPz5L8hcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:7zy+vHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T17DF4120777A420F5C27B823588A20945F3B178754B249AAF976056362F3B7E0AD3FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 7ddde7030294ca1535c1e9a8ed236b8769d107f72d1ac54192aee165ff2f6c76
MD5 1b06414cd63c175e869b8cc7ab153450
SHA1 5e61a455076fbcc93c0706ee68de3bc7b5535c42
SHA512 36e730165e56c30d40d90afb8c97220f4c7da66bf5acc5a67da9d9751ed5f6578b9793a050a36126b003332947ebe6ccff0592ff4723ad2f9c6b38a9de3cbc8a
SSDEEP 12288:7+cvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:7tvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T1E0C423085A4C04D3C37B9B3279B148D8D5A43DACEC49B0AFF91578245DBCAA9643E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 77f480ad8d9673d552462798896f805e4bb3bbc7455c1cf46d70718c33d8c6a3
MD5 76bf141d2bfbfa415b0bdcf6401dbc65
SHA1 ce6d7f592a5d5371c58e1bcca834d734189e6064
SHA512 bf7cdede2e97baca575bb8e59b8603fdbddd597f1dfb458ad3504ace88c0362eaa83aa8a0a8066340bdcf802690c9617811524f6acea87a1880d9e7db28c118a
SSDEEP 12288:a+cvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:atvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T160C423085A4C05D3C37B9B3279B148C8D5A43DACEC49B0AFF91578245DBCAA9643E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 5d650c7f6a36ea1aca9b634afc2c5b39ac508fa0db779f3bc7fc813ff37f301a
MD5 7fb26fa04d29ad8ed1e77f5c21cf4f18
SHA1 1e75b7b34a08dbb753e928232d6468bfff855e03
SHA512 bdb9b65abed5bd423f51aee58f64ff6819ef936099086b201abc40159d69605d8a137f3762bb0465f021ec9143d69135ade9ba9be198664e5b6bb11c919f6a4a
SSDEEP 12288:5yPz5L8hcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:4zy+vHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T16AF4120777A420F5C27B823588A20945F3B178754B249AAF976056362F3B7E0AD3FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 77525f2d95952d02eb22854a5b5c83a661640fe0f7484095158574ec19bcb1da
MD5 b419add606dc5b8c5c57f8030ca2aaf0
SHA1 f2a5017ee2bc165e5086b74fdeab3bc8a7f541a0
SHA512 449452a0311bdeee7fd719fb32f5671c375fa0a6d9ad88a8820eb6900227a9738e5b8d4b125527a13f62232fa654c941768ae2af61620ebda8faaf3c7d13c4cf
SSDEEP 24576:JTHaLl3z0zDwvHqsBUVqTkmZRFh1mtCXLoiq:JT6LljOSUVIk25otCsiq
TLSH
T1CA050198B39008F5DD77823ECD658906D2B27C694B60C61F53B436265F373A11C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 0534bbeb0dc933e932099cfe346ea3bbfee544678d488627235a68dc474aefc8
MD5 90ab820d6381463dc15b65d8696e16dc
SHA1 dc69b5db4a151ca0829aa194257bfa09fc3a088c
SHA512 aaf849f0b7f7bfb89d5f51a12c278a35133a82a44cfb839a31f0b263a7ffdc2591a750140b842da3a4f2b5d57b4a52cd8eead5ff8cac3da0709c28864071aff5
SSDEEP 24576:i37d9CHKy7GZsvHqsBUVqTkmZRFh1mtCXLoiq:E7d9CHKyajSUVIk25otCsiq
TLSH
T18F25CF90F3E810E4F1B7DA358D764511DAB67CA95B21DA8F03A4252A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 f1b129960a8194d1950ead75ebfa3519e5861398ade5373ca41395da392769aa
MD5 6c997a32df4ac2445a92d9ca1064e44c
SHA1 05ddaa6613873da8d852721e526155bc3f37974c
SHA512 51c1c4d6f5f422b87e7ebad2eda649e55b0bc1ed87d95e8f8c6de6749422171c94223c6ae82836b5c01ade859cdae9ee058e1284df641507e701a7dad845e513
SSDEEP 12288:vLcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:vgvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T1E0C423085A4C0593C37B9B3279B244C8D5A43DACEC4970AFF91578245DBCAA9643F3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 36f6812ea02d6d3228ba182c030f0710665d63f8a70147c6f8df7f703ec188eb
MD5 14a90cb26d3fd0db3ce668011eda342c
SHA1 3967526df48ebfe3914882a760891d827382fd44
SHA512 dd0df07edd41fa8ca2dac42cf03188fc6c126cfc9040faf0c75c3f8de1f3e84068bcaaccd4500376a6366d63c25da3a041759f0473a684253a59425af1988d50
