be82981cbeee9b9ba2f666210b071ce908c2c6a7231d7ad63f638c6608958a14

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 10:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
Size 3.9MB
Sample260801-mfbfraseng
SHA256 be82981cbeee9b9ba2f666210b071ce908c2c6a7231d7ad63f638c6608958a14
MD5 ee08387e2e4806c004e93d4424bc64a9
SHA1 ce982e0d591c4142fe08f625e3e598123442cdb7
SHA512 f9dbc970c36e63cbd60f240d296d6989e50f7c83ac9f06e8d56d5a07e50f9f06e7ea061bf0a3fc22502b7f14bcd04a505bd78b63430f48ef342765d174dc005e
SSDEEP 98304:BqfQJvlN/J8c3ioAnxgUuBiFE5fIIIIIIYIIIIIIIIIYIIIIDIIIIIIIIIIIIIIy:K6JTHgwfIIIIIIYIIIIIIIIIYIIIIDIa
TLSH
T184169D07F69600D9C41AC2358347E733AA327C885B61A6DF62D47E363EB2AE05F39754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3048	elevation_service.exe
1556	elevation_service.exe
4300	maintenanceservice.exe
3008	OSE.EXE
4276	PerceptionSimulationService.exe
2492	perfhost.exe
5100	ReFsDedupSvc.exe
1600	SensorDataService.exe
3640	ssh-agent.exe
4768	AgentService.exe
828	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\44d78e7083806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000036b11a2ba021dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000028fec52aa021dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ba84c6ec9f21dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009254a3ea9f21dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002848eeeb9f21dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dcd7bbed9f21dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fbb1bcec9f21dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ced4ded9f21dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bde6372ba021dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3048	elevation_service.exe
3048	elevation_service.exe
3048	elevation_service.exe
3048	elevation_service.exe
3048	elevation_service.exe
3048	elevation_service.exe
3048	elevation_service.exe
1556	elevation_service.exe
1556	elevation_service.exe
1556	elevation_service.exe
1556	elevation_service.exe
1556	elevation_service.exe
1556	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3444	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	4768	AgentService.exe
Token: SeBackupPrivilege	5100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5100	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5100	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5100	ReFsDedupSvc.exe
Token: 33	828	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	828	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	828	SearchIndexer.exe
Token: SeDebugPrivilege	3048	elevation_service.exe
Token: SeDebugPrivilege	1556	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3444	2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 5880	828	SearchIndexer.exe	100
PID 828 wrote to memory of 1648	828	SearchIndexer.exe	101
PID 828 wrote to memory of 5420	828	SearchIndexer.exe	102
PID 828 wrote to memory of 4108	828	SearchIndexer.exe	103
PID 828 wrote to memory of 1520	828	SearchIndexer.exe	107
PID 828 wrote to memory of 5056	828	SearchIndexer.exe	108
PID 828 wrote to memory of 1308	828	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_ee08387e2e4806c004e93d4424bc64a9_glassworm_icedid_njrat_ryuk_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3444

