6b1b3d8c1a433391d6aa7c8a75526ec34a8c852d0848ea878fc8e17a647f44f4

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
Size 1.8MB
Sample260727-xdjdpack4t
SHA256 6b1b3d8c1a433391d6aa7c8a75526ec34a8c852d0848ea878fc8e17a647f44f4
MD5 c1a466ef093f311de16b2f0d943a8dca
SHA1 3d4f6a88f73030940b4ceeab75b387fe8147c3d7
SHA512 16205bae7d419ba08a3e44af8574d152bf1a72cb3b1177ab88dcdfba3a94f4eccb1555af9659471aa7e23de231677116e501ddd60d524ab829943a7041f77d27
SSDEEP 24576:Y0mwBq7Zk0Of5TpmwLt3iRu/ocxwKDJKIe05Qws:Y0mHhOrmwx3lwcx/Kt0F
TLSH
T13995E107F29408F8D05EC279CB669112EA71F8950B70E69F13AD96622E33BA15F3DF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3044	elevation_service.exe
5780	elevation_service.exe
5520	maintenanceservice.exe
2984	OSE.EXE
4144	PerceptionSimulationService.exe
1144	perfhost.exe
4280	ReFsDedupSvc.exe
1560	SensorDataService.exe
5420	ssh-agent.exe
4436	AgentService.exe
4576	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\aebae5d024febf98.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117953\javaws.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c573ff9f71ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000239347f9f71ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001a2996f9f71ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000050f7ef8f71ddd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007467c63df81ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003f7db23df81ddd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000023dd13f7f71ddd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
3044	elevation_service.exe
3044	elevation_service.exe
3044	elevation_service.exe
3044	elevation_service.exe
3044	elevation_service.exe
3044	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
Token: SeBackupPrivilege	4280	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4280	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4280	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4280	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4280	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4280	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4280	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4280	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4280	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4280	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4436	AgentService.exe
Token: 33	4576	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4576	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4576	SearchIndexer.exe
Token: SeDebugPrivilege	4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	4380	2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	3044	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 468	4576	SearchIndexer.exe	100
PID 4576 wrote to memory of 3824	4576	SearchIndexer.exe	101
PID 4576 wrote to memory of 4388	4576	SearchIndexer.exe	102
PID 4576 wrote to memory of 2820	4576	SearchIndexer.exe	103
PID 4576 wrote to memory of 3384	4576	SearchIndexer.exe	107
PID 4576 wrote to memory of 5672	4576	SearchIndexer.exe	108
PID 4576 wrote to memory of 1412	4576	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_c1a466ef093f311de16b2f0d943a8dca_glassworm_icedid_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4380

