0e1b35be5ad1d74a16ac77e43f5ffbb1ca8b98a8f6cc3db40048b7e6d75a772d

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
Size 4.2MB
Sample260804-vb22xaszbv
SHA256 0e1b35be5ad1d74a16ac77e43f5ffbb1ca8b98a8f6cc3db40048b7e6d75a772d
MD5 0572e22a2a78decdf35af3b1c840a406
SHA1 4fb6815847fd4a82122c444a67bbebcf1fe7d1d1
SHA512 14db9ff417879235dabc4988d3e9678d3d7cb858f4fceea5ce133e2718a27b9f3cfa393371b24edc4710bc92838c48ff25c1e1bf88e16d458599fcbac66cd379
SSDEEP 49152:bhlQTT69EgoB6G8BnLKNLvT+TCBrUl722LJHDy5gdIU6iYh2W+gYzNH/fTHbBk:wknGT+DdD4gq+e2ngYzh/fLbe
TLSH
T1B8166B12BA5A94ECC05AC47483478A32AA3174CB1B35B9FF41D496393F6AEF41F38758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3808	elevation_service.exe
1592	elevation_service.exe
5196	maintenanceservice.exe
2268	OSE.EXE
1360	PerceptionSimulationService.exe
2800	perfhost.exe
360	ReFsDedupSvc.exe
4968	SensorDataService.exe
6044	ssh-agent.exe
6128	AgentService.exe
1224	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\66ec935583806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaws.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a762164e3124dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f839658e3124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d0b6d4e3124dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
3808	elevation_service.exe
3808	elevation_service.exe
3808	elevation_service.exe
3808	elevation_service.exe
3808	elevation_service.exe
3808	elevation_service.exe
3808	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
Token: SeAssignPrimaryTokenPrivilege	6128	AgentService.exe
Token: 33	1224	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1224	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1224	SearchIndexer.exe
Token: SeBackupPrivilege	360	ReFsDedupSvc.exe
Token: SeRestorePrivilege	360	ReFsDedupSvc.exe
Token: SeBackupPrivilege	360	ReFsDedupSvc.exe
Token: SeRestorePrivilege	360	ReFsDedupSvc.exe
Token: SeBackupPrivilege	360	ReFsDedupSvc.exe
Token: SeRestorePrivilege	360	ReFsDedupSvc.exe
Token: SeBackupPrivilege	360	ReFsDedupSvc.exe
Token: SeRestorePrivilege	360	ReFsDedupSvc.exe
Token: SeBackupPrivilege	360	ReFsDedupSvc.exe
Token: SeRestorePrivilege	360	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
Token: SeDebugPrivilege	2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
Token: SeDebugPrivilege	2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
Token: SeDebugPrivilege	2900	2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
Token: SeDebugPrivilege	3808	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 1880	1224	SearchIndexer.exe	101
PID 1224 wrote to memory of 4872	1224	SearchIndexer.exe	102
PID 1224 wrote to memory of 4188	1224	SearchIndexer.exe	103
PID 1224 wrote to memory of 5404	1224	SearchIndexer.exe	104
PID 1224 wrote to memory of 5708	1224	SearchIndexer.exe	106
PID 1224 wrote to memory of 1412	1224	SearchIndexer.exe	107
PID 1224 wrote to memory of 3404	1224	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_0572e22a2a78decdf35af3b1c840a406_akira_glassworm_icedid_rusty-stealer.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2900

