f1c0d343c1a5d6c0ede0b87e4fa14c376318d6004dc1b3d3144eaaffe8e8332a

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 04:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
Size 3.0MB
Sample261027-flft4ayt5j
SHA256 f1c0d343c1a5d6c0ede0b87e4fa14c376318d6004dc1b3d3144eaaffe8e8332a
MD5 dd8fb620413322311b4a45fd8e8707f6
SHA1 880ecea1c9572e4ecf9bd708e8617e5853729a85
SHA512 43118a36dc222ee146c045d7733bab0079ae809364e5ddcdb3bcae15e0a8a0e262827abc7266e0c4072cb47c0502e8ed721d061ff1196ee4f3263cca2e8d68bb
SSDEEP 49152:s8s3gt9LoHwjvTLXewnfZO3T/M+w0L6uRhTnZrCfQqNbME8osJHW1R:sOvLSwcbw0L64EfdbB8hW1
TLSH
T136E5F24773E6C0D8DFB781F6C9315222E671BC110B388AEB25A0962EDFB39905B36711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4184	elevation_service.exe
1380	maintenanceservice.exe
2516	OSE.EXE
4552	PerceptionSimulationService.exe
4316	perfhost.exe
4512	ReFsDedupSvc.exe
252	SensorDataService.exe
4656	ssh-agent.exe
5296	AgentService.exe
996	SearchIndexer.exe
4212	elevation_service.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	OSE.EXE
File opened for modification	C:\Windows\system32\locator.exe	OSE.EXE
File opened for modification	C:\Windows\system32\TieringEngineService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\vds.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	OSE.EXE
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	OSE.EXE
File opened for modification	C:\Windows\System32\snmptrap.exe	OSE.EXE
File opened for modification	C:\Windows\system32\wbengine.exe	OSE.EXE
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AgentService.exe	OSE.EXE
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\alg.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	OSE.EXE
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	OSE.EXE
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	OSE.EXE
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\a99ddf6b67fac3b7.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	OSE.EXE
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2916-0-0x0000000140000000-0x0000000140307000-memory.dmp	upx
behavioral2/memory/2916-63-0x0000000140000000-0x0000000140307000-memory.dmp	upx
behavioral2/files/0x00010000000093c8-291.dat	upx
behavioral2/files/0x000100000000994b-297.dat	upx
behavioral2/memory/2916-301-0x0000000140000000-0x0000000140307000-memory.dmp	upx
behavioral2/files/0x000100000000932b-290.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	OSE.EXE
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	OSE.EXE
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	OSE.EXE
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	OSE.EXE
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	OSE.EXE
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	OSE.EXE
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	OSE.EXE
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	OSE.EXE
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	OSE.EXE
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	OSE.EXE
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ef24ab9cf65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000023e4cdb8cf65dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec3810f8cf65dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4184	elevation_service.exe
4184	elevation_service.exe
4184	elevation_service.exe
4184	elevation_service.exe
4184	elevation_service.exe
4184	elevation_service.exe
4184	elevation_service.exe
2516	OSE.EXE
2516	OSE.EXE
2516	OSE.EXE
2516	OSE.EXE
2516	OSE.EXE
2516	OSE.EXE
2516	OSE.EXE

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2916	2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
Token: SeAssignPrimaryTokenPrivilege	5296	AgentService.exe
Token: SeBackupPrivilege	4512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4512	ReFsDedupSvc.exe
Token: 33	996	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	996	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	996	SearchIndexer.exe
Token: SeDebugPrivilege	4184	elevation_service.exe
Token: SeDebugPrivilege	2516	OSE.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 2104	996	SearchIndexer.exe	99
PID 996 wrote to memory of 4472	996	SearchIndexer.exe	100
PID 996 wrote to memory of 4648	996	SearchIndexer.exe	101
PID 996 wrote to memory of 4688	996	SearchIndexer.exe	102
PID 996 wrote to memory of 3020	996	SearchIndexer.exe	105
PID 996 wrote to memory of 3360	996	SearchIndexer.exe	106
PID 996 wrote to memory of 1332	996	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_dd8fb620413322311b4a45fd8e8707f6_glassworm_icedid_mespinoza_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2916

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4184

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1380

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2516

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4552

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4316

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4512

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:252

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4656

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5296

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:996
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2104
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-560646293-820748483-2532804640-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4472
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 3064 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4648
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2624 2620 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4688
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3020
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2624 2620 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3360
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 3064 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1332

