3da1cc0e4935c81041e1e27195166f269d6c3fdc2b0924d5fe877d34fe48c40a

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
Size 1.2MB
Sample260803-ry24mss1ct
SHA256 3da1cc0e4935c81041e1e27195166f269d6c3fdc2b0924d5fe877d34fe48c40a
MD5 6427265fcaed0f231c0ed0da6d881176
SHA1 b72e456ba60138e702302846d34ce3e8aeafbc2f
SHA512 d5869c3d93afd0a284136fbe241cafb7e1fb193bcc002332136f0c81a9ce37df41db420a61f2b3f67041408be82375651f4e1b19bcf5fb75a94ce63c2ecf6439
SSDEEP 24576:a2AoRP0A4RBajzrxTqN0Yck0LZmmNRnQ/tbw/2Mkjy6Fr7g0o4:a2AohYBajzrxqXcNRQ/lFTjN4
TLSH
T16B45C017B39404F8D06AC27ACB664112EBB2F4850A75BB9F13A447252F37B985F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2424	elevation_service.exe
3020	elevation_service.exe
4776	maintenanceservice.exe
1100	OSE.EXE
948	PerceptionSimulationService.exe
5896	perfhost.exe
5588	ReFsDedupSvc.exe
2252	SensorDataService.exe
3140	ssh-agent.exe
3836	AgentService.exe
1280	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9ba57fffc618523d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000082fe71965523dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
2424	elevation_service.exe
2424	elevation_service.exe
2424	elevation_service.exe
2424	elevation_service.exe
2424	elevation_service.exe
2424	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
Token: SeBackupPrivilege	5588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5588	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5588	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5588	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5588	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5588	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5588	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3836	AgentService.exe
Token: 33	1280	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1280	SearchIndexer.exe
Token: SeDebugPrivilege	2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	2584	2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
Token: SeDebugPrivilege	2424	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 1912	1280	SearchIndexer.exe	101
PID 1280 wrote to memory of 4392	1280	SearchIndexer.exe	102
PID 1280 wrote to memory of 1324	1280	SearchIndexer.exe	103
PID 1280 wrote to memory of 2776	1280	SearchIndexer.exe	104
PID 1280 wrote to memory of 2352	1280	SearchIndexer.exe	108
PID 1280 wrote to memory of 2792	1280	SearchIndexer.exe	109
PID 1280 wrote to memory of 5296	1280	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_6427265fcaed0f231c0ed0da6d881176_glassworm_icedid_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2584

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2424

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3020

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4776

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1100

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:948

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5896

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5588

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2252

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3140

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3836

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1912
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4392
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1324
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2776
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2352
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2792
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2912 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a2d36611b7586e34f388fe2d36abac6eba24f877ab654ec3106a5d75555a0d13
MD5 2e1080f7c97e8cb0c44282d37a267402
SHA1 fd15b7bbf2444298bec51709e6d9f18c8cc22f85
SHA512 7a684cd3ac90847381533ffd0ac8001940d913c96efdeda4ac365cabec2d77fa7d3702ebe7074812777977016d16a6331fe01edc8d494511fcc2756a2d710f67
SSDEEP 49152:nb+632BuPkFKRrdE6ohmstBhuXjfS4LWxn9Q/lFTjN4:V3q6HjBVLm
TLSH
T1EAD58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 350ba4be69621e40c0edd157b6649dc841cc0b7708e10288542e5c254753e33d
MD5 38a9375a0005181b650cd20ebf8aba3b
SHA1 ccbe71137a0663bc2ab6d676518f87f6b6e241ce
SHA512 91ab81c1df01f07f06d59461287582102b2b1e8530b6952876027d983b04be5370d1479fc6f10e686f7210df8b70f6b1a191566f48cd8b7b7a15d7ef50f94099