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3808

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1592

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5196

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2268

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1360

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2800

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:360

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4968

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6044

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6128

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1880
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4872
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2832 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4188
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5404
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5708
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2884 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1412
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 2832 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 acc2c2172e3b877b14c1ca5342fdf0636dce273b29e3c56c435645cf88f40f7b
MD5 6aad83f6b7aea62a618651f9673d3a77
SHA1 bedac9a31238ec59cdeda97b62d249844b37d219
SHA512 76663cf1497fd7bd509eee750b5309e4f4d701e37955da904b4be42a1912edc26c7aad5b74d8a8f132085eeb5e9b9143bb60b084e2e1c131860edab2dbab59be
SSDEEP 49152:Sb+632BuPkFKRrdE6ohrstBhuXjfS4LWxne+gYzNH/fTHbBk:03q60jBigYzh/fLbe
TLSH
T1BFD58D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 fbb9c605d9d3d34a75ee175a03d92e531f88348e3492c56441e978bf3d068621
MD5 664e3fc083062123aaaf387d717b6e21
SHA1 912f05ff445f970d4a4305b0bf487fd93b369666
SHA512 a4eb24f9a6e6004ad9bb49fd1579f2df93be61dab4a5667e6d71924b15795c7242acd37892208d48cd15bf4bf04a4a1fad8bc47b32374a43556d05b7e392fa20
SSDEEP 24576:8XYfDtczA/LL+Tr1qYSaC25H/fTHMuBk:7tcM+gYzNH/fTHbBk
TLSH
T1F005012873E409F9ECA7927CC8A28515E632BC554760F7CB03A49A6A1F337C85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 0b4d14021de8076895c102f837532e2abc720dcaeb071141664b0fddcb715b54
MD5 abdc28a49c92350e30100de0c9ae2449
SHA1 b9756877cab1e5a6d0976db919076ea38162d361
SHA512 b2644b781489fb0862efa2ab9d3b84a105a3aae0221a48385e485d5e4b670f5927946f99eed30c5ebf0414c970df7aa15e9538130d3081f7f47b5ef6ab4688bb
SSDEEP 24576:20Le5ji0hmxNrM6LL+Tr1qYSaC25H/fTHMuBk:2Pji0A7R+gYzNH/fTHbBk
TLSH
T1D435AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4296D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0835c4985dae05fb66edc51da83663ee7b1029dcf3ffc63a78cd10546cabc699
MD5 f57930824f845333fab62e6533b728b1
SHA1 b6a22f221bf34a4185a25f07e63479be03befee9
SHA512 c965bca7f59994c7fbe446ab65e05373480b48bb97575674238fdb1115c568c7f1bde67b16d4f83729b8e8d2e242297f9717836092d6adf828a75279115abea3
SSDEEP 24576:4a7/ezSC6vUyD/aqgrvWr6q8wyuQLL+Tr1qYSaC25H/fTHMuBk://ezSC6vUzPviHjyF+gYzNH/fTHbBk
TLSH
T1C5755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 27398b32a07f680db09f37c98da6840ce2008073250b3057ab1695796a8b348a
MD5 49d2469e2cde196d0cc640143a65b370
SHA1 e6e1f2c7bbdc114ac4b125acf18e295e06b8a8fc
SHA512 c4e3bb9b89ff62e5894474d2238094a7a97d1777482b8f7f78b64fd47b6b07f95dd5917604166a06995dd7dd008956b6b2d8d75def67c81164c8db807d263625
SSDEEP 24576:qVbqPb88hv/l+bTLL+Tr1qYSaC25H/fTHMuBk:qVO88hXl+/+gYzNH/fTHbBk
TLSH
T118559E66F5748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 f9af01290871c4d3e7a6272b3d7f6f892a010090f003492709652d9dc896c5ff
MD5 cb721ba6723b117ebb644766461cb525
SHA1 aea005d082412f079034c998dc0446cda43ed38b
SHA512 5860b9f734a0decfacf7d40aeebf86818b103d97ff0caa47621f9338103f62b31a70db76b404a30acb5638d8a1494e45e661ac6be56d42120ec7754773617f13
SSDEEP 12288:WjGXLLlET3mlAd9/9gzsNHy6T/62+SH1uDBgfuX+QiHZ2Hu2sBkAQf:Wj+LL+Tr1qYSaC25H/fTHMuBk
TLSH
T11EC42345925846C2D2F276F0D0CA036CB430AE5AE594F9874F357FEF1879B83E83562A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 058c24ea5cc28dbcb9ef59f0f0187211b15b87e5ae69c16510f2da288fc6935c
MD5 e40a25611651fd2a32add94ff6f17b55
SHA1 75995f9ba655a48e036e4f9d0f6e72cbff4da70d
SHA512 2b73aa75b5b1796cc7e830ed131b2df8b576edfbb3378004c900fc37f296edf23dbc4c7995a53d6db61f6ec687b9b109c94d238dd48c8287b4792365d5b36923
SSDEEP 12288:eeBNUbTVO86UrXLLlET3mlAd9/9gzsNHy6T/62+SH1uDBgfuX+QiHZ2Hu2sBkAQf:eJIUbLL+Tr1qYSaC25H/fTHMuBk
TLSH
T19705CF3BEE28FCD2C27A9DB856918300E77278314B61A3CBD175834E9E236E15D79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 03980739b4427329d36724dd6fa6f7a05eff98fa64b3d9083718482419f1f3e8
MD5 b60565f1d98927984e0a5da5aba3b7b6
SHA1 2da95b4a057214423aa26c8475e49b472a068a21
SHA512 caa2b3c6d73457e6dc42bcf75754e06e81a5df5557b557164d282bb7af25f646f8af67c69e50af2907c97a5b3d5ff25eb1a15defac834b6270f67b08a59f6be3
SSDEEP 49152:cQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJR9DN5J8NRV3THf:cQvGAdlCEL8c/RRNw5CdgYzh/fLbe