SSDEEP 12288:KBcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:KevHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T1C6C423084A4C05E3C37F9B3239B54888D5A43DACEC4971AFF91578215DBCA99643E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 b931d44f5525155d61941192a78d57a06b2fed89f1c8b216662f22ccc7077d83
MD5 11ff6ea6f8594df579dfb8e5adc53c6e
SHA1 0456f3b44a73f95c1b7c50d26d8619913c803d46
SHA512 9d6e2b8594e1d8f54ed95c75dee4c5d378005f9401e65d90085e62283751536f2f8608ab29befb05fa7874fe6c217a6026c32ddb013012027281a9f408e62245
SSDEEP 12288:+UcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:+LvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T171C423085A4C04D3C37B9B3279B148C8D5A43DACEC4970AFF91578245DBCAA9643E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 40e02d18ce9b7ff3d6a65df2d12d39f5e7e0ce5e206d8b4a215d6f10e5c5ee3c
MD5 6a0d606b44ef879b8caf8143fd51991f
SHA1 24db7bfcffd408d0d09e58c7b052075501ed3717
SHA512 9a0cd2eb3c543d067525742f3b734ab9a7706c7cc5887ff7d04bed3d9b89b23c8f54afe2a60c96bd7d0b319929a2155bec2c7a8fbd42c4a17ee723d821297814
SSDEEP 12288:6+cvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:6tvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T133C423085A4C0593C37B9B3279B148C8D5A43DACEC49B0AFF91578245DBCAA9643E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 8a07f3aa96ddec09ec55f4ddf2e5797c3f169a316a02fe6f494e75089d7e6b13
MD5 01f4acfbdce64884c824bcc09384d58f
SHA1 1e0c7d0ae238e2e1fc952002cb810c6a2f246f6e
SHA512 9a52f29ceb4d003bcc712cc3f7d25d59eaf7645c61661f570dc23c81adc024d12bdc87d72bcc82f54de8d8224439d3e5a293e1dc710f234d53dc90db6b6d28e0
SSDEEP 12288:cLcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:cgvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T1E0C423085A4C0593C37B9B3279B248C8D5A43DACEC4970AFF91578245DBCAA9643F3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 3f2a6c791ec8034ecb8090ecb230ef945da38a06350c5ff07f36f704e11baecf
MD5 98cd606f533adb4c0f20d8fa373a52bd
SHA1 6b090268dacfa5852228d03aed8c3e71cb245a93
SHA512 6fda30eae320c21bfd73043f38fb11de11936a749f2d602023cd5cc67aca13eb9dfb534c34a359eea1f0e03ed0e48e18773d1b5f01c397561c7fa41c701fea39
SSDEEP 12288:t2cvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:tlvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T1E9C423084A4C05D3C37BDB3279B14898D5A43EACEC4970AFF91578245DBCBA9642F3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 076e50706ac4ac506a236993130b7cbaa96f99cb03670ba1954ea85a15364dcf
MD5 af7a48f4b9f2685ec1398e6c57b0feab
SHA1 bfada0eac9ceabec42df8062a5ef867f3658a0f6
SHA512 c00e98357b4a71f84a7c73a2415b0ac0e415780a158aa7efea25ec69feefb8bbd791e09295b5228981843e2c7010b2938b62179cc3d81485294392fda14bbbcb
SSDEEP 12288:EYcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:EPvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T136C423085A4C0193C37B9B3279B248D8D5A43DACEC4970AFF91578245DBCAE9643E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 36ae2d0dbd8b9820408c000e2f8322446bb2a6d5e646411761cca0f0e537e317
MD5 008ef588ffb8dd30b682955fbd9dedfe
SHA1 c2d59ce6a603eaf81e54f3ada386b965ec6b1111
SHA512 0bfcb7428b13ca9b7433aeed8bfc8fdb0153f2cfd69cc9dc699d94e755b71934d880aabffcbc2780ee606585d27ef6da16b96288605e257d79f0d509881b3ed2
SSDEEP 12288:KTcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:KovHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T18DC423084A4C05D3C37BDB3279B14898D5A43DACEC4971AFF91578205DBCBA9642F3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 992d6f2ebe462db76d68de1a22a469b869112ce3618e8726a40a2387564413a2
MD5 40b512030f4744b82df5b0d88be7ed91
SHA1 be02f3b623f24ff913d40c132b658fce5b80d5be
SHA512 13927e119e3cb637b799259b80ba601ee55c257c03dd5e126e278127ecb304edefe8c94fbb0bc998b70e9ba7d1b0a28dce79d39eb25aec43f7e7ac217bc2d226
