82f60e269143265a73201eb63e44fd50f75690823079ef6c3635b1925083e6f4

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 23:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 1.4MB
Sample260810-3q9pasbc49
SHA256 82f60e269143265a73201eb63e44fd50f75690823079ef6c3635b1925083e6f4
MD5 877f2eeae1370b2d166d16fdba494b93
SHA1 9bff5fab22a687cf0d63c534b4c1f7c0344cb8d2
SHA512 b9830d10092c833b5f92072067bad15eec2edea7b5e319096005101005dca232644bdf8cf1b118dff070d4fd67b10b6136c097efd18f1b110f2add807172cb80
SSDEEP 24576:oR2tN7JN2dv9V13b95qWv9YQPZWuipzQPI9hAH8CzQgAqvuG:oR2tjNW96+5kzQPm6YgA0uG
TLSH
T1AE65C01AF6A812FDD076C37ECD565941FA72781657209BCF03A0465B2E2BAE44F3E702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3736	elevation_service.exe
5516	elevation_service.exe
3176	maintenanceservice.exe
5932	OSE.EXE
464	PerceptionSimulationService.exe
4412	perfhost.exe
6056	ReFsDedupSvc.exe
4468	SensorDataService.exe
4168	ssh-agent.exe
5912	AgentService.exe
6072	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\25e7fb37238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Colors	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005ceb59392229dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f3d5cf762229dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e0599b352229dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f22874372229dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
3736	elevation_service.exe
3736	elevation_service.exe
3736	elevation_service.exe
3736	elevation_service.exe
3736	elevation_service.exe
3736	elevation_service.exe
3736	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeAssignPrimaryTokenPrivilege	5912	AgentService.exe
Token: SeBackupPrivilege	6056	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6056	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6056	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6056	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6056	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6056	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6056	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6056	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6056	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6056	ReFsDedupSvc.exe
Token: 33	6072	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6072	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6072	SearchIndexer.exe
Token: SeDebugPrivilege	3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	3116	2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	3736	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6072 wrote to memory of 1976	6072	SearchIndexer.exe	100
PID 6072 wrote to memory of 4740	6072	SearchIndexer.exe	101
PID 6072 wrote to memory of 2168	6072	SearchIndexer.exe	102
PID 6072 wrote to memory of 4228	6072	SearchIndexer.exe	103
PID 6072 wrote to memory of 5104	6072	SearchIndexer.exe	107
PID 6072 wrote to memory of 1688	6072	SearchIndexer.exe	108
PID 6072 wrote to memory of 2812	6072	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_877f2eeae1370b2d166d16fdba494b93_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3116