SSDEEP 12288:S1XLsswWkxy2lRq2czAWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:4XYfDtczA2nQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1F365F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 28e38def714774478bdcbcdeb08c63b47db5e69c15b2e565cb261dafbba0b5e7
MD5 0bb53dfb91b017f38ceb702040c170b0
SHA1 da677ae1bc844cd24886a959adc7eb7e1bec14ec
SHA512 a123b1ff05a86fa1f76f985c3b35c588a104862db51ad5a2ecdabc48e8c27b1ceb5bf5b991f24c3575419f6c44e63d6913796172b001a72d0f90baba318269b9
SSDEEP 24576:k0Le5ji0hmxLrMlnQ/tbw/2Mkjy6Fr7g0og:kPji0AlsQ/lFTjN4
TLSH
T172859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 5a2cf786996738452528c9d6c8710130f5746d3b06e261d6d507e8fe7c0996cd
MD5 04045456c0af3d0bdcea652a415ec950
SHA1 cf83f693ca60a1c887aaeeab840ecbdce53ea72c
SHA512 ea51da71584033b6e2388427c9c3bec34734e4668648bd1a0b2eef12262717aafefe1acd1f5a98ca623ee936fb7639d964a0728cd83d95bf937f7e12b1039f3f
SSDEEP 24576:ta7/ezSC6vUyD/aqgrvWE6q8wyuPnQ/tbw/2Mkjy6Fr7g0oz:k/ezSC6vUzPvxHjyYQ/lFTjN4
TLSH
T12C755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0e0527dc42922e84cd497e951316d773547514f04d65aa20e9cbb58f859f473c
MD5 040fd456c33f3f2cba8eab875be1f72e
SHA1 72312ec750efbfd6841a8efb34e2fa933656789b
SHA512 6affe37d279cbfbf6dea8e306847023be5ffced7acb7b377a99aae1e7986618c244ea6ad740417e6374f7126766b30d4b452294b279decc65fcde81400a8d028
SSDEEP 24576:oVbqPb88hv/l+6KnQ/tbw/2Mkjy6Fr7g0o0:oVO88hXl+BQ/lFTjN4
TLSH
T150559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 9e24715b46b360a351429d49bedb1fdb774f1d0a41e358102ba738a29d113ca6
MD5 7da7c92e1ef13acefbc8f7176de6835e
SHA1 4de84c37d4f08fe82da2623449879616396adecd
SHA512 1d49837ff12964f4fbac93b03a803dde5ef99b00a3d54c6c60653f52b0eb3102a14e2135eb5656b1f8ca26affc0fc97421f33c1b9efe7f9c2f165b448fd6a42d
SSDEEP 12288:6zpGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:6z5nQ/tbw/2Mkjy6Fr7g0oA
TLSH
T15F5523796A24F897FF2B06B15C8284826B7B0EC1BFD4A74E7B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 aa7c10913da5fbd44a90a04890707249b91f65fccb9e851381416bfe0dff7500
MD5 47586264c941bd3825ba35f7ea7a81ec
SHA1 1901f3208d302bb79c26a2f162e182e4d82520c0
SHA512 963e23c1a1855c28260bf992e31b02cb0c0aa4eff6e4728c652a033947682a1ee15bfbada0c19563521e1a84f9dd10acf3d72481a2a0e1bcaf896854cb89eceb
SSDEEP 12288:JeBNUbTVO86UyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:JJIUynQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1C275CF3BAE28FCD2C67E4DB85A918600D77278704F61A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 18ebcd4ee1d9961d81a35522dd906bb5bb9aa86d6a218f5cb78b4f40ddd643c3
MD5 45051e24b7ecba757bab5c7f3c8f84bb
SHA1 a71713299ce8517fe245dfe2380ca6fb141dd2df
SHA512 d64d6746aad51c87e5f2413597a70a1c6e7672e3d3eaa60ab0b1eaee07c91ccd9b9cbbf70e50a7f47e86616d7231c81bf4c07d8e9e77fb9687b8374147824174
SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH4:SQvGAdlCEL8c/yRNw5C0Lm
TLSH
T105267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 24162d6a7388abd632a152f6b7657bb7267fb4efa49926cf25ae88a7e923fa6a
MD5 abfb2d49c8aac39f8f9237772b344192
SHA1 e074b2e873294244578c86b736f1c95ad913563d
SHA512 2692b368acf4a007f078b0a41372d32fabbedf0b792cdc517882ed37e9bc67f278059a66767cf741107b5daa18b43d1380634203d692bf10695c072ce7ef1960
SSDEEP 12288:SAwSfxL/2Dc39DLLmt0LDQewsAjcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgG:XQewsAjcnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1C375E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 2247824822486d7f265e368d316922895df9a2385d5d892d44947081c1961ae6
MD5 f422de2e12634629871c8d12c7f59271
SHA1 ab32d1c8003fb1c46fecc7d70c2bab54e0ade5cf
SHA512 a5b1d9e8266c5a70d2946287164fa580598b2142b229c7e8a45ff737324d41ec3b544baf5d82c3b9a4ebc2da485e6dab73efc338745007f9d0dffc4bc87bd111
SSDEEP 196608:ZUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHnL:ZUEtQevvqc2W1cpV2EI32
TLSH
T11A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 01224cb8ab1efe05d0f62dd9251ef3473b63edecf321e6bea5fe1ca1c5e88684
MD5 5355b2e7522473868d45be87dbbdace5
SHA1 ce4ad9f516195135dc9cdb24c2017016036ce5ce
SHA512 d931efdde5ab0819c578807c4e6545f27459bbe90bedabde3169156461963fa67dc7df035d9cf6b00149e3784b6812ddb6a5b7dc61fb30e26f2dd0e02ef70e4f
SSDEEP 49152:1CbRquA/m2yL5zQfFiV+XenmE3/z8Q/lFTjN4:ioqtVjnmwLm
TLSH
T179D58D1976B8C2E4D1F6C77886A2C647F37178154B30A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 804991b7cf53cb7d8db95df8b327ef921c784fbb14767112dd8907ed327fa103
MD5 e346af78ef7f78e1941a1e264e5d3fe7
