d8d69a0bfb1bf350324f67e558b958b0e921cb296adbabf5e16a6a30f1300b57

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 23:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
Size 2.0MB
Sample260809-3v1l7axeqa
SHA256 d8d69a0bfb1bf350324f67e558b958b0e921cb296adbabf5e16a6a30f1300b57
MD5 92e4e622cdbc87172983acd7bd6ff90a
SHA1 bbfee061a3e66b6464baadd956ecf8d9aed4b659
SHA512 53ccfa1efba78f0e55ed70caacc24f16983bb26ca0062bb176eb731bed03df7243e49a610352b7e17c3a4f88e8ec04c91a79d36a21f0172f69845b0af382b3e5
SSDEEP 49152:05Qc3U7rZNnOT6Q3Umy2emp2AQgAT76sQuE:Z9QpqGsQr
TLSH
T13FA58D2AE7EC41E9D0F6C27589B39547E7B278194F32C75F0A615A1E1F3B6A08D38321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3336	elevation_service.exe
4940	elevation_service.exe
3908	maintenanceservice.exe
2560	OSE.EXE
5416	PerceptionSimulationService.exe
1436	perfhost.exe
2948	ReFsDedupSvc.exe
5016	SensorDataService.exe
2024	ssh-agent.exe
2700	AgentService.exe
408	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\34a1761e24febf98.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117953\java.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000687d91385a28dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000057b4d3f25928dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003845f0385a28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000127cd8f25928dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
3336	elevation_service.exe
3336	elevation_service.exe
3336	elevation_service.exe
3336	elevation_service.exe
3336	elevation_service.exe
3336	elevation_service.exe
3336	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
Token: SeBackupPrivilege	2948	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2948	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2948	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2948	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2948	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2948	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2948	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2948	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2948	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2948	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2700	AgentService.exe
Token: 33	408	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	408	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	408	SearchIndexer.exe
Token: SeDebugPrivilege	1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	1640	2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
Token: SeDebugPrivilege	3336	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 1320	408	SearchIndexer.exe	100
PID 408 wrote to memory of 3348	408	SearchIndexer.exe	101
PID 408 wrote to memory of 4340	408	SearchIndexer.exe	102
PID 408 wrote to memory of 3500	408	SearchIndexer.exe	103
PID 408 wrote to memory of 3300	408	SearchIndexer.exe	105
PID 408 wrote to memory of 1748	408	SearchIndexer.exe	106
PID 408 wrote to memory of 4644	408	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_92e4e622cdbc87172983acd7bd6ff90a_glassworm_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1640