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3048

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1556

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4300

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3008

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4276

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2492

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5100

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1600

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3640

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4768

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5880
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1648
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2896 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5420
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2760 2940 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4108
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1520
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2760 2940 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5056
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2900 2896 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e6e4e07e65a521be546061f35d83c8cdef9be3a918d656e044a27d995fe79bed
MD5 47b46de3084259560f97c8b0fce1f3ef
SHA1 02df41a8796bef05d636807ea23d47f7ee451e77
SHA512 195feeb9bed0410928ee7650f307c695e13fc72632f5e7340be23440de497f4b248c9f4404effccefa7c1889591d3de2171253431e22a1f36aa7fd303b63ecf5
SSDEEP 49152:Xb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnFSsLUX6WH1aUh:F3q6sjBxsgKWH
TLSH
T1A6D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 f982c77dbed7ba88363a51052525f49db34934ee4176fc5fb6f87f563adfe097
MD5 1b84162b358153776753216c3ec4b654
SHA1 ce1b7e4e800329d9cbc7122190638a3bedffbf88
SHA512 574e28c614c176974ca9f0a7fd3332ad576124e5532cbac389bd61974969b0830a294f50aaa0c42cf197660fba132a2644ffd0a54f3d841b43eebbe56c312769
SSDEEP 12288:A1XLsswWkxy2lRq2czAASdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:WXYfDtczAASLexL2gyX6WH1Mr3nQzh
TLSH
T18505F12977E408FADD67817CC8A28515EA33BC8647A0E7CB03A495691F333D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 ae41f77235a975770d504d0193da43c587fc4dbbaee89dfc04508528bae8a00a
MD5 c844ccc26554c692e635bcd3edc4c031
SHA1 66a75fbfd7b597938ac8c337dfa1284f3abf0081
SHA512 14cb3ecb88c721f0cedf3e3e4704bf68fbd3248a91aa0f7fd30a95c577109f5ef65e2a1cfc705f9d5635068e309309eac411e5a03b4e27f8531ea78f171ab4d5
SSDEEP 24576:m0Le5ji0hmxxrMtSLexL2gyX6WH1Mr3nQzh:mPji0Aj6SsLUX6WH1aUh
TLSH
T10D359E16F6748335D073C0B9C5D2A69EED7230865B308ACB4286D77C3E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 caf67bd84f318200e1686249cf174ef7fb305f48bb6f054a43a1d0026eeff05c
MD5 14e9f84b22008953f9176da75509ceb9
SHA1 8920fced126f294687d9868fcfa9c24df14c0768
SHA512 861e79d9893265e35b678c83339fb8606999861090c805a1fa7f4d14534a2a0df5a17b50369d23fd276eeece951f1daecc636f8e5adb058fbdf3476fb129a587
SSDEEP 24576:da7/ezSC6vUyD/aqgrvWn6q8wyuDSLexL2gyX6WH1Mr3nQzh:U/ezSC6vUzPveHjyOSsLUX6WH1aUh
TLSH
T109755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e69cca52b8e9ae70502d5b6ce84d36fa3ef25f36fdd33ba3c562d846f5b64816
MD5 62a020e161325058194b5238445b9ad2
SHA1 df8c5820139423a8276ed6634f74bdad4e16f0a4
SHA512 868e5d135d42252e56f70588e519210b5eaa2b82cf49e5b29139e5fd5f5170b620c6de6298303e10bbf3c4d5419af5c63275c0862e5771f9b3ad7f8f09aaf964
SSDEEP 24576:9VbqPb88hv/l+YsSLexL2gyX6WH1Mr3nQzh:9VO88hXl+7SsLUX6WH1aUh
TLSH
T131559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 746ce108a4ebc5e5d79298df38020ec4e235145723cc583007a25faed4a17361
MD5 7996696f2297c7973b72700ca2d1914c
SHA1 ae76e1af0457815b4bbf0f2ae7a594be38975c12
SHA512 c7deba0d95b72b555e1512de8a6e66bed0a82a1b3e1a278399bb0fb829a8ec8d41ab75f82bbf0ec226e229f88cfb82ab0567b6925962da6cca35f4dc97207d54
SSDEEP 12288:aLJSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:aLJSLexL2gyX6WH1Mr3nQzh
TLSH
T1B2C423AB6AB434EBDBE780F859DB05987E02FFC718914683E514F09D283C24BD92D547
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 5f8b950fc5323e9fdf85aca188ccaa198a72d9b5aac5391a59acb4673bb5a44d
MD5 416854e720b045b4e7835a42cc6f0290
SHA1 b8ccf24f3d6f920795cb9255515491ea7b1e57f7
SHA512 54c8c885a2997d5d0938b68834f8b94d8c41159bc1aeaa19827ed6d486f37e24cf514a6e882b7cc172c42ac4e14caad0cbea15e36fa5677e0bf1d582d51d4d68
SSDEEP 12288:QeBNUbTVO86U0SdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:QJIU0SLexL2gyX6WH1Mr3nQzh
TLSH
T18A05CF7BEE38FCE2C27A8CB85A918240E76278714F6293CBD165C20EDE235D15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b5e89fc8d0999edf15e37295b93a690b07a0d00e9111e41108ac060e10022382
MD5 5e3d5e8aeee06d34b4e0207de4e3585b
SHA1 e8a2a44d9abfe0dcafdde3ea6d6b667d95ccf909
SHA512 05177406705567c96def0949015e6aa5e3be90cedb3106a3858b20484f29c80f7df665d7b387b2c3f983b034dc97f73ca8a88d8707ea22d5added22b9faa2dd9
SSDEEP 49152:cQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH9:cQvGAdlCEL8c/DRNw5C2sgKWH
TLSH