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 3fc0bf658cbf001dfdbc87d93dde23ca3b149ed448e0f653b82e61622787f53f
MD5 d0b0fe90314d694c8fb4e12ac7bfbfcb
SHA1 c11a3a1e533c18cb18fe938b3ea03fc3d8016b6c
SHA512 eec6b503fe333df62a0da86635afdede0b96b760319763668995a596b75e0509beefd09bf475f1c9b071e68dc2bb7aa57ac6f5b082d4ea783187cb77a3184471
SSDEEP 24576:uXYfDtczA/oHjto1GFxlXutIs1WZX5AR:ttczT/M+w
TLSH
T1A785F12977E108F9ED678178CCA38511EA73B8554760E6DB03E4D9290F332D86E3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 4c10050da0629a4e1594adc5c811adb9bfaf73fa253391ee9605fcf6854b3339
MD5 467070dbfd5ee599ded51d840800bad4
SHA1 1f947ea90b1aebab14396fcf610812f101be8c6b
SHA512 1795bf51b0b8d2bc648c51268438a844d2c9520ab5105a38c52d3045754348f840fd2c9a8a16d822cc98682ca281b9c7648020f606a5f039533d218f665177e4
SSDEEP 24576:C0Le5ji0hmxIrMkoHjto1GFxlXutIs1WZX5AR:CPji0AGyT/M+w
TLSH
T16D959E26F5748375D073C0B9C5D3A69AED7230861B308ACB4286D77C2F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e765b2341cbb4bd9645c16e773bb3ac5843e1132e5b01be3152569ebcf686130
MD5 83d746b393dc0827c8cd81d122fcdcc9
SHA1 262f652ccea968d332f5c735ecd441ace05c3a1e
SHA512 0f67b97a2d63c964c5f95dd9598580f5c743e55edf866e6b55966aa495963389a7803f9266b454d364be6cbc3b82411fad63a3b336922794efb76a6cfa11baf2
SSDEEP 24576:Xa7/ezSC6vUyD/aqgrvWE6q8wyuKoHjto1GFxlXutIs1WZX5AR:a/ezSC6vUzPvxHjyeT/M+w
TLSH
T1CC756C25F5788323D0B2D0BAC5D7BA99FE3230465B3089CB0246D76C3E276E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 27afe9e2b3d786a7eb76b2c06d0faaa3592bd2ddb19709403b482715b4fb312b
MD5 cf60369db68219aaf9370b0c27f3c94b
SHA1 5b8c48085c7fbfdac9ecdaf44ed5cca69de3fa64
SHA512 e26a93a351a39003c9cb34e1b6a3d93a463838effcb36d5c2d70366637dc76d475626a60d2fa6fd3519defb9b7d8066e3933f90b95b23e873d848828afad5517
SSDEEP 24576:gVbqPb88hv/l+6LoHjto1GFxlXutIs1WZX5AR:gVO88hXl+pT/M+w
TLSH
T181559E66F5B48331D073C0B9C5D3AA9AEE3234425B318ACB1246D72C2E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 ef418c374067eef66a47fff50b9cc7aabf1d3279ab74f8546b697bd99045d746
MD5 fb7aeefc19c3b2a686623d3a56561d0c
SHA1 601b8c14524468ff60ad5ae068a6aa256c7ace95
SHA512 5b9c4f974e36896bc2fc30ed95c832a915335816d2d35f2c880bcd39c5e8c80ecdcd4e35683a0cb1b337c31683c8b2de16bb0b80a9ce7f735cded28873ec2ca0
SSDEEP 12288:GHqhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY0N:GHQoHjto1GFxlXutIs1WZX5ARtN
TLSH
T1AB65236399F250D7F77A11B029D77AB1EC77BB06084824BB8B50FE190E3C064EA766D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 00ddf710119cd8e56c358e2b60272789995913bd207ec756ae9cd62f04c1d840
MD5 5f9be54c8e6c231e63f43a3fdb77dc55
SHA1 25925a09ecf2be96188d69f6eea6f007f2ae2c28
SHA512 906d70506793edad3a13b48663a23502e965dbc9d3aa8bda6b9192f41fcb2d42c7ba81a86addb18e93c410fefb4f8f37ad8dcbb92f9047aa78d846f6d722b7d7
SSDEEP 12288:neBNUbTVO86UNhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX5Z:nJIUjoHjto1GFxlXutIs1WZX5AR
TLSH
T11685CF3BEE38FCD2C27A5DB85A928640E77274314F51A3CBD164C20E9E275E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 3ef2a815d4877e277abb2d1c819ac7431094e71d5a7fa7288195e5072af28c52
MD5 ddc22cd4c77157cff4ead0a7ab3967b0
SHA1 8e3adda654a10e5db794f13e739e70e4eefa6ae7
SHA512 4b1eb566d37e5d5e80dae2c182fec19a98e57477ed13f273ba25e9400e53e377e88964a05aa95f8f015a4f4d85ae08c8882d1541bc79eaeab32a53fbd8c7d877
SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THV:SQvGAdlCEL8c/yRNw5CPw
TLSH
T125266C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 7767262b89fdedb6c8f039ed2469544204ff759df98a21acad440426d94aa602
MD5 b2380fbed7797f1105fa9e07928560d9
SHA1 4b5f1a1bf7edef4a3831e5758a355db7d035d88b
SHA512 fa9f8fdf2aed9d85690a0546a3a8deb4b32c51c9d1e785cfd297defa3bdc4b990f2a629d405bcc37303c03078bfaabb602423f090cb4a1eced64eed366c959fe
SSDEEP 24576:z7ewsAjpoHjto1GFxlXutIs1WZX5AREN:XljiT/M+w
TLSH
T11685E031FEB0E036C37B0DB12B26D716687DBA204B5119C3E3A89E9E49341D22776A57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 ee13c7c61ee026729b7f5229ca02821ecc389ca66c12e1d6e0262276a3840bbf
MD5 3807e7de3ff464e4a1c416be8b875606
SHA1 b07f428aa6ced1dd78354d3bcbab7e06202ccd4f
SHA512 1bbe248696c4b228d9f08f4e0b9f75ded7419a710626f79d2d90bb7b3359a156a860d1a1ac5ade872ac9a68235b87fd461183980ecf7ffd3bc48865aa3fd6e2d
SSDEEP 196608:jUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHD:jUEtQevvqc2W1cpV2EI32
TLSH
T1A2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ada7977214ad7b39db7d47001bdc936d375ad0ade80fe1fd3f85c8334e273e6f
MD5 db0874e909f4e774506df0a54590e35c
SHA1 152cbd7f39a21b923901ecfd2d97f3aacc931569
SHA512 89dbd1f521c1d56038cf723b4465471d4b17203ee3987b89aef0e87bdcd60f66a51ae6de2f1bf5283f08ebf231e89e19f11095e97c82a4d4b7b82c9064bebc55
SSDEEP 49152:WCbRquA/m2yL5zQfFiV+XenmE3/zCT/M+w:boqtVjnmzw
TLSH
T187D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 492da534baccd04076e39cd575623492624d9a4033cd672d90203e285afb4d8e
MD5 57c2986bf621849c0b995a133de4a617
SHA1 8f07890764d8a6e9c042a1444d5cab83c634e8fa
SHA512 ff745af4dd2715b881ba985c7ab2a8d1d1f43eef5b6dca24d602f33233c36f09d0d03318d2a6ab33f691db9980e2c461cce94adfd6ff49710ac067aa2fc122a3
SSDEEP 24576:2AhGLJIFoiwtA5l7S53+oHjto1GFxlXutIs1WZX5AR:2AMyFoiq5PT/M+w
TLSH
T18635AD81EBF955D4F5B3AAB899B69170EA77BCA65E30C20F2150D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 c0be282105948974072cb1914d5fd92078edebf4ccfbdc65fd537318a179ead9
