13253f3186d3e08ea5fb8083a57c3b692e5702231b32ed492a2414863f29037e

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 3.2MB
Sample260708-ev3vjsbt8m
SHA256 13253f3186d3e08ea5fb8083a57c3b692e5702231b32ed492a2414863f29037e
MD5 b363d0147fb6a6af4c2c8e25da26f789
SHA1 9a7f6144ba5bf23c89eacc22823d3958ae3ddfa7
SHA512 92ac5fca0f0e5404a9a987f43f3fbcc3129f3ec2bc860cf3fb75ea01099b0c8a89fdef54176cb1f421caf8c0e30a46a90c07f94f62d906617b786490cdace5bf
SSDEEP 49152:2gZd02qItsVrJjyCwAeyfvE0Z3R0Tnxn1o2d5HliWS1SZBnHTAsi:pdvqItsV9gAeKtwnW2ocNzAz
TLSH
T1DEF5AF21B2918120E5F39370297EB7EA5B75BC256F76408F32DCBA390B725C09D35B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000001ca7d-2778.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables built or packed with MPress PE compressor 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c66b-2193.dat	INDICATOR_EXE_Packed_MPress

Detects executables packed with ConfuserEx Mod 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c66b-2193.dat	INDICATOR_EXE_Packed_ConfuserEx

Detects executables packed with Goliath 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c66b-2193.dat	INDICATOR_EXE_Packed_Goliath

Detects executables packed with Themida 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c66b-2193.dat	INDICATOR_EXE_Packed_Themida

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\mbamtestfile.dat	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File created	C:\Windows\SysWOW64\drivers\mbamtestfile.dat	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe

Patched UPX-packed file 1 IoCs

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

resource	yara_rule
behavioral2/files/0x000c00000001c66b-2193.dat	patched_upx

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe

Executes dropped EXE 16 IoCs

pid	Process
1604	alg.exe
4508	GameInputSvc.exe
4752	GameInputSvc.exe
5812	elevation_service.exe
5420	elevation_service.exe
3904	maintenanceservice.exe
3180	msdtc.exe
1288	OSE.EXE
3672	PerceptionSimulationService.exe
1400	perfhost.exe
5052	ReFsDedupSvc.exe
2248	locator.exe
6036	MBAMInstallerService.exe
4756	SensorDataService.exe
2472	snmptrap.exe
4252	ssh-agent.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral2/files/0x000c00000001c66b-2193.dat	ConfuserEx

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2a1efbf684defa61.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\mbamtestfile.dat	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\3932710c-541e-4fb4-82d6-a5ef1481bf72	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File created	C:\Program Files\Malwarebytes\e598d3627a8311f1996c4e366854f0f1	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\e599211e7a8311f1a0fd4e366854f0f1	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\8eddb2ab-f0c6-4a38-9b85-6c869298e146	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File created	C:\Program Files (x86)\mbamtestfile.dat	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5376	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
5376	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
4752	GameInputSvc.exe
4752	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5376	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeTcbPrivilege	4508	GameInputSvc.exe
Token: SeBackupPrivilege	5052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5052	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5052	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5052	ReFsDedupSvc.exe

Suspicious use of FindShellTrayWindow 14 IoCs

pid	Process
5376	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
5864	sihost.exe
5376	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
5376	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
5376	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
5376	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
5376	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
5376	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
5376	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
5376	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
5376	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
5376	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
5376	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
5376	2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 4752	4508	GameInputSvc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_b363d0147fb6a6af4c2c8e25da26f789_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in Drivers directory
- Checks BIOS information in registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5376

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1604

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4752

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5812

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5420

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3904

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3180

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1288

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3672

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1400

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5052

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2248

C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:6036
- C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
  "C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun
  2⤵
  PID:3452
- C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
  "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected
  2⤵
  PID:5956

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:5864
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  PID:2872