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3044

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5780

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5520

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2984

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4144

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1144

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4280

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1560

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5420

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4436

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:468
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3824
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 716 2360 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4388
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2568 1764 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2820
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3384
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 716 2360 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5672
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2568 1764 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 bfdf2d141fb04dec017b84f1f7767766a7bd632e3843fe9da1dd6e144688f6e1
MD5 5a505ef98b68f728441d86c7baf3534a
SHA1 d44ba7083f0ae0c2f93f32e3056ff70fb767bb47
SHA512 6a9a76b7a390ccfd5ec0fa92468773ab1d0d8f45140033cc56740661906c295d5a6b3a24fc798d10e7d5bb54ccccd7446d51e57b81e9e85343a3aae13111e810
SSDEEP 49152:2b+632BuPkFKRrdE6ohrstBhuXjfS4LWxnSrmwx3lwcx/Kt0F:o3q60jBJPx3lweSmF
TLSH
T193D58D03F2D900E9E06ED178D7469132EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 91bd823f4b29e49852f452564c4329ddae5fb0bbdd2b6a58b77b650047028b2c
MD5 012b8e0698d62ceeb805eb1cd04b7b13
SHA1 9f0bf955cf7a68a6612d297c5927ced634de2f7d
SHA512 cc5d547eb98c19f13b334babb38dceb92e19d66939b565582698000367d8d5ae3f514609d6dd6019986b57bb0ec8c121afe52182b85ea279170c19348a560d5a
SSDEEP 24576:xXYfDtczABf5TpmwLt3iRu/ocxwKDJKIe05Qws:Utc8rmwx3lwcx/Kt0F
TLSH
T1ED85F12867D408F9ED6B8279C8A2C511EA737C514360E7DF03A4A9691F332D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 45b1562026dca08091842b2082d48dbae261d4bcbaddf0b17e1a87217d481734
MD5 ad55114045823dd3390fd79e784b6d05
SHA1 b7f636fc7319a41d9bf32a4bcf7450b71e53415c
SHA512 98418dd9f1b408067e347736b71e653a94b5c9bc0299a4c10970d6a0e1e97cab1b2f9ed4237d39eacd38aebd61591b3b67937e822893e12798bd70bc60a0e99c
SSDEEP 24576:l0Le5ji0hmxorMKf5TpmwLt3iRu/ocxwKDJKIe05Qws:lPji0AOPrmwx3lwcx/Kt0F
TLSH
T184A59E26F6748331D073C0B9C5D2A69EED71348257308ACB4286D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 60ee5df30e949c3b3759cbb1a07571231b41a09c332bf958e5884ffee2382d3f
MD5 057316221fdd2fcfac27752b2b8d622d
SHA1 2b8b6ee4db9dd1aceba6f53c79ca05b215229f1e
SHA512 f0692a56d69b7c20cf5be9be580a80837728e39295b9cc1177d18f11021225241f0e020f84b82f6685d0b8b246a53020f496fef73dd7b6407679a32dcaed5892
SSDEEP 24576:Ka7/ezSC6vUyD/aqgrvWr6q8wyusf5TpmwLt3iRu/ocxwKDJKIe05Qws:9/ezSC6vUzPviHjyzrmwx3lwcx/Kt0F
TLSH
T1CC756C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9ca6b70f01e00a21334b3df57e239b1febf6bf524173a78010b178a789605700
MD5 70ec0dd895a9da5cb9da285d6841a646
SHA1 21b8dcf4221340977ff791ba8970c080335ece2f
SHA512 363169d87cf28efd9589cc38b73e54b1bd2bf8acd77aaea80fcdc45ec7a4a1c40dc540a057ecb18677cab8a3522fc5132e5243cf029e618ca9d03c174c0b1fa9
SSDEEP 24576:gVbqPb88hv/l+bNf5TpmwLt3iRu/ocxwKDJKIe05Qws:gVO88hXl+prmwx3lwcx/Kt0F
TLSH
T1EB559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 4ea2fcc956a3aaee94b8b6accc014981bd11cb9701b8f1b25ba3181938570920
MD5 d7615db27a0c2ba7624087611d8c5717
SHA1 b00382b480bc28f275315b46aec088b2c73db03c
SHA512 edd2f86cc8da85881240be569b41272ef55acc7519b5f7ed3fed91947bceeeb04703c603af574312ad359c928a442e424e73f30e2be5b4af8bee6fda15f616fe
SSDEEP 12288:KBWYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:KBWf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T1767523295E894560E75E4A73668BC65835B17C3070268EAF7232FCCCAD395F5E93803B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 32130d4e58c695e0708983a85f126072bf3abfc55804c918d591afd90130876e
MD5 f66f875c21096267d9e1b6f0c554dd03
SHA1 3e1bfe6191fde138fe733b9968da791004de78f1
SHA512 4231cdc42b3a0ef7a4165a34042ad4c850c63b701726ef96aa4cc7e3fa2f4636df33c10d4389c8f2977a678bd473ee5eff99e3b66da3463b2f5dd995c22632bd
SSDEEP 24576:8JIUFf5TpmwLt3iRu/ocxwKDJKIe05Qws:8JIUFrmwx3lwcx/Kt0F
TLSH
T12685CF3BAE28FCD1C27E8DB95691C600A77278304B2293CBE175D24EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 04e3f91e3a0f0606d32dcfcd085c1afd2b1af2efe6ff3be78b1122efa065da0d
MD5 b0acf81aa86a8c5597cbb875d08aa8ed
SHA1 30999df382c8ed7146a6598aa16f0d5cc306ca69
SHA512 d4d32060bb5a7ecf73ca3cfd38886de9e4de9592d0a4db9a9252728d079c699695f2c3283f1f52fb95022c5945812e4b0b12482a09b47bcab2aa3132958dbf8a
SSDEEP 49152:3QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THf:3QvGAdlCEL8c/RRNw5CoPx3lweSmF
TLSH
T16C267C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 3860d7dd389fed23f35cd6aad06d76cdc480a601f408432439de02aed73ab320
MD5 d21ea17e34a7abe33a140f39953682f3
SHA1 c9f5624af9d82c79def2970b2e5fbb38aed1ad1d