MD5 cce88e6af9490b110d64f2375457cd1f
SHA1 bca5ef45f12333fdc61673d5377cbea38da737a4
SHA512 f3b47ff2be472063d0a66c701f09ba6ae75fdae843868079a891deafea46f2f0c328864e35e8184d037654eedad0a7f8da821baea290b47dcb3dd9227c83bd68
SSDEEP 12288:Xmw5HEjsChNDBFgl0WDm+CYhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09z/:2wuiOWtoHjto1GFxlXutIs1WZX5AR
TLSH
T17485F14676E50CF9E96781388597D536FBF3B8022A25D72F0760CA1B5F37220BD29B60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 5d9822c234a991a6126e6b05626a2149fcb51e83e929c9e95a7c6403d6a2f39c
MD5 32c5f920396de931f2cfce1b0658e902
SHA1 806f7e6e7a48f60253d95a6d45f1d7dfe54b43b6
SHA512 057680e7f672ce0f1b097d5d779d0c13694d9cced9879c5ce08a9ef31ee982a700d6170c950b1ecf162888a80cda8b5b7b29633176b6accdb9f2f9b37a964464
SSDEEP 12288:1TZ1IyfhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:RZu8oHjto1GFxlXutIs1WZX5AR
TLSH
T13975125626F020FAE2A752789DE36A55EBB3B013173503DF07608A2A0F375D16E39772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ce5a856b9922de8bde3689b8ec7cf8e86cec0a2c745d15f965a71dd89424db74
MD5 1e428fc4dba77b51bf035a3ed61cda6f
SHA1 4ccaddb5f4ec4f35dc866c52bd8ffebff88875aa
SHA512 4841205b2e5e1e051ed7641c7cb43559b0c9a6024dfcae9359479760d0ef6b8e4f137b8b273fc1aa47e171bc20831322b495c3d05ac24b40b795188f2f40844a
SSDEEP 49152:Oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UJ:9QRQyi36YOcPQLvw2gAf+PN3Sw
TLSH
T1A7667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2fe8cd20f96dc1fca1f5b7515d67e4f163ca2f9fd9960c8ad275d9196dde8868
MD5 32d036acab2e19778119874526c6999c
SHA1 0698b8af8c437058814531e26473265a0a5b7199
SHA512 f1f7299d70f8bb6ef7d1797b977385db2cc0c189b8d6002d7749dcccd91e1c1cf950d66cb9b0a7a225c103c3e39bce0236acb2c13b6d820ca1016fd6cb61418d
SSDEEP 49152:ij8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UJ:BQRQyi36YOcPQLvw2gAf+PN3Sw
TLSH
T131667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a65a840c29774926888d65e50118b484f5ba7473fd4c81789edf165cf1b1cd39
MD5 d57ad771b288db650962601a613cb462
SHA1 3270127b9d04bd24487c8c62903d39b8e7bd8e80
SHA512 32b6217de9b14a2a9330228b0916c44b0fdd9312393e9ed250d1279e1a19deb0adf3baa89ad88fe2aabde9786635b45e44bd38b51248c1c4351919f212bcd3fd
SSDEEP 24576:QwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0soHjto1GFxlXutx:W68Qg55nhheWu7PNU3/yT/M+w
TLSH
T124B54933B2F20099C44DE1769F4A973196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 935b27508fdbc8aedf133cb9b91c43661c5683dbe6bfab97464eb93ad8987a86
MD5 6813e1a11732c14bf9569acbbf8d3ee0
SHA1 42b1d7fc4ec111d75d47018973ccab64815b0cc3
SHA512 9bb620d0b0622d80dfe9b81fcbb6e0f7ab5bf340ca519d6fa61688406f025f4a0abb4ab2be8578663be95fd02fb41bdab456dd7822aaddd0dcaa8d1cc0c3c463
SSDEEP 49152:23aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99b:ny5112gYy5azzVvL69nLKnhZ9w
TLSH
T19A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 aed1be850145740cb7bbcfeab454f33d9c29df45ccecd848cf80a0681b495bd8
MD5 aee98c505c7696ebba29128450847a02
SHA1 da2746696c4dd601aa60b94c675c358bfb350a85
SHA512 4f0fa03892cae78b361479197b84d2b5f22866aaf1b78721f9a72ca55e40474b6200e5678b8eeaf533f3a8aa18acba73af7999dd15631d2694fc1346798af58c
SSDEEP 49152:IB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glwT/M+w:Cu6JmVxd2daw
TLSH
T13FD59D13F1DA01E8D06ED478974A9233E962BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 bea8d1adbb5c57c725d5b2d2f06e4ac6d0017c4b7f7bded81a438610000d290e
MD5 10ec1d4f7a6fc35fb14acb566ff0bf55
SHA1 c8d35494b8d72e953d16c3b596034ee7ab2bdc63
SHA512 abdcefed5e1f1bfb8295ce13e754198d9369e25a4649a6d851563cf39fad73889516d7fb60cb1b567a9e9070d25bebc9c2fe5d7980a58bfcf1bf5ea541adef41
SSDEEP 24576:8hv8E1hps0+ogd2z615uCMVF1Agz6bUQ1zNOgLLwH7ReaQXx3ToHjto1GFxlXutx:w1hpsNoJpF1A6UU44CwH7R4xMT/M+w
TLSH
T11EB5AE13F2D900E8D06DD17887569632EA62BC460B34B6DF0A90B7961F7BAE46F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 072b467d335c8b16366ce3e2241996b87a54446fa83aa8b62cfd50e171c2f02e
MD5 3843d3df38bf1415499ce643192a3b7c
SHA1 6498e0c248ab4b40bb2d3c95c8e8124fe779a161
SHA512 3488a8a6d7fe53f3921c6dcda6765b93abd4d5df7ac5bd882b0de8cdeb6d9370c77ca60df92564645769bfa4f56eb8dafeffccb98153e0e8878ab13f3e00aef6
SSDEEP 24576:f4BvWw7fuwWQsBZFAfPSPa/0BeHWxE6WR04FxGgVG2Onks6xt4bSMHnq8oHjto1z:5SuZQIY0Be2KRRVtOnks6NMHqVT/M+w
TLSH
T159C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d207c0a0ce5f665fd2a3343b491d683b9e3479f0631f1546b8b8c032ca912609
MD5 9579e30c550e562e752e36d10202edba
SHA1 0285d39f176cec3e3545bb3d78f2e24131211119
SHA512 0df10d03713080bd9d193c968f0e390072193c52731f69443d906aac5201ac338bb786086a53c3a6990373a36b91b9016fd0382aa836f5813b286edf5ed3be5f
SSDEEP 24576:QhiavrPSLT8EARn+FgyUgd0fJY6Bni3iy9CTn0AP5+2QLToHjto1GFxlXutIs1Wg:QhtSn8EApI0figngiDn0AP5wgT/M+w
TLSH
T19D95BE13F2D900E8D05ED178C7468632E962BC160B39A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 10b09a0fe1a04a9851b448a6851d7d607b6a493b69db102ed45758c17946cbea
MD5 f4cdb0bee17d43b9a99dfd3f11343d15
SHA1 4388cbdc2db156469cac78b1543f0bbc22e722fb
SHA512 fdf03f94d37b926479eed13ee2c64aa49611b1db6a9c66e2c82b937cabb6844350e53670f7c0657273192b570cf7cb860a66956dcbfade38c158afe04473bad5
SSDEEP 12288:rihKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:rIoHjto1GFxlXutIs1WZX5AR