SHA1 7ac948f78bd0b81fb2682f058bcae29672954560
SHA512 633b422ae7899a2a74575f9519788157d575f732ce284f376e30f3b2d80ead122d27b292c559f872e4103820421db43dbf33c495d4f74e9d401ffaf1d0f62daa
SSDEEP 24576:cAhGLJIFoiwtA5l7S53bnQ/tbw/2Mkjy6Fr7g0oH:cAMyFoiq5rQ/lFTjN4
TLSH
T1C335AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 14764f1d7075096b3bc10c97636ecb406908be462f38dc3dea9382de20761cf7
MD5 05548e145f8951518b5ba0bcbded1540
SHA1 f756a950969c0608edd2067ba9c2f1f11b89bb58
SHA512 1096cfe48f2ddda4c618749b76f344a024d50357f913c7a747a304fb8ff5f9df416cfdb938c6988ac23778bc72ea1cbbd1710a28559b781f1deebe12ecfa87b4
SSDEEP 12288:9mw5HEjsChN2BFgl0WDm+CPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoML:4wuHOW4nQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1F665F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 ffbabbaed20e60970b843cf7594c3dcab8aa9decadf7313bc1b96f0d4b942187
MD5 2c8218724e28d12a8468417f3e9be1aa
SHA1 ec54073fa3075c9ff90b3bb3c49e260bd99c3efd
SHA512 0ffb3e5eba4b85a755de45c1a06881bbbdd5a34f1e38446c3716d3407ee75d6b92f2547eec51d6a47a5667c6160afffa4508fea9817bcff4a0ca2bc1a7bbcf38
SSDEEP 12288:oXZ1IyMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:wZutnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1C655126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a87bbcb342eacef51c9337536ad514adb4c7ebe60c80343a78f7ab8cc5a22d84
MD5 b69a79a2804313035b6aae42ceedbcfd
SHA1 1c8d3e04a2b0ec2b63d62a9b9b73a222975b82dc
SHA512 36f95f839bc0f7680a6aa1d824467863100988b34404d1279904f611ffa5c5f1f88c70cb3f1239df2aba39a9cf131085d881694223f160825b8818217e989165
SSDEEP 49152:pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UU:QQRQyi36YOcPQLvw2gAf+PN3ZLm
TLSH
T102667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d60af253d9141c0f6b7970efc076f5c689fbb026138821334392d90b7310fe85
MD5 d312c9d3c75c8cd01dd7c23df30584fb
SHA1 d86b96320398fd73f175e3fcb5e8268f702a0106
SHA512 c057228fd1fa5089639ce930f32ae46829fadafad9413e65fc0dfa7bc2199b2f377cba98b21a7d71be52907e3d5a20d4bbdf6b2727f15bc9f39257ac7fa3b8d6
SSDEEP 49152:hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UU:oQRQyi36YOcPQLvw2gAf+PN3ZLm
TLSH
T1FC667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 fece9026daa4c73d457f0a991d38b9ad96823dd4d66f44d184e6a629c99b8c62
MD5 67b10bf80ee901ab685bac685f74e094
SHA1 f3cdbf4d684171710661bb1a704e4936d90cf58c
SHA512 6701e9d71d5335d8c209fd095253df2c5c022fe6e8272805a571eea6eeec56ae5104b9cbfad27c24207f521f6bac588005f4b2797ea01a6ec4c93a6148e9f0b2
SSDEEP 24576:DwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL09nQ/tbw/2Mkjy6R:768Qg55nhheWu7PNU3/sQ/lFTjN4
TLSH
T1A4B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 13de3c83ae77dd18270a5f8dffb817d7c6a90a863cceeb810c994d728071c288
MD5 e817e4cacfeb09f6ae6f58213c2b5e85
SHA1 5c82db7087ddfaf92e2cff7fd1cefd5d8946fecb
SHA512 a638494fcc7687fd4ff529614f349d3302b690923892a75647340b2cd0d96c1a7e890a6ff8653f0ec5050a5a972d3b7293886de9ccf2db52a9c8ddc8d7d8edc9
SSDEEP 49152:Z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99C:Iy5112gYy5azzVvL69nLKnhZuLm
TLSH
T18C167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5054a2f90215ae094df74e3dc406c628cff65c46999d7e053a83521c3b595e13
MD5 7312f17be82849b75b4b5052a5a42408
SHA1 90742ee648348f72e7c7e9a8642a6735a51895c2
SHA512 66efd31d2aa5fb241ea59dccce1dfdf010ea7e0e91c519b63e21cd33ca9b8e0dde592a126afd2e764a5ebb70905069f655b0a19349878d344e23a497ecb1f700
SSDEEP 49152:OB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glGQ/lFTjN4:cu6JmVxd2dRLm
TLSH
T1EBD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 cc81ef247f42168a3623365e16ae96e8724bf074fe59bc850250e1d2ada770d8
MD5 debd9a0d1c3759f022c3af43ac38f65a
SHA1 847c600761b7e35792750b7e12da4ca52a57f9af
SHA512 fd36c89e05a815faee4f31a3ae4f89d686f652fdc94aa29629067d714a726d07ddab8ec0a6184eebad8fc567c3cd166dfbc22eb4363ab6dd0aad7717973f4353
SSDEEP 49152:O1hpsNoJpF1A6UU44CwH7R4xSQ/lFTjN4:OmifPbRwLm
TLSH
T19CB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d692282b34471eebab19d748b10f589f9aff91a1b6662b20a9a28d9ccdf89433
MD5 a7eef2ff05e35a8075254695f0398089
SHA1 ec3fac42e9e0a082dc8b4c34e66055b77fcb1713
SHA512 90f2b11dce8d57f5323ac0302dbefd551d4f14ddd876715f19f264170ae713ccf41694b2923f98012b727662aec845ef6ccdfb606d88e6d9720218e4dcb48fed
SSDEEP 49152:VSuZQIY0Be2KRRVtOnks6NMHqtQ/lFTjN4:75dKTi61iLm
TLSH
T151C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 283b9f479c8d86f211eec161d01bae658884a74ee7a6c962e6c631fe37c1a85a