SHA512 d4dd01854bd722f2f17e8020dd1b87b1333bbf92019d5a7bb3f4339ecb883e881972aaa5dc94dd7d5abd7aee2237f81462ba24d0e2db370ab429511ae8ad3676
SSDEEP 24576:KdewsAj/f5TpmwLt3iRu/ocxwKDJKIe05Qws:6lj/rmwx3lwcx/Kt0F
TLSH
T11595E031FE74E036C37F0DB21B26C71624797D204B621AC7E3A8AD8D59342D26776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 92930fb2553d62d8d7b466970ac3dc863a835de5221dbfbb0ad20b547f5d5450
MD5 6174de13ebfdf08c693bc3daf37f8ea6
SHA1 e4a7eabc3b611ac5d808cdfdefaf4797ce94af20
SHA512 8cb0daafac5c5379c67796921bb500d957c0292baa9259a8a28f05d46f6b0e946d3513557a434c80db8e563845159f83bb092f1e7f5865682a31e851bb4f2694
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHrPvl:jUEtQevvqc2W1cpV2RI32D
TLSH
T162474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 b36c200d512c6eac2e44da5a95978b7dcd95e0984ce0f0115cec10c7215f44b2
MD5 4708334745ff98091de5b48634f3220d
SHA1 8c810ca1c1717c3a40d95280c82fb8841024e323
SHA512 95d49fbc8b16fdb70abca1c536ec716df483115530ac04a6ffa82cd74d649674afb6f56bb80aee4bd06ffa66794cd0c68dc535ef854bda23aaf4a7fdf3d9e414
SSDEEP 49152:MCbRquA/m2yL5zTfFiV+XenmE3/zfrmwx3lwcx/Kt0F:loquVjnm8Px3lweSmF
TLSH
T13DD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 68073a2ff30c9bcb3add7f183154e9362b7a57a1cbf7016b4c716afb0fd9fab2
MD5 5cb8332a148772de651509e975d30d5a
SHA1 eae18dac0006239c0bce1cae1699e96624abc016
SHA512 5139ffa3384252c56bab9401d6cdd0a0391748acbe67c62ca9c29959ca0bba14ebf4c68ddd7b172c5c68018ff7f1d5fb7bf29d381834a175ab3462eb6880339e
SSDEEP 24576:mAhGL2IFoiwtA5l7S53Af5TpmwLt3iRu/ocxwKDJKIe05Qws:mAM1Foiq5Qrmwx3lwcx/Kt0F
TLSH
T15635AE80EBF955D4F5B7AA7899B68170EA72BCA65E31C20F2160D14F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 d55a73d7f1e1186e69b2437d5114f313b57f23b1313c40458288afcba17d4771
MD5 dc76f9bc41188df945c791535ec312a0
SHA1 d5971809576788258ebfef844f4e56bb4350ab0d
SHA512 b9a2ca8832834b0f80ab98471ca8507a16e5b0d3b9c6baf887470fc8ca752a696ecc2ab989684cca661c564b3f705587e3d20593aa2834bd160f46c6f6e8ee50
SSDEEP 24576:BwuoOWTf5TpmwLt3iRu/ocxwKDJKIe05Qws:BwLOErmwx3lwcx/Kt0F
TLSH
T1AB85F14936E40CF9EA6B82398597C135F7F2BC112621DB1F1360D69B6F37261AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 598a92dc2bff39eadb293155008786dbd381d0687597032b7ae794abe276542a
MD5 2ae0e4a032a05b25cd2d68c328db05c8
SHA1 f9d5aa1434a748d1d5c1f7c3be9e27654d9ad049
SHA512 46fc328047187d819ebfc60d6766f35396d78deb18a444f927d24402fba1b7ae67290b260d36e3bd3bef15fb244cfb11b258f8acffd3557decb30f922bdc7820
SSDEEP 24576:hZuCf5TpmwLt3iRu/ocxwKDJKIe05Qws:lrmwx3lwcx/Kt0F
TLSH
T1AC75125926D820F4D36B427AD9E68604E7B27C62233643CF2225B5D96F33AD16D38733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6b90bf8b8e2bdaf2d6158a29decc46d4db1ab9763a56a89ac02928efcee7957a
MD5 a6f685669713fb733420f16641b09736
SHA1 ccd209da41fa5a37dd1f11a5208c328d5f39c958
SHA512 ca8cc03ccb63e19b0df379d6b5f094c54d5a3883554f8715bbbb5715a1d4c30f6a0ae6027b43269f4e281a305e2711a815fadeff8150f6049598089c166ba806
SSDEEP 98304:BQRQyi36YOcPhLvw2gAf+PN3lPx3lweSmF:YQyiKahX+PN1Pvl
TLSH
T1B9667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 62bfe1e8c0043c3358f84572b113864aad8ee395675bb1504b9b3d2d9e92e9e5
MD5 b13a5b6cf456140656477f5f519674d9
SHA1 d76dd7912bcc0ba1aa88790796bed3f99456f334
SHA512 fda53cdbe956333461f6474195399b4eb6791cd5506b30ca7d2b35ebce053fbff35a9fa9c500388b4982e7e3356432e9ceb040c5351dee8b00875616f42bcc33
SSDEEP 98304:nQRQyi36YOcPhLvw2gAf+PN3lPx3lweSmF:2QyiKahX+PN1Pvl
TLSH
T1D2667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6c7b2a04ee9505d4ff3405fe872d8532c82da6a47052c31c26db33c487c7f68c
MD5 457870bb97214907234326451486d01f
SHA1 8447eb61d7f38b1a4ee5a4999ae0985a83908ce0
SHA512 ffcbb3193a4d3bbc37b5c97344b270afb503bdfa56df0976f42419466ee08ae0960074100f1ba412a6e8eacdb17ded7b2e7aebc7039d36223e56401a88600783
SSDEEP 49152:S68Qg55nhceWu7PNU3/Prmwx3lwcx/Kt0F:QthLRc/DPx3lweSmF
TLSH
T1B7B55933B2F600A9C44DE1769F4A872196D17C718FE1E3DB8511724A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a66854d4691771ca1992074df754de752d11cbcc61a3602825865415ee8882cc
MD5 0d8d77efb110481ba041cece01d04ab2
SHA1 3ca5b0b1d8057b1d44ae223e6d1430e07866f4aa
SHA512 be7eea1482a31ee5cf571a39fdcd337054363bea77b54aaf1a98ddb9fc32a7ba38e12f85e49c73160ae6c907705ae41f76946f6fbb5c9b15a7219ce9b44a4205
SSDEEP 98304:ky5112gYy5azzVva69nLKnhZaPx3lweSmF:lLIHjWh0Pvl
TLSH
T11F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ba0864affa89be38dbb2639d1e091bf8cbfe95c236f9f6a3a482c20d0a480a21
MD5 70fdca52f1cc8928e899ddb04c7f9d4a
SHA1 ac5386dc4df03768df4640f3c94c314443d8ed89
SHA512 3fc7cfeeb3c0b5653d183ab8151082b176bbabda248fe18cfeaede5668d5585311c0162d59c8ab1b7999485c174c040cf970661287495fd4e299b8ea9d4b7073
SSDEEP 49152:yB+taZ3usBWOBr4tEG20bqx0z+n217aau1glRrmwx3lwcx/Kt0F:Au6JmUxd2dNPx3lweSmF
TLSH
T1EAD59D13F1DA01E8D06ED478974A9233FA62BC490B35B6EF0A9072552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 79defd13f1b80ee41ce4186e8940e509d44af65a800df94f3f692a99c01f084a
MD5 931939c5bac123e5a8486cecbd6909ef
SHA1 eed9ba1ffdd38c7720ec2fe8d7998c689a8a97d1
SHA512 2ecdd685d8315ccbb9b11b2d60f8a1a4eeaa386510678c74fd2aaff5f4f8d6bdac884f445fedb27673511c4b9db1521283bb1bb427224dc06b071f43f791d685
SSDEEP 49152:M1hpsNoJpF1A6BU44CwH7R4xlrmwx3lwcx/Kt0F:MmifPkR8Px3lweSmF
