cce7bacba781b20d147dca9501f693c5c73700088ded82bc75cb9b569be9a64b

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
Size 816KB
Sample260922-rr2vasst7m
SHA256 cce7bacba781b20d147dca9501f693c5c73700088ded82bc75cb9b569be9a64b
MD5 27336d9a63aa800e1525ffbfc0dfb466
SHA1 975a6f3e7df99f08fd15d61a7f42dd34169b3d1a
SHA512 c33a4d9803be35ddb7705b8a3705f63fc19291fbb30b9de803a8616363c1fec0990e017c84670a0e076b245a54d206fd2bd5b7d28a7969932e9adc4fd5a0d054
SSDEEP 12288:/AmZXuYaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/AhYasqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AC05E06A7A4480F9D0614D308651F66DA326BC19D8134F9B32917EDFFFF29D08E29A31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3004	elevation_service.exe
1068	elevation_service.exe
2668	maintenanceservice.exe
1280	OSE.EXE
2448	PerceptionSimulationService.exe
3148	perfhost.exe
1456	ReFsDedupSvc.exe
2156	SensorDataService.exe
4764	ssh-agent.exe
3972	AgentService.exe
2184	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\837fb5a1b68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000031a5ae679e4add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000ebeffa59e4add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e33229659e4add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3004	elevation_service.exe
3004	elevation_service.exe
3004	elevation_service.exe
3004	elevation_service.exe
3004	elevation_service.exe
3004	elevation_service.exe
3004	elevation_service.exe
1068	elevation_service.exe
1068	elevation_service.exe
1068	elevation_service.exe
1068	elevation_service.exe
1068	elevation_service.exe
1068	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5564	2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
Token: SeAssignPrimaryTokenPrivilege	3972	AgentService.exe
Token: SeBackupPrivilege	1456	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1456	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1456	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1456	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1456	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1456	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1456	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1456	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1456	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1456	ReFsDedupSvc.exe
Token: 33	2184	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2184	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2184	SearchIndexer.exe
Token: SeDebugPrivilege	3004	elevation_service.exe
Token: SeDebugPrivilege	1068	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 3488	2184	SearchIndexer.exe	100
PID 2184 wrote to memory of 2384	2184	SearchIndexer.exe	101
PID 2184 wrote to memory of 4644	2184	SearchIndexer.exe	102
PID 2184 wrote to memory of 1352	2184	SearchIndexer.exe	103
PID 2184 wrote to memory of 3044	2184	SearchIndexer.exe	105
PID 2184 wrote to memory of 4996	2184	SearchIndexer.exe	106
PID 2184 wrote to memory of 2612	2184	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-21_27336d9a63aa800e1525ffbfc0dfb466_icedid.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5564