T183266C656BF880F5E0B7E178897A85B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 c25d226084292cf0ad09a5c43e69d139b9f4f01cb97055ac8ab523f6c5c9f183
MD5 5cfdc64028d37b80714087f93d2f0627
SHA1 de14d198e4bd928e783a28e586e79ae7d911c8c8
SHA512 48b57ec82ec0ae549ced6354a8336ffa1eefe73ba69ff8c6e7c33d3632c290059ed1fb99002b7980fbc12b4170369070bb1acf256a646e25ab324ea88c04d873
SSDEEP 12288:JAwSfxL/2Dc3RDLLmt0LDQewsAjqSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7un:60ewsAjqSLexL2gyX6WH1Mr3nQzh
TLSH
T1FD15E031FE74E036C7BB0CB61B76C716182DBA604F511AC3E3A8999D59342D2273AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 144cd78a948f4b2106b5fcec1f367a439f3890d62e6771d0d02d601d9ceab734
MD5 38787718815379a9479b888a3fe916b3
SHA1 5fbb4cd2bcf683b8c7010917dcb7b6b8a81487c5
SHA512 3f81aeddcf2c047cf78fe0d77c04b2e9a783d64297a09fcaf2415cf3d6172631afa1c9b17a691f04bfc1bda4fcb6bddc123da4152f9a52e3692def31b0cc1b53
SSDEEP 196608:4UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHxK:4UEtQevvqc2W1cpV2tI32k
TLSH
T1B5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5d423d8e0a3871dff17a7b624d490709956771b381b564e304b09ea2c897cfb0
MD5 c9ea36fa3bb769bf2e5b4562727ec0f0
SHA1 7e02626a4b56fe70051af9950a8148ddf8524439
SHA512 880f331246178356c0358effaa3c33dbdb50c2fddad213b5c845294eecb151a45547c82e8a5cb0798edf73695989086f3fc4e1769bb6b6b0e0f915b01ee3ba06
SSDEEP 49152:qCbRquA/m2yL5zifFiV+XenmE3/zKSsLUX6WH1aUh:foqHVjnmCsgKWH
TLSH
T1E1D58D0976B881E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d8ab20f33a3a6ea14e1962a052c4b55526cbd839672b6c72ea8ddfec8332d351
MD5 52e200682e3443006c869c62c92df67a
SHA1 5ea2b14cd081ef889cc588159837a0cf54518767
SHA512 1dfc14fd8f0bf845ceac26947f4978ba044dca90a493bed478e548cd9ca5b049e92b8024be743b69bb9fa5ab67b40b457d86b11a66f57518c76127b02ba74e6a
SSDEEP 24576:hAhGL3IFoiwtA5l7S533SLexL2gyX6WH1Mr3nQzh:hAMUFoiq5HSsLUX6WH1aUh
TLSH
T1B9359D81EBF955D4F5F3AAB899B68170EA72BCA65E31C20F2150D11F1E37A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 53305a37ecd930749cbe3d83cd616ad8fd3832e1bec644e986de23b335c8da07
MD5 8c99b8e82b8e75d080eadaffeed5dbe3
SHA1 5f2930554f08fc9d62ca8a44cb230bbc06c321de
SHA512 36fbe50c4ab32d0bf6f8a9ff29f1cc5d1da9d17a8b6292ba9f4b45d7a6bb5c314033a9084decbea28cad20f1a4186c281c81ba77a7494c7a53f2bd42ff52d0e3
SSDEEP 12288:Omw5HEjsChNVBFgl0WDm+CjSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:Hwu4OWuSLexL2gyX6WH1Mr3nQzh
TLSH
T19205F14A76A41CFAEAA78138C5978135F7B3BC022A21C71F5760C25B6F37351AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 1a54f2496565dd48e4de517c1e2eefa15292595dde7ca3902097cf5ea03de092
MD5 ae4c2dd1e6ed880df969746fcb487ab9
SHA1 71a89f2fb404a91cd332e3b886e3b288ac2e7567
SHA512 3ffc2ded3feb670aa558df2c007de69ad74264849480e7c4177a31097094752110b6092fa512e4f001e9d94ec08d1a5d0bd8577a44ed85484e1f8c55dc410473
SSDEEP 12288:GeZ1IyaSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:bZu1SLexL2gyX6WH1Mr3nQzh
TLSH
T14BE4129A36E430FBD2A781BCCCE60648E762BC87177243CF552491992F36AC65D3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fbcd122d798de50b8b1f2657fe6a6650df5a347874f0418070ff65a800cee995
MD5 34e7b0e94f0d02669f0b2edec81bb452
SHA1 67be3bec12cb329e1a13606c330ec84055143277
SHA512 c7cca84b7daa95f5f504c54a67839fa9a97763b7576808fdaa59702d9cb158c425ac5683658fb4db9297650ad6a61a05338db9f1ac2319c0b43256ff197490d2
SSDEEP 49152:Qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uh:3QRQyi36YOcPbLvw2gAf+PN3VsgKWH
TLSH
T119667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 815f1c707747c6d99d1f8c4aac183643c5a13f37ed6369650d02f7e9e6b22657
MD5 03ee0aa43989afd0a6508673b013d2f5
SHA1 33d2602aad1b05fe1315bdb989e6f2803f9cff59
SHA512 f19aaa2831633c6cf9891df6c3ad5b3eab629e2847643065f5578907f618f7c7bf2948e1ab5bdc3a03268eab02dde04cd556b8352013213b9d7bdad15fdd06b2
SSDEEP 49152:ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uh:tQRQyi36YOcPbLvw2gAf+PN3VsgKWH
TLSH
T1FF667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2482d3e09edff8e3418a2728aec1d92981d8b250816bf66961efc5da21e53717
MD5 e958f0bd10237e62b534a40dfd5db54d
SHA1 f3803ee02c6e49657fb59d64d555ff944396b305
SHA512 c59d0f6acdb129452af1570ecd8dd78f979c64a0db793bd077e8a12279aaaa47379daf029114f6781d4cf1b7909ae93f5a2b6f2fbd6cf243a44a7c4926bd49fa
SSDEEP 49152:468Qg55nhceWu7PNU3/6SsLUX6WH1aUh:CthLRc/zsgKWH
TLSH
T13CB55A33B2F600A9C44DE1769F4A873196D27C758FE1E3DB851172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9e3f6401b98329ea7001ee365b1f29578d6c4ffea981c389bdc6a4019deb4fd9
MD5 461e07ae4311d55bd83987b3b6e90834
SHA1 78bb3bb2f646f61e5699dda80d9d1aefb62992f3
SHA512 cb9c88d8b52554fd07e6582ecf849ef09059475398b5f35b78dddf2283650cca2e63e33b18a06b37ea75cd6121f705d91767cb2025b5c718985ac22df5126a70
SSDEEP 49152:U3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99f:By5112gYy5azzVvt69nLKnhZIsgKWH
TLSH
T1C7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6dbc65b2c1d27519e16827599e3618d54489c80ec09d14e6c4c0f212f2244c02
MD5 642d48d8e45ec99e46bae7de52eb6e15
SHA1 f6be69b7109cfc097c3e9a72540f8116bf55d98c