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4756

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2472

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4252

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:5568

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:2524

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2128

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:1508

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1644

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3044

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:4616

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2980

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
PID:5764
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:4392
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2049790993-2338060321-149346055-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2049790993-2338060321-149346055-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4680

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "0000000000000184" "Service-0x0-3e7$\Default" "00000000000000E0" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"
1⤵
PID:5180

C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"
1⤵
PID:1788

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
1⤵
PID:3256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mbtun.cat

Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.cat
Size 10KB
SHA256 9ceb410494b95397ec1f8fa505d071672bf61f81cc596b8eccd167a77893c658
MD5 8abff1fbf08d70c1681a9b20384dbbf9
SHA1 c9762e121e4f8a7ad931eee58ee60c8e9fc3ecb6
SHA512 37998e0aee93ff47fe5b1636fce755966debe417a790e1aebd7674c86c1583feef04648a7bc79e4dedaabb731051f4f803932ac49ea0be05776c0f4d218b076f
SSDEEP 192:gM6dynJCSEJOL7yKnUi8rFWQFIGjl8zjEswYt1FfRM/GX01k9z3AeOlFa:gqS4CFRWGjl8M8/fi/GR9z/OlFa
TLSH
T1B43208E1897D84C2ED87A87147E8E5977C3C1BCB2C5055A911ABF7600AA33C6E71853D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbtun.sys

Path C:\PROGRA~1\MALWAR~1\ANTI-M~1\mbtun\mbtun.sys
Size 107KB
SHA256 6903e60784b9fa5d8b417f93f19665c59946a4de099bd1011ab36271b267261c
MD5 83d4fba999eb8b34047c38fabef60243
SHA1 25731b57e9968282610f337bc6d769aa26af4938
SHA512 47faab5fff3e3e2d2aea0a425444aa2e215f1d5bf97edee2a3bb773468e1092919036bcd5002357594b62519bf3a8980749d8d0f6402de0e73c2125d26e78f1e
SSDEEP 1536:k0h5S895dQOYJaryTmbMc6uqkZUcmSl47AjpdAyDCYJqUufIfmNn3VzwZ6Dh7Q9y:C895uOYJar1MLcmSlrSgC6Duls2t
TLSH
T174B36C9DA1783089DE42A6B482B98793EFB4357A2B1177BF01E1C1748F537C0DB29DA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f7c731283fa90ddea72c4968b858e231f819b302616b900e8c16eea2dfb1721e
MD5 3f64c1744523cb629739c4739c8c94aa
SHA1 eca210ab1aae9fb5141d46a6551e55288ce7f5ac
SHA512 fb5956d1e89ff062dcc0bda4bf11a085ddd791c30d2596e22663af5475b1854d9c79596a0b2f1b262b58bda490aeff403b91d918aa909b6bdf025d52a5a1462b
SSDEEP 49152:pb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnaWS1SZBnHTAsi:/3q6gjBhcNzAz
TLSH
T1D6D59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 fd9bdb5b622618477f35e2e9d930a42f9715d1261e5747c547af40cb5d09e7ec
MD5 f1a6ae99cdca94604317a51098770f67
SHA1 e8d790d3048c48612e1f5481ef27e055411f2eca
SHA512 7f2def089720f13169b89576e334be1007f2d057db5c713ddd759b3f6e9a54ce688b31ce686249ec3d9ddce68d4a8aa52e44f79e8a2514104de65c426c806a62
SSDEEP 24576:6XYhztczAwp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:Ltc1WS1SZBnHTAsi
TLSH
T1A405F128A7E009F9ED574239C9A18405FB73B8518764E78F03E49A6A1F233DC5E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 ad122446a4edb78c161ef02dcedd6cbad5ccc2bb05fbfb4ab9123beaf49a8041
MD5 e103f56381c71904c979e1f86e1cfaa6
SHA1 853b424d9fc01cbe05685a5b98c1569f2c9bd012
SHA512 8ae0499b1fbf15e3afa49aff4696138400e7db11116dfe8bedcfae96ab3f330f9d90b473c0f8e7964ba229774fab2f8d93bfe3c0d74120aef09a71c31c9c64ca
SSDEEP 24576:UwusOWRp8SXdo8ke5i5Xh6wnBLTHTAcZQ:UwfOqWS1SZBnHTAs
TLSH
T1C805F14967A40CF9E99642398557C436F7F3B8122A25CB1F0760C75B6F33365AE2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 cd83fbebed7d6755cd2eaffc7cab8b1af34cd916db386e7a72904f9e8b7223ed
MD5 4df83c1a31ff65757d0dcce3dc643296
SHA1 65716d7a3de6ca3d43540aa766bc9eea7777e77b
SHA512 a658b244f53851b2a748544990ad17cb27c3fb2aa743c730dc36bc326c43b4eb3fb4d6663ad15a8d7994be8046a6a832450cec9624b88d2b0dd52174d9c3e674
SSDEEP 49152:+B+taZ3usBWOBr4tEGp0bqx0z+n217aau1gleWS1SZBnHTAsi:su6JmTxd2decNzAz
TLSH
T15CD59D13F2DA01E8D05ED478974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.dll