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3336

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4940

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3908

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2560

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5416

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1436

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2948

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5016

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2024

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2700

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:408
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1320
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3348
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4340
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3500
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3300
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2848 2852 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1748
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2876 2892 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 c6a12961441e84e41ad4dd874adb949a89fa52ea43a0658808d4c091dbf6b403
MD5 67616c38b1237991c58b89a7a6ed8e1f
SHA1 07ae0f6f4eeb3a5ecae8508cde8464363d0fb1bb
SHA512 0b3371ac080cf61a135abd0c3d1b460a211d44d4ff71af8f19497d079252d9ee2e0b9b6b930aed14fd99b65e9ff24737b9fea0a0127b0699b51d58243aa3e44c
SSDEEP 49152:jb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnwAQgAT76sQuE:B3q6sjBWqGsQr
TLSH
T1B6D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 33f66eed78e4fe92a3344b6e772bf852a1d46fad495bc2e10156f73f06b36e68
MD5 ab971107fd6a2719f5949268b5e4fc4f
SHA1 54dd43ec9f2a6313a479fb21ab384bb4b9eecb50
SHA512 1b3138f0b8ce65a77c6c3bf92616f985c94cb27cda4ebf41f5377fa0730553d2b6fce849db33cfce01eb25e294812622e469f4df573b634002b3c689ff194faf
SSDEEP 24576:TXYfDtczA5AfYLH8AcevDN0FImbwQuq3Wia7gD:2tcCAQgAT76sQuE
TLSH
T1A675F12963D408F9EC67813DCCB28521E673B8A54360E7DB03A49A661F332D85E7EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 85d5c963a1c9fe02c80a5810ab47821fc769868cebf7ccf026908095df9bd0d0
MD5 6fb478a3a82c1fe5ef36d0348fc85923
SHA1 b6b6fde95f5a8cce271c216cb95c9400332443fe
SHA512 2bd0c2ba5c6e4552cf1e82dbd48261764c5d541300df3005bcfe712e91305a74d0c29697e7e15082db94a54fa677edef21fd3f10b591e826b845488ef7d47088
SSDEEP 24576:20Le5ji0hmxxrM4AfYLH8AcevDN0FImbwQuq3Wia7gD:2Pji0AjvAQgAT76sQuE
TLSH
T1C185AE16F6748335D073C0B9C5D2A69EEA71308657308ACB4286D77C3F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 6773ea32abdfc5103e1651d4261bcfd3752f789b52d735a5b728e3f29ec9ef42
MD5 05702c2568d15f52b04907bf2125df46
SHA1 ae3bb2f06942c9e89d41a70945f2f091be5d6b0e
SHA512 dec81e31db7fb84eb7a13adcb52a12c9d432427dc6aeb0489000e62f4eca415c54b05b42e661e952aebb1c4d124269dd9b2a45b3b9a5596956ee8617bb86d62a
SSDEEP 24576:na7/ezSC6vUyD/aqgrvWn6q8wyuSAfYLH8AcevDN0FImbwQuq3Wia7gD:q/ezSC6vUzPveHjybAQgAT76sQuE
TLSH
T187755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 6fe89b57d8207fd950649d30e615f71c2f77a1075de6d75d2d181e6777595f09
MD5 8cbf5e7ce2634b98c1893cb08eba38ad
SHA1 be86d90d1506a7c267675c2279e7e6975594b376
SHA512 419c3ebf96ecfb916cd35d574b76364e75e2ed7899d06d3bf5f207bc879fcf14431b2d9ec3629f3ed5c704170b1f927a0cee1126254b6d606a9b3952f236a546
SSDEEP 24576:UVbqPb88hv/l+Y9AfYLH8AcevDN0FImbwQuq3Wia7gD:UVO88hXl+KAQgAT76sQuE
TLSH
T1CF559E66F5748331D073C0BAC4D3AA9AEE7234425B318ACB0246D76C3E67AD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 6c9672092ddf5f09691c9ad65d24fb7ad3ea47ae67ac62d84d15043600a03560
MD5 9e667aa1586ae471926d7fdd1a492dba
SHA1 24cd85a6e5b7e5302a275de0b143fc4e210c1dbe
SHA512 924fd0ef81ea8e5e99965f21bd6362d540403b73900d46a51da46c4063e706a0f033cd045bf4c1fa189cfb6725b158feec9af0ad39fed9e2f4adbd10f7fc591b
SSDEEP 12288:DLcAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:DLcAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T191552357864C30EAFEFBD1369CBBA9B963D1BCB88245979A00463BCA793D408D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 33b05d75a45e3cd866a84faaf04db4d7b309cf0c281c929113413be55c0e2b77
MD5 7f8b565dc15c66178d60c75ed55784a7
SHA1 003df77e3b45e127de14726874c403b5c785d637
SHA512 b49f674cd7fb16cff78d582b318486611ffdaa96341ff6fa4a46b7f826c0107fe898c8fc93d112750ed79a4c6001f1c2c13922456f58562f0caf07ba9f795050
SSDEEP 24576:qJIUlAfYLH8AcevDN0FImbwQuq3Wia7gD:qJIUlAQgAT76sQuE
TLSH
T1CC75CF3BEE28FCE2C67E8D795A918600E7B278704B51A3CBD165830EDE235D05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8e02cdad1ecf2436f26dad4b137aae2aedcc7c3be53b3c4a5162570a2154e577
MD5 284754e8b52ddd4bd9401778b70fb0a2
SHA1 a5c0c6cb70a0980f28e1790026471adfda4d1dac
SHA512 bb592469d76a9f5db5c121a58ac99ba876375c12618a86f04845bd376d25e487e2baa61131e89c318b24ea4ab7b9c9d162ab70a3d226807dcbcba93ec7b3f860