SHA512 2728a6bd60adc9e4dd8b2ba14210a651afcdcccb5d1e14a394ebfda71c4cc2d18e66338554745d810177b38aea593edb75c5839754ef126c95ab5e4fdfcbe403
SSDEEP 49152:rB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glQSsLUX6WH1aUh:9u6Jmdxd2dNsgKWH
TLSH
T119D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9072562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 550965ce58f8b650c7ea1deea544bf97a8d24392c49ee3eaa5449b7db791dd28
MD5 ab13e3b57940ab7f92a78918cd9b5f3d
SHA1 816f71d0e689c008fb936b6982c7d8d6a9cff396
SHA512 7e1506794e25a5ec7ea575db2c6805a30e98a37182b06c54cbd04929827d71974ebf15ddfd0917fbcf333f7289e94a1b0aa88aec8ea94eef18477bbadf56283d
SSDEEP 49152:F1hpsNoJpF1A63U44CwH7R4xUSsLUX6WH1aUh:FmifPWRCsgKWH
TLSH
T1CAB5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0eb7086117baf22f12537d7db04a62bd0bf870f5d3a1085de0075138131e35c4
MD5 3af376b06de15170fcefe28da5115a00
SHA1 ee926237937b66fa275382c740d7456a5e468bba
SHA512 e31687cb95a5b16764d421986a3dafcc32daf049c559c68c6ffcb983434d45d5febcd4dcb956f42def75e6386b364407b5d992736a04722673921b99b1e37387
SSDEEP 49152:QSuZQIY0Be2KcRVtOnks6NMHq1SsLUX6WH1aUh:K5dKii61csgKWH
TLSH
T12DC5BF13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 f625e70bb813ec033f8bd6a1daddc7ddd257a87c253ba377357f715f11205f3e
MD5 201c40babecf80eb4b7c1f5b1c88f933
SHA1 07fa58536b3cd6e756f29d26e6c995c0d70c8142
SHA512 6635aa4d45f9ed5b2b38dcbe19c72a13b9013a4303f3ed7a42e6a0c395096a63cd06791f3d6e26be575819106d8425c4972dd4ad86304659a27d15d115b7b3d1
SSDEEP 49152:WhtSn8EApI0fig3giDn0AP5wASsLUX6WH1aUh:3X2imphesgKWH
TLSH
T10895BE13F2D900E8D05ED178C7468632EA62BC160B35AAEF0A50B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 4886dfc20383e0e226a4c128e9533f4f40806aa115423f55f118152f4cf546b0
MD5 6fb3d7e0ff5ac3a44995e9246e209f70
SHA1 f24b20c9e40ab1b942c3965d58d8c505160f6494
SHA512 58f849da7e81256aaa4934f5189915247ea2e6ee039788cd3ce77b0ac8451eddc517ebee24c55d026cd1b018c95c6cda300e21fa00def86ba4c204d380d9201d
SSDEEP 12288:tRSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:tRSLexL2gyX6WH1Mr3nQzh
TLSH
T1FFC4239B6DB524EFD7A680F889D7019CBD02BFCB6D924287F519F049393C24B192C58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 8da31a565d395180764d5524911e4ebd1b51e9790fd50ccc28e6fc07c8c715f2
MD5 3e2209de18571d1e010ae153e6605bf9
SHA1 80d4ec8afc2a9769d1d007197b65170d1546559a
SHA512 78d4be44949a3866f08cb89fefbbe54e58ebba1e7a1b5a1fed8618f5314f51a1635333ee46155817aad2ea86ec6cb5772667d141eed875afd1e7ac7b56ff8fce
SSDEEP 12288:BmSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:BmSLexL2gyX6WH1Mr3nQzh
TLSH
T164C423AB7CB524EFD79680F899D7019CBD02FFCB69924287F518F049353C24B592C98A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 a496c653bba438f0d4c6580f3fcb035d62ac691db56134dd2eb343c075e10ddf
MD5 c760b2e1772139eac31b8bea6063a30f
SHA1 1b9a6a12f7470c988653a57c541ac821fb145b5a
SHA512 ecffccc558411fbdb740a7107688d092eef1aa2b91167083b9e49af6357316c9419e6df0a8b44d8c989a5df5cbbb4ab0dfa14e66ac05ea7599f76bfee064e041
SSDEEP 12288:f8SdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:f8SLexL2gyX6WH1Mr3nQzh
TLSH
T1D0C4239B6DB524EFC79680F889D7019CBD02BFCB6D924287F519F048393C24B592C98A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 7a1e1cce0c03b680b6d36cf0d1b2ec0ac478e88a7fc12efbde9d631a5646ec2a
MD5 1d262e5f3d686b8bb88a2e3a448a9051
SHA1 8090e4813da81012b33a33683c9ab889e3aed899
SHA512 26b20a04c81f8be71122fc0f4a60e33e8b01d6209db785e5ab6740f11a11cb5e9a583604c70767d5730aaa64d6e6db2974d957094b6584231803911a2f76d734
SSDEEP 12288:lVXSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:3SLexL2gyX6WH1Mr3nQzh
TLSH
T10BD4239A3AB520DBD9A7C0F8C9A70158FA52FFC75A7253CFE600604D1D783865D3CA46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 0653eb0bd0a9879d6901053480bef46a305e8f0f12528ea21946865bf726e3fb
MD5 83ecab9afdcf3167d5c0b98402a36e2e
SHA1 af77c94a1246086487da92e91debf674320fd3f0
SHA512 d444d71d5626da18c3deef6b9cd253eacd04d4e2f53f99e757243a08d786e129bf66a17d3d0521b307da79382cf2d5921ac2b6feb5fa9c6c53e20914e5b7ba0b
SSDEEP 12288:5PSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:5PSLexL2gyX6WH1Mr3nQzh
TLSH
T16EC4239B7DB524EFD79680F889D7019CBD02BFCB6D924287F509F048393C24B592C98A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 26ab64682059efe479e9b94e4be95a7955d85334a46795a01ba16384bf7c68ac
MD5 92b9eda3d8aa0ff875832f2c3e1a3619
SHA1 6262a4304340369e39701ef726607b34fe40332e
SHA512 032fceda87a8cb6ffbbb0fd2cce92ba9ac323dceb4fcb948e3d36df6dcd29ea239250e72c8b90613e1165ffd042c17bf38b3b6ef48419d6d6d3b9f134be8aced
SSDEEP 12288:QySdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:QySLexL2gyX6WH1Mr3nQzh
TLSH
T1AAC4239B7DB524EFD7A680F889D7019CBD02BFCB6D924287F518F049353C24B592C98A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 f864972f5c4509e5e560eb2701bf1663878dd56aff64b58c4c7038191dca6a4d
MD5 9f3261a506172e348cd46356d21b8d01
SHA1 d2a5fbf5d61150c7642e1ba247c6b2b7dcf96b44
SHA512 630ac893138a1a8316f9c3cd658dc128e61ac9cd44c4040e8c781f27dbd62dd61d82fa46e368ea3447457f1171f0498a009b1612c946fb0f476f683c3e7a41bc
SSDEEP 12288:3+SdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:3+SLexL2gyX6WH1Mr3nQzh
