c70c65c538e95620ca2be792afffdef8a7f0eb25cca69b2193b3b024d339e941

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 19.9MB
Sample260916-2fvxqa1t3m
SHA256 c70c65c538e95620ca2be792afffdef8a7f0eb25cca69b2193b3b024d339e941
MD5 39424c39188f49f9daee381e45e8609f
SHA1 34b6f56ccbe54ff99c818d8be118272f30ce18a2
SHA512 9c7df72e9ac8b69ba31bd0e69c2679a51deb4293e7ed888a6855ca27d702a05b44bfbd486112a1c0b1bfc64edbad54ed20455a63f36c54fa81fc99adc2b1644a
SSDEEP 393216:ueZZMJKDIKe73vr3fiP6wU2m+/7Hkq8G5V9/e5dGuxxNyGe9:uX73vj2Eo7Gz
TLSH
T17E27CFABB2A501ECD0B7C074CA569917E7B1744A03B06BEF0AA049661F67AF05F3F711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4988	elevation_service.exe
3052	elevation_service.exe
1320	maintenanceservice.exe
3720	OSE.EXE
3240	PerceptionSimulationService.exe
4812	perfhost.exe
5704	ReFsDedupSvc.exe
3120	SensorDataService.exe
4324	ssh-agent.exe
2264	AgentService.exe
1280	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\f54998143a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000372cae482b46dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000004d4ae54a2b46dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006ef2a4c2b46dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000351d154d2b46dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000504ce2482b46dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000023d4d04b2b46dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4988	elevation_service.exe
4988	elevation_service.exe
4988	elevation_service.exe
4988	elevation_service.exe
4988	elevation_service.exe
4988	elevation_service.exe
4988	elevation_service.exe
3052	elevation_service.exe
3052	elevation_service.exe
3052	elevation_service.exe
3052	elevation_service.exe
3052	elevation_service.exe
3052	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1240	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeBackupPrivilege	5704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5704	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5704	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5704	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5704	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5704	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5704	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2264	AgentService.exe
Token: 33	1280	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1280	SearchIndexer.exe
Token: SeDebugPrivilege	4988	elevation_service.exe
Token: SeDebugPrivilege	3052	elevation_service.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1240	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
3588	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
6100	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
6100	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 4488	1280	SearchIndexer.exe	99
PID 1240 wrote to memory of 3588	1240	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	100
PID 1280 wrote to memory of 4620	1280	SearchIndexer.exe	101
PID 1280 wrote to memory of 2644	1280	SearchIndexer.exe	102
PID 3588 wrote to memory of 6100	3588	2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	103
PID 1280 wrote to memory of 4276	1280	SearchIndexer.exe	104
PID 1280 wrote to memory of 1840	1280	SearchIndexer.exe	109
PID 1280 wrote to memory of 4848	1280	SearchIndexer.exe	110
PID 1280 wrote to memory of 1452	1280	SearchIndexer.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Users\Admin\AppData\Local\Temp\2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3588
- - C:\Users\Admin\AppData\Local\Temp\2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_39424c39188f49f9daee381e45e8609f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:6100