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1068

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2668

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1280

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2448

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3148

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1456

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2156

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4764

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3972

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3488
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2384
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2452 2456 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4644
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1680 1676 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1352
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3044
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1680 1676 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4996
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2452 2456 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8323d6a5facb2434ad5c33c6d8625dc1c33ba2d48d2ce79f0fe8cab861a12a21
MD5 faedb0163cbde2efe6aa7e2623633f96
SHA1 22b41924feeefb440cfa143097668367d27dd63a
SHA512 a436af255333222f4f2eb8b043c8d4a70165155323c44a6db13f8bd0a8a1487db66ccbf55837fc54136eac0796de3088749edaa89b993ee9224f17a9f8e1315b
SSDEEP 49152:mb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnmDmg27RnWGj:Y3q6sjBdD527BWG
TLSH
T1A2D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 51f5827d4b956c0af8fd6ef61b890f6763e3a504f08941dcf5bb703c5b34c975
MD5 dbdbd26c5d3623f19f0bd3b0f47928b0
SHA1 f7eac21afd5d64ca2568d3cb697b35e836b748e9
SHA512 f1ea621af83e6c70abb0d34593fad7af746fa5ffb712bd1fddfa4f99e0406d526da56704c97f90287f3a8acddd2d4d6217991bc35aa4b9392c81b8f404c990c2
SSDEEP 24576:NXYfDtczAVsqjnhMgeiCl7G0nehbGZpbD:YtcsDmg27RnWGj
TLSH
T190050129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 cdc93d8c465fb6448aeabe95d62e84ea33b3e96a6758602fa7e5a1a27cd9c553
MD5 efaa597fa3d1dbc1154972ff94205ac6
SHA1 1e0427dd753ebc7adc6f01123bf1d2dcf195bbbd
SHA512 2ba8f1b94c229cbccf9ee575fafa6e58b56119968f8943cbf200dab820f2776a464ac8b8fafc21a4f1e54c2ca6d708d705aea327112c74c76a04b2176c458ccc
SSDEEP 24576:+0Le5ji0hmxxrMKsqjnhMgeiCl7G0nehbGZpbD:+Pji0AjzDmg27RnWGj
TLSH
T158359E26F6748335D073C0B9C5D2A68EED723086573089CB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5eea0bcf74f5f25d2e43dea27a9f9af0c727e41f15a9ebca5a42c285af08372b
MD5 03bf1a9dc1c6d30e701bf6cf9c59a7f1
SHA1 70add3f19906262b8ffe29fa49690f5e92a92f9a
SHA512 63d1ea4658e65443a954f8c3e6f353eb085a30614d279d8ada60ca300a7f44458f7354f4eb53e2761102d4f335a2821f60e5e9b46a98b96cfd71829c4de874bb
SSDEEP 24576:Pa7/ezSC6vUyD/aqgrvWn6q8wyugsqjnhMgeiCl7G0nehbGZpbD:C/ezSC6vUzPveHjyfDmg27RnWGj
TLSH
T16C755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b37f0a7d17c68fccb7765584798890e5f64f7f8d1b22dec8323e3607a7fed553
MD5 725bb684addace939917d1d44b687ac1
SHA1 0b8d4ecae781600bb4e87c11aa35a7be2ea09d96
SHA512 a28f84ab3ffb68155c9515a43c1d19c8e7a6618b60ad5764e102e9a4831eb04b0e8eaf0d81d455ea897b6a64d5ba079a7243f5cd373f5949ef2c13c7ab5386c7
SSDEEP 24576:kVbqPb88hv/l+YJsqjnhMgeiCl7G0nehbGZpbD:kVO88hXl+kDmg27RnWGj
TLSH
T1E1559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 20926677f5af950ab53e273679cbc97532a08f18b91f61b870b642a92700ee7d
MD5 5d9625c3d2aba40fcadec3becb9884f2
SHA1 7895c9276c1e0d905540a04088369e2ba9609a28
SHA512 52f2f8958890f4578a21412f92a436fb23ea63ebcb4a5413608cb9e8c0af068685f17d9b58401ee1e1bee0be54920e5909c83e2e537c7e755e6cbc681a961d7d
SSDEEP 12288:dLeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:dLesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F7C423BF964C50CAEB7608B5C3E9F11EAC137E56982008536A637DFEE5B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 9342182953dea97c26b650a22aeaf7154188ab92774a9d163f30d85cb0cede6b
MD5 1dedf403ca41f80ccea3c1012719e5b3
SHA1 228046b9084f18509062ee188402abd28ceb8cba
SHA512 107fab85185c9493e3e5efe0ff6160bac9eadb17f64671bb15a8fc5bf261c9dc18487afa82d5cccd1ed656f50d7ec86afd4f6bd441f8dd8c2ce154114bd62547
SSDEEP 12288:weBNUbTVO86URXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:wJIURsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F005CF7BEE28FCD2C27A8DB85791C600E76278314F6193CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e54075651443347944e15f515ec6e89dcfc35cb9ed81f09f8ae2690962ad800e
MD5 d2bd368bc6057a295010db377e862e89
SHA1 8e16a2e0b5f6fbff77843a507466d99bf86c7eed
SHA512 7dfab3ed11b050a2804dd174de47744aa1bf297e2d480a2e6508488a36bf5a5f7882b51b1de362f02c54b819e6aadff8a0b3c650e9d22bdcf3942e288577d361
SSDEEP 49152:wQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THg:wQvGAdlCEL8c/DRNw5CMD527BWG
TLSH