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3736

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5516

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3176

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5932

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:464

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:4412

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6056

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4468

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4168

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5912

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6072
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1976
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4740
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2168
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4228
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5104
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1688
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 be8021c44575f661811cbd7c3edfefe35062998452597e6776d1e5ef7136558e
MD5 c8241494f496a684089270df8d46a340
SHA1 179e38013a5131fd4eb1a4efde33d2c5641b049f
SHA512 51b8104b9e3e3d305cae8e0e19a4fe069618c165cb9015835f9a10d4564b4df29f02c29f0738e4467bcb904ab69b0889c652978221b7386ab4fed6ed81bd9273
SSDEEP 49152:sb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnHzQPm6YgA0uG:W3q6sjBW6YgAn
TLSH
T140D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 4c63657f4e5ee2d1089ad2b7181dc27f5eb871d4fa80b576cd352eb26ffbdc30
MD5 eb10194d2ccd7f133e2498f673515198
SHA1 95be0eec8da7936886267f401d0438d0058ac609
SHA512 f1f34cfc6c7cfe56f991d9eff350d07a5a3b04c992f3634f5968e29364fa7abeb74bcafd1d3f0e12969e2136be7d080eeb06afca3a366f7dbd402a296c2da833
SSDEEP 12288:O1XLsswWkxy2lRq2czAuRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:8XYfDtczAAzQPI9hAH8CzQgAqvuG
TLSH
T1B0750129B3D409F9ED6B827DCCA28951EA73785047A0E79B03B489654F332C85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 6765c8eb5c3603cff39b9c73bfac1991e0f93be86942fb24e14292611ce83210
MD5 2d38804910f6e77b0a79e543dc5dc42f
SHA1 876f234c2d70f34d9dd773279c05b6b0ec0e3e18
SHA512 eb356d9509be60bcb5ec32a0a29c5153d615c3b7df9562bbc287197094fd911cc8f277eb7f713af1df443543133f2c1874dfa727c00f5c80e2ac2d9eeba54720
SSDEEP 24576:V0Le5ji0hmxsrMPzQPI9hAH8CzQgAqvuG:VPji0AK2zQPm6YgA0uG
TLSH
T18D95AE16F6748371D073C0B9C5D2A69AED7230811B308ACB4296D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 bb829a4027c1012f43e4356431bcb83c4b4bd29d44e941623bc9bb52dd6087ba
MD5 87b832f034b337cae128c531fec1fdd0
SHA1 b2dfa9f5a764f154f6ae81a088ea69e0d721d1c3
SHA512 09e1ea8fcde5be382a54f1808ccac964227f60db9dcd68abbbfb78e9fabea58b62f98679c15f67d81908a5e8f8f1249ff249ffc60a20a732000e583e165a0d0c
SSDEEP 24576:ya7/ezSC6vUyD/aqgrvWn6q8wyuxzQPI9hAH8CzQgAqvuG:V/ezSC6vUzPveHjyKzQPm6YgA0uG
TLSH
T12F756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9ccb980c5543d81ae7de704eb2a86af49d41aa2e14fe53a30b943ec8ad663435
MD5 cde6a8e437e2c661273fcbd3b70549d7
SHA1 20e35aa3012455bab01dfc4da1b82c281ae7cd74
SHA512 0cce452f3bda3f6a8c8c3df66f8c55c190f0a9788cf7f12e0f36adc12c1f6609e9081c4671c9f5073656fd2ac9bdb047f4ae96bda0d64caf2c44bbb6e8ef7cf8
SSDEEP 24576:MVbqPb88hv/l+YMzQPI9hAH8CzQgAqvuG:MVO88hXl+pzQPm6YgA0uG
TLSH
T121559E66F5B48331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 aa3139ec90f63a298705fce490e1855ae50084a60aa97c0baac137c17b019f83
MD5 d6ffa9f88c5b7994af568f9ed2d581bf
SHA1 1d1b7265b62660854a4cd47743861f227511e9dc
SHA512 5c9109e93d8cde4121caa89649f0c139f11e5427bfc67bd3063444ae904e2bc148d10c869988b27e93f3272b85b4630ec0d0e60e3963f43bf5c6a46c04cc18f6
SSDEEP 12288:9fFRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:9f7zQPI9hAH8CzQgAqvuG
TLSH
T11F552347F59805E5DF5F0BB2586B5FE2087D8DB43BC4A76702322DA68E7F0C4E906292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 80685306aa36263f92ccf7bea57d32aa2c1da81f75da90e73fa0c88b1b67942a
MD5 85e7f812b167253fd47a0e93d4087abf
SHA1 6eee78ca58530fd4578fb1b9add1d4af470fde2f
SHA512 7d06b3cb0872814277ca50a1761fe6621215204bfdac53d64df9b4958866e3883d5c7830fa66a669fb085ad5663ac8f4a15c8738d424e7ea4fafd15219d51abb
SSDEEP 12288:CeBNUbTVO86USRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:CJIU0zQPI9hAH8CzQgAqvuG
TLSH
T16975CF3BEE28FCE2C67E4DB95A918740977278704B51A3CBD135820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c8878d73940e479a1ba9f74d5fd852e0871313d2813fd15547fe0a8c3f27b731
MD5 5a5636a1ffc42ee8d5e95ac33d499385
SHA1 637268e523289b28bed216919c3c56081c3285c8
SHA512 d6f2cfd131a978c8f9143fe752402f0bb12695f2e7ac7d9aab9965c518fe8ea6d18649ea82f487a1332e1d024b0b4f04d13ea1831d8d7d1773cd74dd799ee5b0
SSDEEP 49152:aQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH1:aQvGAdlCEL8c/DRNw5CB6YgAn
TLSH
T1DE267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 ca457c568da6aaff6cc25b936c1e3ef675a1f9dfb2bf0f135e7674e50d866e64
MD5 693b5639bbbcc106157b125d6b9b62c3
SHA1 3cbf509eeacb73b1b9edcc6c0407304302c515be
SHA512 b9c5ae752c56ed10ddbc27f42095e4aab723be400f96e7ce6ed6c394ae6094aa618eb6b56e9a4e77c080f61b04ffa716428b93a2ee352f58027eb75da7d68c60