TLSH
T1DEC423AB7DB524EFC7A780F889D7019CAD02BFCB6D924287F518F089353C24B191C986
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 20e0d16e4f589e6408dcb7d6564a599372f163717ad1cd19ee1797a773817782
MD5 ee3f1ac7a5e6a8b349be720432433ecc
SHA1 70f976689efce18972424fb403b8a0e79cee3698
SHA512 87197421a98ebe731c3f0918a5266384741a7d26c65227cb188e6bc7404196486bd94f6e32570fd3d4bb3fbe4efee37a41dbf3233ef2c84938f88a6b1d429fca
SSDEEP 12288:5iZwbVzzFEoS2cPvyGSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:8ZMRzFVSOGSLexL2gyX6WH1Mr3nQzh
TLSH
T1D10501A9B3A018F9DDA7817DCD564905D6B2BC5A0BB0C60F13A4326B1F373911C3DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 aadefdb90bbdaaae00c71ce1ee3af9ced0196e9cbfe3581c80e58b3c9ebf3fc9
MD5 b899233598f77728eb58dbbd998a6e80
SHA1 a390c3fe9042065c13e0463fd99fd8e9af58f9bd
SHA512 23eacaafc7a66a0d28aadf6be12eb4e5b3fdef91cfd649b927e15af0dc2850d2092177be939fed7c65b53409fd5a39eaf24a3498027205c8c74155b29bf7aedb
SSDEEP 12288:9lSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:9lSLexL2gyX6WH1Mr3nQzh
TLSH
T13BC4239F7DB524EFD7A680F889D7019CAD02BFCB69924287F519F04C393C24B192C58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 8e8bb8c4add0983e78fc61cd9f261411f33fdec85e214e4ece58c3ef5906f00e
MD5 ae7919fbfb99c0a07518bfb1ec0bb800
SHA1 488b7d24791344b515e1ff096cdc26e183039f9b
SHA512 23362ffd55d503f9838f8b1a759b063f03d3a1109ecf0e3d930f52d78d5220ac588233aa1739e6f5a7acefda74704c059a61c6fedfdba4958a8b534d0972c308
SSDEEP 12288:25SdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:25SLexL2gyX6WH1Mr3nQzh
TLSH
T149C423AF7DB524EFD7A680F889D7019CAD02FFCB69924287F519F049353C24B191C98A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 514b03c0ead571914a629eddf0d61e1a9b3043a59e960bac94136ddc1b2eb850
MD5 44a8497a30f71376e72ca521714f185f
SHA1 6cf3fd2c731af1e484066c560ead57ae7b39807c
SHA512 005ceec2cc33ad2c92156bd78de1bafe138aef31c399eaa10a813261073bae6336b55f37a6d5470fb81203138dad9b56a7e952ba63581dcb1efd5a14028d0e91
SSDEEP 12288:HyPz5L8aSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:qzyaSLexL2gyX6WH1Mr3nQzh
TLSH
T19EF4125B76B130FED1778178C8A20A05F772BC730B608A9F5364527A2E372915E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 502679873a12c311da965b88387f21fddf2e603fe1fd607d3e4f33c64b40a7a8
MD5 d0244b89a9ced3821af16cb812c2e51e
SHA1 96d98d6a031f0850ab53bee3f3b291a2383d5534
SHA512 a01d10a47993e649ff5ff305eb06350383f5b993756c6dad92ed06d46fe49ffc37207c787efa2a6d792f03422f5482b20a1556c0787cf08e4e2acdfb8ac41ba9
SSDEEP 12288:tlSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:tlSLexL2gyX6WH1Mr3nQzh
TLSH
T16EC4239F7DB524EFD7A680F889D7019CAD02BFCB69924287F519F04C353C24B592C98A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 210ab1f5e81703b865244c887213c45a373250b8c0173c166371989cb09e8360
MD5 92a46dcc5c9be765ea6dc981ea04e8bd
SHA1 9f1b438e7ccd0216d103d37dda77af8916f41cf6
SHA512 9ec444f114e9ebda514e6d1804f6b3cd6ed1e148df165072d405bd5103062c12cb3032915db6a9068756e9a4b3a7ef41278fa57058d1bb0210789382d1a131cd
SSDEEP 12288:RlSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:RlSLexL2gyX6WH1Mr3nQzh
TLSH
T189C4239F79B534EFD7A680F889D7019CAD02BFCB69924287F509F04C393C24B592C58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 0a0b7038915aab64d11517132f5a0c1d3067dd94d37dcfa8331617ab048eabfa
MD5 bf4a8acb7a1817fc68d43daa14ce7f63
SHA1 08f5ebce2e68c844753eb0673e9bc798da6a0b76
SHA512 1a1ae5d92735fa0cfc5ced8f7c9c94063c450d4cbb705090ac187705c0c21649d921e9cf8c14f1ee3f4d668d3bc0022870729ccc717ccda07df9483d37b1bfb4
SSDEEP 12288:3yPz5L8aSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:6zyaSLexL2gyX6WH1Mr3nQzh
TLSH
T117F4125B76B130FED1778178C8A20A05F772BC730B608A9F5364527A2E372915E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 c1a9d05778df92bfc6d8e9a9c1df8d780563cfd53fb5b456cc3785849647f115
MD5 cf9c44d0de3f2e5b0b71377d5b0bc709
SHA1 14a0586b6c2120a01356865e3aaf96d8e1d8dd7b
SHA512 e7988856d17d4759d90347ddc32de9842635fad2aa75bda30366ba94bd3374c74f9f0e2c6260adf0fab5a7f56ce765acf557bd70ca3b6ed09aaa6c8467b58b17
SSDEEP 24576:pTDaLl3z0zDMSLexL2gyX6WH1Mr3nQzh:pTuLljDSsLUX6WH1aUh
TLSH
T1600502A9B3A018F9DDA7817DCC564905D6B2BC5B0B70C64F13A8326A1F373911C3DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 c60c70af65376e75d565862a74727abc7b53661d5bc811518c965c61f5202529
MD5 557eb1f4f52cf7bdc49fb03f46b96dfc
SHA1 dac899da792fb85ac490ce98a06d2c85f37393e4
SHA512 f1de4fc48cb403b19eb58188cd5546c9cfbe110bb7a42ea67e57e2f9ead91286b5dd22ad201b4682e4c39f2ce87324f8164fdcc5c8ab0eef5a82376a53ca86b3
SSDEEP 24576:t3vd9CHKy7GZISLexL2gyX6WH1Mr3nQzh:Nvd9CHKyaiSsLUX6WH1aUh
TLSH
T16225CF90F3E410E9F1B78A758D764511DAB67C9A1B31CA8F03A8655A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 8e6d87806f60122baa3261621fafd48367d9e67fb763846d90f336e8f26b9606
MD5 e1e582e1a7642220ae46240d2c7fb926
SHA1 f975f67e951ca56d8b040beeb5484bf771225fdd
SHA512 4775c5c644ed66ea651b977d8665f206a82f0fa7124db6fe812d21d8c69e30427991e80c7296e5af33853e964073a832df5653761059211a04b691aae0cea81e