TLSH
T14F6523639CF340C7F62551B069C77AA5ECBBB307594920BB8B50EE190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 05f8ac90d74e85e93d23be9e5db52f32bddb5ec68f2c9de1ea4f5e4a0f0996d7
MD5 0353489de0f2eefb183fe45d0fe38fd3
SHA1 69baea7fced7b256c60c2423884461335baf0c69
SHA512 a0f77ecd5da410ef5f32363ba7d9b3610bae544b055ef98d7f640c82423b3970532b4d4dbb6dc1b5aa4abe432206ad0f101787fa29fb610121f35143a5306645
SSDEEP 12288:KrhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:KVoHjto1GFxlXutIs1WZX5AR
TLSH
T1B2652363ACF340D7E62551B029C77AA5ECBBB307594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 9c30bdfc3aa9561905f73af2a248293b74b8db17f19f5452ed89f749afd1e57a
MD5 d195c76569cb049c5202293b71558a4a
SHA1 e6db20d7839117391b9d9937830cc40f5e64eb48
SHA512 4120059eb1a5e224232a581b69a3ea7f68ca09d291a224a2e7782200aed4c83c967e3a77019910779004ea5b5dad0acf509640d8e75207c0843c790362cf6e0c
SSDEEP 12288:uFhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:u7oHjto1GFxlXutIs1WZX5AR
TLSH
T13B6523639CF340C7F62551B029C77AA5ECBBB347594920BB8B50EE190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 62716bc51c52c16b4e2afc9330f5e0618471c39e9a70b8ae3d573be2ea09c6b1
MD5 6e322135f4011cd0af65f867045f4fac
SHA1 d9cb26d7f79521c0cdc013e0015a09261e12fead
SHA512 1d737dc7582af19a216c1af6299092d3f733d8489c6b5663d7f0bfda29c7043727fc88c6620f8c67335f0c5a5380bf92100a76fa778561381472c7816ce89307
SSDEEP 12288:4VMhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:LoHjto1GFxlXutIs1WZX5AR
TLSH
T1DB65232369F200C7E53692B09DD36661FCB7B6565B2521FF8B009E190F391A0BE35BE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 a4967805e6730756183a08cd36b7552fc7769809e57e4100f024934ce128f26e
MD5 8e70a9b12b74e2fda74165eb0ec20cd3
SHA1 b767dc3d98f6f0c28f650146e0cabb4a2dee0d6b
SHA512 5ad3c85af37958e147c718bc3b8c79e42019bf42a7875f318ccd62c6fc3ce5900a15068d91de4f09b6811d8be06b168a3b5b40085c605da5e90ec54f699c7e4e
SSDEEP 12288:7UhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:7moHjto1GFxlXutIs1WZX5AR
TLSH
T1C66523639CF340C7F62551B029C76AA5ECBBB347594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 0dc901f2795dc240678815acde83314bc30ee7f567223c7c5b172e2832623cad
MD5 b044aa825e1047b42ba933dc2a8de963
SHA1 b902a42cf4841591b3dad3956c09ebda00299965
SHA512 6a45dc32648d9f68d75850bac138a1e3a19e284065cc8c0f5dd5159bb58382a41da67bd77eec5891ad8eb6175c2acb016c0264a3738d811c6d1e6833bd89839a
SSDEEP 12288:TnhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:ThoHjto1GFxlXutIs1WZX5AR
TLSH
T19A6523639CF340D7E62551B029C77AA5ECBBB307594920BB8B50EE190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 0cc0ce56b4ad3eda5f4e090a3291c2a73b88bde028850d23274905b27b0cf789
MD5 cedcd7e87d3a7acb65ad722201acfe22
SHA1 2c733036812ca1882c96101dc680e1ca40c28327
SHA512 18b294406e7d563509121238f67843543f80f0e9f1fe93ccc4095d3ef3cd94465176d932f52afd037683e69637064e5df70abc486c9635977845426b43b1a525
SSDEEP 12288:XThKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:XdoHjto1GFxlXutIs1WZX5AR
TLSH
T1886523639CF340C7F62551B02AC77AA5ECBBB317594910BB8B50EE190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 26bbd123764ab8939ae0eff96df0bee9c00fb6f382eacaf569e2bea064b8ae8f
MD5 a9cf0434379243178f42378ac8c4ccbb
SHA1 b780630f082b9ea2d61bc8b02a0eb06cd7a14106
SHA512 0bbff8afc7263ccb106bd7120de2ab42eb58c9643fd3184019cb399468a32d22394152a8af84f80d8e7b258014ddb814c6a079a351da07f0e022cf5f14b08391
SSDEEP 24576:IZM0zFVSO1oHjto1GFxlXutIs1WZX5AR:IZM0zfqT/M+w
TLSH
T1498502A5B3A018F9EC67813DCD569916D5B37C1A0B60C65F03A43A2B1F373A01D3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 49bf16e8fdb285264a4d1ca4d5fba60112ff5c87022ac3e18e4f1056fd80ac30
MD5 a1e77de808991700fb7e41b35658c2d4
SHA1 f7c5c06790b6a080eae137733beab7f8fcf34043
SHA512 e92194a2a2c226e2bdf93749d53420ce904b016efa40f7870771662c2006bdd6a4d686150bd84eb6968ace434837b6021615ae38db5a163a4c7dc57b1bbd0b7f
SSDEEP 12288:2mhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:2MoHjto1GFxlXutIs1WZX5AR
TLSH
T13B6523639CF340C7F62551B029C76BA5ECBBB347594920BB8B50EE190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 5e01d051c7e30875c9b7e75694020773fc049f19c6ac2c9ed3108225e5323e2a
MD5 8b42bbbe05c50e4004a09c3c602b046e
SHA1 43dc02d1182598d99f30ffdb43ad3ed2c6225d92
SHA512 1084c670f5745080b754aaf056bdd8b2b2f52d340a34c850536faed404a3b9a6dd372f92a661c74412a5343ad0bff473152975662218e017ddace6070adfadf9
SSDEEP 12288:dahKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:dgoHjto1GFxlXutIs1WZX5AR
TLSH
T18F6523639CF340C7F62551B029C77AA5ECBBB307594920BB8B54EE190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 9784c516bbc0471e878fb6fda446f90e3a9df1d27a05323830a48569ef400a5d
MD5 ff1d0c122b2a28a53dec3c9eae180416
SHA1 006ceb283bdd30930201fa0ce6adbbb090592f15
SHA512 cabead10f648719c13963eedf73d70b37bad5ae177e896e47a4433b98ed65da2c272f4972cbff29ebbe0e35a4a2bb94d91f8ed2dce17ef5e4a978e8ea201664d
SSDEEP 12288:DyPz5L8fhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:uzy5oHjto1GFxlXutIs1WZX5AR
TLSH
T11375021776F130F9D136927489931A51F777B43607245ABF47A04B3A1F372A0AE3ABA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 c5fcd87e072ace2bdb96fb34cab183f7b6fdabfbb67e701bcfa0497a6a165928
MD5 13ffd277fd10c2a3c907a14a79dcd2ed