SSDEEP 12288:NAwSfxL/2Dc3FDLLmt0LDQewsAjARQwhmPISQblAHadCC0+ziqgp+SRDDu4wKole:+wewsAjmzQPI9hAH8CzQgAqvuG
TLSH
T12F85E031FA74E436C77F0DB21B36CB16187DA9204B912AC3E3B84D9E59342D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e748dd28b074f4a9ebab50634129c75c7a64a6a4510f8b8e6e65425233263b5a
MD5 0e13a60eda4399aaf3ca3a41fcb7aa71
SHA1 d5886784a152f2acf8a195264345d7db901738ac
SHA512 02a65c3bcef2f37d8358d37ca3c656aff5dca0ddbb1e4641254d84bfd05daacfce43587940b9cb5c157ae4858e72a7a086e06a5bfa4cfc0dab6995cefc4c9685
SSDEEP 196608:eUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHFp:eUEtQevvqc2W1cpV2tI32Fp
TLSH
T11C474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6ba29d82ede87be168b3841843a2d546da5c00aae371071e42ea0256a0edc9b0
MD5 defcd7c08309536d03b5077236b6e166
SHA1 06c69c10eb6c6db6513f32c0cd4669f97c6c0bbf
SHA512 2c9921609b0622d4966461f6cd8d050a54ef1212f12116e345e4412a435df60623703fd9b5e07343ccb24f81eb57c3fa1691433759109d9685a30b2c2ee354d9
SSDEEP 49152:xCbRquA/m2yL5zTfFiV+XenmE3/zGzQPm6YgA0uG:+oquVjnmF6YgAn
TLSH
T1BBD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 89aead3701314830d669d8c641010f0fc351f478bcc30831ff5ebd2529e22196
MD5 4707bbb391ea099d5176ca585072bb57
SHA1 186a64f8662fecd8434d8cb9dcfe53076df35fcd
SHA512 3837af5972d2db4cab2ca712322b67cf18d6b70df80cce1a0952abe49707080a3d0dd4dbfa52fda4f43cfa9d69624d9b9413e27fccbe4698da4812d15c866084
SSDEEP 24576:DAhGL3IFoiwtA5l7S53lzQPI9hAH8CzQgAqvuG:DAMUFoiq51zQPm6YgA0uG
TLSH
T1BC359D81E7F945D4F5B3ABB899B68571EA76BCA55E30D20F2160D11F0E33A809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 5b1f53e45bbb78a3b61af369db5363a7cf4c11c3278fc811d9ea4c5e45a98f68
MD5 b8ddc00b4c66270c77f5b033749bf36d
SHA1 67013d0f4b63350d66bc6363f70b83acc98036ac
SHA512 1863d266911f159ffa962d940c39c0c1de2fe9e25ea8929a39d6da3f0ff7fce8591f5c7bcd376ac2612fb0cc90288af45377d8728df8b7b932e27d1dbd2a8710
SSDEEP 12288:Hmw5HEjsChN5BFgl0WDm+CnRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:GwucOWqzQPI9hAH8CzQgAqvuG
TLSH
T15275F14A76E80CF9EA6B46398557C632E7F2BC112B21D71F0360C65B5F37261AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 8747f69c2d1c33bd7cf4e19ef023ff7c186b390f6da107aeb57f730ddb11189b
MD5 594307f86417c7371b1def3a50ff48a8
SHA1 995e0c5729a42560f9706a5e2d90e15f140697e2
SHA512 7ce7536df23d7123d9b73185c6f0352a5312645b588604224aec70006bde0f9bd802f1d6dc5b9d20e7b97090bf505f6bf65b7ddd3d61c850369775b461d2b28f
SSDEEP 12288:b6Z1IyQRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:+Zu3zQPI9hAH8CzQgAqvuG
TLSH
T12F65128A72E821F9D6AB4379CCF64F8187767861277193CF023106A65F37AC56D39322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2a3a57bf593da8c3e451f10ef3170b11467895c5dd059c84b0e8298d58f54752
MD5 bd6b5d022d6311b281472827ab5ba1b6
SHA1 a40bf80afe725b0adfa7da994861a7575b424a61
SHA512 872a15f1d722bb376ef0904f5fc17f8847d0c64ae6907581e01f0da5cf413e53fa32fa6c775807cc2ec07efde07bfb465532306883a6f8b5619847ed49fc2b08
SSDEEP 49152:Xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UB:mQRQyi36YOcPbLvw2gAf+PN3i6YgAn
TLSH
T173666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 816a613d64607cbbab9301ff6c1d5cb8dd72470fc796177aaab3e65c436874ba
MD5 04d8a951c5f0f7fe2ec9225f6a160e96
SHA1 c4ef5c59f055f7bc7f974c0e0e56c85eff8b6936
SHA512 f641b377333fec390192ca230eefdbc13ca3506dd8bbe7673403d717936334c19b63e6207371a4f91573741073d41924adaf9f8b39cea7510c8e7479ad397910
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UB:qQRQyi36YOcPbLvw2gAf+PN3i6YgAn
TLSH
T121666C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8c7aae626ad01441f266778b8965e571cf5e95ab691e3fd7d336561d202c5ce7
MD5 d96f3dad23c52cf16eb54f2945550362
SHA1 db47c590387d850715efda92a4a71814a0267587
SHA512 61e9985f2862f586ad6566e409ec8db78a9e175cd9485bb46108ab32e65904e255be9b8a44a9ae6d5cba12f45abf3306d296b5c05c84bea41fdec5b80d857eed
SSDEEP 24576:YwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0HzQPI9hAH8CzQgv:+68Qg55nhceWu7PNU3/2zQPm6YgA0uG
TLSH
T180B54933B2F600A9C44DE1769F4A873196D27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 a7b12bd27c2c3f3b64663128d8681d1f4b0aa1c8951e2867a89236ae8e856254
MD5 47e5f80ec3efeac53122d28f27b2cdec
SHA1 e008054387f199096e9c5ff2bab6627757f6b31d
SHA512 d7a7009cef75bc63b1f41bef6fbfb9b438ac41a27d3139b15476ee7412a892c0af769a633771b16b68026272491bed290a34e37d762429c0427135f53f7c1b82
SSDEEP 49152:O3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99b:vy5112gYy5azzVvt69nLKnhZr6YgAn
TLSH
T145167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e5d64beea108a5530f6bbcd4904395fdf8fdb7978a7ee1103a60c09f128ad69b
MD5 17d894facb4ec7fcafbe1df821b39d3d
SHA1 11775dd93cbf173a62c9caeb449e07f2259acddb
SHA512 083766a1231983db44874acc89f0d2b8fdaf0846556a6a8a5bb80a3616bfd6df6834018eea045566770e9acc64206424ef55a5c88b6a478da0690820b22aea07
SSDEEP 49152:hB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glQzQPm6YgA0uG:3u6Jmdxd2dK6YgAn
TLSH
T1A9D59D13F1D901E8D06ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 4d5f6617d7428fcea5d9b9d371d6b61aaf97e995d180ab63600296d2f10953a3
MD5 eb715941af607217256dd8cf1aead3d2
SHA1 87ddf33425394449d27d70c0622c58303557ff8d