SSDEEP 12288:OcSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:OcSLexL2gyX6WH1Mr3nQzh
TLSH
T14CC423AB7DB524EFD79680F889D7019CBD02BFCB6D924287F519F048353C24B592C98A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 64cae6e1c2e9ec140f3affb9605f71cd559e87d25565092e0618893b85fc8896
MD5 b1c62318d6aa006f9f090f5e16756384
SHA1 80cd7dbe3a7d16b16a23dfefe6b2d69ee42ddc96
SHA512 d722c0e02800b01afd3e1ef6ee65e2bb5f58fb3af68aecd7cd7c9b7240ed0c07910e83ae00be8630aa206cb6501d66a57dccfd804c548f34e22ba934f613769b
SSDEEP 12288:i6SdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:i6SLexL2gyX6WH1Mr3nQzh
TLSH
T198C423AB7DB124FFD7A780F899D7019CBD02BFCB68924287F519F049253C24B592C58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 aca6d2927fd0423e689e846c390faa4a378c6ba6e87f2bd5412136f4e4957678
MD5 8261f66db21186ed30d7fab57534656c
SHA1 1f25f9611717ea132bc0e10be23995755f9796b2
SHA512 df6c48774cd9bdde2c6a36a153dcf2b611c8ac45463ca636f20086cd9759b9d46b224b25bee44dbbc6a104b792cafecc3bd2151de9be7c97d636cad339fb3a9b
SSDEEP 12288:tbSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:tbSLexL2gyX6WH1Mr3nQzh
TLSH
T1FAC4239B7DB524EFD7A680F889D7019CBD02BFCB69924287F519F04C393C24B592C58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 e74b0d402db1a432b90a657ba08994bb51fd36a7d8f2531cf7c05c6e1422135c
MD5 1823b704207a2b44aba8293d6a0d0d2e
SHA1 7e98050dd4017dfefeeb8491c3d0991a92a3c452
SHA512 3adc04a9854224c3769acceafa60102eb5cfbc2f59b019a2fe1689a26fed3866a8d174e44c342095473a4bc1f86a27e859a38cce2228e46844025335ec8e1ce3
SSDEEP 12288:GlSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:GlSLexL2gyX6WH1Mr3nQzh
TLSH
T1B9C423AF7DB524EFD7A680F889D7019CAD02BFCB69924287F519F04C353C24B592C58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 8ccc19d0dddaf2466bb29dc24ab8aa0685e1912a8ddc6f3031fb0bd41ef7e216
MD5 983b92832b38c0da53f99ab6330528c7
SHA1 e327842d657578c2181c39cff9119b1d60ed4e85
SHA512 59de23493ecada1c2a060a3006aa9b99cdfa0358521a2fddf4307fa249e0da72b8ec9d040e3690fe3380ad5a9132ccb7618b2fecc5176fcd82539b380c621202
SSDEEP 12288:8cSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:8cSLexL2gyX6WH1Mr3nQzh
TLSH
T196C4239B7DB524EFD79680F889D7019CBD02BFCB6D924287F519F04C293C24B592C98A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 6de9d04df1dc432072fd33f2438a603237ea6db1c2b62dc0a1c6fb7d48f415ee
MD5 c2c0f58000654904d85092590f28e7ff
SHA1 a5ed685c4202f586e357e319c8a32ed0a42e0549
SHA512 b0024ec4ce3499b2ad79aac68d742063e7e78c5c9dd7d8c441703bbc11a607d963f5882493995dee04e1e06b3501d702ca3d7c574b37761ef5a0450306263322
SSDEEP 12288:E9SdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:E9SLexL2gyX6WH1Mr3nQzh
TLSH
T105C423AF7DB524EFC7A680F889D7019CAD02BFCB69D24287F519F04D293C24B591C94A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 2c6c9c5d3d418fd422e22375bd1788348842d42a2084674cd05445979ea9bc9d
MD5 02aefded6e2b5fa5337abb915cfc3bfb
SHA1 c41f2eff72a5f383f3b2281e044567048e8a349b
SHA512 24da09ace1f27b07f9e8d8b749f07bbf40d656cc20fbb4f42c095065e4d2de208013094f561bd4bccb7323e2b063ccc0057f87a91dd6f6d822768c51c5751e0e
SSDEEP 12288:qPSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:qPSLexL2gyX6WH1Mr3nQzh
TLSH
T15EC4239B7CB524EFD79680F889D7019CBD02BFCB6D924287F519F049393C24B592C98A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 4fe95a29fdb1673d2cf10f0c6135f46f81a63cfc9c9cfc08ea2ca1c287a3bec9
MD5 1b3d3d593d445554f11fd89a414e54d5
SHA1 96b649f5385895837546bbcdcbb8a27ba5f9761b
SHA512 2167f0c92dc3bdc8354671e67d4a72c4b363a1ce808c06303b498f7c3446210db2130b2a9c7556b1da136f6cfeb72905ff9eff420754e4ae4d1f213eb2c2d00a
SSDEEP 12288:NkSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:NkSLexL2gyX6WH1Mr3nQzh
TLSH
T1F0C423AF7DB524EFC7A680F889D7019CAD02BFCB69D24287F519F04D293C24B591C94A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 581KB
SHA256 dd67222645291a48fc92726dfb8408ca65365840b79b792717bfe932d0fad521
MD5 9e7382253a912bbe537a1b983a3e5446
SHA1 fa518ebd54c212005b9079611766a45202acaf95
SHA512 1f17ef67ebe42399b2b51ac9ab17a3bf3c629dbd88d2900482b195f6714670a557a883b87096eb91b8c883d51196814134038f8072a52bf647f9bfbe3e385b6a
SSDEEP 12288:OPSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:OPSLexL2gyX6WH1Mr3nQzh
TLSH
T159C4239B7DB524EFD79680F889D7019CBD02BFCB6D924287F519F048393C24B592C98A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 51d621f49c0f649c5f580a1330f9acc4c27cc93c6717fabcd018b542ecb3b366
MD5 832cdccd9179054c56839cee1da920a7
SHA1 dd626139e3e409aa90a11e6de23deccef820ae83
SHA512 5f8062840b74640230d1d49799805baf0cd13b427edeb4d687c2be74a8605de030d0662c92a869c76d5db66fae598db8fcf6d839acab1931df89f2af4cb78504
SSDEEP 24576:gfwvUk9RX6wkyAIpSLexL2gyX6WH1Mr3nQzh:UMnYIpSsLUX6WH1aUh
TLSH
T10B35DF29EBDC04E6E1B7917C89B3460AF6B1B8591B31C2CF125A53AD0E37ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9ef3b338e4877b2b2591319bf4b432f4a07c41b9cb0aaeadeb1d09bb93808be3
MD5 7bf24e692e2558afc30f488764d85326
SHA1 b1cec61e4eb265de5503f0322b345bfd2c54a169
SHA512 a8eadcfd427f2e20aef699bb23291810157093640c12ba72300d179eb81136d52c0b6e052c78f9e8671fb24a6e9fc3b1c54878bb72f82ba824ca45eef9a9bf7a