T180266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 4f2bce6cd98bd0bc6a68152ec14123383c825faa30a9d26b4e62e8d793b72f7c
MD5 9f0be2c356b9df7b46e5c0bc81a77e63
SHA1 568c088d1f5b998ad8ee583b62fa2c03bd184ed4
SHA512 28578bae00a3bd4f2f463b0eb1230c457812c71c2abe4f5272a3638311e7865e865a59f1e94949a660b1c13583ea196f04acac84380b1a4de7e4d1e14a9cbb1b
SSDEEP 12288:8AwSfxL/2Dc3RDLLmt0LDQewsAj/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:h0ewsAj/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16515E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 410412d5aecce3eb0220df55ffd6c047dd98425a69f84c08679b0c1c89a21b00
MD5 7de1f399433edba22ffbb2c2c929935f
SHA1 a9709746791fe8421c41ca6992a224296ac5724f
SHA512 01b25905182aa8d9040d17bf44fb07d620a55ebc87fb77dab5713e79168ad85ef0a36d212f5f165056e03f99a4fa26f2d4ec4f3429675f229914979f7f2ce04f
SSDEEP 196608:/UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHrVQBWG:/UEtQevvqc2W1cpV2tI32CB
TLSH
T170474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ea81a26066e631342ce2a7f46aac580beb07948abb9e382159a85b63cda588a2
MD5 c3c4655a634fdae345670d401da4e5d2
SHA1 ad3306caf3b34bc7f3f9d6d7a587f87e7519fd84
SHA512 eb39f225082cd8f876e3bb6aafdba35e63e16318728737d68efb15fa4b0a43b25e7cfe2e6ef85eef28cd670d5173a92b1229b81739294c46cf30ca76ec227517
SSDEEP 49152:aCbRquA/m2yL5zTfFiV+XenmE3/zDDmg27RnWGj:voquVjnmoD527BWG
TLSH
T175D58D1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 62e6a2b5e73505ea3e6db9142ffef667bf5a8937e4c8454d1f442102f021157b
MD5 98094d87e276372cb4994d765ae5fa40
SHA1 b7dddb28939d1eec1c0300031dfab1cf5c9d2909
SHA512 7f526ed78bcb17ec2a97d375a5848721b4fdde22cc0d89dafd08e37cf289ea95a5a0dacca308f3e5c7e166b57af1c1eb29ef8b56f93210fd14bfa1be3f5f6384
SSDEEP 24576:DAhGL3IFoiwtA5l7S53csqjnhMgeiCl7G0nehbGZpbD:DAMUFoiq5YDmg27RnWGj
TLSH
T1DA359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 7bf426b3ace27d1be85c70db755432b1b266b73eb50c942e44f4929c6b4c916a
MD5 7cb359af7a16216b48b078cc4d41312f
SHA1 161a1c4d959c79a693907f8ffcb2da3f66b748f2
SHA512 99839c25ef64c10ca6c04d38e8228f9999c72704c9d47ea8372d24aec3d7284ea1bbb78ea9f730bbca4f9352877ecb6967dc2cc01da5153c5b6d62f8e0213a35
SSDEEP 12288:vmw5HEjsChNVBFgl0WDm+CAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:Owu4OWLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10005F15A76A80CF9E9674139C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 d8b6e05cb7162b593d042843dbe30b2e914200698f5617956e01c2eaa2cc910d
MD5 bc8421f559d2e00596b1315d37d2b025
SHA1 fdd3282fe2aa6be6c10508b121ee93b3b14fa11d
SHA512 0c0289e4b03e5083226362cc0245eda51d24dee0839572343e4a7656c6c3be5d91306e143333d5479e09c84a7bfe9cb354588e56b97de50c6ca8892cf8bb893e
SSDEEP 12288:KeZ1IyvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HZuSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T184E412AA239820FAE163417CC5E5D609E7333C62673043CF166659AA6F73AD44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ead0b7941161ccd4b4be366d7126dfd83eb895cb00dd8baac37bf0753da96215
MD5 a5fd06d854732fbfc487746e4630f5d9
SHA1 6da674b9c6d61e27a9ba77f0a67da2c26da28d7a
SHA512 8301b1e5ff78fedae86fddd2166817fccbd12da1d49baba5229e1d212e6a602f8a2807547ffc0fc77dc9c84b80837c0806320acd08f5ab4165dbe3cc8c207682
SSDEEP 98304:rQRQyi36YOcPbLvw2gAf+PN3BD527BWG:aQyiKa/X+PNRVQBWG
TLSH
T1C7667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 59227caa9329ad4fa7f44a167a6f61e0ca93b4210597de3d8d873aefd146df1e
MD5 8ffb80fbf4315b955ecbad17b670809d
SHA1 f05fe903978cc7a39ce4bd83b4e68d7bf83361fd
SHA512 bd5c63b63c663596d397b975147f0279fd92c21755bed6c30e78c84a50cbe8a0bf32125f974cf3b861941e5e9c233d1bf603eba1c48e02b8f4fffb8141924b39
SSDEEP 98304:9QRQyi36YOcPbLvw2gAf+PN3BD527BWG:0QyiKa/X+PNRVQBWG
TLSH
T10E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8676009106a84dbaf3cdf70a67a80cdfdf9de78f495b5a970aab533eae711816
MD5 cc67b65635eed945d83f7c6384146e44
SHA1 c9fcfd0e990d207ea170dc05c3292232e0f6a03d
SHA512 c99f5ddec0dff8e68f46c74c5cd599311fd2c39e07b3b606fed620ecbffa44543c97336021ddf214929d868c5e0eb3915dd7533c345399c284bce5d1193c4322
SSDEEP 24576:ywvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0isqjnhMgeiCl7Ge:M68Qg55nhceWu7PNU3/zDmg27RnWGj
TLSH
T165B55933B2F60099C44DE1769F4A872196D27C758FE0E3DB8511721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 ba5a7577690a5fc70b265601ad8843a2bd1ef34b3b8f7983c5a5ce76291a2d9b
MD5 08d649d9b7e1b32f5070eb96d2818cad
SHA1 4ac4b8261fb11a758df246d4aabb937e9ca5cf63
SHA512 b6df4a2dc8b67d7cf45a8584af0b543eab8823ea850b90c1b6d133f4e16acd2f049ece286e7b572c8480ce2a01ea0d520de0cfd5cc8ead3cfe8d13de47fb4003
SSDEEP 98304:2y5112gYy5azzVvt69nLKnhZyD527BWG:nLIHEWhQVQBWG
TLSH
T172167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 525868abf34fb3e56a4f6c8ea5e76b59049d39bc0edb7b911a39b569b8d6e9c8
MD5 ac505ba09cf63b31f8a45f76ff96a625
SHA1 de2c233b0fb614220f19dd85058e692228b6c325