TLSH
T1D2267D656BF880F5E0B7E174897A85B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 84a483dc2c59b545ce72370927c7864be753af7860565b6e0f18feb63b3a69db
MD5 a01214f38b9d337e8ffd9e637a403c6c
SHA1 e00a3da9e75f84b8ae87fa283ed37986f9855ddd
SHA512 0b54463008ef2dee1c2cc69abfaa2df56de39e5a30fd0e4268da69b24742d68f016184bd4551ee7312199d02d5534a9f7ef9c0048d4404516039a5ac8772beb7
SSDEEP 12288:aAwSfxL/2Dc3DDLLmt0LDQewsAjBXLLlET3mlAd9/9gzsNHy6T/62+SH1uDBgfu1:vSewsAjhLL+Tr1qYSaC25H/fTHMuBk
TLSH
T14D15E031FA74D032C3BB0DB21B66C716643CB9204B512AC3E3B85E9E59742D26776E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 639726c92d95d732fe6c1ff491f073912b826e808b015e9f679fa9f9bc59fb16
MD5 66ab03623544fec0bc7030bf172fca6a
SHA1 95db5aa4831e67e4926da0a6332ee23e6432bf9d
SHA512 005e6dd9bad81965c6b25a5aa5ce134570c529860e2df5fe3933b2f7f9cd88558a7af8a66b6c7827e757014235fa584e6797840115b9ec4c9e0106e2a000dbb2
SSDEEP 196608:XUEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJH4B3:XUEtQevvqc2W1cpV2RI324t
TLSH
T194474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 425ff5671cfd6588e69ac4cbf1c79dd67b3a22c97467d62eb590b92c06ff2c5b
MD5 95b358bcf76c7c2ab6aee2321ddce4be
SHA1 44dc8a6e47bb24e3c53f53797142ea82ed20cc90
SHA512 88ac7efdb737caf26c59d8355d98013ff8c0cc8f8c381ca5e5cc48227b5c69fe4fbc67b34ca0624edcd748f8e30805161e8f2c1a49b06597191c50ab44f36400
SSDEEP 49152:ZCbRquA/m2yL5zLfFiV+XenmE3/zB+gYzNH/fTHbBk:2oq2VjnmpgYzh/fLbe
TLSH
T15AD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4b0f18b9341461b6c6ff62c383d4ca2fc9141c8d1623712b5e1650fd3eceb492
MD5 90eba69da5122f72ed62bab40be78393
SHA1 fa585d572cc2973516999745abbd7f7a57626baf
SHA512 ce331be474097c5c772dedcae1ce4a30b9e1aabca065f159f3c3801701fe965b3a05b96ca5b72eaa1a334cdcf55fc7d2b65cbd63b6588923c08f1c24301395b6
SSDEEP 24576:FAhGL2IFoiwtA5l7S53MLL+Tr1qYSaC25H/fTHMuBk:FAM1Foiq5g+gYzNH/fTHbBk
TLSH
T15D359D81E7F955D4F5B3AAB899B68170EA76BCAA5E31D20F1160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 15b0b770f6e51d18208dfc011aa6c24219eb7d4ed28dc15330f64b60ecfad34e
MD5 4902089604a8ff0c6faf430ec73f0fc4
SHA1 0558b9217ce0e1d28474f76ba76346d9eb5a615a
SHA512 43296f240b589d764ef501ca682bbacb88d09df2e3daf315d9e9d8f6dc55d35ec63e29fbd349ea1e19f88086eef9eab9a3513e32ddc77dcf622dc7993974f58d
SSDEEP 12288:Lmw5HEjsChNSBFgl0WDm+C4XLLlET3mlAd9/9gzsNHy6T/62+SH1uDBgfuX+QiHa:KwuXOWtLL+Tr1qYSaC25H/fTHMuBk
TLSH
T1B305F14572A80CF9E5A79278C5978136F7B2BC062A21DB1F0760CA5B6F37351AD3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 c539524ad510774a762c0f7ec7782bc812e5980ff502977c12886454578763d1
MD5 baaa76b9cfe7c04cded18d2008840e18
SHA1 f5bc7b8953121bcbf38bd10a35f14cc9c68231ab
SHA512 bf8d32fe20eac5d4f9788e63a59b601d101a4afc3f3a1ffecd79f59786356bb49443555074a81959cca2b5b468d5b00bdf258f883b6aa0a63da50832af314475
SSDEEP 12288:w/Z1IyxXLLlET3mlAd9/9gzsNHy6T/62+SH1uDBgfuX+QiHZ2Hu2sBkAQf:0ZuiLL+Tr1qYSaC25H/fTHMuBk
TLSH
T1DDE4128923A821F6D1E362B8C8D50759E7707857637193CF0A245AAE1F73BC29D39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 237f13ebf0d6a11033b731efcfb3729a4b81646e2101051855000421525502b1
MD5 60f748b2024bf5d1e0255514e19b32bd
SHA1 a71245db5ffd08413004124eb021b3e0d59d9222
SHA512 26ea5064b2f789aac4ac559f58f7dcd63f6921b994778270b9a3a66fc0fca44c64c252c9b76a309a04f0c248bc12468666b9d328a42f66d729571f78a1e38456
SSDEEP 98304:fQRQyi36YOcPhLvw2gAf+PN3GgYzh/fLbe:uQyiKahX+PN2B3
TLSH
T1C6667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7e2eb2aa03181ded4b8afc32d1ee5f1d76fcf5aded8001f10ed3fa16586eda9d
MD5 bbb76dfed463bc58d1936d3962bbb18c
SHA1 52beecda522bec1f0709311cdd606ae15862ce67
SHA512 20b15404f71870404529d9d075a6e22b9590314ef2d197700728cec22c60556875ae34e267acb18c57925604a35d0bf3ce15007ee670869d7643d1cbd57089ad
SSDEEP 98304:YQRQyi36YOcPhLvw2gAf+PN3GgYzh/fLbe:PQyiKahX+PN2B3
TLSH
T1BA667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 aafe873634395baf94bebf1139bc68f506fc0b8fe683dc9d6512b152a560ce2f
MD5 e26c18745d1f14003c8b80625f47e274
SHA1 4872f71e24bf6953b04b0511cb6246e369e18097
SHA512 ef9c4ab03828e5df7f4052c0275813fe744908f2d55f353525bcb48539bf18971cfd6d5b35f59634086368a212dbc251326375c1542253550da350f8baa3a304
SSDEEP 49152:a68Qg55nhceWu7PNU3/R+gYzNH/fTHbBk:IthLRc/wgYzh/fLbe
TLSH
T1DEB54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fc63daf94287b5371c2ee65f133e1f613e489ae72604e2b1bc50ea70639c5cf2
MD5 af949adadbe0de9a4b3914a3b4860518
SHA1 1dc71c9401b639482a4f89f247309c10e5591aff
SHA512 a5e28531d2a408cba3cf3643b585976fd65f6abb9d89f73c24ffc9e67325dfe028738a1742472269b66b6a2ec2b4c93e407cd3bbed832d017c936b716909dc09
SSDEEP 98304:Jy5112gYy5azzVva69nLKnhZLgYzh/fLbe:kLIHjWhBB3
TLSH
T114167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e0d98fbf85ae9aad73d891545d03ab4c03fa0eaf4f221d79a6621cea664de6ab
MD5 3f48d60c1e2e8c1cac47779f08609e40
SHA1 6f43bc7c0cc50ca946fe1cee338697ee300a7852