MD5 0830e1efc7b36c71898c9d8022a2aa0c
SHA1 27911914a255cc406960dd20f9eb6000cb6c96cc
SHA512 1995420fd9b227ed1a62fea95f7aa6b628bffe1b74dce3941c7e76129c8e1aa7fee23e072d77f246e3a5d6b9d52dd7febe28e5553f7f178619dd70dd237a061e
SSDEEP 49152:DhtSn8EApI0figngiDn0AP5w2Q/lFTjN4:iX2iyphcLm
TLSH
T17E95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 4e9855f84c375ca738aecb0e9418acac51680bd2e24d8fcb19ae227ff1c3c030
MD5 b728fe3613dd08918f5584a7b45621ab
SHA1 2cdaecf4f21d78dc7286b1dc956f2342871b4b73
SHA512 eda52265dc7d8630b263f53e58dbb2cabf65922bf37a5287d33136dc31fe7ad8d1222558ce8fc1666b90d35570718494c893d6d931cb96724c3ed4123f7e02a5
SSDEEP 12288:ixGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:iBnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T13A5523697964F98BFB1706F18C828182A73F0EC6BFD1938F77082129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 31f989e0cd1797bd0b36bb7c55f0c16dfb4223684cccfc1f1ef86229913f3c76
MD5 c30dbba3080e237475ce7f02ee360532
SHA1 ffa0ef4ebe7d6b4ac13073383e75483072d8bd1f
SHA512 678460df9b63920c455f6c08d5568f68a47fc3eae5c4e0e5ed63e901fd315dc9466ef9580404b45696a3a78818c185f2d375db521369838027a3b938baacbc90
SSDEEP 12288:uwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:uQnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1885523797965F98BFB1706F14C828182A73B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 2af9d2f8c810d4e36c44c9e52079342cd62dd9226e2b17594abf0fece16df0a4
MD5 705926835382105728466ab04ccec5f3
SHA1 f9e55c129fe974b271e7250990c35ff1da809822
SHA512 6c1872d73c9bdba61444fc639e37bb3c1ca26c2a88c733a98f1e5c4a8e47e2b8e9710fcbaa74c83a19eea1116b497ba7a0fc196cc21392228b8dce66803a3b67
SSDEEP 12288:CaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:CanQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1C55523697965F98BFA1706F14C8281829B7B0DC6BFD1938F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 b99b667a2ab3dd3933cee11807d7bef6c9307149543eae6a2e6dcc9c031b56d8
MD5 330806bf097a398c2fe296b93ec78a5e
SHA1 e969a2f93a37ad0c4c87f91b925879ab30db8907
SHA512 1280aa2a07c4f4d0a5d3b4e6cfa25932629834823ef86b6924ee2bea59e0b9ec8642cd89319f97313532c80076e62ea6038c5a3b22eab7ea22781e95a43c6036
SSDEEP 12288:9VLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:DnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1B65523693B69F4C7F92742B4CC928142E7BB3DC5BBA1A3CF6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 59b62b8152b180e0a832ad2190aa34bf82a4210d1307aa4240f77fe616a3dec8
MD5 552d24665bf046ae894e05b3d41fd8cd
SHA1 b12f26b4811e0805aa977644d30b7c5a03225c52
SHA512 1859eff8e22167085cc23b8127e64aa07e1357a6cbdb22d5d63c063cfcdf340c342a19d28b6a3984274defcbb31c6804d0079c5e3a33230b47523eb30d2aec67
SSDEEP 12288:+DGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:+znQ/tbw/2Mkjy6Fr7g0oy
TLSH
T13E5523697925F98BFB1706F14C838182AB7B0DC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 1f6bb7d8071b66b6cc969a568fd68d42f21c24bc5b10e657cedab7cd81e4894f
MD5 8ac4ce9c9a13d275a84863c478ea4a7f
SHA1 c8c3a0995c8658c4235a4103666c419997d9f6d9
SHA512 9e99b08fde3450f0af5cb3ce33a3b68014076837c67d95533c63ff661849aed214745ad35738684c38cd27e1114fedfdfa932f14c401a9fe5ac06f5d9bea30be
SSDEEP 12288:QEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:QknQ/tbw/2Mkjy6Fr7g0oy
TLSH
T12A5523697965F98BFB1706F18C828182A73F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 387d398bed5c36f190c365e14aa4ad0623682751fa621a3ff4d268514adb4516
MD5 053be32672aa9b04d8a9cfaa0c82f6f5
SHA1 647c388962aa9f9aa5f5c861d1a5f96deff3d1cb
SHA512 9f1584a4d50627943da1b48eb824f3a5ac205f6c3b90c80210230db46269e347fd6b0ad45909c28f77e34659fd595b2e4ed6476a53c0676d446e1f2919c208bc
SSDEEP 12288:PIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:PInQ/tbw/2Mkjy6Fr7g0oY
TLSH
T18F5523797925F98BFB2706F14C828182977B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 8be11fb745ccc5790b0536c9daa7c399b5e6c511df97ca65a17c89d5fcc9378f
MD5 34cf610fdb48e87dae76ee31c26279d4
SHA1 8feceab52785ed8491cccb8a7cd33036e0641ef4
SHA512 2fcea90a394ceb1ef29986c2434c77c183b9f13bd7e7f62033f6b7285f5c727cdf41a10405615906c68b6b9913307975502e16f802cf51f21b7f8019dcaf30aa
SSDEEP 12288:8iZwbDzzFEoS2cPvyQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:fZM3zFVSOwnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T15F7501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 095262fc00dd4d51efbb2040b93b4ed19cd1a279127cc96efaa9db61b3f2be88