SHA512 ea4077d3c2a3f459e99679724b79497b8fdc0398be3bed025f9a7787e490e6a3ee21238b05246cc90b53cb8a189d55ea32e42387ec2da759673837f5e5cee11e
SSDEEP 49152:uB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glZDmg27RnWGj:8u6Jmdxd2dZD527BWG
TLSH
T172D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 039280186979aa539515452aed6ab0c6cb7f4000ef9c0676f8471e5ee1e177e7
MD5 c96a82ffb8fa568a224ecc89cacb8f58
SHA1 85a7423eaafa711698ac43657d0495d9e415b835
SHA512 f77f68b8e2cdf3958afc983194c7dc8b551195b9adaad0d9e82550e4fc05defede8a32f9b6418856a28464bd2f8fff550d57868293575d4c4bfaabc0894bb83c
SSDEEP 49152:51hpsNoJpF1A63U44CwH7R4xFDmg27RnWGj:5mifPWRoD527BWG
TLSH
T197B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f5bc61431f1b1b7ffe406d9215aeb72c5fc590d2c3fa1f4e95bb9a32dc8fd4d0
MD5 422fecbaf75f75bfbc964977838d4e68
SHA1 08514ecc266097e0a3284781318510f15efefbaa
SHA512 cc5605fb524a5c788c417fa3f2bddf1c449ca45b360ec2a2b9f19c68fa8a1df906c293a3f1d951216fc976fd3cdd24cd215f46499f81ab614748d5801f3a66a6
SSDEEP 49152:nSuZQIY0Be2KcRVtOnks6NMHqWDmg27RnWGj:95dKii61WD527BWG
TLSH
T12FC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2c48e3bfd97f3eb5cfa76d591293e1e7b0fbb84360971f062aedb511304a3068
MD5 e90a9731e03b5cd9d0e80a5f80fd03ce
SHA1 09892480580f8d6881221b45a93e382bdf78715f
SHA512 fd268aea4731831d8fc5365338e4a979f90a68e86dd0fb28f3dac608abd0322c01546c8f8aef2aa58de59d773db56ef234c3faeaf96b730f17af27f600bf7f07
SSDEEP 49152:jhtSn8EApI0fig3giDn0AP5wJDmg27RnWGj:CX2imphUD527BWG
TLSH
T10695BE13F2D900E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 bdfcf93fa672b8eb0aa552f71d715b5eb89ff7880eeb90244feb5b9bf07193ce
MD5 cbf91dc89c638d26dfc5cf284f96f15b
SHA1 f46ea4e71899394fa5b49c8c2df506d849e99595
SHA512 1f9e1fc1cb7e57e31e92cca1c83d6e08e8210f30dc0d04345e90739b97e7abc65e95f485790190ed9ff269e3f8d96ca5d8379ef785472a30c6ac14fdbb0f34dc
SSDEEP 12288:gGXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gGsqjnhMgeiCl7G0nehbGZpbD
TLSH
T148C423BE964C41CAE52644B5C3E5F14DAC073E5BE92004937A9B7CBEF7B28584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 24a627440213e3ee96294edbc207dda501a059dd3cb2990e3cc0f6b6358675c8
MD5 5faf12a082e30cecf066886f96e168ea
SHA1 7687c9fa7c6eb8583e073d4bafd80276a4a16248
SHA512 565818d00e3a70e48fa3b20f5c30ba970ff15f1cfa4b6b42e0437d6cd4d8a77c0d3f567b06df6ffb9036b3577bc9ed6f114914c1c5adc7d2bcc302a7106fc942
SSDEEP 12288:KDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10EC423BE964C41CAE52644B5C3E9F14DAC073E5BE92004937A9B7CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 f5040bf3248825e875b9f7d871ffc52f4c2f5f86f46338f03877baae67bde71c
MD5 693cea3a04285f7e26bd184973b3719d
SHA1 ca4581e2bb079e288d0ac6371a67418e401760d8
SHA512 9aee6499eefca2fbaedab23dcb0e30578a2a1fb68c19748b3ab9bff9f992e201c6d9bcc41c4482b20b8683e5dd4d2d9fffa0b4120e318d1accad9279cfd66c98
SSDEEP 12288:zZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18FC423BE964C41CAE52644B5C3E5F14DAC173E5BE9200483BA9B7CBEF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 f3732d110e2dc76c19f63d8332cccc7a37f43eb58449ebf40d374de731bbf920
MD5 0057f5b7e0ba880083e9372c2e8970f9
SHA1 eef99abe562109d0973ceca996505c072f55a4a4
SHA512 d719fc3c2df1519bc1269e30b43a4423137bf07f79e04591ca9bab7f6f8b669ad01b2598eb580e7db9b55a639bc0c7fbdb93be02fd6ad6ed196ba6f30048b248
SSDEEP 12288:+V8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vsqjnhMgeiCl7G0nehbGZpbD
TLSH
T113D4237F675C00CAD83685B4C2F5E11DE8237D96EB30059B6B532CAE5FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 ab6885d9d78561b60a07de85a95035b83ecdf600a78b7cee1704ddb55591f628
MD5 a10fa547d1ee96d10f49307f04ff45d8
SHA1 823443fa2e1234e4fd88178ce3598942d9268f3c
SHA512 a1f30956b4b8b3d3bfb8aa0cfbcff954e96fc07b936ca7bb9ad003f830f6d51b3b4875b1c0cee89e30cbc3f55e1e3386010929702a0e04359788dab86ae5ec2b
SSDEEP 12288:zUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11CC423BE964C41CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBEF7B24584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 c8da521170be790f7192c3326fa098a714b7cc3e3a42430a1da147a9ed93f895
MD5 26031bde7d5663125df8932cc1300a8c
SHA1 090ddd2172dc5e760756be5964c60963c230a839
SHA512 49c6206e970c1fffc7ecb0f54fc5ccf843b639d8af4f74a2d9bc45b973b97d2d167fe01267c2574919fb0c8e328070f832b9fa04c1109e74a29a3160728550cc
SSDEEP 12288:WHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:WHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T190C423BE964C41CBE52644B5C3E5F14DAC073E6BE92004937A9B7CBAF7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 5c648be729806d8918e1703f40ae773724b0d9ed606bf18ef028f17709ecfa32
MD5 2ee99197e9e4f2f68bd72115fb81ca0d
SHA1 c2829c2a7da83f92590953663e6ae5ded3c703d8
SHA512 d92d255a92a5aa915b656f331d68682d5ec1a6bc7fceac8b18967c8214b405a72d29b5710e175f1b39aeac0f5897af3a956cb16254d1cd67205afc5878aba6cf
SSDEEP 12288:2bXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2bsqjnhMgeiCl7G0nehbGZpbD
TLSH