SHA512 42d92c5e0613207478115dc8e07b562b9a6c08877b20f43473636895514bcb451c9c99edf5cbcece26437798ccd61bbffb133d8a9f8bece9065fd26caecafb67
SSDEEP 49152:21hpsNoJpF1A63U44CwH7R4xUzQPm6YgA0uG:2mifPWRF6YgAn
TLSH
T1B4B5BE13F2D801E8D06ED17887569632EA72BC450B34B6DF0A90B7961F7BAE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f7abdee4a0d1a99383c6b962834a223461b7360ad7382aa95c7f24aa93c89626
MD5 86b2d3f0b561735a4c9f5f75c26fb4e8
SHA1 26416dc0166d03445c35dc0fa6b8263986929092
SHA512 04916695ce71344ba690d735a58197f3d250e9eec9d156457f804d09de672c86e95e2d78521d79ad99a98d3d7162307a85af25a84a4cdf41ebaae3420300f811
SSDEEP 49152:4SuZQIY0Be2KcRVtOnks6NMHq3zQPm6YgA0uG:i5dKii61n6YgAn
TLSH
T1DCC5BE03F2E901E8E0BED6748B669632EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 73db4a6773d39d7759fea245ed472b5ac77cc033beb56781a7872efd2fbd4bdf
MD5 6a33168bb4a94413bdcbf629a48f9cc5
SHA1 e99ef930c547372500f6d8e36f3cc35785a315ea
SHA512 d26a4eb0fa7295b8bf3e4f416da6a86e3a6acb47733d16d28fc6b2721978a5c715649de5a68b6a7e5c0b2d22d0c047cd1ec8e18d359104270bacd8f112f85f71
SSDEEP 49152:VhtSn8EApI0fig3giDn0AP5wAzQPm6YgA0uG:kX2imph56YgAn
TLSH
T15D95BE13F2D901E8D05ED178C7568632E962BC150B38BAEF0A50B6561F7BBE46B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 d78f84eb8a3ebca14c6fa8d249293c88d222e0e66116aef74346a93bfb3bd096
MD5 f5d2b36d90fa4443b2f810eb5a41264a
SHA1 e5b369ab619372d3057086d188e23f78eab6277c
SHA512 4f3d7c6dc1755431ad97e7d487adc31dbab3686e9b29a1852842585fd99961c311154d4370f1a3b52faf57b03104e80100e41cbd7ccd3aab2b18cb4f9e4a9165
SSDEEP 12288:CtRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:CDzQPI9hAH8CzQgAqvuG
TLSH
T1D855234AF4E80AE5DF4F0BB2486B5FD1086D5DB47BC1637B123318628F7F5C8690A291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 09f73bd31adbcacb66e671912d7e6368bb212ec05dff4e794f440f8e85139eb3
MD5 61ba6ea081ae0a6074316e179dd80a14
SHA1 375754109799389b31b271573fa3365877f2cf54
SHA512 8ea8235043d68d4b07f7636a9ac6b19a1253df8c7e874228de487e59b038d78aa642a43be6c2878419834b1db6af49275d2f5e3d5464c967f85829f11aa5c081
SSDEEP 12288:OsRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:OizQPI9hAH8CzQgAqvuG
TLSH
T1F055234AF4A80AE5DF0F4BB248675FD1086D9DB47BC1A37B123358628F7F5C8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 9bcfbd445efab3cd0d407b0c6ba504163dfb4a83886e1c9e700a5a628eec5968
MD5 912a9324bfcf7af5e82243c6cb3bd9c8
SHA1 eb646c711edcce4345e6e3fef84fddc2547b7fbd
SHA512 41e7f45a01d553721e4b6b9ba36b4a24412a804fd935f6b5400c12c6f178cf971e7c4239048a045d3f43df16173561b33b26611bb2c38e00e18690c5189e6499
SSDEEP 12288:FaRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:FczQPI9hAH8CzQgAqvuG
TLSH
T13255234AF4A80AE5DF4F0BB648675FD1086D9DB47BC1A37B123318628F7F5C8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 4dcfdab6ba4912234128c3f53b2bd46202e12742677f86698032235431248710
MD5 89fe79aa03ee264bddcc5b60a1ec6d38
SHA1 a4037a41a27601018a7ebf9b46e18fa4b31c44db
SHA512 8d08aa1441cc75f597dcb8fb2ebfd5dbf9ac3d2e4e0ab655167f48712206f084eed1d281f9bde1b050b47b0a884ee478c5075bc695b134719c3e1e6cedfd93eb
SSDEEP 12288:OVrRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:GzQPI9hAH8CzQgAqvuG
TLSH
T16A652346B6A802E1DE5F87B688374FD144BDBCB47791A3AF032208A64F7B2C4BD15791
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 6075f24a2634f60c140a76d888760a63fa44dfe4fc971f7d930245853ab5458f
MD5 57cd54c56abf91ccf675525f5a71ad7d
SHA1 8633e823e09a47d10738a21d33c9ef2d8c474f89
SHA512 aa4099880a27abbca0929ea6ee53ee6b7354c73324783fa6f09d5753ce4af522bedaa3dd7e971156bff99ba425712c0c0544a15c3b4096324d0c89cd324b4f66
SSDEEP 12288:xjRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:x9zQPI9hAH8CzQgAqvuG
TLSH
T1F855234AF4A806E5DF4F0BB648675FD1086D9DB47BC1A3BB123318628F7F5C8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 707d6aea92e64fdb57d8deb3c037b88170212dfa7531476509aa8c32cea5b9c4
MD5 5a6f1a40f621a55fe29ae421e05ae02f
SHA1 b499e5b128bd80716234df560889591c5e5744ba
SHA512 66b3e668a3761c76a5bd14b0b286ea2fdf51b90d5179a97b60f314211db72f07cdcf7f28286ff47a32cb53f2070c38ce1205a98b6a237c0adde89acbc5a7ddec
SSDEEP 12288:GIRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:GuzQPI9hAH8CzQgAqvuG
TLSH
T19D55234AF4A80AE5DF1F0BB248675FD1086D9DB47BC1A37B123318628F7F5D4690A2E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.3MB
SHA256 34b81ab01632d67b1d98d38c9d787a3db87bb07a0b2074a39f878435f8ee5c88
MD5 6176515ae9e830961c3df27d2ab1d0d5
SHA1 00a9f4555276a269ef4e481388a5c1ac8770cad9
SHA512 e750cb1eb759da5760d8195e2d481fb6d57f140ceec03486a4284db424d5d94c7f43fde86f9e6b94d6b51e2cfc4c4bcaa2eb5cd6af57e61e14fc7352afc5f5c1
SSDEEP 12288:CERQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:C6zQPI9hAH8CzQgAqvuG
TLSH
T1CB55234AF4980AE5DF1F0BB248275FE1086D5DB47BC1A37B123358628F7F59879062E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 b364349cca4efe59b545f25a0e10095cc77521486873cb7d529b537e453b1ff7
MD5 5f93b5a462fbc8f2914ea1ac218874bb
SHA1 cff1136f6da900ab6a242494bee1cbd49010c8c4
SHA512 cdb6da9bda0d357165f50095cbafb5445ddc635e133b3ad0c08327808419da06a3066dd8ae608c1600d85fe7ece3001d53e7ff8ea8535220df6cc00ed8f5b665