TLSH
T1D4B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BBE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 bbada47b6f6d913829e3f06d447792b080fcfc37c998a346dfee118a8c5013bd
MD5 da59b266a4a514c7bff23ed536ca9e66
SHA1 b2e866f292a83a75012550e6d77599b53ef69514
SHA512 9a80c6c2e76a9f60451c2dea9818fdb123f828fab65039631f40cdef904846c944d7802d04c79c95225a91bf01f41934e901848f636bf5c98f984b328b11f384
SSDEEP 49152:tSuZQIY0Be2KNRVtOnks6NMHqCrmwx3lwcx/Kt0F:j5dKvi61mPx3lweSmF
TLSH
T107C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b7c353f5c4421c279abc8eb9f12aaa70c78443a070dcd7d4049c0e415f9f5c71
MD5 1371f326c3611a3b5f2a5b019dfa7f21
SHA1 8d71fe9f2feba1f07f115de809352778c180536a
SHA512 3615c481a0e22bbd38395a5cdc963a6cfc30974c232ff7c7bb69b73c2c86a54ced9957dcd5859bfdbb1500b01cbfa6205c7cc05a5e1d4f6cded7246ee9d1c11d
SSDEEP 49152:khtSn8EApI0figXgiDn0AP5wBrmwx3lwcx/Kt0F:lX2iyphgPx3lweSmF
TLSH
T19B95BE13F2D900E8D05ED179C7468632EA62BC160B35AAEF0A50B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 f2c0881a26631a1a9b8f320cf4d51e6258c7bab7215862f08294f8fbfda2288b
MD5 800d4c3b8a45909135cbb1ebd65feddf
SHA1 2db778bc5fb9abe6c16df237f7640a256125db4d
SHA512 9138d501ac3891a29e73bc48e381f1d7fba5f0811cbc8785e91296051d8f84986abbc32ae277b6514528256b1339448eee0c2784bf04594fd4f40d8aa782f9f2
SSDEEP 12288:BOYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:BOf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T1746523285DCA8664D30D46B3964AC64875B17C32B01746AF722AF8CCBE365F5B93843B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 4cdd0551354e995607531809aa5ced9b5dbce6c9696b58af6abd9100b4e8ec0d
MD5 1aa8e5c516a51a177d247bfb8b855166
SHA1 8bb22ffeb2b892dde2ccefc80666c2c7e094996b
SHA512 2dd3ea27a569f5ddbf6e263edbe1fde8ccb4173082d1a7053797633b07c4eb48f83bb82611756f7b19f112340231c0f8a912dca05a2dede4be94b4b2e33dff94
SSDEEP 12288:I7YW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:I7f5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T18F6523286D8A4664D30D46B3964BC64875B17C32702746EF722AF8CCBA365F5B93C43B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 a19fb6890957da74658e0587647c7b5b7479c2487a959b9bc43a2386308fb36c
MD5 f74b7f4adaabe3e890166757a1822373
SHA1 6e788b90b9f0e9e6b313f746b800e48192a99a5d
SHA512 de5838b9354f6c700cdfa55ffcace020401cb4cccbbff3d05b6d63ece56b9cb8eaa6a433b591135e1846ed1ca39ee1cd41dc56f26a2a3dbbe4b09c6067489e04
SSDEEP 12288:jdYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:jdf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T1296523285C8A4564D30D46B3964BC65879B17C32701746EF722AF8CCBE3A5F5B93843B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 4675a87a7e0265b2e4e492a9eede0d4588dcc44f582ef8177feb7dd372e83d1e
MD5 064088efceffcd6c7e074ccea00b25b6
SHA1 db920356297abd75ac840f8a831f42ab1f880d45
SHA512 6cb7c0ef72d603eec3595fb0cca01f8207f1efa74550ab308bb60813cb7b990cac6e770c986e15c098dc65dd15e0a1bea1d6ce1cfbccc96149f7e4c2cee823d5
SSDEEP 12288:gVgYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:Vf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T1047523292A9A41E0D71E8677C656C214B6F17C71B13287EF731178CC6E327E4A93893A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 925413a14cfa69009a42e03aa7b54d39a4e2ea798b5e212f4293a77a2774f244
MD5 c9bcb9f0c0721c16310853fbc6492aed
SHA1 3376a7e5050e74e531bd9e26b1d45c378a65c66c
SHA512 9b3526ad75ab8b5b3eae86ca43ed52045e6fd456925f3b174f146a5b8021df87bbc4204437c5c99bc8677da539e2c6b259ca3101aefe2e014b49cb5bac2d682e
SSDEEP 12288:wIYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:wIf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T19F6523286C8E4564D30D46B39647C65865B17C32702746EF722AF8CCBE3A5F5B93843B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 82c18ac876d4335a7c111c878ad667e57e0fd93d6fff250a5f1b55d707bab8f9
MD5 3f64f05808a0663b8634b487f37b0138
SHA1 864799b3f4eee2cebd0f0a2025fb76c4da1ad125
SHA512 5836d42bdb9e4b94a1c56e62d5bf80f6bce1f974d2013787d88962b441955104e2b3d44e130ed182dc37e2cc271b83530c0b18df1283178e8f1d6d3ebf36ca91
SSDEEP 12288:OXYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:OXf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T1696523286D8E4664D30D46B39646C65865B17C32702746EF322AF8CCBA3A5F5B93843B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 da674c80cda12f111f4c9feeaf5deb183b2718f8edaff8d03115eda2c8f81dc9
MD5 0878d5a3e54fa759126b42feeecbf4b4
SHA1 186f9044c2e7ca621a0d5ff4fdccda4431fae6e9
SHA512 db1b7815aa107e7fcdda8fb323fd10f93461f98214175b5eeaaafea40637fe56ac2cdeec54477c15a78772668140e3b85b69dd9c9ea90cc65584ccadaa06f69f
SSDEEP 12288:yjYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:yjf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T1F365232C5CCA4664D30D46B39646C65865B17C32B02746EF732AF8CCBA3A5F5B93843B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 5f3b32a896691d72cdcc0e40aea8ce979d5c43b9aa77416f1ad63ad52bc293af
MD5 4899a3c6c02b61ed7f6441a58779bb25
SHA1 f64bd315f73a300dae27ee7280071a73f3e8617a
SHA512 aa40c5ce11a3087ba2c4185d2c79a4924ba07036ed63d6f8fcb78faae2154bf020e15bd4370d43cd2c8cebecca0eef6616db9b03296109cf1ebf365cc46daac4
SSDEEP 24576:jZMdzFVSObf5TpmwLt3iRu/ocxwKDJKIe05Qws:jZMdzfHrmwx3lwcx/Kt0F
TLSH