SSDEEP 12288:TYcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:TPvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T10FC423085A4C0193C37B9B3279B248D8D5A43DACEC4970AFF91578245DBCAA9643E3E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 5e9b8d35545c1936c5d0c97e656eec3fce1d47efa85308ee0ad1c5434b0ff60e
MD5 0d85ee7e4e4af0f759406be552763b7e
SHA1 714ee7198f5595ff51e95e57cb4fdf19df915224
SHA512 d1bbd6fcd6d3d2cd6c82f3bffdddba0a3d1d8ce451d02cb35f3853bc60281f7456c5e7fc5ac5717134c9585da673517c7d2a09a2228fbf8cc3e3a8135aa3f7f0
SSDEEP 24576:Lfwvok9RX6wkyAIBvHqsBUVqTkmZRFh1mtCXLoiq:tMnYIQSUVIk25otCsiq
TLSH
T12A35DF29EBDC04E1E1B7923C99B7460AF6B178681B31C2CF125A536D0E37ED46D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 2cf16802c6c9a1962c8e2b34ff254d349c5886f74780e7915966e9fa248af54c
MD5 79024cef75863ae63d99a5598ef74d60
SHA1 5630c05eb1cf9e157b2cdef564d05dea75ee1ca3
SHA512 e369ad1d8fbb6a208357b7cb103ea7557a57cd18b162c3a955efcbed2584495a5e8094c90a0052ac497b17f52cf443ec59e82a26d2f1fe7297584b35f72e3e3f
SSDEEP 49152:vYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK01SUVIk25otCsn:rySzPNVIk25Lq
TLSH
T1D7066C56A16801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 ccc89aa0ef2d00c6d41561922eb2f76692fc053dad371aa654695e515257fa21
MD5 7d54d073d284da335517b668833a4c27
SHA1 16bc3b36ac21e2ea525902861379c11dd7d51b39
SHA512 dedca0d392659b2c233fa0b4f7d9457129d3783b15c47b44469c418e1c08bb4674c3f6d382c34684aa289951921fcb8c2a8d5d041abe45fcdb4b34e890d87548
SSDEEP 24576:B47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYKvHqsBUVqTkmZRFh1mtCXLoiq:B47JUQj1irIhCnDHUPfF/lSUVIk25otF
TLSH
T11F65AE1DA3EC01E5E1BA923885154A5AEA71782D1F31DACF2270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 8edc9bae1de20047b50ab0805f04c7f4b5de0a6b8e38582c1f03fa4d00cdcbd1
MD5 a35b34d84999492a838bc3cf334b3bd9
SHA1 747e8c25b32dbfcf415c4b547249ee0b6738d159
SHA512 145fd8e6780fdbf2a024aae158b431617c671ad0fcd5d28f18d9d45b82b270d1c80b9bb53204aa820f62c1b9308141b47dda4d6ce973e1e0ec39d6542cb09875
SSDEEP 12288:xNsfucvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:2dvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T1D8E4F009D29802E5C16EA235CB624A40B3733C6497E1E3CF96D0F83E1F796949DEA753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 0a7ff0f868d947ddba40d03367d79a1e962ab49b367c5a9a760f7824ad29eb39
MD5 0dc2b2b5b14131ba6ffae8536c9e22ea
SHA1 39c9a9e5504d2e22f1c36ad4e0ffea32f36144c9
SHA512 d90e86bee03b4add0d65701aa21e27e128533975227f59ff5ed97239f0b9472125a162ecd5174d160aeb2b4ef22dbfb87cb0a473154fe4c696e6f6dd6f572cc1
SSDEEP 12288:rhzdqU3fjY3CqBQd+mFKdRCAbONR/cYMbHj9Jw4Y:rhz0UPU3Bt2MRncREYcHj9JBY
TLSH
T1E8451640762AD78BC6A950321E36C6CCAB707D01FE45AF1773C8473F9476668B6F6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 515c42510ed273b2b4c5552639bbc2907c384d13ed5ce308978b218aa62938a7
MD5 ee1d21aed6187c8b4c90aa94ae7afddc
SHA1 80f9fe3986b7cc695e54e8274ec70dcac32b36b6
SHA512 a85f524fe611e20bda1d96dc10155965c189e07e93e3f2692b493c4b16507c01873de47e4dd39866b403f39cdcbb5ae3ef0c6a47b28c364c3a25b31a7138aad3
SSDEEP 12288:Gvez4oxnsPAkcuX+6XEe5uGfh0dvziD2cNPt0VAkHUgjA7UHF:GvcXpAnljsLiD2cNlqAkHF+uF
TLSH
T19C654B41A5BBE35FC9FD9073423286CDABB49C02BB453B0173448E7C986757EB5E2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 7f49e624d52e2f3aff8cdd5ba7c3fe18034d988a02a7cd76133a6a38dd011b7e
MD5 d2948a5eccf8965c95ff44009e560b04
SHA1 e008de8fd2bc965f3742c34093b29b63f37f6ff9
SHA512 f9133cc67bf98546295f5ad280a6241c85f0848eb559ad0313ce2851e2b4bf44331d480b848a5117a5814b20ed41bd7679be3fe2c4f470ef3de3c94478d5e752
SSDEEP 12288:2M7mcvnHqdUp+ysgUxvj6xTkX2Z0sC07hvtmt0D7XQxjoovaqb:zVvHqsBUVqTkmZRFh1mtCXLoiq
TLSH