SSDEEP 49152:mYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0gSsLUX6WH1aUh:lySzP1sgKWH
TLSH
T1DF066C96A1A801D5C1B9C1B98F0BCC1BFB7134490335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 4272968f73fdd03d5fb4d7dfd6d5a6a32174178fdb624e5dedecb5537d2371ba
MD5 d319490c011e32e37201336cc9584a2a
SHA1 573e4c55d7e8446ecddb2b63a0f024e0e7205363
SHA512 0f0e6a6879ca0c2d7cd42411669a287b11d8e58a4e0536552e04114860c3c4de143ec0f067870a501c94acdc343b974d7699e16940bb6950237ca791cc604f44
SSDEEP 24576:D47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY2SLexL2gyX6WH1Mr3nQzh:D47JUQjTirIhCnDHUPfF/QSsLUX6WH1V
TLSH
T1BA65AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 75ca156472b65e883cb5061a7fa81ffbab1e79a7b40d2282e571c5bd04ec19b4
MD5 79cdecf2dfd009f90f8c11e217af2d16
SHA1 aad5fba89b37f2eded45a1ebd870f2b69421681d
SHA512 d9f33b200bbb5eda74e60c8dd3fa115793dfebcdc5a4ad85fb09533213ff908a18be4c96b53f50d6f60c8af020a7f20686af28bd0831517874f8b0073f1d5005
SSDEEP 12288:Bbsf1SdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:c1SLexL2gyX6WH1Mr3nQzh
TLSH
T1B1E4015AD2A411EAC1AE91B8CB960644F7237D5687E1D3CBA2C0F07E1F392855DEDB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 3b03e9b59c76990d28c9e02d35c5e332119fb8f4b66d8bc3c85d5d2488a6277a
MD5 05ea08c4bd1bb75b147af0c7c596a8f8
SHA1 d9d7ba4df29b8d9dc0ab970986f2a9654ecee41a
SHA512 f8e853d8566f06a66523afd9c113d3760a50df9d7d6a830613ea9494fdfef3d13eedf9c803be1e30623379c15a6bf4287b3ea04cf25553b3541c161926ef356a
SSDEEP 12288:YgqCU3f6lG6p5lhStgoj2KcHO/Hu7aF+2YQLUkyT:Yg9UPSpnQgojY+Hu7ac2YDky
TLSH
T1C4251750766BD75FC6AD40321E32D2CCA7707D01EE05AB0372C8973EC576669BAF2682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 2a63099ccaa5bd1e75c0d811596c6e8534625f301f2e4de4c326a1c94ea97f29
MD5 a7fecbdd4480d34cf09405ee76ddd42e
SHA1 493d0e562b1966cd0cff350867a3b03a06889d68
SHA512 54c9b748054574071c739a557a2257a27f6465de163cb33f1a80b7747f156a171fb40e7a977f3c5745c7634de6fc3fd54f9e6a1bb9f5991fba39106a34ff5680
SSDEEP 6144:ST+3R0LWshY7172cS3ID5rTgKdj3LN29cbVtMx+cbVtMxd1AeHbkK2Ry0L:vshY717x5ITL
TLSH
T18D65C8416537E28FD1FB6031072A6B4C77A4EC07B7096F2677C8447AD86BB25A0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 f5c7d41ca837fffdf6065fb55600e76daf7de69cd41dd94d81e56111ae579d3b
MD5 a18fbbc23ab3fef5a879748d0dceeb68
SHA1 e27fefe70b5e24647f3535fc6081c2d8f3996188
SHA512 015ea215d07a76c966abc622ae0c3fc2f76d526bb04f7ae54c7d2ff78b1db999416e0c68c9f56d55ed1265ae30719737c92cabee585fb9a82a2f42ee31918cdd
SSDEEP 12288:/z7NSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:vNSLexL2gyX6WH1Mr3nQzh
TLSH
T157D423A76AB4389BDAB790F458DB01687A02FF875F9181C7F504B09D243C6CA5D3CA4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 3b8115ad4e39ab4dcd6ca3e5040bcd332d8fca36bba8bb601e1b6340e3b84215
MD5 00bfc7d7f941a2af78ed196a8085556d
SHA1 03d4f3a95aa1ca219909bc1040f6d403e2b3f66a
SHA512 d9327b3cd1695d36a0ac18c30fc43ce60a5a250ae87ee07784034d026570b5fd16640d85a6246b602c93d976a08bad589b9c7e6f984db89d69df5d4e660ba8f3
SSDEEP 24576:Jgb6bmBIi49WNNFpg1rSvFv7bYDSLexL2gyX6WH1Mr3nQzh:Jgb4mBIBhGF2SsLUX6WH1aUh
TLSH
T1B965AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 e121abd5bb3b88c8476f2435d44f5ab3986f797658e73b42d1afeb40eb1fb1ce
MD5 bf4d8e487cfcc54e54a2328519323ad0
SHA1 d13650cb6af9948b36227454ed8ba63170c1b943
SHA512 8792677ecea083051896e9d7b32e039e3dce08a0b4876427748a603ef491402f9933b74b0fcef6d64087f9fd4e9f2e984b9b3737928e46ea2d73f81810f7fde7
SSDEEP 24576:TG88u8FpJqH1bzria7/mGSLexL2gyX6WH1Mr3nQzh:i7ZFPqVea7/7SsLUX6WH1aUh
TLSH
T19E35016676E101F1D47BD03889864667F6B2B8160360EBDF07AC8A551F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 dc6cdf0842e73d159739cb12842e1123da410f3f6f14301e22403cbb4d23d6ad
MD5 4eb3f8fa1acd832035956bc0e74327a3
SHA1 ab238eb43789990b6c80afacf6b890342d7b098b
SHA512 1ac788be975f473f81b90d79674f2d3c026f55f626331ab17317749b9cbeab1bcc650044b5a94075bab065bd1769e0a321ddd68edef3064db348bd1ed0fe42f0
SSDEEP 12288:VHvUrBFrEjwaQiSdFpLgxsoCtbgNYXj9AWTb1MPBNIzhS+G7umvQzh:VPUr+NQiSLexL2gyX6WH1Mr3nQzh
TLSH
T18905E12F26E818E5E676E17C8982461DF772B853171292CF02A0817E1E77ED8BD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7f88e3b2a65a2aa441f7293bc6b2f492bcc0100a10fbddbc331cf1e803e9d759
MD5 9399bb71be1b6c460a61811805bc521a
SHA1 f91db214cbf061352535ce8daa72202cccefa41f
SHA512 555d4ee58ab3f1ac6aae7490fdd6b15e04416b6d833824d418af2c81e6431c58b4928c5da3fc959595a28e733a608fdc7b611d12b2d455e8d0beda4e643224d6
SSDEEP 49152:6BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjySsLUX6WH1aUh:lG05lO43bQsgKWH
TLSH
T194D5CF6E62EC11F9D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 380ac93b30a5ebd2539ee35023af93ea1ca28e9e8ee398ff7afbf3904b82333d
MD5 be4af084073ed64ec7f440011604fc56
SHA1 3a3bcc2a3518f115fbfbde4ae34dd5b7cbe5a781
SHA512 a8972247e8fb3ec63df3d00ddb8d8f01f29331cc0612d286001d3f600e747220bf7873ee0008b699baf4f8ef4f59856f44a0cc4175a3a1f9446e20d31b4258b7
SSDEEP 24576:vfa5POZ3dpuWVM50JicR2hG0lasx2+47eidngSLexL2gyX6WH1Mr3nQzh:Xa5POZ3BJt2pasx2+m6SsLUX6WH1aUh
TLSH