T1E8850265B3900CF4ED6B823EC9568905D6F27C2A1670C65F13B436AA5F333A11C3DB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 94b2a0affac8b2606362f3c66bbb5572af03754d4eaf0adc156f3793d1d43669
MD5 6bfd7f89f3d80d1392c85e05280e20a3
SHA1 880d3a267ee5ff10690936675b9993ee705778bd
SHA512 8673497b479523858265d1bc26dd4d2bf09edb25987f7b6f162de5b076186921b4ebd168846e62e56d68c862a205a1d1988e6fa5f9c8df1041aa9801aa19779b
SSDEEP 12288:QyYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:Qyf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T1BB65232D6C8A4564D30D46B3964BC65869B07C32701746EF722AF8CCBE3A5F5A93C43B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 4ace4a111ee510751bf72c01b3708679fc90ef2faa33d5a08a6c3923ef235d5a
MD5 cf9bfd4b5697f184a6a8058b374e97a5
SHA1 d3b39805029fb9e728bad8340380720ef1cf6859
SHA512 274016a184c4cbee642e99151507f2f3600c03e0f27b79d0687a3a7abeffc36ea48989a10491275adada4217814280ad8140998b69b861b1a2a4798daa69cf2b
SSDEEP 12288:2GYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:2Gf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T19265232D6C8A4564D30D46B39646C65869B07C32B01746EF722AF8CCBA3A5F5B93C43B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 56d4e9de0a16ec78aa851c9214c02297cbf50575f48c6644b9b8b94815da5072
MD5 65298cb5130128443cbb84555941d630
SHA1 40abfea236a594ef80f01b78fb98cb98b864f893
SHA512 fd272558584936b0d9bd9d35dde2b17de35103f81f020a97dadcb53e7e4b06b376ccdeeee76b5f6ab3f0442194a46b09bca92244e073128c46a83df1772eb9e0
SSDEEP 24576:Czyvf5TpmwLt3iRu/ocxwKDJKIe05Qws:Ckrmwx3lwcx/Kt0F
TLSH
T10F75121777A520F8D22B8235C9524A05F7717C3257218BAF236466BA2F376E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 346641c4c3eeff2ee9e80f52e787ee6971a7cfc704e29c23b37eb6d3773df624
MD5 373b4e08846e633b0f50914658aaffde
SHA1 f998c455b0193afd17db7018ab9e80f2dbf86bd8
SHA512 304169a94a39637a77f34ea2fb837cf207296de6a9a00c8ab8e25854395f8995862ad842fba497e5154889fd7eb61d5d12f6c53a7b5f86cf5551473be1914ac9
SSDEEP 12288:UyYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:Uyf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T17B65232D6C8A4564D30D4673964BC65869B07C32702746EF722AF8CCBE3A5F5B93843B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 50631962e8bf0f2c1f1d7c218bcd4ef4c862c7b6684004e0edb3648256d5f12a
MD5 35ce630d49cd536ca7f6fe95d927188b
SHA1 07f97608835dd61b4317d21b701bb6c1688ba989
SHA512 3ddc2db91b2a919854a3c7ec585fc48570d12da5230a0bd97ff385d4a383edfc8bcbabdd33de705344a9b16d6d4480b63028172a9573e4a1007a7c117a95ddcd
SSDEEP 12288:EyYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:Eyf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T1EC65232D6C8A4564D30D4673964BC65869B07C32701746EF722AF8CCBE3A5F5B93843B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 46ffd86b391942cac11749f9c29ec3bd912b1632c058866b3bad49319f33d07d
MD5 287f62dd772ded504e63f55a1892a05e
SHA1 a88f5d8571086f06a63f8959d41856a041961b32
SHA512 e037150b8598b9073bfd1540fb130bd17ab7955e42303f7904f0c078ec5aa93ddc39d65a6bad45e0091f37b3081c6ac8a65b8f424a655c5e5dbb18de37911eeb
SSDEEP 24576:jzyvf5TpmwLt3iRu/ocxwKDJKIe05Qws:jkrmwx3lwcx/Kt0F
TLSH
T19375121777A520F8D22B8235C9524A05F7717C3257218BAF236466BA2F376E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 2d017f2d527ae5d2811a4782303446c210ef5aa961d381afbdcaa70e0cfc72eb
MD5 f31068cd3c1ea99864f69246b6a8ccc2
SHA1 8e403d24cdea97897ae2dd2ea3302744e3d32fdb
SHA512 f69025e1cc448d32d4c93335cc753635890d1658387c8f622fb9e727ca53119e9847c34e453f853bd860ff34ac25e2dfcbe663dd108a49c422973521e802b508
SSDEEP 24576:+TSaLl3z0zDtf5TpmwLt3iRu/ocxwKDJKIe05Qws:+TJLljsrmwx3lwcx/Kt0F
TLSH
T155850264B39018F8ED6B813EC9568905D6F27C2A0770C65F13B436AA5F333A15C3DB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 e6a1c28746693d095006cf0c4e87387c7d69995b57f92e9efedeac642032bf93
MD5 b6b8a04d1a95b40196f84d38e4426db5
SHA1 fadaf2a050c696280ccd4763e7effd313b60b4fa
SHA512 a4af153dd1cf4498a58784d1f5aaad6cb7de448730f7cea26303625e6a20a71b7adda9fbb5edeb1c6509b6ea31b12029e402fbbcb6d11455cc14dc57e40023fc
SSDEEP 24576:R3rd9CHKy7GZ5f5TpmwLt3iRu/ocxwKDJKIe05Qws:Brd9CHKyaHrmwx3lwcx/Kt0F
TLSH
T13E95CF90F3E414E8F1B79A3589768511DAB67C6A1B31CE8F03A4655A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 dddcf70262b30f08b3577f2f0ea4ba0a29871fea815fc458658f414cd0dfec44
MD5 5de228a25cf7f5adb698368ebe261e03
SHA1 1bbd4a37fae765f4175ef813dc774403a76abc2d
SHA512 29b2746151be35ada4093995c58c2bd80b4d8feb8e223919de0c42755832ef22089ad328c55e2c33f36778853fc5ff2174900231572772a2c50f4b67fc6ebb0b
SSDEEP 12288:z9YW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:z9f5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T1556523286C8E4564D30D46B3964BC65865B17C32702746EF722AF8CCBE3A5F5B93843B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 f0765de52f64010009ab475703d7e4148c57ce966aeae5763b6369c43ec897c7
MD5 337440b246dfe4a70ccf5477eb061c37
SHA1 97b10a8fed26827c6ad83db6941204bacc1de1d5
SHA512 5567c28e272488ca1619185e36d226a3dfb15c8449512e496a11a0954ad2bbafa5a4ba3de4984f3df55319da55424a59110b4e326b0219018a9c988e901370ac
SSDEEP 12288:lPYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:lPf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T1B06523285D8A45A4D30D46B3668BC64875B07C31B02746EF7326F8CCAE3A5F5B93843B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 867dfcceaf967207a09deeea76330e9031441a9fcb232580393eb946a595b40a