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3052

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1320

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3720

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3240

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4812

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5704

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3120

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4324

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2264

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4488
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4620
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2644
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2740 2836 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4276
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1840
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2892 2888 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4848
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2740 2836 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 d460821eeae20fbfa31fcd7bf209ef83c9e779a83b25fb5d0cbe85891271ac2c
MD5 87cce064dd79a3155fcadc5182e17352
SHA1 7f6517754a7aff21b732cc73df29624d100f1211
SHA512 3478dd767343784dc3190e9264a2bed15615c745fbd6feee0f27cfa64f5fe453a3d8d649069f05a56bccc69ab3dbdc8817cb863acabeac1c71d8d8aa587e58f4
SSDEEP 49152:Ob+632BuPkFKRrdE6ohdstBhuXjfS4LWxnZLNiXicJFFRGNzj3:Q3q6mjBW7wRGpj3
TLSH
T19BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 e232b42249000af4e877b8b6454f139aa02b34d1b54c0b63b6ba89746599f94e
MD5 78886d901d85de7b82d527dbfc435c24
SHA1 c362f8b97248d809d578d6fd9e5a8066c9a9089a
SHA512 c53fceeb640fb73d215779cede8d61703a0ac51736b598f1cdbd908df18554aa07c707158f2f289df75cd0b6a56f73b64c54a43ef4872c2c65e54ed5aa975a6b
SSDEEP 24576:xXYfDtczAi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UtcjLNiXicJFFRGNzj3
TLSH
T1FB75012963D408F9EDBB813CC8A28411E6737C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 41e27bfbdd3594fca8871a2d229e30db0d8eedda46728e51ecfc745bee0eb712
MD5 0ac79c121a7ea6b8c1abf4b193c5b684
SHA1 58e92837e7e54bf2aa303a4fb5babcce43478df7
SHA512 707a3d4b96ab7ab87bfefa55180083af46be26dc7c1e6f24634ad2707bcf22a6175dd5b1932049469f28fd975fad10979232c0441da07a5b4cc72c38f1813937
SSDEEP 24576:R0Le5ji0hmxhrMB/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:RPji0AzgLNiXicJFFRGNzj3
TLSH
T1CB85AE16F6748331D073C0B9C5D2A69EE971308657308ACB4286D77C7E67BE68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 50ec2431830d1bbab4169f2f05f0ec2fe3e0a8fd1f94fb170dc4c0e579895578
MD5 2d73acf9d4c98e0f19ea57f47110c96c
SHA1 82aa30e6f6a4eaa4f3f4ba633671fd75fc349413
SHA512 d92e82e334275abec73033bdbfc4d4ff9702c950ce56576b23e50fc81ce9cc1c0980b5a90b64dd3b47fabb0c7a891c7b851a8ce2ae2b2840b0589394278e620b
SSDEEP 24576:2a7/ezSC6vUyD/aqgrvWj6q8wyuT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:B/ezSC6vUzPv+HjysLNiXicJFFRGNzj3
TLSH
T15B756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 78e3ea74566f4b7857e49e3ccbaf30950597479f623ba2282b06934e4f5caff1
MD5 93e808c574aafa0218deeb6afd1a79ea
SHA1 a4e1de8c56ee037b64053e7cceb66a6ac057d73a
SHA512 51105e2e51b89fa5d2ebbc31de6fbee2784e246086fd4f7df58800cf87cc679e4e4742aec85946da325a652338fc15b82de5cba7909a136e26d68a410be10376
SSDEEP 24576:bVbqPb88hv/l+BG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bVO88hXl+ALNiXicJFFRGNzj3
TLSH
T12B559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 1f99de6207f5159ff6a53c4cce77cc557d4318bce42d7c401c98309fb325fdf5
MD5 28ff538c2a1f411e231288ee05579f32
SHA1 7ae349b83d6623a38f10b6fd47c90eba4e8caf71
SHA512 fefe5bf3fa80c4fdfc64eb704dbc93e139eff0bfa19c32bfd71fd230044532f58e92e264b9a2d81ba829c7ee693be3e39b8c6a153279ae2078652e57208e7490
SSDEEP 24576:iGF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TLNiXicJFFRGNzj3
TLSH
T1485523D3468855B1FBFD003A867A5828B5845E2C8A5A5DE3D2503E5E913CFEBCF39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 6996a3785c85fc76c74e093978ad1702878ebb8e0f3884aa90a1fc90037f76c5
MD5 80b42cfe6e62b196ee5fcaa9a6706605
SHA1 e66f9b73094d0fa6004c0f13fd7afd9f13827f14
SHA512 2ba27c3cc48c75de163984abae7b7200b32144b949f45c9d7fc9c21245fb2cc8a7e4f558b5ca6768f776b7d929b7d0058007acd9e131e5143796cb7fbe1bda42
SSDEEP 24576:WJIUO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WJIUOLNiXicJFFRGNzj3
TLSH
T1AA75CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 af395d82e78e7159a977df765f48f60b9998830974d6746036f8e4307746e542
MD5 7dbaa7869b1359eaea67b22e1f1f66b0
SHA1 80c9a802bc2fb409694996aa114e7d4eaad60fb4
SHA512 959195b8eaab3f9f5ddccc78076e6ca463c65a7ece8bc17d8cc017c8d607b021107ea247cca5fefb420ad6eb4f02e908ba77be40f408ef8dbf41ec31a955963f
SSDEEP 49152:9QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THQ:9QvGAdlCEL8c/WRNw5CD7wRGpj3
TLSH