SHA512 b7b1f337eb7a1022d1d819e6d377e20b05883c1e37940944c03df49301535e8790981acb0d2b0905a3fee33b8da2ebbe3a2ad7552f2054cd440f40a4ef9e29e2
SSDEEP 49152:PB+taZ3usBWOBr4tEG20bqx0z+n217aau1gl3+gYzNH/fTHbBk:xu6JmUxd2dOgYzh/fLbe
TLSH
T157D59D13F1DA01E8D06AD578974A9233F962BC490B34B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2a169b1da8b17ede11a54c75e052c1ef89ff057eafd354a94397119f01ad2781
MD5 c44b980865c5507ce4e4936e34237d56
SHA1 610f3626a1fd01d87fbddb38004e87efef54297e
SHA512 9b66a7415357b980b72e83c4505ac0d27a1a2f3cc2ac476a91ca28250dbb2784a98f377747831596fad4c0c04d82b6f976229d09d1794ebacf83c959c535a065
SSDEEP 49152:S1hpsNoJpF1A6BU44CwH7R4xL+gYzNH/fTHbBk:SmifPkRpgYzh/fLbe
TLSH
T16DB5AE13F2D901E8D06ED17887569232EA61BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4ba701766924a09b601b651f14a2bca913686d71b90bf42b6797d8b567a2ca2f
MD5 9e8797fac4b7c09b77d3cc6fd245069b
SHA1 c69326125d3de4c6b02623814399868211f6bc59
SHA512 b61f893ccea94d86f21c826ec05c4dba2c6d8fa7e054fe73c32beeb44c7405def63dabe893ed4ae979cb9398e4734a8731bbf0cbcc2d214988b3e6cc6fef16b0
SSDEEP 49152:+SuZQIY0Be2KNRVtOnks6NMHqu+gYzNH/fTHbBk:Q5dKvi61/gYzh/fLbe
TLSH
T19AC5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 24c197c458f598425cdebcb481762650dc535941c3e7ff0a18d8e433db9818b9
MD5 7c9a0849b1e91e27e6a96a35df28e66d
SHA1 336766d5196e785fd255645e391da54a0858c875
SHA512 f018d7317487a3771c8e33cfb83a27e4004ea42c7ed0df9c58b2ae988dbe5b150a36081eee53e793f44a8dafad81b00f6f1a6cf7b3078500cf1352fe402231c7
SSDEEP 49152:mhtSn8EApI0figXgiDn0AP5wH+gYzNH/fTHbBk:nX2iyphVgYzh/fLbe
TLSH
T17795BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 5a87ff7f1349092a632b9490ccee721c7f4f66db1787760888ef181a6b3ee56e
MD5 3e5ae26f2a9ddbcaaaf334cb7e8e7b30
SHA1 807060ff3b0da51b8d523559b50a38624543c4a0
SHA512 aec486c38c5690394f4223ac98645419e8f626c2fe1915ce99d03607fbdf224ff709a98befc84da61072fac8244cf34c734f0ebf135228a402b40294b9f34e3b
SSDEEP 12288:DuXLLlET3mlAd9/9gzsNHy6T/62+SH1uDBgfuX+QiHZ2Hu2sBkAQf:DmLL+Tr1qYSaC25H/fTHMuBk
TLSH
T1B6C42344615D47C6D1E2B6F0C0CA03ACF424AE5BF680B5C75F293EEF2975B83A834669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 38b7d60c9583e12d9ff60646224e03946200b79ebaf0ac346c861faf24458cf9
MD5 3dfc70a4f16cdbc9e8a4059057d61bef
SHA1 cf2b7840b7bedda54d3db7f1a1610e85e5eeea0d
SHA512 62e921e116afcd4785026282c90e475982764d1c475dbe62a601ea7b9580df291433dde118530e8f3d7a99b5bcf56d88480ed78e48937eaa099cd5405a953c57
SSDEEP 12288:tVXLLlET3mlAd9/9gzsNHy6T/62+SH1uDBgfuX+QiHZ2Hu2sBkAQf:tFLL+Tr1qYSaC25H/fTHMuBk
TLSH
T1EDC42344615D47C2D1A2B6F0C0CA03ACF424AE5BF680B5C75F297EEF2975B83A834679
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 5290c0a8597f962868aa60bcaff3d805aceb9ddcf12cb05f59e93c990f85bb2b
MD5 09fa377171da62fa4c84ae4fc440261c
SHA1 064320660272c005bbfcfc342f8518ae9685c1da
SHA512 4d384fa82305f291a705532ed9581630e508467dda4c396a97b13ebbf6d2558120f7821f5e39a0637127eb09ec9a68b11f0e01ee8901c5b06f208ca563a329dc
SSDEEP 12288:uTXLLlET3mlAd9/9gzsNHy6T/62+SH1uDBgfuX+QiHZ2Hu2sBkAQf:uDLL+Tr1qYSaC25H/fTHMuBk
TLSH
T1BFC42344616D47C2D1E276F0C0CA03ACF424AE5BF680B5C75F297EEF2975B83A834669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 ed7c0a163771291c134e7e40af56288cac74e8a9bf1b51d0f279d004fe907b06
MD5 e067318321e36fabcf600eb8cd1c230e
SHA1 b1db4eeaf002564eb54ce2aa06631d0fa06c5bb0
SHA512 7de4d3f9ff9d4c71d8bbbf69471aa71516b7ff4a48a69087266af3be4ab4d918e87fc125ad4a468d59812220f73d2ccd9dc9bac72b8d171577d332001b51ec42
SSDEEP 12288:aVUXLLlET3mlAd9/9gzsNHy6T/62+SH1uDBgfuX+QiHZ2Hu2sBkAQf:lLL+Tr1qYSaC25H/fTHMuBk
TLSH
T1DCD42345626D42C2D0B2E2F4C4D60368F174BD9AE761B7CF4B242EEF1D71782A834B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 214d9b22542280decf82e2dd192ba141edde25809fb9a3daaf48e843dec6a05b
MD5 86346e6e92aad1b4976c911fdbc7daf8
SHA1 a727e71ef765b266c3ca01877fb4306e9adef9bf
SHA512 d24c468a73fab806f7071307b5b5c9bf3ce378e064cac30a4f5cd67dc0f43d0002d5596e08e42399c559bf25e8f3cdc67f7660bf2e3830335ac3efc28d948640
SSDEEP 12288:lsXLLlET3mlAd9/9gzsNHy6T/62+SH1uDBgfuX+QiHZ2Hu2sBkAQf:lELL+Tr1qYSaC25H/fTHMuBk
TLSH
T1DBC42344A15D46C6D1E276F0C0CA03ACF424AE5BF680B5C75F297EEF2975B83A834678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 47681112cf465f1b86a6ed53e17b57ca7473f9940d850afcfce6d69be2f43ca8
MD5 0c141cf245ea287d66bec33e72d0c23a
SHA1 4344e61d6f5a204d23d0867aa48b088893439089
SHA512 de820fdaf3d8db9fec5ffd0d1671f425880ecae0f94cdd2eec990e09aa77a6fc69b722a93279b0213482dd3f48f67299cd609d338140562daf30dc4bc5e30c1c
SSDEEP 12288:hJXLLlET3mlAd9/9gzsNHy6T/62+SH1uDBgfuX+QiHZ2Hu2sBkAQf:hpLL+Tr1qYSaC25H/fTHMuBk
TLSH
T110C42344615D47C2D1A276F0C0CA03ACF424AE5BF680B5C75F297EEF2975B83A834679
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 ba343cd03fe92aa54c78d474a62772babbed814d525ac2476fc02f6604cff182
MD5 05c3462d1b7aa9b2c9e7c206bc701e51
SHA1 f4c7e32c2dc809e96bdaaecdb6592da3cf0b785d