MD5 8bc7ebf6a4f08ccc458f955728648845
SHA1 c5e14ecc368380335c82303d1bb56a5a209df815
SHA512 afbc5319960457abc2fe4a61fe7e5fb4ea30e125e7f3c8171a2b65a1e98eb9ba4116ac1c34039ecfeda678994c37a35a20541259457d25630c537fafa69ec0c3
SSDEEP 12288:5UYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:5Uf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T1616523286C8E4564D30D4673964BC65869B07C32701746EF722AF8CCBE3A9F5B93843B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 ea86482bc4959a3e82fac7b4d02a1f9a893f70aab5f08e880c6fd414b7ab07f0
MD5 f484019cb47bae387de09057f1fb96e2
SHA1 7ad57c5ecf93a8de684b89464069c51b2f66077c
SHA512 d08693000f8681dad00d9d17899c10f2618f32b89012b97454cc9fc70c1c23d529eda8ec7954a40771dc97c1aa32a8f80bd3163193b19e40e76fade32c11ae7f
SSDEEP 12288:JyYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:Jyf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T1536523296C8A4564D30D4673964BC65869B07C32701746EF722AF8CCBE3A5F5B93C43B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 4827934d3bd68d282da04ac5b579c70ac05bf52ce4afb6ec6981c1a2709093b2
MD5 641978469ab5b83c2d2834a1fed58601
SHA1 15c7ea96effe6ee55e26b718ada5940b2cd60c85
SHA512 83b306836987f7293f26c429427b76c484e48e6a10ec085f43a873f69674db391b5a35be28af380e752bc12898b7fd8d94347d037bf6602ae310d048fd473a8c
SSDEEP 12288:v9YW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:v9f5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T1FF6523286C8E4564D30D46B3A64BC65865B17C32702746EF722AF8CCBE365F5B93843B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 6f420d51151ed6490e0df3b05420851470a9ac730ada1f69bfc80aecb4009f8d
MD5 469250a25c3401f32ed4f6bbb4c3ff4f
SHA1 311c7f0f480ef9b8432c6b6916c9ef778824d9cd
SHA512 482ca4f8f8ebce86329bfd5cacae9837cf300be161fa18a9e6f030ee7b86fd1c3d232d03876dfa0836d11fe6346956cf3c90f7d516e1097b0a67bf96dfb171cb
SSDEEP 12288:/aYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:/af5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T19F65232C5D8A46A4D30D46B3968BC65469B07C32701746EF7226F8CCBE3A5F5B93843B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 40cc539c16083529bf06dd62135656da1bc67b8c0803b7c519248d6d5a356806
MD5 dadfdedddf9531f7fc3e2aec908d049e
SHA1 ae9aebfe0bc200febd34e060c3d007fded03e26f
SHA512 0c8d5a741c822bf73cdff0b080f4272f242e6164cbc0902640a7e184c6fee14a6d61a0553fc389735c8e4d2f437b04ab631ef7c9aa63254dd91854d638e27b3b
SSDEEP 12288:dIYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:dIf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T1476523286C8E4564D30D46B3964BC65869B17C32701746EF722AF8CCBE3A5F5B93843B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 79f661196b6f359322e98a51dd512759c1b7b071c0c585117016e8c60723a378
MD5 66d79111e1ea038f23efa621e59e4cf6
SHA1 a3f8da165323f66e5154bfa38a26283bb62fbbae
SHA512 8313929b11189c0e64f2fa547c9fbc00a0bac0f2b934c9757b0292dd47d30ed66b384b766e19b068ccceb5355f0f24e8b46e15d96b796ee76427ec24113bf67b
SSDEEP 24576:kfwvrk9RX6wkyAI2f5TpmwLt3iRu/ocxwKDJKIe05Qws:nMnYI2rmwx3lwcx/Kt0F
TLSH
T1E695DF29EBDC44E5E177923C89A7460AF2B17C691B31C2CF125A63AD0E33ED46D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 4ef9cf7c499622c4d397bf745d3e25bc6d011eb80c5b7fa3559dffe6656d3147
MD5 9178259f862045504f0dd50f21b0e83c
SHA1 1a1df2c1a7167d7bd08abee4d119043b5eb996aa
SHA512 8db9a3e02f5b76ebf42cf6a6f7219f17768787dce8b6c6250ae4749d71f30c18253b47e0a69d222a18b27fb0c0cc238f29163d8f5d37b0628fe5ace76a961e75
SSDEEP 49152:6YvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0hrmwx3lwcx/Ky:GySzPFPx3lweSmF
TLSH
T108066C56A1A801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 37d3c155b52798926deecd146176f3f3a6e8fa0168cce8482c092dade06f4e04
MD5 badf9420ef8f00ea188299b2cfea6503
SHA1 d72c1a2756c5e28264de45c203457d0d7c7b7b00
SHA512 94e7f6e15409a45075de093abcfa4273f983d59cd9f3633fa816a4500d0f3549a0e5436a1e5c16e4ad2a97adb43c201d85042ef12f7872992d2fb36abdea617e
SSDEEP 24576:i47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYLf5TpmwLt3iRu/ocxwKDJKIe05Qws:i47JUQj4irIhCnDHUPfF/Rrmwx3lwcxN
TLSH
T1E665AE1DA3EC01E5E1BA927885158A1AEA71782D1F31CACF2270937D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 a837e7275ebb7dcae38d4054c251a25d8d5158bc4aff4ed12cec623b65b678cc
MD5 e1116a03e315e0ece4dfaeeae1e25add
SHA1 051f1604dea2184f2940cbe2ea09a1ccb83c1982
SHA512 228640dea009bed31ee301950647f9d687092eb02a86e4c3edad300cd38b263b57385e614751d434010bbc0f5caabf2f018ad13d6c9f8b55b484f822ed73abcb
SSDEEP 12288:QrsfCYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:PCf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T18675F119D29802E8C16E5276C7468A40B7737C2593E1D3CF62D0F8BE1F76690ADF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 5e6f3b8c3509d040a855b6c6d2a2f099b609bbeeae4041171f3391c1de404e22
MD5 ae5ea57cc3a71c407f0897ab8a859ee2
SHA1 adf7bc0753d21f7fb928b1137ac78e7d9ef321c8
SHA512 a47aa37840b3381b56634b1bd3687dfcb21ba2501ded58de5f6482c4ed4d48311d42b7e2157b54c831ad20b1c521b1820247a64a8e203a57f39864074728b658
SSDEEP 24576:B8UxtUPSf+Zbp8a7e3CS4olfnwCsmZ614:TtUk+ZWa2CSLlfw5mZ61
TLSH