T182266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 d61b0283dc36835bbcf102edaff8eca5d463f303e24168fb9b4a1efb4692f04f
MD5 354862dca8cfdb98ca103acc271cd12b
SHA1 aefb595ee7765a2fb118c8a489f205ac1695b09f
SHA512 19dedba43c02103f23290bf6bf2d123430e910a752886c6a77985f2e2b45bd6ef27d2dff0246201d1fb3ccf6b8c4e2b18600b15e7cae2b218c210d4c9f805990
SSDEEP 24576:RfewsAjQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NljQLNiXicJFFRGNzj3
TLSH
T1B775E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6d4bc4b3b984cd0299b31960439a7fcfa0cacf03453579f497a65c9690d0286d
MD5 40e3ff68ebce4e2e7583b7efb73bd3db
SHA1 00f333ddd83dd482305726559540a05e2450ead6
SHA512 b947300438d9c17eca30f06d91cb1289086f42f68533a7215ad2412dab740298bc7840cd9b51768c0df1209d34f02b68522aee4311d1959770c59f15aaa64b73
SSDEEP 196608:XUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHUF9:XUEtQevvqc2W1cpV20I32I9
TLSH
T135474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 515ceac9636d3a3a9871c83215bfb9967a79ad366aa223196eb141eb9a380911
MD5 df7a63df1271acb5166ea33b8d994d28
SHA1 810366127d1af14846f3defe2a450188abcaf2e1
SHA512 a9a5798d1356b1cbd3b78a8a4651c5fdcce12053ddeb8d43a0032b36fb1ba86e75b83fce94064ed4300d2f9952ac3bcf4f812c44ce5fd0565af27b3a696e12f1
SSDEEP 49152:sCbRquA/m2yL5zLfFiV+XenmE3/zwLNiXicJFFRGNzj3:Foq2Vjnmv7wRGpj3
TLSH
T1C7D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ba5763e5ad5ba4009fd82dfb1593e475a3ea235fea7e32a4381ac5409a646b33
MD5 fde346f3fadc5b7ae9049fc2ce23360a
SHA1 064fb7ad89e419e875181d2633e1e6d9ea234ba0
SHA512 8b2df3ee70c638fab0b3931ea00abf9bcbebde1c2cf47dd3167049b377d1e6e0e678128472248ea17d7dff95c2c7bbfbfac11e35cdcf65241658bfa28551e220
SSDEEP 24576:TAhGL6IFoiwtA5l7S53P/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TAM5Foiq5fLNiXicJFFRGNzj3
TLSH
T158359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 960716f7843802687b95ced0ff6961fecf58d95f1d457fa989525bdff1894884
MD5 23652a9331de5d29b0f1a2eb09af3803
SHA1 42bbaa1fcda1ac078fcc68140ca746c4ba3e176a
SHA512 7547c7e1bc5730a1ad0f4ed6b63d9d23cdbc772cdb0dcab6f6eab94f773b12ba917d9f6b982b3a4b46b3298698bbcfe71f0fa52a942bb32b14befe4424efea3f
SSDEEP 24576:MwuROWM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MwSObLNiXicJFFRGNzj3
TLSH
T10065F18632980CF9E9BA41398657C035F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e152ab59ee0e429d6633f212c860d3d9e19ab325423606badeb07674bed586dd
MD5 7d65ea4ed19bbc0d41e403bce236dad4
SHA1 465b1ca1eb0c5cfd7c07c2e49114e92ae3348f3a
SHA512 a0b7323496511113e041ee4d82c6f1ae3372111c004ee9d3d81e7dfb42ac752dfb783bbc2fcadd60b3c306757dee55ece0ee11b00b01dd6798cc3f4ec89344b4
SSDEEP 24576:kZuJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/LNiXicJFFRGNzj3
TLSH
T11D55129622C820F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 08e4a95e069c853da3e9c697bccb5ff710f144a6e65c3dda90b04840feb738ef
MD5 28564b84646938e5840759666743418a
SHA1 245ecddf3c510cab16a3d8b02991e8c4386f986c
SHA512 34c101753e951a8a7740820185e18cb50bf2cef07acd93337038a72189ad17d24666c1ba378a8ad4c0ea6071f22d16435bfda270f5e58d92cb6a282377e5783d
SSDEEP 98304:kQRQyi36YOcPDLvw2gAf+PN3q7wRGpj3:rQyiKanX+PNuF9
TLSH
T104667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f3e2e36c3ecb0cbf332ad742176eefffd3ecfc6cd665ab257e251e61131fa8a9
MD5 9050419db8c2d59a7b372bb9625c07c6
SHA1 384df840ce1f7547cc7ecdcc2f77e5bfcf8add6b
SHA512 0f5a927f45de9069b2494333e80bc5b678e9343b094862cf68c3133febcbbc80043fa71e21e3205dd4dfab63703bfa9ba9e95e3007c42c2e508d39090402e9f8
SSDEEP 98304:VQRQyi36YOcPDLvw2gAf+PN3q7wRGpj3:sQyiKanX+PNuF9
TLSH
T1BE667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7a922349c907d9cbdba5cb60bb894992bdf24eb578564c51f2297544b6dffce1
MD5 d813e9d2e3444e40624819e8f9f0a639
SHA1 a54e4bb55ccbc14f16dff4ca909fe63ce81014b0
SHA512 02f7c102d7f258ecbddc85fb772a5e8405c405877f670db991ff67952704463f41527a1e3660fd541046c4091da15778857d3b1e209b642e7ad615e5187becd6
SSDEEP 49152:r68Qg55nhkeWu7PNU3/gLNiXicJFFRGNzj3:1thTRc/g7wRGpj3
TLSH
T185B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 27012e9689e6c2d78963f5bef5ff98d18b5227abe8254439b231d4210a277e38
MD5 9f8b250810d0347b63db32820e64ac52
SHA1 82122c352d058db73670a90bf9d0e43bfebd25f7
SHA512 53b781b673cf63b945f2ec469c9a3b95cee4076adec97b88c8abacbeccb3c79fd852fddea36964d4fbbb383a012349da3b741ccd0fa3b4b38ce42a6181fac449
SSDEEP 98304:2y5112gYy5azzVvU69nLKnhZF7wRGpj3:nLIHRWhbF9
TLSH
T195167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 dab8199b278ec24dfab46e2ac793f5d6af1abf44defeabefe48113923edd033f
MD5 c457f698873b3c0a6a709d88793f1cb6
SHA1 5da7aebeedf49111fb103c1b4286274e4a22aa6f
SHA512 0ba5c7de6b614c5e095c795572e8de31ab29f6d90aa096b108297e5f4d3dfc953ab7126cbca8631a8ac76deb392aa6f278ef70546c542c385d4831a88c4190d0
SSDEEP 49152:jB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glyLNiXicJFFRGNzj3:Vu6JmIxd2dy7wRGpj3
TLSH