SSDEEP 49152:nQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THm:nQvGAdlCEL8c/DRNw5C7qGsQr
TLSH
T1EC266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 1ab1fd0b6724726e03a3e9155f0031cb29e4bfd9582ab159d3ba039e4b37e837
MD5 0405e7f8a8390d302966724cc451c562
SHA1 8137e11d5c45ad0f3d270ef5cd43c1919284fca4
SHA512 00607f35631cd05614cea42a59648d4957adc115bda9355ed3b9ad5d3cd7552676b17358e1aaa49d407182fe31464ee27817f20429cd75c82a985ec79563fba4
SSDEEP 24576:s0ewsAj/AfYLH8AcevDN0FImbwQuq3Wia7gD:xlj/AQgAT76sQuE
TLSH
T19F75E031FE74E036C6BF0DB21B36C716146CB9604B511AC3E3A85E9E59342D263B6E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 23c2584f1e506f45284781aeca9f08aa4b816348c76845ab00ba64a53408215a
MD5 ebe99059819c1e3f1992997512fad4c6
SHA1 e4e1bc46e0cce033549d84a5735179cf761b637e
SHA512 935405490985f139fbd4633ad72814317183e8cceb9523413187554ac8905f22be17c4efe5ad47b2269039601d9d9d2eb874b9fa03b9ce3f09d4fc6564b18fff
SSDEEP 196608:tUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH2j:tUEtQevvqc2W1cpV2tI32
TLSH
T1F5474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 fb67e96cba20b26bfebc2332444f039771e1781411146fc912dca32183811c74
MD5 f58b5365efdbe3e84526bae95b5ca4a3
SHA1 88810c4e91ee8207bf4d1ee64f20cfb61c7d5183
SHA512 c52f589e2cbf867a3fda528e833d29c8cf3099bfdc9cf25f7b60ff79d8efef4d367cef5ce557671fb47fbd96cf9670b0cac7be8fabb812512d7d820041ade9fa
SSDEEP 49152:2CbRquA/m2yL5zTfFiV+XenmE3/zfAQgAT76sQuE:7oquVjnmHqGsQr
TLSH
T1BCD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7c8df04b2f603663705d01814c21ec2e99428802233908314579001d2208cebc
MD5 77f393a27d51781f49ea5a8811d32c86
SHA1 38a35b6d2add3c52d0b05b69ba1fa9a2a8df707f
SHA512 b82be2e7d20510b318bb4e4648a9005fcb659674f0f622729f3fefcead2057ede1570f86d34bc6113148461fcda1b88c6580dce666d3fc812fc9f3a57a39e701
SSDEEP 24576:dAhGL3IFoiwtA5l7S53OAfYLH8AcevDN0FImbwQuq3Wia7gD:dAMUFoiq5+AQgAT76sQuE
TLSH
T15B359D81E7F955D4F5B3AA7899B69170EA76BCAA5E31C20F2150D20F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 7f47c39774b4243bd9a6edab391f1e50ccc000466b09bfa1bb082064b092a24a
MD5 9262f4865c0bb3dc85039809e262d03c
SHA1 af670a69a555e2ceb3106295b2639db2b2b96758
SHA512 a990df6c90d113320e5767db64de69ce1aa86d443dfd58cee573dce3c843c525e4276ab1712cd3a022c33f7583038f7132b884bb82c40c23291bd033d0c181f5
SSDEEP 24576:lwu4OW7AfYLH8AcevDN0FImbwQuq3Wia7gD:lwvO6AQgAT76sQuE
TLSH
T12C65F14A76A81CF9E9A781398597C136F7F2BC152A21D71F0360C75B6F37221AD2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5a9fa4948ad2c248b468012b9a4fab315cd48fdc0d4cbad5e7bb8f16df782a99
MD5 672761858b09768c3052f5140fb93203
SHA1 595f22aebab9af3dcbcb6217276b362b465da306
SHA512 df04277c837025668f877af983af52ca7d41fa5523d9fca6442a4dd635a785833e57bb3747fc065bcf690f112feefe9bea2959b615c1685ff70f32cf8d27049e
SSDEEP 24576:vZuAAfYLH8AcevDN0FImbwQuq3Wia7gD:XAQgAT76sQuE
TLSH
T1BA55129B239830FAE5A7C139CCF25665E3B278A6532183CF0115079A2F37AC59D79B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0481cc71d603977797176f5c9cc4b1ede1f2fc40c5566f732d5d1d4aaa2f3932
MD5 5d6bc5e86baf0531a12a17b32708ff52
SHA1 6fa806ad4c704742f479120823c7a7383939e1a2
SHA512 bba34e70896a810aaffb70c51d2c371ba06b31f29402a3599d819f8add7f26a7a1b95ae93505e84af3bfa2d692524662aae32c90d2f89d68549f039741983d46
SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U6:pQRQyi36YOcPbLvw2gAf+PN3qqGsQr
TLSH
T1D3667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a57d9efd02270c9a9b8a308a0315d478d2e8a777b26e55b08da4f23b9a8e1377
MD5 f5aa780196257d7464464a2e58ded07e
SHA1 745ae7127c9f30f5bc19e1c4919d5ef1df4745ad
SHA512 b45f0fdf1f1e7db9b2b1f0a104e1e2f024689e30822e6861c10e3b7c20fc82c77fd58920b3ba5f2655ce52068f77e152c8f1b9697ee6592f98c249b49ff62de7
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23U6:qQRQyi36YOcPbLvw2gAf+PN3qqGsQr
TLSH
T17C667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ad710cb7c63e56845796084f5337bcca6fd4b85e582e8fe10cbcbf48e3b7a3f4
MD5 89123ddd6df224280c2ce3f89a0793b5
SHA1 f3f44ed1a799030f031e295e889186a882fb0298
SHA512 4a13ce53639258ca04652c860c202c62449b0d181c85a8a9baca20c80ab9ab86cae1089ca1816bc4941dcdffbe269d887e4f054e49bd710c1a694709ff3304d9
SSDEEP 24576:IwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0wAfYLH8AcevDN0Z:O68Qg55nhceWu7PNU3/vAQgAT76sQuE
TLSH
T197B54933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7ebda2b0c420f53fb0349c7c18d01996e5b0a8e49ecf1911f7e952ef6fe8d074
MD5 3ad2cd4b49dc5479541aa57c6d2175cd
SHA1 62d2b58af289a404701217d70f48b4051487482c
SHA512 91b5b2b7ec19c0535b466052e931ef287179d18f4cf65e55f51b9dc9445da00898661321b133dc89f6ea60e3a22cc7056923137c90d6291c978c7f23ff4970d6
SSDEEP 49152:S3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99c:zy5112gYy5azzVvt69nLKnhZhqGsQr
TLSH
T16E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2076384cd90dff2bbaeb6293b1b4f16c646b0c0186edfae8c3e38751d1eead38
MD5 582c841e61566961cd8f5b1b13a5939b
SHA1 16881dd33add7909df04345881352ec5cac87ad4