T15F352741762BD74BC5AA50321E36C6CCAB707D02EE085F0372C9973FD476669BAF5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 8db2e5c4a1d35bfd3cf5614860da36d6f7e63ad23cfaf2e36c9b4e943d180c14
MD5 ebe82c321942ebf76554093c3f2636d4
SHA1 16477db84f77f6c4a48dbf156d2e9d6a93ecb937
SHA512 a30fded792cf75d5812581db930346680300a689ae3a17a9b0b62fae527b889f13d184a01a9c16bc663e4b5517a546eaa7d644ebfbd5e56ba32de9869fb9d58b
SSDEEP 12288:A2uL8CIdO9UEjK3xy/yBR+lUObH8PRxek31igTAsgX9VUz4baL8Sgcv22q:A2i8w2BaQIOObH8fek31igE8waYdM7q
TLSH
T1FB553B41A5A7E31FC9FE5037433286CDAB786C07B7492B057340892C986767EB9F62D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 ebd8b40dde4afebe20d3f4b86a75453b149c5fcca4cac9edda8d5ccc6c1162c0
MD5 25f069d626b188c3b9884a3b5c7a3c18
SHA1 7c853d1aa26e5869f4e739d83c49885aa1b41840
SHA512 172599dcad20c888c97d6a16dae1f030487a9cf1ae027608214c5ebdb84d0fb5f2ce76ef5502596c7acf3c4c8212c4b4e1017f3a4b91952b6286eba7ac6eecae
SSDEEP 12288:oe7qYW5Tp8ftaLtke9tisSPoGn65/oKhxwKphJKDke0gy5Qws:jqf5TpmwLt3iRu/ocxwKDJKIe05Qws
TLSH
T1A67523295ACD8964E33E4AB3658FC22435717C30671185EFB216B8CCB9369E5ED3842F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0d51af90d336036823790e770b4b5a109fb96fceda462793ff5ca7abc2050968
MD5 672d428a2f0e32efe7da42a8867f7f92
SHA1 bc2a61ee14431d9181f8d8efdc85143b1b5b30e8
SHA512 c723f45de12f47d49a7d44dad85dc381f91d4fbd5c39dc84c1fe70e08f9f94427465aa34b2dd19717ff52f500851a90f1b74e295b02bd6ce6960af1b7661be1f
SSDEEP 24576:lgb6bmBIi49WNNFpg1rSvFv7bYsf5TpmwLt3iRu/ocxwKDJKIe05Qws:lgb4mBIBhGFLrmwx3lwcx/Kt0F
TLSH
T1A365AE1E22EC02F5E1F9D2B8DDAA4417D6B278160332D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 8de1b22fd8116ea7b198c2e13dc6b238724e6037c75e97cbca8cc3456031b118
MD5 6ba084b7150284b74d0deec277fad020
SHA1 27af10e3cb65bbb3afec8754b6954bb1d9407ed8
SHA512 768b4c5c1030573b8ed92598c9faaf49135f8f08abb9a4434dcac57f661870ee28f0ad850cfb84fe5bae9ec4e379a11d8baf309b2b25ca487a85e622e6b5a643
SSDEEP 24576:7G88u8FpJqH11zria7/mbf5TpmwLt3iRu/ocxwKDJKIe05Qws:a7ZFPqVsa7/0rmwx3lwcx/Kt0F
TLSH
T1E0A5012577E101F0D47BD13889864663F6B2B8211364EFDF07A89A951F33AE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 20a771a29fd34f74cddd29adf9b6db41d14481ce2d03a6cb757857511895eb6b
MD5 5034cd468ef81688422880b2fe400689
SHA1 0c07ddea113e3dd52a3d75b07c3f24a52a59a4ae
SHA512 bd1e5c31408c49144fbce9b5612138e6655a87628e46b82189509de872302f9343248745ba37aeb7a8590898dd26b41dbb508bf40dd495c4264ef7d01a89550a
SSDEEP 24576:WPUr+NQHf5TpmwLt3iRu/ocxwKDJKIe05Qws:WJQHrmwx3lwcx/Kt0F
TLSH
T10C85E12E26DD18E4E67AA17D85828709F7717C62131292CF02A1917E5F37DE8BC3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 3580551193b5e1b859f3c5e9d9d4c920385299e2a0f08677d690f7086c59a098
MD5 b9d799a39f8d443bad39e0b581894535
SHA1 65d8c4858935a5953d724c166c9186911eafc703
SHA512 fa59a710bae4318005d26a2d43f6665ec9e1c26564dda1b2d4748b655e365f31f38c4ed806b6b7f8d79084e799b309bcbadc5d2f5d0ff0effb3d718d9385621e
SSDEEP 49152:qBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjXrmwx3lwcx/Kt0F:VG05lO43bSPx3lweSmF
TLSH
T123D5CF6A62EC11F9D1BBC17CD9C6860BEBB23825033556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 76de6000d543cd5fd7830842dc01fad7d2dd80b51a811cbfddca2ee7b5e6fbbc
MD5 a65516de0100efeed8156e992eacf7a6
SHA1 43bb2628bffb2aead6ecba3e4f9de525cbd9f98f
SHA512 12bd2d3ddade70733995942cf044e8c71344672e186512da3565df89f284bd2e25efe292a2810a75d6d483b905c79b1e3335a6e58030cbdce365ebbb3de103e1
SSDEEP 24576:3fa5POZ3dpqWVM50JicR2hG0lasx2+47eidnhf5TpmwLt3iRu/ocxwKDJKIe05QL:Pa5POZ39Jt2pasx2+mPrmwx3lwcx/Kt8
TLSH
T16165AF5EA6EC01D5D179D17DC583861AF5B1382153329BCF122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 180795e5cb9c1bb193e499c92739c0b7925ed70aa45eb6d0531f02b34243e1ca
MD5 4ea088168863c0e9ed95d76d89de6ee7
SHA1 52de1028c89dceb0dd90c42f96dccc518d7e8b99
SHA512 e9a22c0b9a3e70a97793a8d4c6172435767a93155c511cea51f3d2c4dd17e812de59edb64d874baf7df9fd43df7bc3241e77966ce62d896dafa1c735dfd8cbee
SSDEEP 24576:mNcwHdjbyQ4nLC18lb/EOjowL7Fkzf5TpmwLt3iRu/ocxwKDJKIe05Qws:mNc/zEOVHFUrmwx3lwcx/Kt0F
TLSH
T1C2857C1623E901E4F1BBE1BE89679546FAB1786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ed69b8e5c6f24e1eb874cba6b54238e87fe526f53737dd9bb88b27b44518dfe1
MD5 0691535059f68c8d33d78fbc6f856dbd
SHA1 446282f690471d63c1d39a578f6b2f82e704de2e
SHA512 1fec91280d33c0b344f40dc91036701f190f2fc49975869cfc3a086adf1aa2d8e2d862d0916815abe1ea5746df009d7677d07962b840635d4c720f87f2ba4ca9
SSDEEP 24576:ptkNvNnaFeYhJNtmZBm1f5TpmwLt3iRu/ocxwKDJKIe05Qws:ptMwBtOm1rmwx3lwcx/Kt0F
TLSH
T17F55AF2EBAB846E4D1FEC6B5CD238512E6727861173293CF5290C13E1E279D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 a133f53998c50fbdc262c9e17ed5f126f387c792638c6cd4fbc24d14391b8f16
MD5 9601ee7ae8ba2e8b86d6d42dd9625a3a
SHA1 76da497b53d580a1876e80374716a4209b2c3a8a
SHA512 561bb6b1205e0bd2993a49d157a46d87a07a04da5bc54354b10c19e1cd31c233518dea55f2fe04e504208c7b2075a0f6732627dc909141aea99a300fe60c53df
SSDEEP 24576:pD3FHshBIYQgAuf5TpmwLt3iRu/ocxwKDJKIe05Qws:pDVHeBIAAurmwx3lwcx/Kt0F
TLSH
T19595E03DEA9C04E4E57AC1BCDA538A06E6713CA9032256DB1294D1B91F3BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1144-77-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/1144-303-0x0000000000400000-0x0000000000580000-memory.dmp