SHA512 edc39c9fdef55f3f1eeeaaa986b20302f20dc9bca0dd59dcd322840c6ed8adc74cf81af9ba31493dd0a551611f519a665fb5b8358e18b2229823d0950e14aa0e
SSDEEP 12288:sNXLLlET3mlAd9/9gzsNHy6T/62+SH1uDBgfuX+QiHZ2Hu2sBkAQf:sdLL+Tr1qYSaC25H/fTHMuBk
TLSH
T109C42344A15947C2D1A276F0C0C9036CF424AE5BF680F6C75F297EEF29B5B43A834A79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 641db005a602c0c7a0bfb183453c322e63a1be5defaac26cecf5bee40a371171
MD5 f14637325264561cd2d4fda931bf5808
SHA1 5893862fe657c6d7aae268ce3e553c579ee9c9a6
SHA512 daed2f80c895a1401c09149c0d1bd4ba7607b49d4250a6821fcd4b3ef0b99c1bc734994e9ef05222bf063fcbb43950008dddeeb24dad22f92b8f722cef4cef6c
SSDEEP 24576:VZMMzFVSOlLL+Tr1qYSaC25H/fTHMuBk:VZMMzf5+gYzNH/fTHbBk
TLSH
T17B050294B39008F4ECA3827EC8554A19E6B17C5A5760C64F07B43A6B1F333915C3EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 c88e102caee0311585813d40c6afd749ac528054d42acfa36e37a5df76329a85
MD5 332c0a2b5f46da2448876ea71f773410
SHA1 b57e6e47d2d01b36c392710d297311b84dfac199
SHA512 f0abcbad979316ce0f837b31019798fe99d1c1203648928393da705852fb1a41a0670852fa422612bea4356cde520cefe10a21d826060c126beab45392cf1dc0
SSDEEP 12288:p6XLLlET3mlAd9/9gzsNHy6T/62+SH1uDBgfuX+QiHZ2Hu2sBkAQf:pyLL+Tr1qYSaC25H/fTHMuBk
TLSH
T1A0C42344615D46C2D1E276F0C0CA03ACF424AE5BF680B6C75F297EEF2975B83A834679
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 49b3145659551bea8a112ede03432dc0de57a713d075449faabe3a452ca5dfe9
MD5 784a4a335365659a32c864745cea0274
SHA1 af67adbd53af27649b6c3a1eeeb425b7e8f90543
SHA512 892ec409aa2fe79a87e51b0d8339876ef0f2d0d5d290fe1acf11a4d722c5f5489ad2766a493fd069f8532eed804537e4cee33a8dc0dd75e25f2825be40023ec0
SSDEEP 12288:r2XLLlET3mlAd9/9gzsNHy6T/62+SH1uDBgfuX+QiHZ2Hu2sBkAQf:rOLL+Tr1qYSaC25H/fTHMuBk
TLSH
T18BC42344615947C2D1E276F0C0CA03ACF424AE5BF680B6C75F297EEF2975B83A834679
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 102195b6a675cef30b0e12633b0b1588a3813c40a2d571262de627a824b0e61d
MD5 6cdcadee12e3f1a06120dbf7cd414110
SHA1 6f9a1342e337d1dac3593f47d73aa154cbb1e514
SHA512 36627b53edb85797de208ad483c197fb36cb18f8af15c86d0742cfbc866ead7bf77e76b4f818653c329563def67e4f53abcd7e755deef4d3141cd2929119c4e6
SSDEEP 12288:1yPz5L8xXLLlET3mlAd9/9gzsNHy6T/62+SH1uDBgfuX+QiHZ2Hu2sBkAQf:czyxLL+Tr1qYSaC25H/fTHMuBk
TLSH
T1DBF4010773A521F9D1729278C8920A15F371BC3657209AAF17641BBB2E377D1AD3AB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 45f4eb152eeb009afa750524e5c5c87b8c993c9660f60203c568fda6d5d3e5e1
MD5 532e9741c26b948ffe3a692bde51f906
SHA1 d7c28d6cc0d5c66691fecd35fedfd7922714918c
SHA512 19b593758a31659952727a0b0f19a41af29adefa4507f50a11bba88eed01f1d6c630f21bd08edf13b1234a47cdd5fd52ba963e863f22951ec3bbb65b66dd5d35
SSDEEP 12288:B6XLLlET3mlAd9/9gzsNHy6T/62+SH1uDBgfuX+QiHZ2Hu2sBkAQf:ByLL+Tr1qYSaC25H/fTHMuBk
TLSH
T1E8C42344615D46C2D1E276F0C0CA03ACF424AE5BF680B6C75F297EEF2975B83A834679
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 f243a61daf65f4b65fcc5ab4135df1c1c8bad8b3d8d117c7908d82a3f31e37e7
MD5 200f82ba2def1c2865a19b23bfe3a872
SHA1 fdd2a79bfb7730705222da2f53fc7d27e7a94415
SHA512 6042d21b399974a9603f38e23ab898b1ee8813df4d95a708804526ec93f23028eeb1fc96e72cf8206ab176cd79c22fb9e03c032d15f2117b08e83909d79cd253
SSDEEP 12288:b6XLLlET3mlAd9/9gzsNHy6T/62+SH1uDBgfuX+QiHZ2Hu2sBkAQf:byLL+Tr1qYSaC25H/fTHMuBk
TLSH
T1A5C42344615D46C2D1E276F0C0CA03ACF424AE5BF680B5C75F297EEF2975B83A834679
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 3cd68a7933b34108417eda37ecb326c030c6b42441281fd348da753d36fd16cd
MD5 60ed6ace2e0e372ed946c3bbba2f9aa7
SHA1 c91c0b26529cec2754aac717e43e3bc82fa880bf
SHA512 6ad28cab69a94300fa4fd4c618b8baa77c42831db9da2f4a4d957774d765af9cf613fe585c44fd2172bd055a281cf7bcb7e84a4f5db1313a5c3cef9f11e58416
SSDEEP 12288:pyPz5L8xXLLlET3mlAd9/9gzsNHy6T/62+SH1uDBgfuX+QiHZ2Hu2sBkAQf:IzyxLL+Tr1qYSaC25H/fTHMuBk
TLSH
T17AF4010773A521F9D1729278C8920A15F371BC3657209AAF17641BBB2E377D1AD3AB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 b85f93844c4a14e360bf001e521ebaec9402343fea28029ba6bae5c4525ed64f
MD5 ae3622d749823c87a58ba253ad02bea2
SHA1 f92eea40a06c967d7f1872d4df1f0ceb4fedea0e
SHA512 a7d048f27a214db22bc20d9f0e9f3ab206f4dca562bdc8313839d648078a95495d9ad4bce12f532794be4639d9591de1f8a9a01cedcb908f14c173c8013dacd5
SSDEEP 24576:9T9aLl3z0zDzLL+Tr1qYSaC25H/fTHMuBk:9TQLljc+gYzNH/fTHbBk
TLSH
T1D2050294B35008F8ECA3827EC8564A1AD6B17C5A4770C65F07B83A6B5F333915C3DBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 c91548c782c521b0c3f1fad6ac9ee6e591593a2f12d048e78e0b83c4aad18188
MD5 59ddeebf1fca0a23de9990c566766c04
SHA1 558789a2899f6890a597fa4d5e2568ab1e1f64e5
SHA512 0f5c1e1c7419a6f3dc38528664114e368976ba70f18ae87081de5a4aaa26b8cc4b6e8b037e569c5774a0220b700250f15a566632cf2ec5b936d0e20ee8257dab
SSDEEP 24576:l3td9CHKy7GZHLL+Tr1qYSaC25H/fTHMuBk:Ftd9CHKya5+gYzNH/fTHbBk
TLSH
T1B925CF90F3E814E8F0B39A75C9664511DA767C5A5B31DE8F03A8265A1F33BD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 be747b69275036b49c9b111303d0023a9cf8a2010ec383c5d2015ff2ceecb3b3