SHA512 0c89ef6c196b0ee7dcee511ffb7f753050ae2abccab2a3c5f836e17c0fb2b675ec98e885dbef2bf221292c986a420eeea8907ee798cc5df6a36eae22c44ffa0b
SSDEEP 49152:ZB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glpAQgAT76sQuE:Pu6Jmdxd2dyqGsQr
TLSH
T1F5D59D13F1D901E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b1af093daffc3a333641f252561633900f5c7e1a15a08929550a29fd52d41857
MD5 021c3e5b32cccbfaab11b510142d46a4
SHA1 ea06a6b816048e75f78aa7bd261d9353e2c2e785
SHA512 3ee8adfd82cc3f069cb3b999d1e4993c4699fb2cb2893ea6b1051d880e80c8f9010c605d2ff3f39fb6db1b23f200a13b195a0a3951060ea3f40905a1717a5a4a
SSDEEP 49152:R1hpsNoJpF1A63U44CwH7R4xFAQgAT76sQuE:RmifPWRHqGsQr
TLSH
T110B5BE13F2D900E8D06ED17887569632EA62BC460B34B6DF0A9077962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 85ec10495bb8a5dad2ae6491650131e31e1c279025adc32a2783458cedee68f9
MD5 8fcb71a66ddc7b112c10e97c6fcba35a
SHA1 639017f82dd7f6b101586145be687eb5c80317ff
SHA512 e0b668d12a1e20683765cf347b781bc926dae9e6d71a66e19404e10a91175c9015c3342da14159a5f802f01192c2d811192ab637729d9194f439668fd1ed97fc
SSDEEP 49152:jSuZQIY0Be2KcRVtOnks6NMHqAAQgAT76sQuE:B5dKii61VqGsQr
TLSH
T14EC5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6825e4712ce09caac9d0bea7c7a137ef50969b948cd3f1485a6fdba38f5ac26b
MD5 6ef28a961a2ee2d4657929c06b4ef018
SHA1 66e0a2d168b046e4c84758221ab13f0a72065664
SHA512 6656434b035d45a190c11426634b2be31a75278fe4a9306b608ae29260776fc2b01f1bbb76919ba99b2e72564478756e67f2b15a6f23d505ec9f22a3855b3be6
SSDEEP 49152:qhtSn8EApI0fig3giDn0AP5w5AQgAT76sQuE:LX2imphTqGsQr
TLSH
T1CF95BE13F2D900E8D06ED178C7568632EA62BC150B34A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 8213131cd374fafa7b519a98626e6d4b05c8f9597c1b55bd5b19ffc875b93df5
MD5 b88d3d146fe8e0f7451c5458817e06f6
SHA1 0a822a1e3c2e7427254c2dfb9704d94664239dc2
SHA512 c72a771480c1cd4c3cbb870e1eb9a0e058c062f0eabdfc6e087e9f578686e0f287d48c5683ce74cbbc687a968bd6273c6a5987e4a97bf92daf87a89c53fa82e9
SSDEEP 12288:JEAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:JEAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T18F55235B594C30EFFCBAD1368CB7A1B9A3D07CBDD346939A110A268A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8d453f6a3729d6270986ec97682ba37bc5c39ef974643e0142cf0c060886f281
MD5 ebc1995c093991758f56ccc60533a886
SHA1 095098f81cee7946107c9a48c7daa853cb77db34
SHA512 e5a2a7be791f78e93d316cd2c75891478d18cc0fcc3aa21b2e3e640b91395824a34b8efd4bf5632054bd981c2ff2fd4005f6b22b3a8fd7341e38780cdcd3a72a
SSDEEP 12288:rTAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:rTAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1BD55235B594C30EFFCBAD1368C7791B8A3D07CBE9346939A150A3A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 f8556067a7988f03e69b88145b461bbe380ce2e84f1aa04e1579ab6a4f0b2f31
MD5 f09956f161cb8209ee29632d23f309d2
SHA1 4f79f96f173b3f5a99824b9c8266c162604a51c1
SHA512 3b703ab70f668e34ff4cb40408e35d418c613e848c2d927864debf139b0103637a7f6e19c4351128acc39cc3473d81524b1f6ee71f139ccea900e7d429b1fc7f
SSDEEP 12288:8tAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:8tAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15155235B994C30EFFCAAC1368C7791B8A3D07CBED346939A150A3A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 4f1da1ca10b8f9b71c885df76426016a1d5908d768660f5ac91b053fb0aeaa5d
MD5 ac048130e03377b1d88f2c9803949888
SHA1 0f2cbb719fd18ac4b42af527b9c9b704c691d444
SHA512 6f009d2f98e6bf8e14cc81e77866ab76e43df8744d54f483db02c3f3c2cbb16e9f385d78e29e8443232492e6158e83e14217f742edeb3223904c595eeadbd4a8
SSDEEP 12288:iVuAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:rAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T158552357165C20EAECBBD135CC779179E3E1BCB9931293DF46011A8A2E3A248D1F4E70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 5328105c1e659eca83472a0e7951ffc8848d36f33f7743fec23d11c07ec9355b
MD5 36f9c27013e8222d445a985067f8dacb
SHA1 66aeda5c5b4c1872e74e76beec15b69d17702add
SHA512 d4d5167e605dd88c2edd71728a18c416e2bc8a4fd029eda54f38ec6b195916eb2da685b6cce1f57a26c497a793db120002f7fe1d94c96be7258654f18cd4b667
SSDEEP 12288:/mAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:/mAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T14D55235B994C30EFFCAAD1368C7791F8A3D07CBE9346939A150A3A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 86e54b0c50119c44edac07c7ff96745cab0febe01e8746bfd60d305fbe9af999
MD5 0c3e645003588c80a50b76ba95c55a74
SHA1 c7dc7cf6f764b0866903722089ed0c7c8c099619
SHA512 0332f95086114be64768d478e7a6bf62083126e5d80a29c8538ac523494d61a2ea78534161f6f65f99c74f458bb64cc3d1e57688ce418c632df2d98056aa36ff
SSDEEP 12288:hnAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:hnAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15555235B594C30EFFCBAD1368C7791B8A3D07CBED346939A150A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 dac5fc83fa9f454928d1e0f8bc336d89a8c9b91c2e8136179b195278cc1928ca