SSDEEP 12288:aiZwbJzzFEoS2cPvyMRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:9ZMNzFVSOCzQPI9hAH8CzQgAqvuG
TLSH
T1FF750195B39008F8ED67823ECC268E52D5B27C691BA0C61F03B436675F373911D2EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.3MB
SHA256 9de81b818e42a7b3f3bd426224e699c94763f9f6ff35b8462d27529d7a024c45
MD5 8af3c5f9d3f752737a4eb993e208b0ff
SHA1 086384f3f35752824364c6aae17ec0b18ade8e3f
SHA512 6ca90b87625df0a10d0ad275f12d9f7f529bdd67aa9b24e9a72b8ccc575049385c7a743ebc9a707e497428dbac3f182d3e776f5f34f74afdd0c1d7dce0fb7754
SSDEEP 12288:GxRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:GnzQPI9hAH8CzQgAqvuG
TLSH
T18855234BF4A80AE5DF4F0BB648675FD1086D9DB47BC1A3AB123318628F7F5C8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 fee23137a269c434b79c8a02dc6d61c60fed9f6427a85ac291a933b73794f7d5
MD5 72eae6aca91030302ee1315e37a0665f
SHA1 5c7bd969d8af68aa4a18cd16afaed1cc097f293f
SHA512 1ea7f4345ff054c00d638ba58d03a471f2020c938a3c68a6427b81b37ba61cc9463305a086f9140448a512386c1288d851e0b608f110fea143f0854fa272dda9
SSDEEP 12288:eVRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:erzQPI9hAH8CzQgAqvuG
TLSH
T11255234BF4A80AE5DF1F0BB648675FD1086D9DB47BC1A36B123318628F7F5C4690A2A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 dd5905e2e41a1bb20713d015e087903dcd5197415acf25ada5d19fa10565b0db
MD5 96adfe6e739fd6cc904e72d4f552ef4b
SHA1 4c2d937e1641605100791b592d0dc2f6256dd113
SHA512 b4db98bd85ecb2f39cb50a44ad29beb61842d27ac96d3e2c63d3dcac8d255e0261e44c37001d29666c4e371d6f2273b2657f28afbe682837ac33de17f3dabeed
SSDEEP 12288:3yPz5L8QRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:6zyWzQPI9hAH8CzQgAqvuG
TLSH
T1C1650247B2A421F9D56B8379C8631F82E776B87117609BAF136006761F372D0AE3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 d54949359721c1e33161dfe2a483bb17bb6f7315060078b8f56cba50596c315c
MD5 7932c6da224637a0042567f81d3b73db
SHA1 d79866ae78112077096d5f317701126cead243aa
SHA512 2e816369026f3d3495b43862933bb74a2f0447f9b0227a13ef51990c4b03531f54ab276d4dedff49ffdac21c55bf7246e712cc9ea776096938c7ca37ecd76b87
SSDEEP 12288:yxRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:ynzQPI9hAH8CzQgAqvuG
TLSH
T16355234BF4A80AE5DF5F0BB648675FD1086D9DB43BC1A3AB123318618F7F5C8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.3MB
SHA256 1d5b6323b6d092d0dc611e6d291a0e0f1f829e59ace6a2fdb0aeddbddadd9c8e
MD5 24b842f5a6c39e54134da894f16a6eba
SHA1 073396a96f9f7d5d898c952f51587ca1f54907cf
SHA512 701124d447272133656ecdf408509e7cf593b2ad9554d48c81a97664c7fe8ef1389f3d569c8463749beeb758183b5e02a3b7f6749043b30ad461595565988596
SSDEEP 12288:fxRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:fnzQPI9hAH8CzQgAqvuG
TLSH
T1D855234BF4A80AE5DF5F0BB648275FD1086D9DB47BC1A3AB123318618F7F5C8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 eace94c90b4d00afec9613e6ca5196084bce5f6731057004cfa7e65aeb40d881
MD5 bddcaccc3d9d2b5a206c746e6378196c
SHA1 d20e4653571d728c045271e49bc289cb8eb6878f
SHA512 9e1f94a2c166e5aa77ef655845eba061d9d2ddc76f6d674143092fe025e6c307fa6992f3b7cbc558ed8d9c57838345fa04e7044d319d67de8cc1010ae869c1ea
SSDEEP 12288:FyPz5L8QRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:MzyWzQPI9hAH8CzQgAqvuG
TLSH
T1D9650247B2A421F9D52B8375C8631F82E776B87117609BAF136006761F376D0AE3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 e39c022b915c7551c5b8e14f89d0d0bc9020c0b0fb70252afac541cbf8c278e6
MD5 22e3d7718ddc9a4c08713bc4cf7f6c76
SHA1 c157d6940aa6d846dc5b6e5cdf77f9dc7656cd2e
SHA512 b3968cd51e27fe8047de7fb07eeba44dac1ab013fc3cca925b1ab6acf41aa34503e3025895ea4bb1db83e2ce9ce780daa56a0a5bc3d04ebabed5ef1559d972ef
SSDEEP 12288:BCd9mWYoaLHF3z0z04PDvhKRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:8TvaLl3z0zDszQPI9hAH8CzQgAqvuG
TLSH
T127750195B39018F8DD67823ECC268A56D5B27C691BA0C71F03B436675F373A01C2EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 87c05600122a87365fb26d8202f2eacb41e8c51c577ded00ad36cf30f7791599
MD5 e877e1f654547c4970f7ae99f047b3cf
SHA1 ffba61b6161446943cc28c6e44843a9793655bf3
SHA512 cdf6b080b6bcb8deb429eeb0e8d1314b92a7b225c7ed2714b42ad7ccc6b46ce1887addc6c7f0bc8c947ab1ba4c1b56574f79e11ff78671144f500af71a86f799
SSDEEP 12288:6i4e7mRdTfgwCHKy7GLbbdIv/RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:63bd9CHKy7GZIzQPI9hAH8CzQgAqvuG
TLSH
T1F685CF90F3E414E8F1B78A358C764611DAB67CA91B71DE8F03A4255A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.3MB
SHA256 cd80aa19c784212aa8e5d64999e9682fc9bf03b8d2d3fc010ca2beb80e5226b8
MD5 14426d4b766cfccd632ad6e63158adbb
SHA1 6fc3e4b36a9859d8546c66afb84cca6cac90d0ce
SHA512 3c89b5740125b6f071c0f7e84a3eda86e8ec2560be6e3ebf37683009e8d3f694691c78d8fb6ee58d8fc956b5d37b3a6e40e02ebef92864f9c057200e59cf67d7
SSDEEP 12288:F6RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:F8zQPI9hAH8CzQgAqvuG
TLSH
T14355234AF4A80AE5DF4F0BB6482B5FD1086D5DB47BC1A37B123318628F7F5D8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 a1c6f7ab0297774ba8d239e2711ba9585050493e08202e5b40f24f4e6b4ae4d8
MD5 24d542360034504f603bd4892cbf9b2f
SHA1 a20e47d8b2395ea016d58719164614b8ecabec4a
SHA512 bb1176749f60e3e360e9a3affd2ad68a76fd7dd1928076d32f4b1cd21c2a1b216ce13c66c7c4c39e34223e41ec123a64ec589d8d12ecc578eb52bfb4d8fb6f8b