T1EAD42304874C0493D2BF9B3129B68468A6693DB8DF44F0EFF91178255C7CAD9AC3A35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 88032a4a9e4dd8989b77332e5e7679c379daaa529e5d1251945f1c5a678f0824
MD5 270f99153f3d72445b9900109a80d755
SHA1 7805e4cceee609942045879164548fdf14e22b54
SHA512 3db55f4b29cb6f7a10eb4e1de34e2004f82000dbafdd9e1a50f3f496330c6919ff0094e21d5f848737e159a0013a73a5e4f0ee73b02759059142c6bb3303c258
SSDEEP 24576:Bgb6bmBIi49WNNFpg1rSvFv7bYzvHqsBUVqTkmZRFh1mtCXLoiq:Bgb4mBIBhGFHSUVIk25otCsiq
TLSH
T1DB65AE1E22EC02F5E1FAD2B89DAA4417D6B278160731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 f91eeef1b3175888a4f3f349fdf5103a9be4fba222d9d87a250a26d8255806ae
MD5 93a0c294a13091ee8d64fe6ff1eb6c0b
SHA1 93eeb90c115a8e17f91be50a3e775fefe8e8fb14
SHA512 e91cdc5aa58ff545b68a27ce65ee00bae751ef97892dc4d8e760bbe6adb084766b9f58dd4611dfae267829113d49547f3e5b585e2c3e5259989527cbb20ca7c9
SSDEEP 24576:0G88u8FpJqH1bzria7/m6vHqsBUVqTkmZRFh1mtCXLoiq:H7ZFPqVea7/mSUVIk25otCsiq
TLSH
T1B735F16567E401F1D07BD13889924663F6B2B8250364FBDF47A88A511F23BE54B3FB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 3f7efd33c235a4cea5df5e4eaaccb6e49b8b8f1650e500852c3be26ce53679e2
MD5 81f1f1431b56087fb9e2671becdcc679
SHA1 486769c38cb64a708f635cb5734c92f3bd041758
SHA512 782ffddab86ff159ef5e14910106b84d9b9b6de21b3eaff8084282137dd451f5a0d2b081728fe4e3bf27f3636d44b870329474a613ff272582df63b97ad12083
SSDEEP 24576:NPUr+NQmvHqsBUVqTkmZRFh1mtCXLoiq:NJQjSUVIk25otCsiq
TLSH
T12F05F21E66DC18E5E67AE13D8992860DF77178611711E2DF02A0813E4F67EE8BC3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a55bbf7e114e9dee9652338cb28c4709a48d163a3db6840bc98fb0dd7e3a611b
MD5 3bfc24a6aae366ec2ac875ffacb9fb3a
SHA1 12977d4f8148491daff4be05f98a34cbbc07d511
SHA512 83e1da1248c4d46bfa89c7372fe74508a3a87d11c7f9e63a447b51546992711ea5826c964e3fc32d7d5a6e83d7942f6ab7409ddc0fe02d0826ca13b079799b29
SSDEEP 49152:NBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjzSUVIk25otCsiq:WG05lO43bWVIk25Lq
TLSH
T1F0D5C06E62EC11F5D1BBC17CD9C64A0BEBB23825032556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 c8bc60071beea91af4cb1a280d3b33c39be4453c0424de6a0340274a85fc384b
MD5 524a40d0a494e02c86769e296d5f1f68
SHA1 676cc9c98be5b087bd8f9dc3eea675c46339a983
SHA512 52fce93b7fdfe62ca6fc7d9cd3d9c5618a7c0e062446a5045884711d4977505581165a52bcae95496912fac180ff6827728013fcddd5e26dbc6275f1b3e10435
SSDEEP 24576:2fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnEvHqsBUVqTkmZRFh1mtCXLoiq:ua5POZ3+Jt2pasx2+mbSUVIk25otCsiq
TLSH
T16F65BF5EA6FC01D5D1B9D17DC583861AF5B1342553329ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 16c9c88046cf2d5c0620a24a2643c29f5ad8cbc3554bf86c825a2a0ace021d9e
MD5 1b0b7c7c4685f1b0fc1cebd7b9616641
SHA1 cb7c7044499369a8582c53888e689ffa2dbf5419
SHA512 72642463c0751264abcf769d1d6b3e96f967eeb2bee73aed6164136fb08c5f64b6f6ea223bc875300bc059dfb03559487ffe143e090de56f634e7b414d2730d0
SSDEEP 24576:MNcwHdjbyQ4nLC18lb/EOjowL7FkivHqsBUVqTkmZRFh1mtCXLoiq:MNc/zEOVHFGSUVIk25otCsiq
TLSH
T188858C1623E801E4E1BBE1BE89779546FAB17869573086CF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f74beee14f668edeeda06cd8ed7c7072f780dc754b0644df7cc8259ab8877b1d
MD5 06cd83093bc4f9cb83f97746ef83c1ea
SHA1 583bd090b91fe20516e132482c613fdcf8f17634
SHA512 b9aae7df25b916f4f792929c249751a815029bfbf74ddbac5e22454e978808204e5bbef5ad0699afb6d385979c6f748f4ea8b25cc8009e24b14b5a1622121574
SSDEEP 24576:18kNvNnaFeYhJNtmZBmovHqsBUVqTkmZRFh1mtCXLoiq:18MwBtOmZSUVIk25otCsiq
TLSH
T13355AF2EBAB806E4D1FEC6759D238512E6727461173293CF9290C13F0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 fa18dd554c914573cdbfd8eb1956120828e26e026a187b92eddf3088e770815a
MD5 bda1d0da39db917f4bf1252608edf57e
SHA1 fff45592f138c09e4c7a708d6a0712fa32d004c8