MD5 65b96b85563c2e0b0bf0a5263e2fe005
SHA1 749c7429773706753c0ccc6d23e6055f4fea0d51
SHA512 88e8276dc847d59ba4e79286ae0b2a420ea6b3f0347a1f8db685ffeea7b321b9c85421817f3e5713b39a14f1f754688f055051edd2c61d3c6858e2742f72ff0d
SSDEEP 12288:mrAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:mrAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1A155235B994C30EFFCBAC1368C7791B8A3D07CBED345939A150A2A8A7A3E418D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 11e2bf17b5b1d2aad7464d679a4c6d8968396c664a1a6819022a94a1ef358727
MD5 399198e8de96934a9bb36dcb97950f4d
SHA1 974497290d3636458f0fe105a44bd085b32e5ae5
SHA512 dbedf96eb842fad6e9c10379b13088b6f331dc8012705a74134e4f3a70dcf65d6015773243de243abac416e56b08ba5554006be3ba3255a52a545111f2660dfe
SSDEEP 24576:LZMRzFVSOzAfYLH8AcevDN0FImbwQuq3Wia7gD:LZMRzf3AQgAT76sQuE
TLSH
T146750195B39018F8EC67813ECC668916D2F27C6A0760C65F03A4366B6F373A15C2DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 d939e7ad4f286ad36c68089a99ce4b0cde7dcfe469cca523c039d04a6708b4da
MD5 68e0d4945f61586149bb4eaaec52aa77
SHA1 acfdb77d066768ad90cbb1208ec1dafc7f182b96
SHA512 88e407528ac5cf5430d78a196a86efb48bef20bc937b2ad7f4fba30b3bcca83d4778be61b074027643f48ade9f4f06be079444b5634dea956b7b87c7790a4933
SSDEEP 12288:fQAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:fQAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1E755235B594C30EFFCBAC1368C7795B8A3D07CBE9346939A150E2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 51d478a98de957bcf485e67e68fb797df4f9a49ba0497a2a6400b5ca02efcb34
MD5 b5408533515e560d29c59062b3f1f863
SHA1 018dc777224f5c2a233d18407b8a946aa8709b58
SHA512 8fa92cf2d91f49d5958705b2e95ae67318461386ec672ce4305973debe9d2da456fa6fbaedbfd35fcda6b697a06c3310caa592af88bb43c6257d797e52048a79
SSDEEP 12288:ssAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:ssAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1DC55235B594C20EFFCBAC1368C7795B8A3D07CBE9346939A150A2B8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 becce66ef6357d1440d22126af386c928f02e7ce41f6f0ef3038a1964ac2b98d
MD5 0549dad64944a44ca1b9dcce20a5dc85
SHA1 be04a95a7c70d7db3bb793c4dbc29f8694e91c44
SHA512 33c23680840572c4391da379e48483b8931ba484ce4b2c32091b51d3e2fb8ff2c60e82e98a3776a86e5a50eb0635405a4bd74be2b47aa3d9a3fcc89368f00d44
SSDEEP 24576:jzyPAfYLH8AcevDN0FImbwQuq3Wia7gD:jaAQgAT76sQuE
TLSH
T1CC65024763A530F9E477C239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 1d001f9dc09c84b6552775f11d8360d5f5cc62aabbd39b041e77675c66d2da39
MD5 13bec748dc6603a5bb1bbec45ac0767b
SHA1 48531505e51d529c2e593c965d4f4b3843fb6423
SHA512 d915e28553052c88d1a16c55fee93ddd396312bc0b4cc82af7e8d51833fd45378eccf3a00224787eaddded98250ed7601f93a0ed4581891a03fa8074a6dbed6a
SSDEEP 12288:KQAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:KQAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T14355235B594C30EFFCBAC1368C7795B8A3D07CBE9346939A150E2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e21e9bce216a226a5069e29a0711630d4607a866d35e0e3666ce4d897aaf5473
MD5 8515bd0381f1696d62a3e42a08ca411e
SHA1 68f9a992660c7ad4e43a3609c107d86a1415334d
SHA512 f674e7f93fd42602bcd1925897e0c9d6c3da6cc5d7bcf0261138de7d69d2f25fd94b243dcb3e81e8308d1cd9389eb5a17ed26e7037929ca46ee386a711447f03
SSDEEP 12288:MQAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:MQAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15D55235B594C30EFFCBAC1368C7795B8A3D07CBE9346939A150E2A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 c96f048225c28ef96f7eff256f2b450f95984290df51df5a046d06cb3bffee45
MD5 623dc81f4cc8a2c4c735111a0a990bd2
SHA1 0bb87de55f9034aec2923f1bffdc88d46fec7136
SHA512 388ef835caa071005679794833deb505e97cc173fcab7a80fab1f4dda4904bb4b9726dd112e1c4dbe872a8b652dd03b17fd2b630bb48303609f60a5a2d70783d
SSDEEP 24576:TzyPAfYLH8AcevDN0FImbwQuq3Wia7gD:TaAQgAT76sQuE
TLSH
T10665024763A530F9E477C239C8A21A55F3B1B87647108BAF135407BA2E376909E7AF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 b16af2c151a44ca8eed9c68b4b444d15cfe75897be86a130396dd6aa5bec1e2e
MD5 0d87e64c46a51da363c7d8688d5f22f5
SHA1 44b68181302a44775b8578e01c577744a735026e
SHA512 d9f38286f28ec99beba53d7616380fd3519559fb05bddc438ae8e6396eef485991a8699e758e94a27d88e2dd851061dbe6aabd727a774ad42e0ac324c6a61277
SSDEEP 24576:eTDaLl3z0zDdAfYLH8AcevDN0FImbwQuq3Wia7gD:eTuLljSAQgAT76sQuE
TLSH
T1437501A5B35018F8EC67813ECC668916D2F27C6A0760C65F03A8366B5F373A05C6DFA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 e308c262035781469c1750384a36bd6c549c014cbb16a9a472cfcaccc4206a84
MD5 4eea62199f4d00493a584c02bf278f18
SHA1 f0359f747225f8da77f2e9ee0e7733af94f02e19
SHA512 62e7d8b02ace909aa6fbe48410054946fcc11d3010a1ff4b4bf7dfc4c9b47e64ef35cbccb707e93f7fade3d3af28df4c9612b03b2d5b08ea5583209ceea0c68a
SSDEEP 24576:k3vd9CHKy7GZhAfYLH8AcevDN0FImbwQuq3Wia7gD:uvd9CHKya3AQgAT76sQuE
TLSH