MD5 17f18e96b84f4ff351ee0594a089a012
SHA1 e594eb40087d972575774b76e324bbfe6a636d4f
SHA512 481f7267b45c16e50f17c046c973c2a89be589f91b0a53506b1b8cfcc4d2468b31005747166531b4c5971f9903aee6dd4e9e0361924e3a752ba335987d111120
SSDEEP 12288:P9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:PdnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1C75523697925F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 e910af36706413ad56c73ed6c7c0edce37629d13ae01c4d887553f94bc469164
MD5 c8f67447bb327e422d83e301b39eaeff
SHA1 c7ed5d1f2a3fdc64815cc334774e20ee1a8a6e59
SHA512 ad2b16f90ca081b938c8b9d38433c40706ab06d68e231aeae50c255c26a4bd176f2901644da7fe7d39c611618489244e1129737d2d9f01cab71df1b02e43eea7
SSDEEP 12288:kZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:kpnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T19B5523697965F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 87de47985c5e60306400ce4443eac5ad7437b7017946de5f80a5627447e50173
MD5 02b6d8d4e83090f764386d580a49435c
SHA1 f08c9a5bd69d68c002b898d241a55a0a4a2d94c8
SHA512 3f27a9dc2a1c35996441f3f0417011b34f9e881ef4ba6548ac30d4729047b48ab6193c35873f794503591e342ac977d29096b2509db5df740b53f5695f10f121
SSDEEP 12288:ZyPz5L8MGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:YzyMnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T12265021773A570FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 0a87b6aaa1f807e17cf583a108b252ff122246e3e02415b73a73fa58c35b4e4b
MD5 38909b10995030511fe2e1b580ff1faa
SHA1 92a8a49c283b5bcb77b36d963d5eb5e6149d65dc
SHA512 1ca10e9df1c7daecff780d8bedec28b3f7ca0117854954ed465cb83a1a279bfa399e65174bf8374e3664961d98d44f72695dfda69c12451b37cd22a8f9c9518d
SSDEEP 12288:s9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:sdnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1765523697925F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 a519dee814a453c1bcb9c77f54302325838ab0c2a282a3a4dab5d69d219c04f9
MD5 d31338986040443eb3563e7b5ee5bd8e
SHA1 eaf140a2d303bfec3feca4f8650d717ca5dfca19
SHA512 0e16488ef261600d3d7ed6984af52bce77ee11fa58bf5ce510fd45d2139abdacb27d1adf8a25ef7232821b27d2096eef965f6a8c9f73a8e91ed9453e71646675
SSDEEP 12288:Q9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:QdnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1CB5523697925F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 a5ad1d6c1e0309a463cdc0f27708a88b33e0820c56c60f46846d6652f749a927
MD5 039df2dcd4ae66d380ba1cebdcc6d662
SHA1 d40125cf54d3bc721a704d86343de0eda893d76a
SHA512 4742f8cb0a6ae4eb7952e4309a3a6c4928a2b7a4530c6e3a9bd4a2f00460d63583a3f1bc5d975e89859df5e92f7e70fa69fcb84ecba35cf77fb37a87c3921197
SSDEEP 12288:ayPz5L8MGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:HzyMnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T15A65021773A570FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 5358228e0392c32225875b8d7c4f43e1953f83af22d66eb6b4bdf81c7d26b6f6
MD5 239022a0fb25f53ef267e51bc2570170
SHA1 297a3a4325a6e83e22c222e141cd47bc3f5d355f
SHA512 f01369dd3667e0332576bef6f94ea683a7e17ad176ca45730d00994707d3a1a0c2e9300b745fc53bf62c4332669828f6b599df4889205290dd9f22f78567705c
SSDEEP 24576:RT0aLl3z0zDqnQ/tbw/2Mkjy6Fr7g0os:RTDLljPQ/lFTjN4
TLSH
T1887501A4B35068F9ED67417ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 04377c78d0c122a795c3b71286fe16849eff4ebc5577c1ee0a3e7c448026842c
MD5 78874146789ea5ddb00701e6044020b0
SHA1 ef98537e43654cece690236d5ee9c26e872e42b9
SHA512 c59911f75d89114f5432f48c069b11aa0ba3af9c2036b61d4e7b9a7f5b1a6c625daaa5de35b479511d3a8fde148a3fa527480730068127f9bb6b26c89345554e
SSDEEP 24576:/31d9CHKy7GZenQ/tbw/2Mkjy6Fr7g0oe:P1d9CHKyaUQ/lFTjN4
TLSH
T11385CF90F3E414E9F1778A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 0c8979a74e03825080694f46f4f79272ba9439a3dddbc56ff724dc3e72cd082c
MD5 fa9f2d482402af8934b49744a39812cd
SHA1 48f9faba1b407a014ceba72b8c4b5f95bc9a3baf
SHA512 9677e726d6901da1408311727e094721e4c9fbdd937bd84578bf69698f453de4bfaa782e0867b21deb37db60b8f212165a31ccf0ad71b0fd4bb490adcf681f14
SSDEEP 12288:c6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:c6nQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1745523697925F98BFB1706F14C8281829B7B0DC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f13d892b3826b5c9a7ce08cf00b129f897c91fe64c003388e7e251434ebce014
MD5 5e2b710bfe8f31ab73b1acedd96b9123
SHA1 d3ec9d17c840ac7a8d167f4f16af26b695a52b80