SHA512 82b9fbe90ec635f5211e666f3e7f67d8ada5f61b3bd5f1e80942169e3a96525693f596770479356676e92942c75c8ae75433d41b369839090717018f11d9fefe
SSDEEP 24576:8D3FHshBIYQgAJvHqsBUVqTkmZRFh1mtCXLoiq:8DVHeBIAA4SUVIk25otCsiq
TLSH
T1D025E13DEA9C04E4D57BC27CDA638906E77138A8072265DB0294817A1F6BEE47D3EF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1208-317-0x0000000140000000-0x00000001400D1000-memory.dmp

Download

memory/1208-0-0x0000000140000000-0x00000001400D1000-memory.dmp

Download

memory/1208-1-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1208-312-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1208-9-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/1208-78-0x0000000140000000-0x00000001400D1000-memory.dmp

Download

memory/1244-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1244-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1244-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1244-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1316-62-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1316-295-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1316-55-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1316-56-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2244-371-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2244-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2244-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2244-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2328-79-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2328-80-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/2328-311-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2328-85-0x0000000000890000-0x00000000008F7000-memory.dmp

Download

memory/3576-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3576-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3576-128-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3576-139-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3576-134-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/4532-367-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4532-109-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4532-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4532-369-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4640-68-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4640-74-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/4640-66-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4640-310-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4692-96-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4692-384-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4692-383-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4692-90-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/4692-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4692-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4964-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4964-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4964-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4964-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4964-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4964-53-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5576-23-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/5576-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5576-15-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/5576-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5796-370-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5796-122-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/5796-114-0x0000000140000000-0x000000014013E000-memory.dmp

Download