SHA1 152d9c8111b6fbfe7087cf9aef4568c362659ce2
SHA512 7551d8d785eb4220e2692e4c2bd0f45e5e800ec73472c6ae559a4b0e5346dc527b2c4f8500895a33fd326fe4b4cbc29d594b3d5a0b32909fbb9d1fc3f00e420a
SSDEEP 12288:omhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:oMoHjto1GFxlXutIs1WZX5AR
TLSH
T1676523639CF340C7F62551B029C76AA5ECBBB347594920BB8B50EE190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 aa0892ca1ff6755db5f78f5c9bd81b0be864554c1190fe25131e9bcfc958589c
MD5 adf71bfbcfd550f73e882666bbc55389
SHA1 9199d582a52c42961e9bbf7a5a509844120c48f4
SHA512 fdc6808e8ad645f56c858267cf0c1249a63f31e06dca55acc5fbbc750114b805b438e2530d1f0da6016041d888129b46fb021b23a5e2b45c0cb55eec6cc6c20f
SSDEEP 12288:vmhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:vMoHjto1GFxlXutIs1WZX5AR
TLSH
T16B6523639CF340C7F62551B029C77AA5ECBBB347594920BB8B50EE190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 1d8faa9b66f8bce11bea64cf02c0eb7ed9672b8cea1260b667165934950db15f
MD5 ea2f4c4b6dd32e733deb85023741e7a4
SHA1 92773de181f2130467e5f401c110c3fe052d0648
SHA512 deb8c8e2514cf334e8976a75a3efc280e4cfe22535f309ea6c95d80302b5cab62dcb2d337f6e0f3e9a50dff2aabd578de971c314b72c52e3280f0ccde60fa4b6
SSDEEP 12288:AyPz5L8fhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:xzy5oHjto1GFxlXutIs1WZX5AR
TLSH
T18A75021776F130F9D136927489931A11F777B43607245ABF47A04B3A1F372A0AE3ABA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 5f09fa31d43e646120428d97e138f6a9a1801ad1c1a39cc6910967bc907c4d59
MD5 04ae18d7ec8c2d44546aace81487a1b8
SHA1 715e10dec2c0507849a1c91852ee26f553d0dd3b
SHA512 79aa52c9dbda38c5f46036c0d36c26d11b6fe30c8dc3ccc80ff97268ea5653ab974c1bc20278fe44e47b5fd73b93b733ccfc4016e08eb4f6363b7f93486af0fd
SSDEEP 24576:WTNaLl3z0zDroHjto1GFxlXutIs1WZX5AR:WTALljjT/M+w
TLSH
T1DF8502A5B3A018F9EC67813DCD569916D5B37C1A0B60C66F07A43A2B0F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 86d1c20fb2489812c24e65757c1e06a0a7a67d92cc12c4c905fe357acfc1af46
MD5 d65410d20307d48bd1fb1496f4cc0868
SHA1 31cd311e6c5cbd68b7e2f061302b262566d97d6c
SHA512 87ed0a5a0623d03cbecec72bca3711df24e01ac38c81276d01442ed20ab335aa44e376615223735f15c8fa19d876d024aada373a16a9deef76634d2393608b56
SSDEEP 24576:D3pd9CHKy7GZXoHjto1GFxlXutIs1WZX5AR:jpd9CHKyaqT/M+w
TLSH
T1C295CF90F3E410E9F0B79A348D765512DAB77C5A1B31DA8F03A4661A1F336D18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 bae785cbb28e9920893b2300d5bb53afb269e25366ed5970012686cc9876a177
MD5 831a36f7f6caa610ffc8ffdb3a6005d0
SHA1 67acc3aba8698d9837a7a4f3f7958fdd2e99de0b
SHA512 4a9edec54a9615d9fe01d2067fc15e02b6fc1dc5ae4c43ae7a68209cbc632072315a9b0564a7cb14780fa28624fd168cd98964959b7745bd1c6c5592bc6c880e
SSDEEP 12288:qlhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:qboHjto1GFxlXutIs1WZX5AR
TLSH
T1C6652363ACF340C7F62551B029C77AA5ECBBB347594920BB8B50ED190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 c1d04adc7e1ee8885071f9729fd038a99646863865b2899ae909319f191187e2
MD5 6de86b1755427c52728c345761455cb9
SHA1 ffb5b5fe6fe1c75a5ad7abc2595c918343ee79f2
SHA512 d7025114765ad106d1f262b6630a1e21ebe9d332be9f951f05c77351562411850af4d19438465f2d077b751b222a48c2c1d03878db5f5197a2c54edb7879f6f8
SSDEEP 12288:Y/hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:YZoHjto1GFxlXutIs1WZX5AR
TLSH
T1086523639CF240D7F62951B029C76BA1ECBBB307594920BB8B50ED190F3D064BE766E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 2ae7aade87f5e7cfa71f1ebe14936ff52d8f31179e365cf69b83814a20a7fe6e
MD5 e1ba22ad5f5bf540670e9be008201d1c
SHA1 6517001ddc8a1c5e84b5c3d6035bf5a407930805
SHA512 b757cb9ff2ed64ed0a0a198a36f44d5769f6c9c308fcea4f4c57f218aecfed895aeff9d10d6aaa39dfcc205f05da78bc44717405d996f896e4955117611fce08
SSDEEP 12288:mAhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:myoHjto1GFxlXutIs1WZX5AR
TLSH
T1036523639CF340C7E62551B029C77BA5ECBBB347594920BB8B50EE190F3D064BA765E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 bfbf6563fbbcf93f5b4b92f89da0bb55787a22d92261a93601edbe1ba06ec7c1
MD5 84a0a82bd712087c33ff4214839e1c25
SHA1 8ebd68b2cbdba231c7f52eb247b64563e9b95837
SHA512 b2963400673a8db2c8533f2d36034dfb63a568e612b443dcd59553f2d56d2e2863f0b0840fd32cd3659070131efcc55f26b79799a3bd0bfd92854c9d03e74467
SSDEEP 12288:JmhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:JMoHjto1GFxlXutIs1WZX5AR
TLSH
T1BC6523639CF340C7F62551B029C77AA5ECBBB307594920BB8B50EE190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 84e90e7c29d7deefa9754e9c7e6332c47324500c38133dfddd21c2728dffdcca
MD5 6b579b8c64bb7b1fe9759c254de8b5fd
SHA1 3594b9b564f35ebe4d925763fa1a1a45b1942ae7
SHA512 3a7ed9d79c9d72125259504c6f0c9e0aff3f7cfc2637ad33f733c28b98f69817c1d6a57b1121847b8d26e70d9ee29add310a4e0db84cd2c4ffd4fc67705bb52d
SSDEEP 12288:6lhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:6boHjto1GFxlXutIs1WZX5AR
TLSH
T18A652363ACF340C7E62551B029C76AA5ECBBB347594920BB8B50ED190F3D064BE766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 8b4cb71103755c0a3aeb078be513d2f0fb2efa4a595fc436dc258c8180a3df05
MD5 68215bf56bade7f65c3cbb5a5a4a4a1b
SHA1 4a8c11c1557623a268120e81f19a568c59572415
SHA512 a7bbc85fa8965d3f61ddb4b67f5b603b12934cf26b4c132ef344114d24a374322235475570210460f98595248d5e61eb51c69ed14d53651fa937c710f5d5482c