SHA512 dc0d4de863853b6cdb0a8c4e9400551856b9c63754483e1acc766cd944bd833ee9bd61914b9998125ba6319132580e7f807f36d53d5465965429f06495dc4c4d
SSDEEP 12288:YsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:YsnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1A85523787924F99BFA2B06F14C838182A77B0EC6BFD1938F7B481129967D39406C63C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 4d9194743716b747031bd0a619c0dec147820bbd3da6d3588fe82dc49f206608
MD5 366e0372ebec20a08b0ac99a1070903c
SHA1 e7c0096c75860d1d9463868a82e0460143a0dbd0
SHA512 b0191f27c04dc44e5cde54503614bf138f1913b30abb844e799fc7a7579fb2da263234e0cd83b36ec54e338d9dfe9567f334aaac0c3022eae04f55a8a1ae873c
SSDEEP 12288:gHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:gnnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1515523697925F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 152aa3ceae1483fb2f0b0e46641781064b66c7934c4b064ba9951c9b01039034
MD5 f3607da066167e0d399477117626257c
SHA1 42f99028cc60ad7db71d3caa380e72d64cf8595c
SHA512 eb437d57bce350c7c8192047a15cb2d69191ba0f6be6cda2f8f8351b4f74b33f8a343ad7ecefaf7711021bdc4b80d4cb359db4521837d698e38cb242205cbef3
SSDEEP 12288:d9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:ddnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1FF5523697925F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 1c861398c14a48fb78f9f953cf80036976f5ba0d4392e498bc40739297599609
MD5 e2b7e43115524f35f5447b0d0c1305df
SHA1 7f62d58e7d23f28d2d70955bbea628a9dec299be
SHA512 16e7f5e72a6960536cf4ac237fd8a8882c2164713c0f574c42a1fa604d023bba6f3c56d409bb0a7cf5bc38c97a254e8166d7c031616c1a7c81434d65e506b720
SSDEEP 12288:d6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:d6nQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1335523697925F98BFB1706F14C838182AB7B0DC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 a8f3c1ebfe883f4fb0456af3c1b803c73bfca07175a3133268ddf8026153a621
MD5 87b9b7cdbc697ea750b946356b1d516c
SHA1 1a91007c6fd4fda09fbdcafb1b082f0bb01c20af
SHA512 a01d52b144b7c4526597a68d878a46bb0b9c4397beb5f498bd9374542e7cad27c0c7d1a55b571b0f3c09b8b847345c70a7a007b08049a788942aec3521659b13
SSDEEP 12288:IVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:I1nQ/tbw/2Mkjy6Fr7g0oc
TLSH
T19F5523797925F98BFB1706F18C8281829B7F0EC6BFD1938F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 413c9e52b4a6a8b78a8a46855b82afc6d3e125800aa62639cce94cc9a4e5de56
MD5 732de299204252826e0dd6af062d82fb
SHA1 9400bc8a0dfad30e3fe3d4aac2809391481f6ee3
SHA512 fb2b60a69f1c094c1512b48d18b4f032faefc4c2ee43232a7794fe96590ac6eca620c35b521a42fcf0fac3741a576106b39cc9f654cf3aae1c04b50a14add678
SSDEEP 12288:sDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:sznQ/tbw/2Mkjy6Fr7g0or
TLSH
T1B35523697925F98BFA1706F14C838182AB7F0DC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 96b2a9894db9a2408f6cbcc662a486107337765d7c233cbfca441ee011bb387e
MD5 cc30cf6e22dce95b098596e78149bfeb
SHA1 4bc42e992815172183ca0a5a6160a4ba8263e64c
SHA512 114fbb0d5e237e813431e37c84001999a8d3b6c6c3385ff991c325ca52d55fefe1a6c37c1dd3c728f2de836b741212f3922b65fb4637d18bfadca525aa56fcbc
SSDEEP 24576:Vfwv/k9RX6wkyAIZnQ/tbw/2Mkjy6Fr7g0o2:EMnYIZQ/lFTjN4
TLSH
T17985DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a4c3e57f76b0fd451e85a58dfde2ea0bc4898d44f5b2c26be72bc0504d74c60a
MD5 fbac83466c69cd7e07d06a8667918d77
SHA1 8517191b886bf81b7b756997d1eacd1f7efac9e1
SHA512 ea90d5ed67ee3593d338616fca2eacc9ab81cf5f74979057883ebb5fc85e529b9e3627a8be78bfc0d38ee2253a453cd339cff4fc88937cedfd5b1399c62b9ef7
SSDEEP 49152:3YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0WQ/lFTjN4:TySzP5Lm
TLSH
T1BB066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 0008612d58fe089f1a4ed57d8f47a998374e5a381448aacd9a6489bbce0dfd78
MD5 fad12ca1f64d946dd6e60366a0e69497
SHA1 5dd6d33af14e60943d1d33a6781abf74a10dfedb
SHA512 b7d6c50aa12adf563de6a45a3847bb4174df347700eb617fefe7387c684617c45e5165983427f2334d5018be7bda725f23b2c5f0c0f9958ae30844f679850318
SSDEEP 24576:147Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYgnQ/tbw/2Mkjy6Fr7g0oz:147JUQj1irIhCnDHUPfF/GQ/lFTjN4
TLSH
T1BC65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 4a0066ec0992f118dbc7da5dcf3c6ad090e4c372f29a27141484b41e6d1b6f7e
MD5 3bec00975938c8c9fdac54454a2151e4
SHA1 0d83ae17b91c3672d40a47942c029b00a62fbff8
SHA512 580393b34deba2e15625a90596664cb4b85798cb2caa79e26603106fe85b48d6873a2c1b10de72115fcfef4802c64f8ecfb74f065261640f632461b9d1b4f6f6