Path C:\Program Files\Malwarebytes\Anti-Malware\7z.dll
Size 1.6MB
SHA256 623e628393bc4b8131c1f4302b195429dfa67e890d3325ceaa56940660052b1b
MD5 4da585f081e096a43a574f4f4167947e
SHA1 38c81c6deae0e6d35c64c060b26271413a176a49
SHA512 0fe168bf1661691dbaa103e478dd7e46b476db094bf1938bf1ad12ddb8a8f371bf611ff504d2eb3ac319862444cc64a27ebee8735aa3752aa32a399b09427243
SSDEEP 24576:a9raURTF/5pe2g5RpBDxSjv9IrqLwRpFEDbt7y0MVoAAlzi8pY:a9hP/5petvSjWZR8DxO0mo5M8pY
TLSH
T16F756D5BF67400A4D5D6C034C5276B1BEAB1B88B8330A7EF12D15A6B6F13BF19979320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Actions.dll

Path C:\Program Files\Malwarebytes\Anti-Malware\Actions.dll
Size 6.1MB
SHA256 d513f3a50ec070bbd74f78d27d79b6cb60aff48310283c74ebeb204aacf375a4
MD5 923a9fe2404277f490bc959493f48e72
SHA1 563c8dcc7adf7fcd2c706be7ac56ed79c52aacf9
SHA512 5bdbe65ffd24380d423c3d2bef220e29c39622551edff942f643e79e50ea582439b9e7e91387ef020d44e2462721dda089a83566c76ba1287c2dd917e4fe4194
SSDEEP 49152:v9x1737qVRJXwMb5WOXz2aXjAr0dcOyccpFZckK/xjDzBE+WjYFJWgP4FNJe5RRe:X97ELkwdchTNOAjYFsG4EGmzqZzhaa
TLSH
T196564B16A7E801A4E0B2C178EEF79103EAB27C255735CBDF0590525E0E73BE09A7BB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ActionsShim.dll

Path C:\Program Files\Malwarebytes\Anti-Malware\ActionsShim.dll
Size 3.7MB
SHA256 6c5047cb77ea843e8386ba2b26a8458e6255e2ab94d493e914620623723c6b32
MD5 33617cde11d2bfcef47faf0d5ce3cef9
SHA1 2439b5f0622cd539b6f6f2f87d78edba466299ed
SHA512 ef909e5e6a695a0f2ae95621cf87795705b3d267ea7d1c82634faeff3a4e3b111f5f809cd9e7dbb71d588d6106e0b54c138364f99ba41c7c5d47cde9af1b753e
SSDEEP 49152:SH0QptrM88LLHy9nqSk5n9BT1vAPZmbLMo7JTfYkwZdPHFszUlE3JqCx9R345GEm:ktro8k3booBovlE3JqCx9R345GEzul
TLSH
T16E068B17EB9540A8CC6AD23C855B8607D7B2BC25237097CF17B462AA1FB3BE1523E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowserSDKDLL.dll