SSDEEP 12288:gOhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:gUoHjto1GFxlXutIs1WZX5AR
TLSH
T1D46523639CF340C7E62551F029C76BA1ECBBB347594920BB8B50EE190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 f3fa003c5e901f9f654c46c9cf1c3ddea8d043dc9580d1d245aa64142f4fcd25
MD5 a8ff75e72800786851aa07a1a5cef94c
SHA1 4c9719a4b638a4f71958dc88850111f6443a14ee
SHA512 f981b13341a4634e1852b4e2df6126b1b00c74f44cb9b9da9131f6c6817569031559fff2479efb18ead4de1a8e4429c0a7cb1100f76cb984e1e048ceef2b7371
SSDEEP 12288:9UhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:9moHjto1GFxlXutIs1WZX5AR
TLSH
T1A7652363ACF340C7E62551B029C77BA5ECBBB347594920BB8B50ED190F3D064BA766E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 752f5d5ccda17f681872441be80de1673ad03d49cf7a60b411e7689e0c30ed2b
MD5 e6059556511a37dc07336f89cd506601
SHA1 d628d1b1bdc4b63fb026b7241eb2a94c59e0aab5
SHA512 96ae347338a61edea7b237b0959ff9ea8d5f8356e32304694fdf23ed3b0c0f97060f701bd573634b8e1ae74d1d0f1f486258f97cf84c0d155c757465808303bb
SSDEEP 12288:69hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:6zoHjto1GFxlXutIs1WZX5AR
TLSH
T1816523639CF340C7E62551F02AC76BA1ECBBB357594920BB8B50EE190F3D064BA765E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 1e872f4e72e93e353118d4199f85a764bf8c038a3b4833c6b5798ccf7f56758a
MD5 79e3bda23476fb976db2a40c2daca9df
SHA1 6a7ff0270878cc40c18f84fa80b242d1536a0d0f
SHA512 1642846efca93857c2c8bd32c9f50c9c12b6e28b2d3ac5a87d49c2c85b3e743e30b8886062c7127c41cd39052bafbc093de87fdcc3a772f7e887183ac41af638
SSDEEP 24576:8fwv+k9RX6wkyAIwoHjto1GFxlXutIs1WZX5AR:SMnYIRT/M+w
TLSH
T18195D029EBD804E5E177913C9DB7460AF6B278591B31C2CF029A536D0E37ED46E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 017ccfcd7f2ed11f0955c0127d441243144a709e8b97375295f7e7d084a9a937
MD5 4f65a912c8e26dfc4e1bf36833445488
SHA1 e9b441c0fcda19a439bae0304a92039dd43987be
SHA512 f1045d6e833c035c5bb5c11ea6ff713c79994743c52147af28052a339d199b00b4287425db4b7bddb5445d5c98154a494355684b74379d9e001b897051b7b5ec
SSDEEP 49152:hYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0AT/M+w:JySzPyw
TLSH
T1BF066C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 fa8451a8a8374191456a1e833e0f7a5c2a9eae2389d3c2b1286fcf98ee194020
MD5 76cec6680a516770145f437d003c571b
SHA1 faf3d4a7a693354d98e610e36332c78c8ca55a29
SHA512 83329ca459f6a7aac7625b65b8c1269890cbd3da3400e9133f1d0c44a769fee68387e3e0fc6ff77ae1ecb0881083c31735738fa41939e4b0a2b4935c4163a714
SSDEEP 24576:J47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYFoHjto1GFxlXutIs1WZX5AR:J47JUQj1irIhCnDHUPfF/wT/M+w
TLSH
T1BD65AE1EA3EC01E5E1BA927885164A5AEA71742E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 5f7f00c791e10718606dc42436cb188de346532b4f74c9953f52af87a24ff490
MD5 5a6849183cdede68d0a3a1653af20299
SHA1 1a8bfac03050138bd9f9ca16c6a31db330fcbed1
SHA512 58d20be9fc05e492f0ed6f4d833701e79d44f277c2f99d3d6e4a158c5d72359fd688fe7841f5eaec8e4d54797411ef2f5238af79492f67f03615e726edac3e08
SSDEEP 12288:1zsf2hKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY:s8oHjto1GFxlXutIs1WZX5AR
TLSH
T10C75F11AD2A401D9D06E6174CB865A41F7337D2647E193DB57C0F93E0F3A190AEEAB83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 b629bb7fb4435bc587bf1499a61b7ea993c4f43acc12bdb8cc7b7fbbf423119c
MD5 9a9709b6cf1fa2d21f9bd5e97bda2763
SHA1 bbfb1e0b077612a10df145f4e5d9781323b0d4c6
SHA512 3f3335f6d2c752efef4a85356a32a1b82f654ca2f61fc5612e3154181d932d69f8f4c74b63a7e0d577e2546d6d07c0d884135c0e6516893dbeeb9f58dc4eb87a
SSDEEP 12288:lbypvU3f11p+2fU+Ff5qhT4MCdiAsadftEm/jKc2:lO5UP7/FHdhsaJOm7x2
TLSH
T1633528107666CB4FC56940325E37D2CCAB707D06EE04AF0773C98B3F9576658BAE2682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 e64731030c650b3d44f71b107027b1b3afda2e3d38dd5494ebb24c990584c8cb
MD5 060340ca5d8cdca36ca34777b57cadcd
SHA1 f01f7a41a5e85803a99fa0da2e424bab38cbc915
SHA512 dabf7529266af3b1748a870d9c54f20f9732f8a00af38409e66e19ec17d9b6e35250a974c7a7c4fd8cda1fd7049ebff59dd02f99dfed30e5bb99287a1ec29d38
SSDEEP 12288:KbZ6kUAD5qhT4I3U7mEExGMTBNe9Jf5jl:G6kUA2kiEExGMTBNe9Jf5jl
TLSH
T1C245D8406537D6CFD1BA2032072A5B4C7BA4EC17B6056F26B399453ED86BB11A0FA3C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 1fac6a97a3e854529fdf972b9db15c91a645dbe86095ddaebad50e739f8c3591
MD5 18f1703d9c10e539cc34ed0b3d3cd49f
SHA1 52efbb55e3d1e331d2f7602acad66c79ce47a51b
SHA512 9d6206b91871ad62efd12a0f08075424e3011ed0c861370c3d1b011225c69f268d23274a9f8275bcaa615377b6b2d61db7d63a171fa41fb23e091b1af5bc4188
SSDEEP 12288:6+7ehKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZX57ERY+N:REoHjto1GFxlXutIs1WZX5ARHN
TLSH
T13C65236399F254C7F57961B029DBAA31BC7FB3160F4410FB9A40AE190E3D0E0AE766D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 6299178b4eaf0e48b21eeea76ecfa39fd0afd59bd87ff3f4bdbb77df484c85f9
MD5 8adb771c73d47c58e910dd7af96546f1
SHA1 55636800fcd227f04ce3a3010ca02867846451ca
SHA512 f9fac07e55a8620715881ed802cc0fb52042409e37ea4bd7ebd3608b5d1dd7e6828e5846cccaa1d2dd75ad7923701a1ae6e021dd88cae38c4a23e3598d2d69d0
SSDEEP 24576:Agb6bmBIi49WNNFpg1rSvFv7bYKoHjto1GFxlXutIs1WZX5AR:Agb4mBIBhGFWT/M+w
TLSH
T152659E1E22E802F5E1F9D2B89DAB4417D6B378160731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 832KB
SHA256 694f29a264f9b904ccc4ba38b0bffd4f61c81b71841f383a02133f07636b0743
MD5 bfc3507a2c7c0ffd819e5ff76eb53f76