T1E0D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 12e2fec15693d31ee7ed64093c2ffcef8670c84adfe07e5b1109c283720b9040
MD5 565a06194b42aa85803feeca3fad0bfb
SHA1 47ffb27b203a388e37e7870517f5e52ee9cc8d70
SHA512 87c62299fb5604d8c91560a950434743445b92b4e85267599ec248efd718c123a78771ae33136075c806358595fddbb0f00f3307e7dd82517fef6057e8d8d631
SSDEEP 49152:X1hpsNoJpF1A67U44CwH7R4xuLNiXicJFFRGNzj3:XmifPqRv7wRGpj3
TLSH
T1D3B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 a02776d27df0ae653a3001d9ef00a57d0c35a7061abb5d9b621edace0efebfc5
MD5 f5d537b69454f9328e22a1fc902c75ac
SHA1 7e7b9f5690b0e9a0874d5eff339490dc5c13e868
SHA512 fd04b54fece600498415f6143f9f93ff6db47b08e215c4d5989a47b02f5d273a22125e13187bc48a1574cde5a843eaaea158bf509a6364dc86656c4f3746f39a
SSDEEP 49152:7SuZQIY0Be2KkRVtOnks6NMHqJLNiXicJFFRGNzj3:p5dKqi61J7wRGpj3
TLSH
T164C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ff8b32f33c83daf8bb0ea34d912cfb3b5dd1efad15714c2f52d79050fc8bd871
MD5 38f2acae53ea632d68237633f311d910
SHA1 313cb13f5f80493e41bd75e22b33641a5261e9b5
SHA512 879f04df409cad0fb152eeb81048ce7d9f69cfb28e33eb64210faad0116a33f41ca112dfe99937a97de070df41c7aea7d4eda84034ad2760a5b1daacae52164c
SSDEEP 49152:1htSn8EApI0figjgiDn0AP5wiLNiXicJFFRGNzj3:EX2iWph77wRGpj3
TLSH
T1C995BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 22aeb9490ee4696173205c24e317904e3f1404128d7d5e3d0e34ca23b6cefddc
MD5 3ad92de49a2dbcdacd84ad9e108249ed
SHA1 2befa2f4c422cb853242d7e3880e8c1d25edfbb2
SHA512 2b70ad95516ce14d542d2ac5e26f992de99475076108f3e63d0f60ed40f72ddd16bf94530bda16e5b8ae6242a37f201545286411b2c5368d68d2755736be91db
SSDEEP 12288:mBiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:mt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1205523D3558955B1FABC0039C6754428F5882E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 7ec15bc8f8fc4ce03b9464ad071121bdb413fc7b27bb78bd1f6554ec36bf5f11
MD5 030b004b494660073978662fdfca498e
SHA1 89a1ff40167488ce528481e33a8248d95646a3f4
SHA512 bc7c55449f5a452bc733e17523044297bdb4c9ff917f38e9c9ee5d9a0af21691bcf3922bda69d535d518c42584f98995f00feb0fc10776967f3e798cd91a1bbc
SSDEEP 12288:JiiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Jk/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1555523D3558945B1FABC0039C6754428F5882E2DEB5618E3E3483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 fbea5fb2b84bf7ff2b7cdbf1ccd112b445ad897263201d0c4f8fe2fd641f3655
MD5 a3d1547adb1a7bff5a7388f1079e35e1
SHA1 7de02234d976b944d293ec65bbd634ef4def7b0e
SHA512 ccca3d687c9a8f968bca4534a490d60e13f92201629de4f4ec9cd6906582870be6755236867dd1bb9f9e61f676fe8fd516e4b4c08ed2d1afb35fc6b1174e2676
SSDEEP 12288:gsiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E55523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 4c1d232d98477e1fad0c5ef80d346b02a008587b25c53aba79d9f94b29b7f517
MD5 d442253a42bac1d5ef775aba31aec4cd
SHA1 89aa526bba34422d9d95b781e4b766b4ca7eb1e8
SHA512 e1be1c7936c3ce523f42396467998889da3e1d080b41e04d7e62648d1c8b5b581176e04bac00ddd6bdc60c2575d49f95d81a1b8224e0570c739b23d21ecc23d8
SSDEEP 12288:mV7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C9552393168901F1E9BD8039CA764424F2A47D6CD7325AEBD3003D1E5A74FDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 5c7cfe8739d04b37554afb99475fba16a77d1621c2017fddf75be9777903072e
MD5 afc47e56b441a8d17bec9a964d427f56
SHA1 ddf389a06e823af47be1670a59e91956a2916e29
SHA512 10f4381f69e23909ec86f048a2378dbe1fe52700a7ebe3711b7b33986c8885de8aa81c0974beb9178e37f2441d4f195069e4ed4db8d2ff34744ec8c13354b1b3
SSDEEP 12288:LTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ln/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B45523D3558955B1FAFC0039C6764428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 04be271ae57fc45ea8da4dc21c17669218030dcd702c61a686c5c9b5e043f19d
MD5 527fbecd0539dc12f97d7598b474c1af
SHA1 adcb66632ed673a7a0d2729d4d85bb6adc51d43f
SHA512 7624ee932f03fd36b203cc906d7a3b8c27c159f91b1e643a207dafbfbe610421669040691d80722bdba73cfa4e9f4bcf838f85505659ccf36b0e11955fb01c8d
SSDEEP 12288:KOiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:K4/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T14C5523D3558945B1FABC0039C6754428F5882E2DEB5619E3E3483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 e53b58bfdf0b42fdd5f77583a7619f1913215ff1672fa8e0d382cc34df895bf6
MD5 985a85850608aa7471bdecba3251b00b
SHA1 6f442c46841a0b166d2e5317b972bb815d3025af
SHA512 3765bed5f1db480846d1417996f75d54454180b79df2bb0ca913a2ed76af8c63eadbb0e6c6d4c97bdabd0c5eff45041319764fd91a0741548922f84a531ba417
SSDEEP 12288:26iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2c/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E65523D3558945B1FABC0039C6354428F5882E2DEB5619E3E3083D1EA278FEB9F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 51b7cd6f27085ff975bd5fdfd15fa9d7e0d2952ab2fc8aa917a750098305ac37
MD5 53db81b0d945bf0725d907f64eb545e1