SSDEEP 12288:+ssfNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:otnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T18865F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 992KB
SHA256 ff6d5a5f1a91317b7a9e29539f5499d3be1b918458e0da71a8dc176fcbdf624f
MD5 4f748957a0703f03fedda0cddb79a688
SHA1 a5a7140d44a67db3450bbf23f3efdf131a7ead72
SHA512 9b2f87944e795f51d080a7eca1138cb19a89e6100d468d76337e07e1f11591883a86b42e8b3f9857e193c9cd2d958154df55dad32e7f518bcd5ba8701ff6af33
SSDEEP 12288:YDdvzsU3fLKAfafOVkApdL9kJ4d4lc+fr9g1mUap8MfwKUb2:YDdwUPbLhr+frq4Uap7YKUq
TLSH
T104252710762AD75FC6AD40325E37C2CCA7707D42EE059B0772C8872FD576669BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 c9df8f715e78602cfc6ba93502dc991593a8666a7fda0d2938a7265bd7b81f48
MD5 92c1e714de86061a813873d5ed118b97
SHA1 619c8b9692320fcfd6469816bad1b4325f822aeb
SHA512 d0945367a969430cbdb886800603f146da655a3865db489e1f3ddc36469acf91369fde4a97c6ca42d9b7cd6579036979cb37530655502e637fbe23c9b3f94fd7
SSDEEP 24576:SQdQ2h9va0tduirPRzErCuOSz+9dCvnRL:PtduirPRzErCuOSz+9u
TLSH
T11C45A4815537E38FD5FB2171072A5F4CA764EC07B2496F26A3C8053AD81AB66A0BC3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 0c6e9699f424eb1d613e4a8417c4e181babdf614bf94a959fc1d6dd2a63b3bee
MD5 48b4713075e85d6873a0fc89bb03cd8d
SHA1 d957cdb0ab4214b3aec9a4cc471b0b8614a7c722
SHA512 d659b4c813089332d3b3388494d96a71a04061d0945d92f93d3b1db5d28b3a41c8d052959c42c321a39eb826c4986bd08d6e2cffa9182fe52595737a47b1e0ca
SSDEEP 12288:h67lGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:oFnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1155523756668F94BFA3B06B058828111673F0EC5AF90D3CFBB082269957D3D40EF6789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f3a376a70328206b69d5c27e8f81eec58dd21e65c6ab507468a1f25bd183b7ab
MD5 f739bbf46f54876dd70bf35aabade7f9
SHA1 cffbaeeb5d58f9b7970e038d04a326e5af3f3180
SHA512 04c9d573bc725ad0f90149e0377a891c5bdb64fcbe4fbc5fe67d3fd815c3666c88698a506f640d60d9ca884a11f7ac425c30eb278ca5daac451f29cb21e57197
SSDEEP 24576:egb6bmBIi49WNNFpg1rSvFv7bYPnQ/tbw/2Mkjy6Fr7g0oZ:egb4mBIBhGFgQ/lFTjN4
TLSH
T12865AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 75c30bbc1ae8245844ee92eb6bfe396c504f1a8ed292e2aba0bb492df8e7984f
MD5 88af396d790e4ecb962de1fd466dd9d6
SHA1 d2cdd90cc795dbace81564854d60b0570e20d9d8
SHA512 19191c81769d25453b44252a2e788d8514e75ece4e49faa3327cbbfb5761d05e996ece1c8046d0b072d4abfba9bb8dcc062d70ab1cb01382e79f876b91d12377
SSDEEP 24576:OG88u8FpJqH1Qzria7/mwnQ/tbw/2Mkjy6Fr7g0oo:F7ZFPqVva7/HQ/lFTjN4
TLSH
T13585F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9c131c97f7314c6c2251067f67c97296adbd063e1f51ac073fc0529a76b2a32c
MD5 2afec6ee238f9af0e2e5ed3260f0e58d
SHA1 0ab056fd10a7f87fc8a23a4d672c987bfd4f14cc
SHA512 bee5d89ac61c6eabdc59f62b13b880f761bd3d92a04a8d8aed2b60be078afb23fd14dda8db7cb8ceb3324b48a7dbd14c5735134a122d1c035110ab5789007f84
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjkQ/lFTjN4:eG05lO43bWLm
TLSH
T157D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b6239972e30fb6eb76adbc605a36def15e98195422a7caf9315d231c1bce037e
MD5 bfa7ca6848613c78f76b3d3c12b78d43
SHA1 dc3621a12472f0c071c112c9f8d05bf920bf2734
SHA512 b9ff6cc0e179455ccb0593f75baa74140875245deadca7184d380f4e4721fe6a9c77304d598d104d0be6b0cef6b20111b1d861d20dacc300fa3d27ddf9d1d0a4
SSDEEP 24576:Wfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnWnQ/tbw/2Mkjy6Fr7g0oQ:Oa5POZ3+Jt2pasx2+msQ/lFTjN4
TLSH
T19C65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7841e3b1491b49a81e207071ab192fbd672bd58c10a1899393cca2df181afc27
MD5 d157fd03bde6fd93b321fa3c8e14a3c7
SHA1 616cce3cef03c14ac02020b9f53f450888ca9b04
SHA512 956e46c07fef789c8fca91fc1c07bbd856d2744205bcb4ff3f93665ac27a63102cd62122c4a2499fe1379891b514a331fdafebe32c360356d42ac2a5600f7eaa
SSDEEP 24576:JNcwHdjbyQ4nLC18lb/EOjowL7FkYnQ/tbw/2Mkjy6Fr7g0oQ:JNc/zEOVHFnQ/lFTjN4
TLSH
T124858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 bee0ae098e7f82541116be94605f64599052012622b5e8b7a9adad5da215d560
MD5 c0d72a19e6a3d49a4ccc2d1b5686f91b
SHA1 2d6cf39a15d4bca4ed9146312cac3a1632d78ca0
SHA512 03fc6e75d8cafd95e980a5300fcabc6b62a1abe84c3a570d43cd1b49c2f7e13c0055bea7835b76a4a09922bfa5fbec077e79454656ee26b7c321ec534a88b734
SSDEEP 24576:M8kNvNnaFeYhJNtmZBminQ/tbw/2Mkjy6Fr7g0oS:M8MwBtOmiQ/lFTjN4
TLSH
T16755AF2EBAB846E4D1BEC6B4CD238512E6727451173293CF5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 c52c76044ef6673fc65090c398f97269e099515138e78ce77ec4806a5ba6fdb3