T13A85CF91F3E810E8F0B7DA35CD765511DAB67CA91B21DA8F03A4265A1F336D18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 38766b6a22df0744c02181cbd7817cb33cafce3e95832b293b634fbc759e4477
MD5 f1ce21a7af193161d4e5965fcff6730f
SHA1 dba2320b1407df0e051b049a2778b5f8af5ad7d1
SHA512 c27a51d61ec16cc90da65fe4d549f81f7630937d54bcb44af22f744fb175e72d74b0d35709ee31431ace5f8a4cae5888e1eb87b27a326de0cdaabd660cbafd15
SSDEEP 12288:RNAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:RNAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1C155235B994C30EFFCAAC1368C7791B8A3D07CBED346939A154A3A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 45cabb8e3461eb3441e00049dc8badeac341b14f6452195b90020c6042027f8d
MD5 7f36e3b70f3ad72cae5af509c7083f35
SHA1 472e7f2e9a2790333a6edbbefd8efecf8751823d
SHA512 3a9cd0c01bfa5311918508f2033eddda34b28bde717c3fba7afa872a8a8024457fea7867c9b0455ed73e65dd31d1e9fece7b14c6a8b455c7e6d824379cba267c
SSDEEP 12288:QvAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:QvAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1A655335B594C30EFFCBAC1368CB795B8A3D07CBDD346939A114A2A8A7A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 6c1e41d2d01d0d8d9f2beb15e1a3821c7e8cd4155814d8577d63fb4e36db9ce8
MD5 c6704fa205881fdfb97f6c09a9e5e46c
SHA1 c5b95433997575aa5f6c521ff89dea5b7a9a1022
SHA512 e561a2b03d0465af3e73df08fe6b984a1f80c467a1c524ca4cc8dce00d2eb8aa8ed4dc513aed06d38db778dcb6414d3c97eb13b6e5e0f5a4d272758e04b7dd71
SSDEEP 12288:EqAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:EqAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T19E55235B594C30EFFCBAC1368C7795B8A3D07CBE9346939A150A2B897A3E408D1D8D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 035de7726289a3d8dd0c8b8dfe91aa5dfd23126dca0aa90c59a61f2dc7d78c28
MD5 7307d0314e133800c17cf62fc81b8e5d
SHA1 aa68fec96e2fd371b4e9366154d02bd52d10d171
SHA512 f6be1cb4d097800259d604caf3de3a9bac34d9cee747cc6b6a3c51de17e57e4f9a27f5d305c3937b6910f2d287a1ef2ed37d586064cda642cf087610d6c136d4
SSDEEP 12288:8QAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:8QAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T13D55235B994C30EFFCBAC1368C7795B8A3D07CBE9346939A150A2A897E3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 018df827b6e139c827b79f9e092625476d9c394d5583ada7e1dbb074d13c1a36
MD5 91ebb39dca293b2e990c563a58ae746b
SHA1 6261f854200da5a30d6a68998640ec124f50088c
SHA512 5a897308b87fbc6ece47fc39bffb2923473ccd703bad9731882ab0b4189b4ad7276b6b43569a67e5edb59867e562299f3f54f6db3c37bcda6da9ef78493ec837
SSDEEP 12288:uNAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:uNAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1C255235B994C30EFFCAAC1368C7791F9A3D07CBE9346939A150A3A897A3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 ad3967df606272da4ca3afffd2375197899f2b15238313bd406e4c81d4898c79
MD5 4f8160e8562f118dbbef6998c89eab5f
SHA1 9c9ea98e2470d5da2b74147715fc013e35ec1598
SHA512 96e831fafd9637a379fd351730352d76b582690fab37fa2b059fcc7eda7adfacef5ca77494db8d73abace4fda079bc467c95f1094e70a768d9f37b8b25827dbf
SSDEEP 12288:GoAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:GoAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T11055235B594C20EFFCBAC1368CB795B8A3D47CBDD346939A150A2B8A7A3E408D1D4D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 85e67db7567ba25b3a96946c6df90935743a4976283d9139ecd348dd3b5c95cd
MD5 82c97a993703c4570355a4ad923c6060
SHA1 7e609ccad0ddeed81b1dc20d0a4a8472a71acc2d
SHA512 12274bc115c31573838c3271ac1ade70e203fa561663e0961b3d33e29cf802f94c965dcb534c3441eec431cbec69f84cd2607f4907deb4908881506cc4069f8c
SSDEEP 12288:WmAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:WmAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T1AB55235B994C30EFFCAAC1368C7791B8A3D07CBE9346939A154A2A897E3E408D1D4D74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 0d30fcad28e874d04831713a538cf139b6d3a0980028c530bb283152dcef54a9
MD5 8b0024a81395fb3431d48c5371df2ec0
SHA1 813a8e98de553e90612080b6c5784bc96f4c3b3f
SHA512 694d60e6b313bff5de6015ad3856c17e66b2b1e27e69c1ac3e39db8eb6b6f98a6aaf189fa82057aa71ef70d894eb10884b0405ad7941f1fbb3bc54d21f941ff6
SSDEEP 24576:KfwvUk9RX6wkyAI8AfYLH8AcevDN0FImbwQuq3Wia7gD:aMnYI8AQgAT76sQuE
TLSH
T19885CF2AEBDC44E5E1B7913C89B7460AF6B178691B31C2CF025A53AD0E37ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 73d2126c5bd17e947139e80f87ac584d11e435e0fd47a65968e7ebd0a3d2ccbb
MD5 7fc01a8a150eb6924ad8fe55154060dc
SHA1 eea1e3a14256ff744de13f2adef9d3a0f50ab845
SHA512 64bf4a3d6277ab154c1621cf62de133a14cd765d165542fd1c4259b7ae0db32a04f1df100c7b364cc14f68d9734c3303b29047dcc710e106308787280003af69
SSDEEP 49152:oYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ZAQgAT76sQuE:/ySzPKqGsQr
TLSH
T1D9066C96A16801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5dd4a6f4a7a6e63677e3c4e2ea6dd7ecc7c17e02c5e29f0e7af398aa8a1946f3
MD5 344093ae57e5f2df1236256591cecfb9
SHA1 527a6e72a20f9837e6455a1ba657b9722bb6efb6