SHA1 59d529fa6b45524461dc852e74f8a235703090b7
SHA512 3af718726a53ba1d3209434c2d2406b93dfc1bf85098cbd6b3c04688ffae9baf246950272da565ba1de5b3fbdf8b381328648dec749033bdf81e28229ffe414e
SSDEEP 12288:/OGg17UeR6SGnGRtOW0eNfcUMFHVOFe6Q8HOOxKsUpbZUqOr2NSARk/TtxIUzOoi:WGgZbR6SG3WRNfaHIe4HZxKsrCZRQwR
TLSH
T1C7052328EAB528D1D27D873D4920A70BF5617072932AB9FF4AF081778B755F0A43BC64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 9800d08689e2aae1118450d31d81dd602fbd75e28f48376390ff7b927aa70b09
MD5 942a76b127e590d849552c579ebdc00e
SHA1 a34745e2f2f26dcf2032a922047ad2aa1521f911
SHA512 476568de7dbfb5ef00dffd9dc82ecc9f3ffd9472675e546255993154a1879a994a676e0071eeb15b2d3ff7c91d9941ff583fc0fa7d4754f7113d696731ce8788
SSDEEP 24576:lG88u8FpJqH1xzria7/m1oHjto1GFxlXutIs1WZX5AR:I7ZFPqV4a7/rT/M+w
TLSH
T1E495F16676E101F1D47BD13889874663F6B2B4250364EBEF0BA88F151F236E44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b0f1e608fc0efdd780c90f0f011ed33e68b41d23524555f334515fa251eab24d
MD5 c61a9bc3031f3c98815522c09992855a
SHA1 f4ea40305b65faa86710bcfc6823e024a1468b52
SHA512 a6c3a3fbd80e6342246490dc2b4c30fe88db4ccbca04983a618b1894668f2dea5bb3ac99284801d190ee90fdaee782e8e6c2f2fbd5575fcdbfa253316f5c9c09
SSDEEP 49152:JBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj6T/M+w:qG05lO43bVw
TLSH
T123D5CF6A62EC11F9D1BBC17CD9C74A0BEBB23415032556CF02A486A91F27FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 95576c1e5b053720fda344be588620323e48f7d5973952258b5a6a25aafcdb55
MD5 e1e8f8156f65b5f05bd933e0e0756535
SHA1 800cbaf34b49f3d7e55f962faf231291f2bc99b9
SHA512 51436025d9cf2ba4a02353a3ad1174dd3f827febb2759b1cdef2f1256d9895b7d35f856b7392d5077aed40bc879976773fd71a0a8c77b901bbc2a6cbef874fc3
SSDEEP 24576:ofa5POZ3dpFWVM50JicR2hG0lasx2+47eidnfoHjto1GFxlXutIs1WZX5AR:Qa5POZ3+Jt2pasx2+myT/M+w
TLSH
T18265AF5EA6F801D5E579D17CC583461AF5B2342653319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 ddccc9494c827fda0df33f6a7caa1b89ac20b967448be8ce7ab4891adb42578d
MD5 9f7cf4f9dd375b47156b32f570eb161b
SHA1 75200f20ee0e2e471b89edd32ec0c541d80e450c
SHA512 47d1b041268a0bed437a5fb9a32cfed629d8ec0a748555451033a8b51e2b29ada30c85e5861d33e99e93067d65d18f0b2e683470b86e7f1b5c2672baad69cd7e
SSDEEP 24576:mNcwHdjbyQ4nLC18lb/EOjowL7FkNoHjto1GFxlXutIs1WZX5AR:mNc/zEOVHFLT/M+w
TLSH
T1AC858C2622E901E4F5BBE1BE89779546FA717865133086CF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 948KB
SHA256 dd4c6bdf913f59dd9dcc85cd9c61ce35bfcb33d727af1bb34ddf3f3a5a6c359e
MD5 8423658dd79620c32306bb1ad06534d2
SHA1 9a425da146d232f9ace4aed3236dc2e650f9e3e4
SHA512 10b5f2c6249a9322f3507ffbdb9c6a64d2f8f3dbff45f00c7198a3b1e3cbb3bbdddea505923fc4b9df08a02ba6205812d7642700637c3bef562ae3c43f24e2ec
SSDEEP 24576:06DIRZbR6SG3WRNfaHIe4HZxKsrCZRQwR:06DIRL6uRhTnZrCfQ
TLSH
T13B25021CA77A10F5D16BD13E86924606E2B2B071C36669DF47E0C17A4EB3ED8B83DE50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 c57bf3540ad08d39ea6419e1d67ed88e4345080bc92d8c82e1fe92d6e57fcf06
MD5 42019f7bf065a89925d26c473eda0839
SHA1 f421afb7d7ce703ae7cd21439ce063ddcd9898b2
SHA512 910b3b926ded69ad14956ee1b122e28cee0f877893051e18fc5e1a48d8cbb174eff1f87b9545a27565ecb87a136dee6761c6c8c048c2167baa30de99ac111afb
SSDEEP 24576:UTkNvNnaFeYhJNtmZBmZZbR6SG3WRNfaHIe4HZxKsrCZRQwR:UTMwBtOmZL6uRhTnZrCfQ
TLSH
T1EF75BF2EBAB845E4D1FEC6B58E238512E6727461073293CB5390C13F4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 f2dd4320423b1c159646b1f4f49697e02e35e13386ef096bc017e527fd0e353f
MD5 e810adea022e0372051b9f282e25a438
SHA1 6d2186bd5d5ff5ecda9aa39c676d8da216e377e4
SHA512 c8a9e49185045207ffa3a733c2d838fc407f4faa0792f72ce76b5e18e28c07b45cfb762c2a20e6caf8fd68b8da9902cdc1ae10a695cc3287f0ff3c590fb8b3a0
SSDEEP 12288:wHvUrBFrEjwaQXhKD3HZxNhxo1GFP59ZRRBTbOpSTZsMlyqFCIs09zfNDY7j+ZXb:wPUr+NQxoHjto1GFxlXutIs1WZX5AR
TLSH
T1C985E12F66E918E5E676A17C89838719F772B462071292DF02D0813E4F379E8BD3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 ccbffd7113f02dd8cf4a2413775111d9d5a82a37c00b7509c9a605422bb6dad0
MD5 a1522e55f8d0d291b26ebd5c71064393
SHA1 61c5e0f629791ea85440ec1b778379002f12cfd9
SHA512 bad6caacc9b8ae9644214f0215288165b1ca9221eecb2a50d230ce188dc8de60e13cffe1533227a53a00c3b15c08881f4792b6c00f8c0822f8e10a386b13defd
SSDEEP 24576:CD3FHshBIYQgAooHjto1GFxlXutIs1WZX5AR:CDVHeBIAAJT/M+w
TLSH
T16D95F23EEAA900E4E57BD1BCDA538A06E77234A9032165DB06D0C1791F2BEE47D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-117-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/252-384-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/252-382-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/252-116-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/252-123-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/996-388-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/996-158-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/996-159-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/996-165-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1380-64-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1380-69-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/1380-67-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1380-55-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/1380-54-0x0000000140000000-0x00000001401B6000-memory.dmp