SSDEEP 12288:AwRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:A2zQPI9hAH8CzQgAqvuG
TLSH
T1A655234AF5A80AF5DF1F0BB2486B5FD1086D9DB47B81A36B133318628F7F48469062A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 bdbd02ba4a9c277c39e5cb7df855ac64afffabc8e342a9d775e0576de24b1a68
MD5 12c17b03c616d9b5a32f735046ee5c6e
SHA1 3d0bb75b99003b816a62f56afb137173243ccab4
SHA512 1357ba5cc9edf44413a1dc092335f3f19a068e4c0c0df26ec74274dec22cde8a6fd46bbdfdb971c7291b57c4184669f8823db7453730dc6ecd79b11c1b269912
SSDEEP 12288:3/RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:3JzQPI9hAH8CzQgAqvuG
TLSH
T15355234BF4A80AE5DF5F0BB648675FD1086D9DB43BC1A3AB123318618F7F4C8690A1D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 8c982579955eb6619cba41303d821ceb91414d9efb6906fd833f382f145557d9
MD5 2a29c2c452ab462891dddda81f7d3fb9
SHA1 39d9cd8d36a3fa0628672cdc8ad14053ff629ce0
SHA512 a98b86fdb4001b51588808c70e11bf74f9bba0f771db61fb8b80d1441cc836a5669a96e6e452b53ca454930410c344868fb6129dedeccf99cd722d867a39f4bb
SSDEEP 12288:1xRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:1nzQPI9hAH8CzQgAqvuG
TLSH
T16855234BF4A80AE5DF5F0BB648675FD1086D9DB43BC1A3AB123318618F7F5C8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.3MB
SHA256 a56f0d6373093f1f916c82db2bd24484d90ec817ef3f5a14fd699ce5af8f7946
MD5 6bda9b2106b8e607cc95b0e84d301cab
SHA1 23996f101cd8084d467fb880db21c4f660c18534
SHA512 e1c245fdcc8099ce8afa00cccced309336f9e44b08b62105d307cc5ea9e15d46dd70b15263cdf8ed24d1b18a46613a0e6784df54aa7413c57734e8d3c8327909
SSDEEP 12288:Y6RQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:Y8zQPI9hAH8CzQgAqvuG
TLSH
T18355234AF4A80AE5DF4F0BB648275FD1086D5DB47BC1A37B123318628F7F5D8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 58c8e02ec44f20bd2e2279d80ac944bcb3412f4d2205a967b097b39751626e53
MD5 e040b4493a67c85b1d77d2c5ef2680e7
SHA1 1de60521093943706760817234e0b21130c2e9ee
SHA512 46b2ea079075d433205e21d95a8d7bb8c61793d03ed6f9c66235dd336ad28e08d280cee3824bc25c16943826cf3a88620e1c34e3efdb8acba6ebe0fad7c9c06d
SSDEEP 12288:ipRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:ifzQPI9hAH8CzQgAqvuG
TLSH
T1ED55234AF4A80AE5DF0F4BB348675FE1086D9DB47BC1A37B123318628F7F5C8690A191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 64177b44fa6288ef63e0607dae539fd05a9c77fb332b96b931dc3a70ad60a31a
MD5 8559862db10d88e1ef81edc01902bbf5
SHA1 993e260591ef0cd51dbaf74c4c9e131c2d28ec0a
SHA512 67ebc50a730e6fea9036a2391f2cef4e40749cc1727a8e1638f99cf0be27c4076bfacc47ecbdd7bd21acc40413c1ccca2e31bf011071cb9d646937f3c76ff68d
SSDEEP 12288:ejRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:e9zQPI9hAH8CzQgAqvuG
TLSH
T14055234AF4A806E5DF4F0BB248675FE1086D5DB47BC1A3BB123318628F7F5D8690A2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 de377c13439af3ff37d3acf1eed563a11012d4baaa5059343ba99f0ebf42f62a
MD5 5f64906d0b03fbd0dc395d9e0b4eb297
SHA1 ec53bf21994f6bcbe366840a6ee4cae61019e83d
SHA512 71137e355bffb298b7634eeee8fcb543ef3116f010ebede01778f5a82eb3d67f37315fa0c5a9eaad6b40ca7c18306f2fd644fc40bb552fc8cfbea787ca7b07c2
SSDEEP 24576:cfwvhk9RX6wkyAIbzQPI9hAH8CzQgAqvuG:NMnYIbzQPm6YgA0uG
TLSH
T10885CF29EBDC04E5E177923C89B7464AF6B178691B31C2CF025A53AD0E37ED46D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b92544c3270a3b2ae3394424b33a99a0bfe916e04d9f54e74e423f8b57616685
MD5 38d3b82da10fd671da9726a63c6f1463
SHA1 e6bfb93d04bccaef6eb768aabd5474e4325303db
SHA512 61b6edd64177a410f33e5cf34f8964b643d5d58f2a8fe8173fe8cad661086dfc39d480d9a15eef1150686878e91e862c4602ed9f81504033558b3412198cbf4d
SSDEEP 49152:EYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0gzQPm6YgA0uG:zySzPC6YgAn
TLSH
T149066C56A1A801D5C1B9C1B98F1BCC17FAB134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e152760b1504e0ee1cf4852c4cc283672cc57e1454833afcfec206bdc74d1d74
MD5 4f123e183900bd84076d29a828eb987d
SHA1 049afb04d8b7327ad5c04db0aa9a03a640d394c7
SHA512 5278ee186f7848ecca8762e908b23da387b96d93a985d8c7a0d3b84ae725871f7fd476d2f0394c802f656bcc200d279c43546db3e21bd060260dde05f4087011
SSDEEP 24576:r47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYyzQPI9hAH8CzQgAqvuG:r47JUQjTirIhCnDHUPfF/QzQPm6YgA0V
TLSH
T1A565AE1EA3EC01E5E1BA927885154A5AEA71782D1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 fb04058a5db943d94f579a7ecda247fef3ce3cef719b7db984a146c2105cf652
MD5 2c4b968315eb96c33abdc36f867a4516
SHA1 3b9297768079f9042348a8f52bc11060a510f6db
SHA512 e249c15f780948646f0dce471975c86b22c70977e8b03084e1902a69ece57cdb52845d5661388bd3ee6b666ac43ca6c17858e8133c50a0924760066fa0b5f3fa
SSDEEP 12288:qPsfhRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:l3zQPI9hAH8CzQgAqvuG
TLSH
T1AE65F10AE29802E8C56E5276CB564A81B3377C6457E1E3CB12D0F47E0F7A5D0ADEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 464d2505d39a8ed4f9b179cd93055c1c112f731decfc83d09e3f4aa9e9537d87
MD5 4abdd0d8855aeb07433ff2c0ae73c835
SHA1 e560526c8e779b8dd06aa07bd50558e972602223
SHA512 a4c877920d1877ad40898609c42dd9659dcedbc44a53df8a5cb20d987b6c3da46f171031af085a271d43e577a30a317c19288ba0c030a76e6a49945a704ff422
SSDEEP 12288:Ijyzyy5nea59GOTTd1BMbFPgiBKl7Qs4KciaRM+0pj:IUy8xMdxi7QsnXaRMtp
TLSH