SHA512 5850e89d8697640ada255f75e36081c773c8aa55547d25e186efd4e7b2fcf2184f69d58fdd6ed2e8438bceb31f61a39b4b2d59fab0ae6d9392272fa102daeda9
SSDEEP 24576:847Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYDAfYLH8AcevDN0FImbwQuq3Wia7gD:847JUQjTirIhCnDHUPfF/pAQgAT76sQr
TLSH
T11E659D1EA3EC01E5E1BA923885154A5AEA71782D1B31CACF1270437D6F27ED49F35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 fb379bd100e74389e51f9d742f5dd22c1816321c42b865ffa9ecc1506bd30b57
MD5 64ef1ace42d514eeb71023534c5e7842
SHA1 b5a3cde4972889a442a3881f56406c950bdce861
SHA512 73383a7635bfbeff590df82bb4a2ace277c69bdca5a33140b945451bcb2ee5a64c3fe8504ee150f408c316e8301066796b63189e47e0b5af97bbca9eeaa53c9f
SSDEEP 12288:MbsfAAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:DAAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T15F65011AD29811E9D46EA135CB664A50F3737C6983E1D3CB12C0F57E2F3A6809DE9B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 e13c3069fd4fc42ffb2bab6aa00cf7f44e6b988984367a17ed9a116cc04b79f2
MD5 4c0f86767d64105958b118b601a8838b
SHA1 72007ddccb5a6b86588d9f8c09db1c0e5384c691
SHA512 717870e12cf7139754709640cf6e63765e1e04a8ddebab711d9a00dfdd88ba234d3194288d2604383f642166e1cb62f961a5898d099435796100b20ddd4aac0f
SSDEEP 24576:mpVqKUPKnluP6AEQwOOB5LE8evD2N1ru+Qh0aQ6ifCO:BKUmluP6AEQw/TuuZtQh0aFifCO
TLSH
T11C450741762AC68FC6A950325E32D6CCAB707C01EE056F0773C9973FD476668BAF5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 962f05f0a174d77eb61c668332aa1c34b18679c739539bc8b88051162f69293e
MD5 2fe2ff7fafd8d5a8e7ab981eb4b77aa5
SHA1 252fb89e04e9b69f8a16921cee2fafb4099ee9d8
SHA512 5ed9e53822c7cd99d3e9034ab5fe5e3d15c31502bc6ce0c5083e36d6fe80e0d0e232b704752a98e4e2bbcc9c17f834b4c0e0fafd2633affe9cc858e17649e82f
SSDEEP 12288:rPZkq+qSexTBdFZ+cMM8/jet2y56U1Yst5IbRU2WG3PSXcvDBpM:rPn5L/dvKNy56xst5IbRU2WG3PqkDBpM
TLSH
T14B451941A5B7E31FC9BA90370332968DBB745C06B7892F0473448A3C946697EF6E63D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 55cda28249ef75a31d1b0817891544d1c87027f4c6bdfa9559c43a2b8bef5f13
MD5 71c5f3bd9e51991c96846dc3c5cdd289
SHA1 8973f5d81e4dc944b3e1ca8ea24829f0136f3bcc
SHA512 14b3a8996e7035d8f8ce8389013f85a1f5c031971444dbb632e753475e166f91c91aaeb691a80956613b734dcf0a4c06d6d801796a26d4915157a3c338d41696
SSDEEP 12288:607YAfQ+fi2CrN0uHI3AqTevDN0FImbwQ2J3a3nWiOV7gD:7YAfYLH8AcevDN0FImbwQuq3Wia7gD
TLSH
T171552357874C78DAFCBAD135487B91386395BCBC870492D7640A27CA793D8C8D9F4E28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0b7c4389e4fc478a9be1feab8655eb3c984cf88d05e9a327954b1e82f2ae452c
MD5 1e82c7b018f7b76a38020cdf5c2fa85c
SHA1 5e98275d7af751963459918e96037382c5e39623
SHA512 89275c11dde2414397858936ad6c34ae484caada30797bff909b907c4a13b08153f7e0f2945beedc6ce283dc95cb940bc332df98a0ba64440456b019495e4010
SSDEEP 24576:jgb6bmBIi49WNNFpg1rSvFv7bYSAfYLH8AcevDN0FImbwQuq3Wia7gD:jgb4mBIBhGFDAQgAT76sQuE
TLSH
T13A65AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 6871d6d29b9b2e38e872b84d921f2e69a7cd8871c33936ea4a18578d0e980f58
MD5 6469b7f270199b8cbac4c19a3c03be64
SHA1 399aeaf13c6e73fadf3f5dbc76c3ef00fccb4f41
SHA512 4fe59dc7a0cc357f02df7d1d9e7ad74c35d7f1d6f62a10f65330d782b32c4849f5908628afc3546995016a47a34d3747dbd6541440a3bb88717ec12335e968c3
SSDEEP 24576:HG88u8FpJqH1bzria7/mzAfYLH8AcevDN0FImbwQuq3Wia7gD:m7ZFPqVea7/KAQgAT76sQuE
TLSH
T1DB85F16677E401F1D47BD13889924663F6B2B8250364EBDF06A88B551F33AE44B7EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 4f64f890f16596ced8d057f0abcc9d5f75c848110b6aee81f9eaf6823863db73
MD5 a7efcc65a7835ed9c411ff0e4d9087aa
SHA1 d0cbefb6a4da6e938f21657682176382ad6f6185
SHA512 3214d87a1c7c848d623283516349817bbd86fa606ac71a37dcd8ad23b365cd892a3235ccd9135f0dc8fc9619d72b987d4bdf695c2cbe5aa3a9a81d36e0e03e21
SSDEEP 24576:UPUr+NQ3AfYLH8AcevDN0FImbwQuq3Wia7gD:UJQ3AQgAT76sQuE
TLSH
T10065E12F22AC18E5E67AE13D89968619F771B866031192CF0291417E5F37DD8BD3DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 85da7a358aa897aa5f05075e3caae00255eedefcd66ca96d830b5ce1097dccb1
MD5 6ea3ed68756fe174fba3e6620ebe4ab3
SHA1 b82df82cf392ae720d76d4024c933b97934357ba
SHA512 ca51a93c84d212aded376a2eec82b564f2788c849c010994652bfd69b9e491e71b1460f46d60d3818d4c74972172da7e91c444fe83a59549586249b44e38e5d4
SSDEEP 49152:/BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjnAQgAT76sQuE:wG05lO43b5qGsQr
TLSH
T1EDD5CF6E62EC11F9D0BBD17CD9C64A0BEBB23825032556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 fad395ace57e861fc30e0ca39c6bde54290889768dace52b140eb14716805bad
MD5 26939e53093a4e1c26334679e856cee1
SHA1 536973f301d9557cbea624051249feea07806efa
SHA512 77d58f0bba1a76df3879d274f8c5b090d4198d04b31d5b7a5fd813c4127d076a03bed3101420af9d7cc5fb69f5e6df8a87d671d10303499db94974a3ed800c8b
SSDEEP 24576:Rfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnZAfYLH8AcevDN0FImbwQuq3Wia7E:xa5POZ3BJt2pasx2+mvAQgAT76sQuE
TLSH
T1C065AF5EA6FC00D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7f32633f166d1b80c8c817ee08334706448a341f689b47e461a375bf7e284af6