MD5 b97ca6fe04b290029e3548b9dfc03d29
SHA1 5a319b2541c024c05a321445c8592491c2bb1783
SHA512 5e52bd0fb3b5145808cb0205f775ea9397417a15ef215398a267cedd84828803b2792ba949f2e19c9daca5b60bdd75aa1f7c6329dc8cf51ae97fac7fe73fa274
SSDEEP 12288:pzXLLlET3mlAd9/9gzsNHy6T/62+SH1uDBgfuX+QiHZ2Hu2sBkAQf:pjLL+Tr1qYSaC25H/fTHMuBk
TLSH
T1A1C42344A15D46C2D1E276F0C0CA03ACF424AE5BF680B5C75F297EEF1975B83A834678
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 a8b86248d2c5bb26b898ffb1642cf78b72e56e0b725ff0354a0e047d050a8dc6
MD5 f73ecfd3418e12bdec0eaf3eea10867c
SHA1 0ababc5ae7143a2e1b4142dbbf2b5ffd5c1f1d11
SHA512 11fc0d42f69fcdcc30387c0db2ab8ed16f0da76f1a8194e410f57a2473dff3456e2793bd9044b43da8fc693bcd91a86c829e06c0af755ca2761e65e267906cc0
SSDEEP 12288:dRXLLlET3mlAd9/9gzsNHy6T/62+SH1uDBgfuX+QiHZ2Hu2sBkAQf:dRLL+Tr1qYSaC25H/fTHMuBk
TLSH
T13FC42344616946C2D1E276F0C0CA036CB424BE5BF690B6C75F293EEF19B5B83E834679
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 a138ffad2c7ae66eaf8cb2df5d610a059cfb0baca132c8cbeeb215d729c91240
MD5 35a039715b2f9753eda42db3129a2551
SHA1 b0ff783ad0b5333a142bd87c6e14edc7c0161c91
SHA512 5520fc5259d0d82da1d6b678af0573a6b429b35b9ecfa70c697a14b1677b7c3d39071fec09690247005de18027fb7f2ee0203ea0cd082f4cbd8ee5919f1f1504
SSDEEP 12288:nQXLLlET3mlAd9/9gzsNHy6T/62+SH1uDBgfuX+QiHZ2Hu2sBkAQf:nILL+Tr1qYSaC25H/fTHMuBk
TLSH
T1CEC42344616D46C2D1E276F0C0CA03ACF424BE5BF680B6C75F297EEF2975B83A834569
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 fbaf4bc566fa46fc9ed9f505799265b7f3730b7dfabf205f7e0b422cee21902d
MD5 a8ce9c7aaf0df4044acccd5434ec15ca
SHA1 6919fa43d9b4284a7d2eea149f088988b8b1c14f
SHA512 b07ea51e665fb5a7c079a3bfd31bd333c52be95cb36b5bdcddc92b19effa09338cb2e861a742738be747442ee49fcf1544012ca1c80b38e2d116e9654052a4b9
SSDEEP 12288:86XLLlET3mlAd9/9gzsNHy6T/62+SH1uDBgfuX+QiHZ2Hu2sBkAQf:8yLL+Tr1qYSaC25H/fTHMuBk
TLSH
T1A6C42344615D46C6D1E276F0C0CA03ACF424BE5BF680B6C75F297EEF2975B83A834668
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 e8a7188f1314a8c17e5b5b3eb85d179165982468ffeade61be11f33768d543bf
MD5 25165eaa09af8be6ca6c18f0e541e9a6
SHA1 a4f941ffd441940cba6a6c96dc48ecdf7980b10c
SHA512 abf230db14415dff6fe14c6ff2c48136125795048ee1cf4e68568a2c7cb860ac62981af0a98e4ddfa6ebb2cc488daee616ff6b91e3419232d5fe4ad859b123ed
SSDEEP 12288:0zXLLlET3mlAd9/9gzsNHy6T/62+SH1uDBgfuX+QiHZ2Hu2sBkAQf:0jLL+Tr1qYSaC25H/fTHMuBk
TLSH
T1F5C42344A15D46C2D1E276F0C0CA03ACF424AE5BF680B5C75F297EEF1975B83A83466D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 e9e1dd4e5fc91fe17976c5094bde6ce474e5267a204650becb65d30c71cf215d
MD5 d92d0c3cd345e8b4c1c7db21db92fe1c
SHA1 cc128e000ad93b82a665c4322392badda5227d7a
SHA512 c9db5060b390b7690ba1fcae7d9e9f756b9b9db28ebd4f9e9e5fb4226996b67765d003b848fe3dced46e738f9475d4c2417079f292af193f682255be46a6e0a6
SSDEEP 12288:mSXLLlET3mlAd9/9gzsNHy6T/62+SH1uDBgfuX+QiHZ2Hu2sBkAQf:mqLL+Tr1qYSaC25H/fTHMuBk
TLSH
T15AC42344615947C6D1E2B6F0C0CA036CF424AE5BF680B6C75F293EEF2975B83A834578
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 e6b8948a34770470a32c91fd668729b6f189de92669b83e30a80739c743b748f
MD5 652cc889b461b87e9b31710a756ffff4
SHA1 311843662349d38f62274450288cf935fce509a0
SHA512 e7de2de74bd80c728a361df4358a78813bb4a1e6c40cb41ff453ce062ef87b8a4e253a5bd0a9de4e132fe5e34e22c82294c9042b75b564fc392e79723abdf0ae
SSDEEP 12288:4sXLLlET3mlAd9/9gzsNHy6T/62+SH1uDBgfuX+QiHZ2Hu2sBkAQf:4ELL+Tr1qYSaC25H/fTHMuBk
TLSH
T1D1C42344615D47C6D1E276F0C0CA03ACF424AE5BF680B5C75F297EEF2975B83A834668
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 58b5341bc2e18ed72c29b8ec70dfe26915a79a9f8b2ff5bfc3bda4982c0d2621
MD5 08da84615d14e422025cc34fef34c170
SHA1 e54e58bca878e8987a298d4dbc994a2686a95b92
SHA512 6d68d2736d0e8543135f072720f49e3ad9394d379f6814b0dba0fb30ba6c460561575146f5b3e237e7fa8603a8a66eceea80d3622c301c3c44ee76e9a1fac912
SSDEEP 24576:Tfwvok9RX6wkyAIeLL+Tr1qYSaC25H/fTHMuBk:VMnYIi+gYzNH/fTHbBk
TLSH
T1F235D029EBDC44E5E1B7927C89E7460AF2B178591B31C2CF025A53AE0E37ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 01005e070dbd5011b8ed47146e9672a1ec68fe1d16b88add35108812d1ec1400
MD5 6878826ebd53828171d47ea0604f3789
SHA1 60df2fff6de419c4d7095ee0e44d8973a699ad70
SHA512 92613c1e6090a3b0a7d2a3cffeace982a2e0c6851833042cd0e4461aa9202ce771b46b879d9ac4cacf137a35a8669a8bb6b6e8ce1e159a06e83f11364b6d97fb
SSDEEP 49152:UYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0n+gYzNH/fTHbe:cySzPmgYzh/fLbe
TLSH
T1C7066C96A16841D5C1B9C1B98B0BCC1BFB7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 df31d23156e24b964894b4ff15307aff181fd06266417e1b83f4b916c09021b2
MD5 cfb2b51354664d38e10e8784c7a5d835
SHA1 7cb8de93e26dbfd25a7d173415835e53e43878bd
SHA512 57921016857a1b96e3fc7a2b187ce27feda3a5ab026ca3a5bfcee6d06d73fb7470d25ca8f68dddb886d016819692cf4ea3c2c32c5640a9040d90fb4015daea71
SSDEEP 24576:t47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AY1LL+Tr1qYSaC25H/fTHMuBk:t47JUQj4irIhCnDHUPfF/3+gYzNH/fT6