SHA1 ef8a3a69d9cd2b3737d4ff768d1a3b6bcb9cea90
SHA512 5d7185f00cca56619197ffb8b26c16feb73f0437fa81e55783bde9d390a400dbdcb1031f3723e78267aa58e775d479abbfd4b7e3b216a302d69013d1876a6b05
SSDEEP 24576:HZM3zFVSOE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:HZM3zfoLNiXicJFFRGNzj3
TLSH
T16D750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 d6c21bf85a4580549b9f2653faf3221dc17ab6dc1ddc720b7ba853a3deba14ed
MD5 d1a723e20c69ad51bfca568401950fe1
SHA1 320e0f23c0886ad7e599ccbe922e1a24444e6566
SHA512 7508d938a8965a40e8d216e0f64bd0c8417b44a52894ca29c1a2e6e32164d1caeaf71307c3125841a883ad02d9547d18e689daeb8532864bbb54810a2a463bb0
SSDEEP 12288:UViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:U5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1135523D3558955B1FABC003DC6354428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 55f54e8b8f1ba0f7625224992e29dae41b4dda13f76e7e0dc737427ea9202e62
MD5 a83fecaaf0dc9d30833025cd1280d0cd
SHA1 0ddfe9875eb437b56ed66100de1a4854228243cb
SHA512 c08caf417f438ecfb0c1c87cb017cdbf1afa415f25dc0b367d30713914dc8402d53da1cde765d56b833e99246abc08b0c91abafd2f4565aac3833ddea4ab1b77
SSDEEP 12288:cpiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:c1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1675523D3558955B1FABC003986754428F5882E2DEB5619E3E3083D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 4d5ace4bb12501f3eae8810ecd991554f0021bf0cee625d47a51b7e3d41a5bb3
MD5 da3f90cb374dcabfa04894a139cef813
SHA1 472a28ed2f59feb6d6137658de3ef8393e6e4807
SHA512 a676433ce8cf1cec7e2ad82c4225dc575363b1b5cbacbfdfb9de9c1437a8ca237fdf0af032007433159b6d9abd9b7a921053c39244aaf7b046809cc7131c98f3
SSDEEP 24576:qzyA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:q7LNiXicJFFRGNzj3
TLSH
T101650247629530F9E17A8139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 de6414719f2146a53e106d5ef193aa49f970978f23efbd832c7a6a0d3e4ba027
MD5 ff6a588605b42d1703a2f580ddfb97d8
SHA1 f4af158246770f72670ba50467cfd08e5fb395ca
SHA512 71b59bfdc8253fffa2534558e9e36ffd02ac773f363f8ac16ce2c2c50b9cff2bfa935de780b1f24a94004293629ecab9ef372bbc750dd9db5e1a7cca17d4ed46
SSDEEP 12288:YViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Y5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E15523D3558955B1FAFC0039C6354428F5882E2DEB5619E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e95e75adfb4e6b57d99dffc5b31879599d156d52ba3ef4a61a9f7ca94a853a02
MD5 05c79a829fc77ce9f1a0c120a33fc44c
SHA1 bb63e870921ab6f49bbd577bf203cce415152fc9
SHA512 cf5ff225b9a9da9eb2e0ab97f8b303b181f89618d53ff6cb274704f47a81ed99c2ddd56b08c8940ecc117a840cf4e46b58b54192799f191f4ce7d73b567310c8
SSDEEP 12288:PViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:P5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1005523D3558955B1FBFC0039C6354428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 c7090b4a6330842913461662618369eb4edeaf67af8df6b13d32418672f6b50d
MD5 52e0fc674e246dbb52439863d1078616
SHA1 afd8354150faf8e0fbb8be41789624b05a1ab822
SHA512 b179b5c6c4b86e53ea70f79ff1e2a18aa447609535972679e4156d9400f897eed2bd40d44cff22f7af8e5bb5bb2acb370b27fa212891af34b10612be1f16d169
SSDEEP 24576:TzyA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:T7LNiXicJFFRGNzj3
TLSH
T16B650247629530F9E17A8139C9620915F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 bc99d64f83b893a86acce59b30b4d2b1b7ad4abd48e82fe359b274685e17c3b1
MD5 e846bfdb1b8695c1ee28eff191479ce8
SHA1 4ae91bb1e5a5f78ef57d51c4dcb5c89e5c3b509e
SHA512 8f2ab1ff602dc3cf4874487a8de41c93a30c1e2c806bfba7ec669be1b0b79f9df14595888e9723b5e75e4f9039b49cf7e4aa04b942a6a507024a046196ee82e0
SSDEEP 24576:3T8aLl3z0zDm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3T7LljTLNiXicJFFRGNzj3
TLSH
T1807502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 edec4add530a9a21e3c5a37030cf4fb458df653ad43f91260d3698da09290add
MD5 1a71e61abac87bcb743701a3f6cbb400
SHA1 6894b5b1e0760fb96b300a0221d07995c4c89add
SHA512 36ed7673a6435e8e6a6def60341e875d77e69a0f612cb9f60bb906b0f22823b5d4e8be9cad036c5d63032df6cd9298e50e57e21a7d870094659318e3d941e1ab
SSDEEP 24576:p3rd9CHKy7GZK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5rd9CHKyaoLNiXicJFFRGNzj3
TLSH
T10985CF90F3E414E8F1B79A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 45097b45f0297e78404b2219eabc560942a200a787dd391e1d0886b6a04a43b7
MD5 edf6d56c04ceb1a2b3b417d70c2133a3
SHA1 a3fc3015f3b4c129632a0e6e834a81a61b551b73
SHA512 4efffce3134888f714d9f86d57d21276c3237730ff0508c69d04c8ab190ba588f36ae459bb4cef49de17e4b7ee4cb11a8406f1eb112c00d7c034005513763cc7
SSDEEP 12288:YMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Y2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D85523D3558955B1FBBC0039C6364428F5881E2DEB5619E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 b366a1c7fbf4d62b46b1857a969b84f95b2861c6cf932dde973a41ef7fd4a1e2
MD5 af3f345610b67ed3d13fdf99750df0c0