T183C423BE964C41CAE62644B5C3E5F15DAC073E5BE9200483BA5B7CBAF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 d0afeb03544beb5df4a88bab6cce5e38e0b058ace67ffb259b007c8327b9c2d7
MD5 74150c86642158a346de7d7496182ca0
SHA1 83aa5237ceb2fbaf7b0e8c6b691478888823b70f
SHA512 5d0a697a5490d81c52cbf78cdf984e015aab472d924f4047decde99efeed4f28fce54e02f99dbc61153d55902a6a2a3346a1fab62ee523c6616114ff5ae5cb39
SSDEEP 24576:aZMRzFVSOjsqjnhMgeiCl7G0nehbGZpbD:aZMRzfLDmg27RnWGj
TLSH
T19D0501A9B39018F8EC67813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 3f53782fd0075e56d2ec1efaebb65a33412370800f245257809725330ff1d946
MD5 ecc94af89c1eeccd9a985fcc97c28437
SHA1 4e3499e7fedf091010e93f77dd9a7476ca39ebd4
SHA512 57b2cec49a489ad392c8ca0504e370b84027de80384f22f7081986502bb1d9e36837d12c2826aef26575b63df216b9313cbf6cd7b69d31fbc0188f0d38c4e0ac
SSDEEP 12288:uCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19DC423BF965C41CAE52604B5C3E5F14DAC173E5BE9200483BA9B7CBEF6B18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 bbad8a502d9d210bfbdb54f7ca6ae509ebe42575be2ca96cc1fd5eca25883d10
MD5 90fb2f031a37e7ff35d19d30208fbaef
SHA1 6bde73cd8047b869f671fdbeaf69dec0642ceca3
SHA512 2e4c6efbc1ee0ab208a3eaa78ea926fc61e2cb4f5d4cca5c37829c1f219ceafa4d4929b625c196c81208f35d4786c97573fcc13387a585fe481268f25bfdcae2
SSDEEP 12288:AOXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AOsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16DC423BF964C41CAE62644B5C3E9F14DAC173E5BE9200483BA5B7CBAF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 1b8f3aad150445fe41982a043f148d757da411ac58a6a877f002da4dfbd1a38d
MD5 fdfac325d6425d072099595d9bdfd217
SHA1 eaf0c7a1ae92e503e29cbc3b547be16533961f4b
SHA512 adc0e19990a015eca03ffa999d3ce829f7c163ea41921e00e0542502e8b150bf319200479161aeee101cf330dbd837f8a33c60698e0769a94d6e42d7d2f417a7
SSDEEP 12288:tyPz5L8vXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:EzyvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DCF4025B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 54cf09e7597257a8e6cdc53c4389ee0de07aa54444b52374fa479e2ea4f50d84
MD5 afcff3a0543104def230c13e800fc947
SHA1 ee105a790161fef3d84735c84798a7b29ec0928a
SHA512 2c973091c5873d34e24683b0056a901e63044de880f929174469e274f552e72732077f26e56d05ed8d95d12134a56cb0c0d3aada94ffd44d9347a498c65a4480
SSDEEP 12288:iCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11BC423BF964C51CAE52604B5C3E9F14DAC173E5BE9200483BA9B7CBDF7B18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 de8c842ce3e64f4a5762cb6a8908b85afbb4a3e2b7cbc31de90238f52780fb7d
MD5 206e1adbf5bcf6b117ba6636c6a713d6
SHA1 a30ac1278dd4b3548c37a36b47b38209e69fea8e
SHA512 284823d9e1f5f2aa3bd58a252005fc8e8aba12a71293896c5e142125a82036c01d99bd3108f96df07f741fa6485bf2b2b954bbeaf5e1b1bfc61ddf7bedd3c0ec
SSDEEP 12288:VCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1CDC423BF965C51CAE52604B5C3E5F14DAC073E5BE9200483BA9B7CBDF7B24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 34e548ef8e1caf89e865cf2541ebf27df70dc272819089499718b70ee764461f
MD5 d5d27c192e6999021cb73f00ded7b24c
SHA1 66f9b947cd45843c7af2b6a00129e16438783d58
SHA512 0322a3442d1d985d668b4872f87b90cab3a500fd03c77531fd2d4d9172c7fb27035e589b4cd45de16c225d985b7f1488ebf76117329ec45d63217558b1b3259a
SSDEEP 12288:0yPz5L8vXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:tzyvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T167F4025B73A530F9D1378178C5A29A06F7327C3647204A9F17A416BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 797b05ab90f3a7e6dc268ac9c541371a5d788312e9afa94a5b2e2fd31840dc05
MD5 4c4dd35baca650cc0c6831e90346593f
SHA1 988e38ca143d9b324ad744ceb99d8bd204e2a0b7
SHA512 01b154c12a13a00cd5a9c9dbde8bee78a14dedeac8bef746f06fe378ed99864d35d1f73e7f165a478c533d382446d69adaa31bf04d3e3d2a348bfeec0788d04e
SSDEEP 24576:bTDaLl3z0zDpsqjnhMgeiCl7G0nehbGZpbD:bTuLljcDmg27RnWGj
TLSH
T1D60501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 1c348f80bf83c30845918a4b5a9712f97931b35736d797b7eb51b2d5805362a3
MD5 d3f9eb9c5629975366264cce8c0d8800
SHA1 f63af827bb7c6e8e6fc8b7a7f8828ca3b5d26480
SHA512 7f9641a5e93b190c07580c73c7195aacf67a9e0e1f9fc23b8a3b5350914b486f942effb1e3b15b8589ad606cc912dd95adfb216e5da6dfe67eb806e1d40300cc
SSDEEP 24576:73vd9CHKy7GZ9sqjnhMgeiCl7G0nehbGZpbD:bvd9CHKyaLDmg27RnWGj
TLSH
T1B625CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 da235cd451e830bcd11aed290d7bcfaa4e4cbd0524a7bc5eecd2827f22ae32b3
MD5 1f2ef284de4fd3be547e477857345878
SHA1 ad55d3ab1de9eda26db3cc9c4c33129e428c1c3f
SHA512 fff94deae905113de2bbb6aaec6f2a1d6cd97a23af44480f1179437f4d942a05f0523c00d6cdce5ca320bc5f164f272d4f17e2b479972f5975a3f4501468e250
SSDEEP 12288:N5Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:N5sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FBC423BE954C41CAE52604B5C3E9F14DAC073E5BE9200493BA9B7CBDF7B24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 2a7026d3451e8fbb480ee275bb12e59ba7c0564a77f4e309528b4019fe2a2c13