Download

memory/1560-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1560-94-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1560-100-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1560-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1560-307-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1560-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2820-321-0x0000016B91250000-0x0000016B9141A000-memory.dmp

Download

memory/2820-391-0x0000016B91250000-0x0000016B9141A000-memory.dmp

Download

memory/2984-61-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2984-55-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2984-287-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/2984-54-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/3044-22-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3044-106-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3044-16-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3044-15-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4144-302-0x0000000140000000-0x00000001401B4000-memory.dmp

Download

memory/4144-65-0x0000000140000000-0x00000001401B4000-memory.dmp

Download

memory/4144-73-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/4280-304-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4280-325-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4280-323-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4280-81-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4280-88-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4280-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4380-80-0x0000000140000000-0x00000001401DF000-memory.dmp

Download

memory/4380-1-0x0000000002180000-0x00000000021E0000-memory.dmp

Download

memory/4380-7-0x0000000002180000-0x00000000021E0000-memory.dmp

Download

memory/4380-8-0x0000000002180000-0x00000000021E0000-memory.dmp

Download

memory/4380-0-0x0000000140000000-0x00000001401DF000-memory.dmp

Download

memory/4436-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4436-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4436-119-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4436-125-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4436-131-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4576-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4576-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4576-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4576-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5420-113-0x0000000140000000-0x0000000140227000-memory.dmp

Download

memory/5420-306-0x0000000140000000-0x0000000140227000-memory.dmp

Download

memory/5420-114-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5420-107-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5520-52-0x0000000140000000-0x00000001401BE000-memory.dmp

Download

memory/5520-39-0x0000000140000000-0x00000001401BE000-memory.dmp

Download

memory/5520-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5520-40-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5520-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5780-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5780-128-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5780-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5780-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5780-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download