SHA1 ccd4b42d98a2a6219d3d99e79e529d11662cbcf4
SHA512 dd6f1ae56e980820061f6eba59680d8c33ec69d41e5cac1a7d907869e21d345c43167f2641069f078abb6e38a8c34dcb0a1ec8de38247922adda37ae65ddf125
SSDEEP 12288:5WiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5g/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10B5523D3558955B1FABC003986764428F5882E2DDB6619E3E3443D1EA278FEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 9f2e8a6a155fbbf4ddfc02dedef19a968385fa2f037ca389ae841f8ce9c17764
MD5 ae44a38f11eb60c34eaf8dd713183433
SHA1 8c3bdb03ff6b609d06cf8607d29a5f9a8974d1b6
SHA512 b4d0c25fda37ac2d9555a92bf8aa1ad264274aceb8d03a2f21e2f9001f1bff3729fb940cff2913c4a2e1a825a0e1ab202f04c645c5b49a2ddbd4362b9771c7d3
SSDEEP 12288:wfiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:wr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B75523D3558955B1FAFC0039C6354428F5882E2DE75619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 5e5fbcd2c026721303800d0c6833ce1b2a0d535ffc5994527cc87183ac4fc38c
MD5 105ab04c3c1ee3550918c8772e3a7967
SHA1 e088e687d492a769de14485b6bebc7b88a46e3bf
SHA512 793946b6b73b3d7556d10890c5c9c9b8639e247d28f0d06bf3ef48fed8a8e8b2ca8fb73880e055d7a7596684e285ea7755cae562f3d658b6c7bd5f1d87ae6c70
SSDEEP 12288:QViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Q5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F25523D3558955B1FBFC0039C6354428F5882E2DEB5619E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 dfa53149b48ec521e15cbf34561ca2a7fa7dcb9e8dea093a13fb2a708269847e
MD5 260d9fda046b0e7b06693fd699338ad5
SHA1 ecf8ac47dd9e7218076da2b05e752ee1033e90c9
SHA512 edefe7fdf69a95a7afc68add508adfad7fd3c08808b5303a84a4b52594aebfee6f964d2c4791ddd27eed0fbb0efe7d9481cc2daf1799a026aa80474db6087099
SSDEEP 12288:hMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:h2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1055523D3558955B1FABC0039C6364428F5881E2DEB5618E3E3483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 c3933f45c54a1d6eab3e45905b0d3496cf4ed24c3a26641d632bb76e82d8ef4a
MD5 cf5af673ed8699700309f807482f0cba
SHA1 0ae31e70b38e12f024af2bb0dc14289e6e74fea3
SHA512 6001c0966277b35a2403e322d88332d46d28d4081b81f90a4418f3e1100e761401940c66ff9fa8768304efc49852372b3023129a7a2ae8ddf36d110e3271d628
SSDEEP 24576:yfwvzk9RX6wkyAIl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5MnYIlLNiXicJFFRGNzj3
TLSH
T1F885D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 095daedd06918cb147b0ea8b30737a47a155d8c1d79ef2701619f6b99bb7b2bc
MD5 580247bcf4f37c5a4a810558a8d4196e
SHA1 91e36d0fe2924d02ae08e7e02c64f5dda70dbdb1
SHA512 611b64461847ed02be0af80639a535b88b214fb8283935aa7d576dc22474d1be0be4417896c5f77551630e7bb0f022dd9c980b9cb0a67f4b0000fe41a12014d8
SSDEEP 49152:CYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0CLNiXicJFFRGN:tySzPK7wRGpj3
TLSH
T1A2066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 95bc7b4b31c96b228e02a0959b1c32dfa4d580caf6d2d644c8269ceea73364ae
MD5 bbc1f58ed441d04702f603b7aea84079
SHA1 d1c3f47399972cc6ceaccf99410c9dfbfdd6c9e3
SHA512 5206c08873dc30804b17dfc71406f4efac1c2969bf15466309916065f938517f4ae93720ff2b3eb0402e5e5ac1e2c98cf801968ed7130ccbe9521c29c52a7db8
SSDEEP 24576:P47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:P47JUQjqirIhCnDHUPfF/yLNiXicJFFS
TLSH
T19A65AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 f0ea0a151b36a88d6d8bd2ccf3665f496e72d3152ca1a84165abc2d7e95c8120
MD5 baa37fb12ffd775cec66afa692e354f2
SHA1 5cc8962dc9099b0a703d4041839438ac10c18835
SHA512 f26b2adf425fd90d1ae82ded2233bbde91d4a02ba5f487c3d40fed5b56178f4a144a73869c16c118e1a65594c1787439b886c3c928eba0b8542fe8a79a84430c
SSDEEP 12288:zpsfFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:0J/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13065F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 51b6bc53bd2b763fde3594e3e0402c71fb8731998c3088f51627f8f871657d21
MD5 82e94b92e54f19a99e21f1e405b3c80f
SHA1 0e6b1123c2cea2c64a4fdda4601b12e2c7f07e60
SHA512 26f1c4ff8034579ecfa4916f23fdeacb9357f8ebae35dac9fa44b712a5cc87231ded92ecde37baad5e757cf4f90d666328d4154f6fd29061411e50b2435801dc
SSDEEP 12288:Qct1vBqr+XtkBLgoyNG62eIXpAGJ0fK7p2GUCI+AvOB5BuJoCTQl:QUvvaZyNG62eIXh7g0I+wOjEJoCT
TLSH
T156553810766ACB4FC6A940325E33C5CCAB707D05EE056F0773C9873F9576A59BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 9df26e13ed26bb72a5ee06e1c1870c7060c6fca56ba79d604d72fbc4f589e60a
MD5 055097b8be64420acad2fb18b4eccb99
SHA1 729fd1a927e0744fb1278f9bfbe625aee502f531
SHA512 c3c3cac1caa886d4f098ec6964837615a84eb3aff62d39cb809d981a6bfbe35d283134d7e9ffd6290a0cb281780aefd3814c8b591ec70def7331fef2c10903b5
SSDEEP 12288:J6FIqFOGdHTQZFzyNGfyNGn2jIX0cH0G6rlKk3Z7:GswTQ3yNGfyNGn2jIX0W6/Z7
TLSH
T17175FA81A536A78FC1FA503203265E8CA7B4EC16B7056F22B3C9053AD87B715B0F97D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FailedGraphicsBackends.txt