T1CD65BF5EA6FC00D5D5B9D17CC583461AF5B1342653329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3f3efd3278f508ec8ba6cce36d2b249a4ab69535613f2d7adc6a33763ed13fa0
MD5 2941b9c306cf03e067959f47e76ab226
SHA1 23c6215e98b58e397ab773e25c450beae03227e3
SHA512 46f8d6048d3d118019d8fdd5645a90d82adc609d5f36cd8b02c1617f2d774ca0b0b7009fb514bfd04d7bcc2e5e4d2d12c430185483d35760d0e8109514cff522
SSDEEP 24576:xNcwHdjbyQ4nLC18lb/EOjowL7FkOSLexL2gyX6WH1Mr3nQzh:xNc/zEOVHFbSsLUX6WH1aUh
TLSH
T175858B2623E901E4E5BBE1BE89779546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 546fd3e8da6d49eeda24394e46a9a109ddb9cb2a7fc8200c99113087e5b159e1
MD5 61e072b0a79a9f7451a82f7ca7ddcec5
SHA1 5a666f2c7e8cb4bcbb0a0e6e8c5e9b63e6a2432a
SHA512 3a483c6e889eccb19dc4f3eab06a8ab2780f166d5be01e7f653037b2ac0d3f83641d71216e97f5962863b38ac0c64b69ccfb01f26c7e3a4e3fe5ef786a88f9b3
SSDEEP 24576:FTkNvNnaFeYhJNtmZBmkSLexL2gyX6WH1Mr3nQzh:FTMwBtOmkSsLUX6WH1aUh
TLSH
T15F55AF6EBAB805E4D1FEC6B4CD238516FA727851073293CB9290C13E1E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 c36d7146030073f94486db992b44c0d059cf6c6fa5d7ed7792ad56818205d0b8
MD5 070d436734e02207280c4190d27dcda6
SHA1 4388d624d82301e0d52be2347cbc68c3e7e696c0
SHA512 31efb01411c3b3c07085587f16a216d69eeb774967a83334bdaccf4acb57a42936170c88dd09d3c03f00558d22fcc84912c8231c0710920e44d2f4f37111a953
SSDEEP 24576:tD3FHshBIYQgAxSLexL2gyX6WH1Mr3nQzh:tDVHeBIAAxSsLUX6WH1aUh
TLSH
T16125E17EEAAC04E5D57BC1BCCA634606E77138A9032256CB1294D1B91F6BEE46D3DF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/828-371-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/828-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/828-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/828-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1556-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1556-114-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1556-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1556-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1556-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1600-103-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1600-370-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1600-109-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1600-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1600-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1600-368-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2492-306-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2492-85-0x00000000008E0000-0x0000000000947000-memory.dmp

Download

memory/2492-79-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2492-80-0x00000000008E0000-0x0000000000947000-memory.dmp

Download

memory/3008-62-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3008-56-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3008-55-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3008-267-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/3048-89-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3048-14-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3048-23-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/3048-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3444-312-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3444-9-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3444-7-0x0000000140000000-0x0000000140400000-memory.dmp

Download

memory/3444-0-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3444-66-0x0000000140000000-0x0000000140400000-memory.dmp

Download

memory/3444-320-0x0000000140000000-0x0000000140400000-memory.dmp

Download

memory/3640-115-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3640-367-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3640-123-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4276-67-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4276-69-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/4276-286-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/4276-75-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/4300-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4300-53-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/4300-40-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/4300-48-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/4300-51-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/4768-135-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4768-129-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4768-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4768-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4768-137-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5100-97-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5100-90-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5100-382-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5100-384-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5100-91-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5100-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download