MD5 ecd661ffe56e72304afecc42dd841dde
SHA1 900ebbd8f62dbba4e0e7c3134777b03440b99ebb
SHA512 21f2ce339e0762a5fce494c90538bd7cc892a74babb2009e7d8670789c8b83cc66e60f1b998c738a791c1e74d35173a45970c314f8a0da90ff83c258d0b18e3c
SSDEEP 12288:xPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:xPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B9C423BE965C41CBE52644F5C3E9E10DAC073E5BE92004837A977CBAE7B18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 7ba15e96b5146c65d1cc82e08b09850fa76367fc7685f717edc2358e28f68021
MD5 8127d2a5b361155457aa6a927c93ba08
SHA1 97841f00311e27056b75e41f26fbccc576f2dd0b
SHA512 15620eac290528bb5d2d617ef0d6d9594be8c5bf99caf80e84314b0fdf0c3fbb151f5c9fd06e586150192f0f35a55b08a90485fd7591c4b0d5c8b3cca2d06515
SSDEEP 12288:9YXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9YsqjnhMgeiCl7G0nehbGZpbD
TLSH
T140C423BE954C41CAE52644B5C3E9F14DAC173E5BE9200483BA9B7CBDFBB18584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 99220da4b6081716022c10d525831218f5c1c4ae523381bad0132ab6270d9ed5
MD5 b9bb7cb0698b4b3f1c25464a16f19400
SHA1 c25479a0d3671740c980433ee4ddb20dc9197b0e
SHA512 8c0e62c0c9b67b6dd42ae9eb74908a531c18efa43fafce93c78e840f99c6f4857d8b0176d36c11847b1810d8517b73532d6d2f9e331fd94b618a308bc99c65d8
SSDEEP 12288:5CXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5CsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17FC423BF964C41CAE62644B5C3E5F14DAC073E5BE9200483BA9B7CBDF6B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 a0e0e197638e54eb0c8c3dcb41571c0c83a17b7adff8e98dae5db22704b9f490
MD5 7513e01ebd5376244dbf2756fd2f473e
SHA1 7eec1e021ed0680428f4cb6e0a7a1102e9198c3f
SHA512 7e4007794766a4a38320c140eccc10d4a125c265fed12057ae166912eaab2b7a86a38c4518ef314f92a78dbd2c5f4051272176d16ec89816ec9df5d2d4038b64
SSDEEP 12288:35Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:35sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E4C423BE964C41CAE52644B5C3E5F14DAC073E5BE9200493BA9B7CBDF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 8b93d63c0be29b91857079f941da02e860729bd515df05582e415637bdddd8fb
MD5 3ddadb83c2564225bc59f22895b8920c
SHA1 97a91a38d3acc44ba134c7276640d8b716a1edb3
SHA512 b93c9bcea88efa3e1180953b6dcf8943ce32477bd17b4b89a90d7d9e731fda12376573b688867e4c8fe24aaf8b803fadc562b2f8f7254237b8fb5ebc6807b7bc
SSDEEP 12288:baXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:basqjnhMgeiCl7G0nehbGZpbD
TLSH
T150C423BE964C41CAE52644B5C3E5F11DAC073E5BE9200493BA577CBEF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 d019f368c8a7ded6248b642b340917360e0449e848e5bd2182e854ba82bbe085
MD5 c49fd36543237c8c04d80b71d58422b2
SHA1 3d3dcee864f8c0e96732fe5ffa1936d425588882
SHA512 9de6e10e6fdc407403f372db9c7954320c48034b0b88ab9f98fd6e4b80d2db0fa6e1ea9587f0d009b78c68e26e00a728fab89e19256d95f2d230f08813aa9549
SSDEEP 12288:hUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B6C423BE954C41CAE52644B5C3E5F14DAC073E5BE9200483BA9B7CBEF7B24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 210f68e322eb4ab56db84e6fad412fc34b9776e4c99e28bc973488fa0004ee2e
MD5 43146ef9f219eb3142a4c07f28e43b33
SHA1 821dbedf883d33dd479678f5dc0ebeda1aa60ea4
SHA512 6dc265012fc6322fe0b2eb38de6f989b29c03e2df0b301514d9908eba473496c79283c7e5cc9801353be393e48e6ab669a661e978b0f565687e7c8dc923b8a4e
SSDEEP 12288:+BXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+BsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12EC423BE964C41CAE52644B5C3E9E11DAC073E5BE9200493BA577CBEF7B14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 9082f9c7c2507bdc3eb0b09be69d88981881efcec21b920d737400cc6be0656c
MD5 5bf86a51073a7b151080002a119f4911
SHA1 2c9f5b7e9d4173db9f55fdd26b3ad4029e850cdb
SHA512 96005062c5478cb93992886bff42f79a0e707924bc57c75324210d1e0462d9cb7c318af91a2ca5ec63a43d6cfba52aa77af001dbad8aeee4d111089e5b0378be
SSDEEP 12288:XUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19AC423BE954C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBEF7B14584B38467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 e80a242889f2dddb12237e05ae10243730ec7295a9db8c71abd155c39af7e041
MD5 749a9556f885871bc3b737641dcb4abd
SHA1 cbdf60e9f7b82f53f2220e6a2617f45a9d1f74a6
SHA512 b91f4e1841a203cb61223b1ca6d5f9b2e5ed2e2e1e4f67fa248fd0b2b2ee2f67f9f3ddb069977da08f439366e58ef286631d87413efe06c12dff12c2ae677f5f
SSDEEP 24576:CfwvUk9RX6wkyAI+sqjnhMgeiCl7G0nehbGZpbD:SMnYISDmg27RnWGj
TLSH
T17635D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 252e09225f8e1daf226d83c0913ba4ae3bfe1231c7e3580781b1d57f247b89eb
MD5 6f24295933152aa0200e3b4d90c8975f
SHA1 cdda55b38236896558187af690093464c3139beb
SHA512 06831274b87779dd4b6907a12a77efd822f71c00cbe7c03b9038d6dee0cfdd4e8a6610e2052e5bbb249db63ec3bca02437651d703b01a48cd945e1b485bf4e58
SSDEEP 49152:cYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0pDmg27RnWGj:bySzPhD527BWG