Path C:\Users\Admin\AppData\Local\Temp\memstick\PSP\SYSTEM\FailedGraphicsBackends.txt
Size 13B
SHA256 738d5a20f77bef16d0d8d60c0e84583e8946e497c9f0eb4d93662909c41486b7
MD5 5879297adef6d3f88e50165ceaacd646
SHA1 3c8d03170f584120137dc81d9ea88a3b66680025
SHA512 af238c66232508970204e2ce364b93426d80beb466c886e9fa19f2d2c10374333887a81d80db3567f7841ec56b80670b8e3c60a620e270efe11a98031e125c4b
MD5 SHA1 SHA512

Submit Download

controls.ini

Path C:\Users\Admin\AppData\Local\Temp\memstick\PSP\SYSTEM\controls.ini
Size 845B
SHA256 7c1d66231127c0dd9d8a47399a267f8659dfca4325dd3e9e59a21ba9ff63f8a9
MD5 1add55682d05c0a308251c9a348a6104
SHA1 c9e729a3c4b87301178b1218afb1372015345df0
SHA512 ff400bf0fc8078c37b75bdc6841c8ff3c6859280d00730dda091d6b57f26018a74b9e03dacb87567fb01ab0779da3d02aabe55189ff3be99d6f323a70c1fc663
TLSH
T1FF01F95DFE698A1ECA5173C7073C184948DC23418506E4F5C766DED05B0BFB55D38032
MD5 SHA1 SHA512 TLSH

Submit Download

ppsspp.ini

Path C:\Users\Admin\AppData\Local\Temp\memstick\PSP\SYSTEM\ppsspp.ini
Size 19KB
SHA256 d4c64ec3ab1ba53c97303715805bab9a10f42d315caf4a4860836638051b4a9b
MD5 b966913a5d8390bfbbd3dbd093c58c73
SHA1 09a77ec1be975bf63809764bfc329274aa4d7004
SHA512 849aa105fb5b230bcd60f8e694a640747809020269d11a8fdd1855479cefafbffb0792bd2607ccc62d78881b672a9bc9fb2c23602e095a73bfca7dd80375d071
SSDEEP 384:7+TrkRh6hlnBl4BbXn6IJ8o3L3P7F7BZKmG5d:8kRhelnBS3OWJl4
TLSH
T1C692E2E4A9380470D43DEBF69C91722249F278A8C7DBA559F1C4C089F6E6E4D8E5341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f54998143a35217a.bin