MD5 a68f6891eb2d84c8d2dfd98935be6d47
SHA1 47b751c9f021c71c82a8a2944c4891bc09efe19d
SHA512 fb2588daa5d620996987887ef33acd99097aa77639da485e1ebd49ccac4055b1c7c668719443f3af7c1586ffe33fbb8855d5efbeebcaf341b1a3731b3bb3146a
SSDEEP 24576:rNcwHdjbyQ4nLC18lb/EOjowL7FkbAfYLH8AcevDN0FImbwQuq3Wia7gD:rNc/zEOVHFqAQgAT76sQuE
TLSH
T1A5857B1623E901E4F5BBE1BE89779546FAB17869133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f4e2c0729a830dff36e3b8772513caf48d34fc17b894f54c113dba009c77efe0
MD5 0a32201b3490c3d2d8f7325ac49578a6
SHA1 90897ed8222094db7f97a6af946862de83e59bd3
SHA512 3b860efad601f82c40e1d24ff270baf244f04a530cec7e3725ea02df9abb98ad857c94dc5846042512dbf84c7d2d9242ec1e4228e4d2c979fb8dd5e65e7b2585
SSDEEP 24576:FTkNvNnaFeYhJNtmZBm1AfYLH8AcevDN0FImbwQuq3Wia7gD:FTMwBtOm1AQgAT76sQuE
TLSH
T16255AF6EBAB805E4E1FEC675CD238512E6727861073293CB5290C13F1E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 948d1ed0f44718e11e0503625bdc7265e45cc7681f5b82506c9a217ab5cb4759
MD5 8ab04ba17d86d946858003cff440c047
SHA1 0eca47496bef42e8d92e670cc12b96825abba0e7
SHA512 a71738b6fd9b4053cf70cc4124ec19844e6e71b07adfce44d4a325b841d26df6476d7b619a242c1e4fa2ee101cc9a4a1cc863df76ad6ee911d4ad4062cc1903a
SSDEEP 24576:QD3FHshBIYQgAkAfYLH8AcevDN0FImbwQuq3Wia7gD:QDVHeBIAAkAQgAT76sQuE
TLSH
T13B75E17EE65C04E4E47BD17CDA638606E7B138AD032256DB029481BA1F7BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/408-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/408-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/408-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/408-310-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1436-77-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1436-299-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1640-80-0x0000000140000000-0x0000000140217000-memory.dmp

Download

memory/1640-1-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/1640-9-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/1640-8-0x0000000002080000-0x00000000020E0000-memory.dmp

Download

memory/1640-0-0x0000000140000000-0x0000000140217000-memory.dmp

Download

memory/2024-109-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2024-306-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2024-115-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/2024-107-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2560-50-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2560-241-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2560-61-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/2560-55-0x0000000000970000-0x00000000009D0000-memory.dmp

Download

memory/2700-121-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2700-131-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2700-129-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2700-127-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2700-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2948-82-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2948-325-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2948-323-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2948-304-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2948-81-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2948-89-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3336-21-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3336-90-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3336-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3336-14-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3336-22-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3500-321-0x0000019B2DA00000-0x0000019B2DC8B000-memory.dmp

Download

memory/3908-40-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3908-39-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3908-52-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3908-54-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3908-46-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4940-106-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4940-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4940-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4940-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4940-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5016-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5016-305-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5016-308-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5016-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5016-101-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5016-95-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5416-65-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5416-73-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5416-279-0x0000000140000000-0x0000000140222000-memory.dmp

Download