TLSH
T1BF066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 b595a2d8cec6371e66a01ed9eeb573b8bc2d2a585f07154a5e07c05190c84281
MD5 1065db3a4ae328d3f365e4cd6c542d46
SHA1 5d883f7e3bcbeaa1c49ce32cb3f55375e32be683
SHA512 b5bb8859b5c420aadb1d9ce4d610049c2afc32371b572ba96e4722d8d0e7fc3ca0cd5e78f6fb011bb2a94bd08e57eba7fa4940e273f883953eb1989b0ca04ff8
SSDEEP 24576:D47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYTsqjnhMgeiCl7G0nehbGZpbD:D47JUQjTirIhCnDHUPfF/ZDmg27RnWGj
TLSH
T1DF65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF2270437D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 58e2d6149c4b2520b8019e0448560a8c0a8c8a8b9b4287cfc266581558e0778b
MD5 e308d73692278e7ae69c7d2af28d9947
SHA1 5cfd3d52e40aae15e0f315ac852d0ec314506775
SHA512 7973700e4a7eae6b9e1530e27d674e57bc8ccdc97afa7f9c0e55213d0b403b113eedeb831c31291efb1bbd04ee3565fbbf7e76708961df6d32ce1730bb17e8bf
SSDEEP 12288:kbsfSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:bSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T106E4011AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 8911e8ab3000f42d4b1991a1cdc02d627eab97acf651f6b02887af3b0bf2e155
MD5 1b244735feb3752d3c56632aa9364ad5
SHA1 769b1cd0818b2f8c9572021a0a048dc42bc4a548
SHA512 012b0b7e0021f2308d6e8062bf6abb0a6bd9e4b9661d55d4fb672895a72ecd37ac397d6784f9d7d0271546213501d8779348ab53eff2a65aefb746ef23199d91
SSDEEP 12288:7sN+kUP4Cb/VS24lb0VcqoCOo7xN5Rl9+TuX9wF:7N9vbInb0VcqojoNN579+Tqg
TLSH
T1FD4517017666CB8FC6A980325E32D1CCAB707D15EE04AF0773C9873F9576659BAF2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 924eecdd587f2cc18853bc597a31af9f0d5afeddf2f1d32064aa2e0d5fc6f7ed
MD5 7b084b33c1313cdf3c5129b0bf98b7f1
SHA1 8e34ff81b5778b5d9ff8c0705d227ba3536fc551
SHA512 9c6956863363914a90e1d4b31c616302df6b5933865781c43deced83e3a9919a3b2bd76a4f1eeb64c40775759e3ee721ec0a121954dd3f5d6c7415fe49a6dc91
SSDEEP 12288:snXt1zU1oDusaabWetqMJ71j8yOv6IudI83Tgl4eF:sd1zUzsaayetXNEtF
TLSH
T1C6751941A136E78FD1B65032072A5B8CBB78EC17B7496F16B3C9043AD86A755B0F93C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 3ceb31102d5ef5a80de122a9119922f37cfe0a3370621dced18d70be6e8d9a71
MD5 47d3c4310a0583f69b9885d8ec58390e
SHA1 6f403fdee4603543112769c32d466a919b5a750a
SHA512 7f99098370ffa1046c3e3c052752c9f5396c6ae53313fb3b5962f0275fdff6459077264850a3b71d84d76f2b87ec65241fa63e577199e6d95d1e14481cbe75ee
SSDEEP 12288:807qXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1D3D4237B934C518AE93605B482E9E12DB80B7E669F1044C3B94778FEF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 88cec88df7f700d52f3bbdc345168a3a9281e5486da110d921485fe2ed061616
MD5 8997b596c93b9d06a811f93a121edb1f
SHA1 81a0aae5680e35cf7d4c61053c44d9472a3ca310
SHA512 7f238df13f26c3dd2c42ce3750d684dabde0ff442499cd322c54ba5ca5ecea68735a33550c93455d6f2f18a701b8b3c6162b677ccd318d4651d2ccc119981936
SSDEEP 24576:Tgb6bmBIi49WNNFpg1rSvFv7bYgsqjnhMgeiCl7G0nehbGZpbD:Tgb4mBIBhGFXDmg27RnWGj
TLSH
T10E659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 d48edf6c6b57daf94be3679e47482952628c906ef021666ab077db83cc7eb42f
MD5 2c28c1c1af8f716668ea00aa93370ecd
SHA1 14823b95a254d3af07e3ff1a6ecc412574bbf9e0
SHA512 00267e5e1160f8d25fb631ce8f57d7850985ac1dff4fe2a093a130e80da594334d0b8aab590ac1f0a1815aeeddfc41adcfada8ea1aa334ceae08a1742bea9a16
SSDEEP 24576:8G88u8FpJqH1bzria7/mjsqjnhMgeiCl7G0nehbGZpbD:/7ZFPqVea7/kDmg27RnWGj
TLSH
T1B835016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 35393aae2b496be83200333e0db14e96f08870e9b2eeab17f09faca83aba1539
MD5 76abc39c232893934b30fbcdbda07d45
SHA1 9cad2d502f1c4647a4af8638df02ceb627d11829
SHA512 cc08055cb7bed18b2cc73598014881a11830a2312be6a457a14c1471bbf97377ff4ac65ccf9e81b7706555fb05513b1427b20611862c227e2d4af197ca6b9305
SSDEEP 49152:2BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjbDmg27RnWGj:ZG05lO43b6D527BWG
TLSH
T18CD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fd1f4730a008dd9ae4b9c699561a0ed5d19407f2c3c406943fea89bb65391fc0
MD5 85116297fe075ee49f1765bf4e7ec5b6
SHA1 350db4a0e28b09ab865f2485e4b66373483bdd5b
SHA512 98348976a50e1570e30436b199fb9b61c1ec13182e2301a28c5260d963b74585098cb9d335790d999db619f4c89350c6a74f922949dfc59c9a86ae5d753c3826
SSDEEP 24576:bfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn1sqjnhMgeiCl7G0nehbGZpbD:Da5POZ3BJt2pasx2+mzDmg27RnWGj
TLSH
T12465BF5EA7FC00D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 cfda7ab273a3b4385bc23fb68d349c513dda05c4e6ecd1caf26c835ef23685bd
MD5 b8471dbf35fbc1172e31d8a5be8af907
SHA1 2f9d3e2e3cb2e82670767c83db0413b0544a97dd
SHA512 b56695270d62426ecd22abdc579434e37c14f761301112825551ced6bdb5b5629de244a6770aac92397a7b588119a2ba9ed0ddfdb6f107b3cfb8851a235eefb3
SSDEEP 24576:uNcwHdjbyQ4nLC18lb/EOjowL7FkrsqjnhMgeiCl7G0nehbGZpbD:uNc/zEOVHFEDmg27RnWGj
TLSH
T1D4857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 10d63dffbdf92d0d0a4cc593eef5f5c178db202e39ae127f41d9656285e0ed6e