Path C:\Users\Admin\AppData\Roaming\f54998143a35217a.bin
Size 12KB
SHA256 1fc7da3b7a7ab1853cd07a911971f19083bad1d06283a7b88b5951622d92a35c
MD5 5b993234340cad53309c08c31f7c8044
SHA1 d6e6561123078a3c47860d9d8d12ac4ad4ae6dbe
SHA512 70af944141fe2c92da5e9ca096d594b2f96bc475952f386e253c7431ed79271f876cfdf8b868356562679e28778b167c9c29d8206f344e882a3e30ccc6fdcc6b
SSDEEP 192:IIyToWqNU+a4ae/t0DpsnNxxV46EFJNQfZUjI7vxE7ErSavv3cKIsWGcewuKjd7h:RnUTs8dNGCmKxu3cpherwv
TLSH
T12442CFA1F152B6F48D550AE4FA92C5304DC15A6FE237DCD8990C8D0F5B2B35AD81EC62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c79bd4b9f5fc0af1c6cae1391026f4a142cd5a91c77dc4edc25c75985873b47c
MD5 e6d09efb11cb4eb7ca4b769c6d687116
SHA1 938e9d3ca5d3659afb89f3ca942958a800740dda
SHA512 5d0bbe0e13616018cf7370b63bb39616f0c89313848764017f7b7cfd7bfbf9330654235448641f1ecf2b83614e131b5bf32e75eec1c9a16b5f6fb8b487c1ad27
SSDEEP 12288:pF79iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:3h/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T142552393468D59B1FAFD0039857A8434B5497E2C9F1598E3E2043A5EA238FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f12d333d4ee6d28e1d1023baea00aa00156661494dac23bea5c234988f671f30
MD5 fe16bc21b59d3d11b5cccfd5814ad200
SHA1 67b5a366fe8fbf1cffc58f1c6f56026479cd2637
SHA512 82920feb6aba9fa5de4f2cd0e51bc862c8ad7368679127790db16c4df75cb0f61276dab4f8fd99edbc32048063f580ccefeee266c08650d0f8cb2188078165e8
SSDEEP 24576:ugb6bmBIi49WNNFpg1rSvFv7bYT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ugb4mBIBhGF0LNiXicJFFRGNzj3
TLSH
T1AF65AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 3ee05265f541cf482bb366256218668581c6a8aa3189d49acb245cd54055968e
MD5 751539fc3200834f40dcacb70339f053
SHA1 26110ec03bb79142d84cb13a2f04f4c11cb13a61
SHA512 24415b98a9a55a9c1fc26ebb59eb07010363404dc62c1211351c9fa78db63b0d9b94e86d0f0e2eedcebcb601350be0eec097f1071a9da38f07fa5e5eda3494d7
SSDEEP 24576:KG88u8FpJqH1vzria7/mE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:x7ZFPqVya7/LLNiXicJFFRGNzj3
TLSH
T12385F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 5a3a711e2b1b60d48766dcbf464bafa8869e2c99d23bf7a4ad00f65d51ab1b18
MD5 1418f7834da1286cc78069dae81323e8
SHA1 394af3e16ff7888be1f0b9ba0f565c4983c07710
SHA512 3252292a0677e5289fa2c4fafcaddf4f4ce82a69f209f9d4b1a039c89e5a9e1af0a687f19f65644f0a9b2adf40e7a0300146b6c5f196a8b389ef6743291c3113
SSDEEP 24576:KPUr+NQo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KJQoLNiXicJFFRGNzj3
TLSH
T1E865F16F22DC18E5E67AA13D85828619F7717866071292CF02D0917E4F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 1bbb7ec98bf3851aad4d9d9604f2994593f4640e5e1b7232bdb605439691a95d
MD5 55d6bb0c9fec1906b36702aa931e3a67
SHA1 ac27c3c85b74fc51032803d1f26ed0017b81c8dc
SHA512 9822d527bc2f018745d52b2ca5a1bb4e78aa3c418e285fa4ecf4a8bf2889642b8841aebd64b07b03a4a9e6d0ac24e4cd6b07c649b2a810972907447ba1266768
SSDEEP 49152:NBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj4LNiXicJFFRGNzj3:WG05lO43bd7wRGpj3
TLSH
T183D5C06A62EC11F5D1BBD07CDAC6460BEBB23815033556CF02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9eaff6fe2cafab407d2ab2b4fdb16ffd40df05dd7a5a7e922b31cd456fcd4da2
MD5 f3fc66a7cd18ece2c1d753842e10f08d
SHA1 1dd1b6140e28d8a1935a60e8f14eb28ed2ff5bb5
SHA512 d92a25a1c7a64bfb329de29fd54fd6feb7a688546fbff6fe8e4587c5cee2d894a2c8ee97375e9f378b79e2844c966965a93766b1188c6844d9bf95372b6c67e7
SSDEEP 24576:Ufa5POZ3dpyWVM50JicR2hG0lasx2+47eidnC/TwSfVcYG3K/cJHlnFR+IGNe8jg:Ma5POZ3lJt2pasx2+mgLNiXicJFFRGNf
TLSH
T14965BF5EA6FC00D5E5B9D17DC583461AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7c273fa7d9275f52eef24d3f8c6e858052ad0bf14e96468ff6aa7166f409f496
MD5 6f9071d189f07e67d1b51dc4bc835235
SHA1 03b9d2b16ff0ebe137e700453604d1234d83ca3b
SHA512 62688dfdcc794a3e757d2b955f27530654fc2cec749a3e95f32571868cf2d0dcee0ac39cf28869acd56476590deb5750aa69676858302ea2a9be87a26e04ab4d
SSDEEP 24576:0NcwHdjbyQ4nLC18lb/EOjowL7Fks/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0Nc/zEOVHFrLNiXicJFFRGNzj3
TLSH
T195858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 56602ad3d8e37964b4ebac5656328e88003424241c63de97807c20e7805c1e97
MD5 5a343698fc33f9a243e91accf6d434ca
SHA1 42f1ae7a7039efa78f27e5bf725daa1c9b198347
SHA512 51e6906e6272975de0ddbcdd5aa82a1308674b1f2e844c18331000ef8a355b69616e8f432c9f2f6a71da6a7469fa83e75696acf7c79f5937873ad147864bcda4
SSDEEP 24576:jzkNvNnaFeYhJNtmZBm+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jzMwBtOm+LNiXicJFFRGNzj3
TLSH
T15A55AF6EB6E806E4D1FEC675CD238512E6727861073293CB9290C13F4E679D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 ffa0a6cecb2ebcc514eee6f3469fdfce54dd26a966984655a08bbe4666da6957
MD5 1f8be359326e4b3bad0668bc77bf3db9
SHA1 a87da37c039bbc9ddd38d4fea870babd866fa2da
SHA512 4210d9fa10c49712b58bcd1a41c6dc7d116a373260974b6193bc0e6e46b33e2f551290f68aed20b329d57dc509463e6ce503d99a7e23c40b7db377e2384427f7
SSDEEP 24576:XD3FHshBIYQgAN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XDVHeBIAANLNiXicJFFRGNzj3
TLSH
T11675E17EE69C04E4E57AC17CCA638906E77138AD032265CB029491BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1240-303-0x0000000140000000-0x00000001419FB000-memory.dmp

Download

memory/1240-0-0x0000000002270000-0x00000000022D0000-memory.dmp

Download

memory/1240-9-0x0000000140000000-0x00000001419FB000-memory.dmp

Download

memory/1240-7-0x0000000002270000-0x00000000022D0000-memory.dmp

Download

memory/1240-82-0x0000000140000000-0x00000001419FB000-memory.dmp

Download

memory/1280-379-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1280-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1280-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1280-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1320-44-0x0000000001E10000-0x0000000001E70000-memory.dmp

Download

memory/1320-37-0x0000000001E10000-0x0000000001E70000-memory.dmp

Download

memory/1320-48-0x0000000001E10000-0x0000000001E70000-memory.dmp

Download

memory/1320-51-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1320-43-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2264-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2264-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2264-132-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2264-126-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/2264-134-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3052-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3052-122-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3052-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3052-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3120-374-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3120-106-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3120-377-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3120-375-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3120-99-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/3120-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3240-280-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3240-71-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/3240-64-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Download

memory/3240-70-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3588-296-0x0000000140000000-0x00000001419FB000-memory.dmp

Download

memory/3588-390-0x0000000140000000-0x00000001419FB000-memory.dmp

Download

memory/3588-286-0x00000000020F0000-0x0000000002150000-memory.dmp

Download

memory/3588-292-0x00000000020F0000-0x0000000002150000-memory.dmp

Download

memory/3720-141-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3720-59-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/3720-52-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3720-53-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4324-120-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/4324-113-0x0000000000E80000-0x0000000000EE0000-memory.dmp

Download

memory/4324-378-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4324-119-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/4812-80-0x0000000000A50000-0x0000000000AB6000-memory.dmp

Download

memory/4812-84-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4812-285-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4812-75-0x0000000000A50000-0x0000000000AB6000-memory.dmp

Download

memory/4988-20-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4988-14-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4988-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4988-98-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5704-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5704-93-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5704-87-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5704-360-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5704-396-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/5704-398-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6100-382-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/6100-388-0x0000000002070000-0x00000000020D0000-memory.dmp

Download