MD5 4774a53501dc60cc7e18abe566fea038
SHA1 128f95a140f74958b1a0d2cace036928c6b4ac15
SHA512 154fa83a2a648214ff8e7cf3d8605ff551ae65158f96a8f5f4b086323174a1823ed3918e6199793c6b294c0880275ba87e118ae2841afd8d2df828c8d75afba8
SSDEEP 12288:qHvUrBFrEjwaQ0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:qPUr+NQUnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T10F65E12F26AC18E5F676A17D89828609F77278521752D3CF02D0817E4F77AE86D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 b030c415cac1f67dade1b39816a4f4ecf928de7b77663e811ac91245e962aa99
MD5 ab2a690bc7c5de3c3db3b16a79d4df4f
SHA1 63dda5f7ba44788938519cca68732018b0a288e2
SHA512 20d5bd33cbfd748e7deacbe12eafc8219208555c2e8c34c1bce8c05596b136bc2048a4377fef44459dac67533831cc8e3bdc04199d218da1b805520294c356db
SSDEEP 24576:tD3FHshBIYQgAhnQ/tbw/2Mkjy6Fr7g0oX:tDVHeBIAAhQ/lFTjN4
TLSH
T18075E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/948-75-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/948-69-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/948-67-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/948-295-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1100-278-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1100-56-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1100-62-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1100-55-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1280-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1280-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1280-151-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1280-145-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2252-314-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2252-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2252-109-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2252-103-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2252-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2252-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2424-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2424-21-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/2424-15-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/2424-22-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/2424-89-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2584-66-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2584-0-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/2584-9-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/2584-1-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/2584-7-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/3020-114-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3020-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3020-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3020-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3140-313-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3140-124-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3140-115-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/3140-117-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3836-135-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3836-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3836-137-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3836-129-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/3836-128-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4776-51-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/4776-48-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/4776-53-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4776-40-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/4776-47-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5588-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5588-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5588-328-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5588-90-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5588-97-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5588-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5896-309-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/5896-85-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/5896-80-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/5896-79-0x0000000000400000-0x0000000000542000-memory.dmp

Download