TLSH
T1EE65AE1DA3EC01D5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 eb5423b4f129e56efcd3d2cf029e504f9616d63afdde3f6175eca0651f62a652
MD5 2610256bcbed2d3b835d62b8b0cca405
SHA1 0f2eb984f28cdae07415df5161b759f9cce40df0
SHA512 83d7234b804099908f0b108ef0ffba03fda6c0338406ad207648987de3f914fc76af6073e676f4f482f69c1df42bbac884f60b6a452bf562cb9772fa739f6eaa
SSDEEP 12288:lGsfKXLLlET3mlAd9/9gzsNHy6T/62+SH1uDBgfuX+QiHZ2Hu2sBkAQf:fiLL+Tr1qYSaC25H/fTHMuBk
TLSH
T180E4F009D29802D9C0AE62B4C7864644B3337C6693E1E3CB57D0F97E1F76681ADE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1020KB
SHA256 29f40832eda01d90101f304d0166963fe1b1dcb0af36014ad12a956486741bbe
MD5 9a5755e20017432a171756b08fd75d76
SHA1 94a0e58430273147afcfdfefb91bba013d3a7ddf
SHA512 736e458d6663bac37e827d261bfd60c7b825c0dde51a18b6c221bbf8acd30b9408aad23230ed2db1785a4fe4238453a9f61f0be2a23cded29eabcf2a747c589a
SSDEEP 6144:MsBC2narmBrR9y5KcbPotMxgYWPU3fUkMYkxe/XVqezxg+DCu0N/asfLt1kphhCO:lbqwU3fbUJ+DaPK37I/gRMApOPvAz
TLSH
T104251840766BD75FC6AD50321E36D2CCA7707D11EE05AB0372C8872FD576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 501ab0189a76b7a91df4ef513299d2078499529e70a495bf20418aac54a9dd69
MD5 0995a98b684106cabfcb7626d35c1ba4
SHA1 5e22a4c1317661e473772eab0191ef9a76aa1b99
SHA512 491f3e31f620a5ed3b5dcd0aa54685fcbdd292fe12cb5bb7684f75da6381fd2e69aa0f47c84604e8d06d17ac2720b4360ffa5e3f64ee8f43cd7958ee834a12c8
SSDEEP 6144:9tQh0nThUWMOv/QIPGKwohOrcbVtMxJcbVtMx2TOmRAXEYO8+aDv:CIO7USRDv
TLSH
T10855B7815537A39FD1F77032076A9B4CAB64EC4673095F27B3C8453AD82BB25A0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 87834bfa3b63f187c26351958d706454f7a5b2c03b06b2a28b088e4bc6913ce4
MD5 6ac13b4095162d6a85c75d02dc2c3d95
SHA1 1ed0d4c97e17e9f6226267c57d12f424c8719a0b
SHA512 db7d095f04a1f53d822031d02c56db3156832e170a16e6196d2cf9138cc46d49597e267ca6789fb4733a0ef010f240e9d29e3d938f4f3e1899825d2f6f661429
SSDEEP 12288:KF7iXLLlET3mlAd9/9gzsNHy6T/62+SH1uDBgfuX+QiHZ2Hu2sBkAQf:GaLL+Tr1qYSaC25H/fTHMuBk
TLSH
T1FAD42341925D4AC6E1F276F0C0CE0338B428BE5AEB40E5C79A257EDF6975BC2DC34629
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ab67d27810eff3a04f4b35eadfda8d4dfa87a00c167bade78f8e23b93791cba4
MD5 9a35d43ed285e440d475fa6ca6cd2201
SHA1 bbd6f2afa77736d67459a29eb5d685240d6e54b2
SHA512 9253630f4677fd8aa995314490c0b7520fe64f729bcb40d718b6a251417d5ba89ae329ff4a973cce84028e5e16d148cc948637dd902b4e2dacb67b6a2d8cf1b1
SSDEEP 24576:sgb6bmBIi49WNNFpg1rSvFv7bYQLL+Tr1qYSaC25H/fTHMuBk:sgb4mBIBhGFN+gYzNH/fTHbBk
TLSH
T13F65AE1E22EC02F5E0F5E2B8CDAA4417D6B278161731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 b7706992975f75de7625ba50a8615040a14a1fc2e5971620d033fc87def9b4fa
MD5 50efe8e5874eb90d27b7ba3113990b24
SHA1 ebac95b7dfdff1dfac1f1e93ee81958c3d9180d0
SHA512 a9ba183c9dc0c64c01fd64cb64ae7a86bba933beda2b1c372dd607eb430d2009471a53bdde3747520a968ba278cf9ba9796163edfa15f8d16c70546c4d6628ae
SSDEEP 24576:NG88u8FpJqH1Wzria7/mlLL+Tr1qYSaC25H/fTHMuBk:A7ZFPqVha7/U+gYzNH/fTHbBk
TLSH
T15635F16572E102F1D077E13889864667F6B1B8251364EBDF07A88B961F33BD14B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2c10f3cb0f71157e51a205d0724f93b90a6c62c7717e9642b5e3ac646fe7e61c
MD5 88742b11ae9148ca1f7ddbed781645ab
SHA1 0c6838c1002077f801dfeb53c444ae91ce0927e5
SHA512 bf4032dd3c1e848bf8ccdd4fed450eaf1158958065fc449ee2bd0c8398cd07bdee7a39f76e57a8fa27c9e4f8126e5342ad005c16fa65765ebce49a223e701ec2
SSDEEP 49152:ABCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjp+gYzNH/fTHbBk:7G05lO43bDgYzh/fLbe
TLSH
T180D5CF6A62EC11F9D1BBD17CC9C6460BEBB23815033556CF02A486A91F27FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9ba2ebf1a9b3e0c01c9b3c204461a8d7a5ccee20119ce5613466da9b5b862d89
MD5 acfec60d7453f90aa22ac2e5963e7986
SHA1 6698a6538fea2032dde1b4813d97dc715e86cef2
SHA512 b70613824aef4da9a083e93e362a6215e0cbd77b0657f057f2ee81819e0f6dceab6436bfde697750fc4b3cf342e6ed1168fed2ff6a2a47d7531088594d74f9e0
SSDEEP 24576:Efa5POZ3dpqWVM50JicR2hG0lasx2+47eidnfLL+Tr1qYSaC25H/fTHMuBk:ca5POZ39Jt2pasx2+mR+gYzNH/fTHbBk
TLSH
T17865AE5EA6FC01D5D1B9D17DC583461AF5B1342653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 650f4fde8aaa372b62762ac0ec773840cb88c378453695b4c0b057f474de2a29
MD5 1e5c30a798c3944ce955d58ecbe86a76
SHA1 e6a26f206dc323346aac5d371bc08d77b2fde7c8
SHA512 961d8725dfd90092e2f7259e951954044f9c28a4dbe682487da7b5a1d5f866271e94d31e04bed31115b6f95299d0989276d4c75d5dea34251caa3b111fca1f23
SSDEEP 24576:XNcwHdjbyQ4nLC18lb/EOjowL7FkNLL+Tr1qYSaC25H/fTHMuBk:XNc/zEOVHF0+gYzNH/fTHbBk
TLSH
T123858C1623E901E4F1BBE1BE89679646FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c96e5fdbab069a76c75ad507dbf0b67fb61fb56b91c1f9310f29a14e6d065f13
MD5 5b30ff2b4dc9eb35d3e0d331f41d631d
SHA1 d40d65d6a9ef62340667be60c2089a42eced384e
SHA512 8a6a0b3e26f1eb8049d5d64764d715c52a6db13a0916e1dc84e6b1c17578ac309e1696ff8f55e9a53d44608fb4c521807521e1ad19b8f37b08211fbec93385ab