T1D2450751766AD75FC6A980321E32D5CCAB707D05EE056F0373C88B3F8576668BAF2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 b55b954381427319f4ce461402fe30596d4d0be5b935a568b2f7c434ed6c25d0
MD5 8ee7a2f0ba251516c47979996bcc2e45
SHA1 b3006307a2672fdce96d47ba45d62662b712cb61
SHA512 8cac319ed924a38cca8f690f62dc032766062b2187fa69f2a5f3a72cf8cf4c51398eb7b4673cd95d46dad05ae3163b81a579da6ab034d76bf99cf2ce0eaccedc
SSDEEP 12288:0ewimO1GBaJ29EpbtWYqfe0YifQSyDXsPaLkIu97GtJcSprwClmZg3z1:J9/lpkCig3z1
TLSH
T1EA65F9819537A38FD5FB5072032A9F4CE764EC06B7056F26B388053AD86A725B4F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 dc3c74b0914d5d269c2c416beaf40f5fa5978da541e3204bcef427d1754d9f7c
MD5 154ec307e645cb01eb6c7c958c60eb8c
SHA1 b37e944900a5755760f2c37cb83b04d24808c24d
SHA512 071eafd679ec73582d7080e2f5a287c24b1e953bb8e7b3c28a1acec4bef8fc2c00475571b88935df0d0b98d5c429b769deb84c4cc6f1c2c2421ce8a1f54b8e43
SSDEEP 12288:so7ZRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:VvzQPI9hAH8CzQgAqvuG
TLSH
T147552347F69C0AE5DE6F07B1482B9FF1142DADB43F80A3E7222215A18E7F5C4AD25352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 471a8de2163886790feed846ece94dfdee969d27520698395ece3e2845f73064
MD5 4ce683d1247c571cca54cb96993efdd8
SHA1 e73a6ce40e0adbe88eaf8101ddeb57f0b3becb4a
SHA512 ec32279f6ed7c2145b54dc5c27b925e3314b37b46d237e2a6fe8115907c163964cbb6f9c280b31114cc2ab0d44ecbe57663f447c8e9497b8402be6c1e8ea0046
SSDEEP 24576:jgb6bmBIi49WNNFpg1rSvFv7bYxzQPI9hAH8CzQgAqvuG:jgb4mBIBhGFyzQPm6YgA0uG
TLSH
T1C465AE1E22EC02F5E0FAD2B88DAA4417D6B278161731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 89126e74858d4220c1ab202e39f91e77742e56b4ed9fca5099dff8ec175646d0
MD5 2143b28898a051e930a91deaed31a2f3
SHA1 eb5235995544681e2f253a577c7aa0cf7bbc3ee9
SHA512 cc278cf8bf4a44bfbfac4148a1a39d4e8f13da5390573253e7dd871fb731703b81b6658c6c0a254c1921b342bb884972fcac5c559c841e0629fd639a1f6c5fea
SSDEEP 24576:tG88u8FpJqH1Hzria7/mCzQPI9hAH8CzQgAqvuG:g7ZFPqVaa7/pzQPm6YgA0uG
TLSH
T1A795F165B6E001F1D47BD13889474BA3F6B2B8251364FBDF07A88A511F23AD54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 23135e0f59b4e42ded1cf2a02c74adf108f8d40be3997393d262906628019284
MD5 6d8680c9b67eddef79272f47f9f1b036
SHA1 b54f72266e75b4daa1eb09102e5bea24f4684b72
SHA512 4f42c30f39dec4aaef255aaa9f5a67f3c835685a13711570832e24c2f72d67dc135db9b190bf2ea0d52d443833524af9ddda37e4f9a7b32f85c2ae0382358d13
SSDEEP 12288:NHvUrBFrEjwaQYRQwhmPISQblAHadCC0+ziqgp+SRDDu4wKolH+:NPUr+NQezQPI9hAH8CzQgAqvuG
TLSH
T15475F11F62EC18E5E67AA17D89828759E771B8621311E2CF02A1817E4F77DD8BC3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e75361ca0012c600aa1331be069e93a266421e7c604847f37223e2d7e7333652
MD5 83cef11b616b95221cebd084fe40fb60
SHA1 f0c298db5d463a21ee96abdcee823087950bdf30
SHA512 eaaec8f318b16eb47d252c59ca3bcfe2e54631e3afe09b1c28c90e68c115ed546d537d27d7f5b52009cbd748e5c2f568522662e041a9fd5ce7def31205b65ce1
SSDEEP 49152:ABCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjuzQPm6YgA0uG:7G05lO43bD6YgAn
TLSH
T1C5D5CF6E62EC11F9D1BBC17CD9C64A0BEBB23825032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 823d391a7218e329dee5f02f589e3cd509980bacce835f00b190124c3f2581a7
MD5 48a04e6f352dce0d44b93d449abf687d
SHA1 2a1d74d06aca6355f4b0410291d193400a335b45
SHA512 9424dd2b00f1adc9cbad3cb66d994b1fb8a7abab4968890ad1dd978b1059dd7c9caca8f717125543433687361db4ac184f5c8bbf63ecf5b993a849a0bc91f13c
SSDEEP 24576:mfa5POZ3dpuWVM50JicR2hG0lasx2+47eidngzQPI9hAH8CzQgAqvuG:+a5POZ3BJt2pasx2+m2zQPm6YgA0uG
TLSH
T1A465BF5EA6FC01D5D5B9D17DC5838A1AE5B1342153319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3c594175dd4256a094996d345e02c610c56e72e5f39b8659e4928e6ade1d5fbf
MD5 f6827ceab85531a915311ff4da15c739
SHA1 15b76cfd9184147b77241f7ba2ca8cdf5f9b71f9
SHA512 97a47b7017804f99293159a162da1ede53a21a79a8756cb7a049073c12b1b416ddae5ff75aaf04c02cbba251bc752ae7bbe9f1a2911732a89b308f79e316e3ef
SSDEEP 24576:xNcwHdjbyQ4nLC18lb/EOjowL7FkKzQPI9hAH8CzQgAqvuG:xNc/zEOVHFJzQPm6YgA0uG
TLSH
T12C858C1623E901E4F5BBE1BE89779A46FA717865133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 edb705c43b9aec52ad2ffd73dd1d8d009f883bbaf3d1ee9fa2869d6528b03fc5
MD5 09831f76d52d3acd916e438faeae644e
SHA1 3946802d8d387a96607b6d0c2ef95baf9a6a85bb
SHA512 d8a22e06dd2586f04eb2abd8fd0ff784902333c2a5241cda92a564dc427edb9ddf892f2b1adf22fd85ee955a8c8bca664dfa76b20c4cbab239595643f775b02c
SSDEEP 24576:NTkNvNnaFeYhJNtmZBmkzQPI9hAH8CzQgAqvuG:NTMwBtOmkzQPm6YgA0uG
TLSH
T11855AF6EB6F806E4D1FEC6B58D238512EA727461173293CB5290C13F0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 1cabbb5d0dbb39ff6ab28a2b45910afcc1613ebf7e870c8edc74952d25c84715
MD5 3574a7764cec094c5330133232a00248
SHA1 4b09f25149579a18d8cf51221cc2624ec16f20d5
SHA512 83031b028faa6f3a4b074591fc3d14902f2051c2eeadb01755b749282a8bb8f0db0af425bc79a482e78737a90da0da3242e2881536bc767b3b68af56c5831439
SSDEEP 24576:FD3FHshBIYQgAjzQPI9hAH8CzQgAqvuG:FDVHeBIAAjzQPm6YgA0uG
TLSH
T1F985E27EE69C04E4D57BC2BCC9638A06E67138B8032166DB029481B65F6BEE47D3DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/464-289-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/464-66-0x0000000140000000-0x000000014018E000-memory.dmp