Download

memory/2516-72-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2516-351-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/2516-78-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2516-71-0x0000000140000000-0x00000001401B0000-memory.dmp

Download

memory/2916-292-0x0000000004CD0000-0x0000000004D30000-memory.dmp

Download

memory/2916-1-0x0000000002640000-0x00000000026C3000-memory.dmp

Download

memory/2916-63-0x0000000140000000-0x0000000140307000-memory.dmp

Download

memory/2916-289-0x0000000003370000-0x00000000033D0000-memory.dmp

Download

memory/2916-0-0x0000000140000000-0x0000000140307000-memory.dmp

Download

memory/2916-301-0x0000000140000000-0x0000000140307000-memory.dmp

Download

memory/2916-288-0x0000000002640000-0x00000000026C3000-memory.dmp

Download

memory/2916-8-0x0000000002640000-0x00000000026C3000-memory.dmp

Download

memory/2916-7-0x0000000002640000-0x00000000026C3000-memory.dmp

Download

memory/2916-14-0x0000000003370000-0x00000000033D0000-memory.dmp

Download

memory/2916-35-0x0000000004CD0000-0x0000000004D30000-memory.dmp

Download

memory/2916-27-0x0000000004CD0000-0x0000000004D30000-memory.dmp

Download

memory/2916-22-0x0000000003370000-0x00000000033D0000-memory.dmp

Download

memory/4184-48-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4184-49-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4184-43-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4184-38-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4184-128-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4212-409-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4212-407-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4212-414-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4212-416-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4316-100-0x00000000009F0000-0x0000000000A57000-memory.dmp

Download

memory/4316-383-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4316-95-0x00000000009F0000-0x0000000000A57000-memory.dmp

Download

memory/4316-94-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/4512-401-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4512-104-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4512-399-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4512-105-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4512-111-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4512-386-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4552-84-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4552-368-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/4552-82-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/4552-90-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4656-387-0x0000000140000000-0x000000014021F000-memory.dmp

Download

memory/4656-131-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4656-137-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/4656-129-0x0000000140000000-0x000000014021F000-memory.dmp

Download

memory/5296-156-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5296-143-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5296-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5296-149-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/5296-154-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download