SSDEEP 24576:LtkNvNnaFeYhJNtmZBmrLL+Tr1qYSaC25H/fTHMuBk:LtMwBtOm7+gYzNH/fTHbBk
TLSH
T16655AF6EB6B846E4D1FAC6B4CD238512EA727861173293CB5390C13F0E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 cc196d5e1809d4cb4f5af1acb7783883e463c2d5a215a10a3583eae47b16355f
MD5 840113476a2fe24699041189fbc5a239
SHA1 4588fc426bfa4310768af344061b11fd30023f49
SHA512 dd3bc48138c018c102fa095df7be62ccf5b78a08d1505af2e1a467b375ae90641db62b8b65b9fb09bea45d482b17b28ddbcb471a4b80b53bb2e979b64343d481
SSDEEP 12288:aHvUrBFrEjwaQ5XLLlET3mlAd9/9gzsNHy6T/62+SH1uDBgfuX+QiHZ2Hu2sBkAo:aPUr+NQ5LL+Tr1qYSaC25H/fTHMuBk
TLSH
T11B05E11E62AD18E5E676E17CC586471DF771B8621311E2CF02A0817E5E77EE8BC39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 ce9b6fc259383948c395ddb1f081909bd487e51437553dbd640a37fbb5e1ecab
MD5 6a32a3ff834b1d2ebe58151f1a76caa5
SHA1 61407a8c22850531b1d8ceb7165a3a4ff22a65c2
SHA512 5cc8dcd307e6802fa52fbad119dfe53580abfc8261d9477ee075e9f3a7fccd47fdf9b953c93662d59f6945dc5885533118e31fa74b59f8f51eedbbe04f05a741
SSDEEP 24576:hD3FHshBIYQgAGLL+Tr1qYSaC25H/fTHMuBk:hDVHeBIAAq+gYzNH/fTHbBk
TLSH
T15125E17DE69C04E4E57BD2BCC6934606E67138AD032266CB069481BA1F6BFE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/360-96-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/360-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/360-90-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/360-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/360-330-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/360-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1224-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1224-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1224-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1224-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1360-66-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1360-74-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1360-295-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/1360-68-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1592-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1592-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1592-126-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1592-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1592-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2268-62-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2268-56-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2268-55-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2268-278-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/2800-79-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2800-85-0x00000000008B0000-0x0000000000916000-memory.dmp

Download

memory/2800-80-0x00000000008B0000-0x0000000000916000-memory.dmp

Download

memory/2800-310-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2900-0-0x0000000140000000-0x0000000140436000-memory.dmp

Download

memory/2900-7-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2900-78-0x0000000140000000-0x0000000140436000-memory.dmp

Download

memory/2900-8-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/2900-1-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/3808-21-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/3808-22-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/3808-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3808-14-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3808-15-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/4968-103-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4968-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4968-312-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4968-109-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4968-314-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4968-316-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5196-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5196-53-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5196-48-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5196-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5196-39-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5404-328-0x000001CE9B570000-0x000001CE9B7FB000-memory.dmp

Download

memory/6044-116-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/6044-313-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6044-122-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/6044-114-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/6128-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6128-134-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/6128-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6128-140-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/6128-128-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download