Download

memory/464-74-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/464-68-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3116-7-0x00000000021A0000-0x0000000002200000-memory.dmp

Download

memory/3116-1-0x00000000021A0000-0x0000000002200000-memory.dmp

Download

memory/3116-8-0x00000000021A0000-0x0000000002200000-memory.dmp

Download

memory/3116-0-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3116-81-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3176-55-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/3176-53-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/3176-43-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/3176-47-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/3176-40-0x0000000140000000-0x0000000140199000-memory.dmp

Download

memory/3736-22-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3736-24-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3736-15-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3736-16-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/3736-106-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4168-310-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/4168-107-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/4168-115-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4168-109-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4412-78-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/4412-304-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/4468-95-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4468-309-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4468-307-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/4468-306-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4468-94-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4468-101-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/5516-28-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5516-29-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5516-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5516-135-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5912-126-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5912-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5912-119-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5912-120-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5912-128-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5932-62-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5932-276-0x0000000140000000-0x0000000140193000-memory.dmp

Download

memory/5932-51-0x0000000140000000-0x0000000140193000-memory.dmp

Download

memory/5932-56-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6056-82-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6056-324-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6056-89-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/6056-83-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/6056-305-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6056-322-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/6072-136-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6072-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6072-137-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6072-311-0x0000000140000000-0x0000000140172000-memory.dmp

Download