MD5 7156ced7944916e3dd753455c81e6516
SHA1 845dc46148115c0aaf28727b2cbd53dec852bc4f
SHA512 040533b98ed10995496bcdebc91bb9522cc83e456fcb43b063d6f0a61dd80ac7b4ef38b4a6ebea65f708c0cf2ead163beeda85fc540df2f6c3ed1c194d646942
SSDEEP 24576:1TkNvNnaFeYhJNtmZBmBsqjnhMgeiCl7G0nehbGZpbD:1TMwBtOmVDmg27RnWGj
TLSH
T1D855AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 087f6988cc74776caae93f534ca2652170ff2ce515c0b9b20cafbc361ff0a14d
MD5 3e8e104717d2c7a7ad9f6a864b905992
SHA1 fdec940e1c9cd432ac71ee6061964263e5f0ca83
SHA512 442576293fe94a0ac21401de718e07fe900de7c606be8819de551a6e499da6e307960ce24f68916f3fa3d854dad659c6982e51a084938e65c1b7c4e5ff079728
SSDEEP 12288:AHvUrBFrEjwaQ3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:APUr+NQ3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T12C05F12F62AC18E5E676A17CC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 1d6bc228b3c01e660b3629831d5897e4a9e6a9f9f8498cbf5e28d31b277f6b23
MD5 52eac7def8208e23543673aba1c0ffe2
SHA1 0e415a96e8f824fa0840d624a864428f163c12dc
SHA512 6951535769f0122030718b97c27f165573458fd36a6520ed8ad9cd2cecd3a9091955cc066025507080a08697d70674fd9f724c276810deed52e0ae3bee4616e0
SSDEEP 24576:mD3FHshBIYQgAmsqjnhMgeiCl7G0nehbGZpbD:mDVHeBIAAqDmg27RnWGj
TLSH
T1C925E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1068-103-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1068-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1068-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1068-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1280-51-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1280-52-0x0000000000900000-0x0000000000960000-memory.dmp

Download

memory/1280-301-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/1280-58-0x0000000000900000-0x0000000000960000-memory.dmp

Download

memory/1456-305-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1456-377-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1456-375-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1456-78-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1456-85-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2156-361-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2156-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2156-92-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2156-91-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2156-363-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2156-98-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2184-138-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2184-137-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2184-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2184-364-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2448-62-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2448-64-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2448-302-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2448-70-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2668-40-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/2668-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2668-47-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/2668-118-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/2668-116-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/2668-46-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/3004-23-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/3004-21-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/3004-15-0x00000000008E0000-0x0000000000940000-memory.dmp

Download

memory/3004-90-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3004-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3148-75-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3148-303-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/3972-135-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3972-133-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3972-121-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3972-128-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3972-122-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/4764-112-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4764-106-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4764-325-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/4764-104-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5564-74-0x0000000140000000-0x00000001400D1000-memory.dmp

Download

memory/5564-1-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5564-304-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5564-0-0x0000000140000000-0x00000001400D1000-memory.dmp

Download

memory/5564-309-0x0000000140000000-0x00000001400D1000-memory.dmp

Download

memory/5564-8-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5564-7-0x0000000000740000-0x00000000007A0000-memory.dmp

Download