Path C:\Program Files\Malwarebytes\Anti-Malware\BrowserSDKDLL.dll
Size 2.1MB
SHA256 ac22cbfcccf2c2bbcbdc49736514b7a33f3e8a2e76d2edaa2c18a2706f177637
MD5 21b6ba13c76e2452c609708af3b51c13
SHA1 361829ee991dd13f7ce438b09facc4e1d142e9c7
SHA512 7d166e667fd253d5cc5290a31055716de2946e4a4b6bf88d1fd467d0deaae2e36673f760e5c5a567c7e04a8aa95e05bccdb3dd6d6aa87548cf7c4eff21190131
SSDEEP 49152:8VF1SVg1db+wMSI0nW5xjpvypuDYpsD0VXZTWi:s8TeZKi
TLSH
T1EEA57E5AA2F800FCC0BBC1A8CE569507EBF274465735A6DF05E09AAA5F33EE0157E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BrowserSDKDLLShim.dll

Path C:\Program Files\Malwarebytes\Anti-Malware\BrowserSDKDLLShim.dll
Size 2.9MB
SHA256 8d9ff4cf298998be12da902e1843f4387e58ff6987c1e374f7eb3c776c2d8329
MD5 8fbeecf46f3e1de8dfd3d6bd4dd07b2d
SHA1 2390a336e18e186ccd02eab55c434b24ab311560
SHA512 0a167b94477338c77c36107e7f8a8a6a6fe2f1db751e62a22f31cdda4a3c425bba142f33f60244b0ef932e2c58920dcdb11b89825c311a135ec29e58627eb967
SSDEEP 49152:aHENZh/xwXNNnfFEXqGW3nILlpqCBS6+38Q/h0oYEaF6r+jep6Plw3zU9:TOX/xPb/aomGI9
TLSH
T1A0D56C57A79941A8CC6AC23CC55B9203D7F2F826537097CB1AB856B90FB3BE1123E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CleanControllerImpl.dll

Path C:\Program Files\Malwarebytes\Anti-Malware\CleanControllerImpl.dll
Size 8.7MB
SHA256 d85916bd0b4ef3f1aa9abf108d0f6a9541b0ff690fe71af8fb90dd4139f411a0
MD5 8a8f67c8ba548aa10ea7487df93927aa
SHA1 6d8655192e857c5f0ca42ba41dd35a866d793c60
SHA512 ecd6ee84c2f0f14fee86c1ef285608b09374203b72279b4812618860d29525818ff89d36ca0e66937318ead393bf619c7a4c8d49ae6d91653845837018a5b55e
SSDEEP 98304:yzyEQ2D+Lbhak7wUBLCGJeUDutjCa7TtryqnYW0mhDMpw:r2D+ok7wUUzUDutjp7TtryqYbCD9
TLSH
T130968E5A66E400E8E4F6D178CE678503DBB2BC551731D7DF0690966A1F73BE08A3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloudControllerImpl.dll

Path C:\Program Files\Malwarebytes\Anti-Malware\CloudControllerImpl.dll
Size 6.9MB
SHA256 71b6312c8f6bd8e62c7f766ed56dea99f9daca0963039128ba11e4b6842b0922
MD5 8a15daa8a9ea233265e4dbf5cf2cd9bf
SHA1 08cd446e2148825fb3b6bce135758b264107284a
SHA512 6741c89bfb611dc1790116c7ab6ddad5726c68aa22a53921281f0f8ceac6fe02b044b58992941cd3fe997f65880513b853303f70fb4c3496bc71b782ef54ab9b
SSDEEP 98304:mMoK/6tfchVTu/EKdD3fcXJv9tzjfalW9h/PR:voK/6ZchVyEKdDPc5v9tag9/
TLSH
T160769E6BA6E400A8D8B7D13CCA578503DBB2B81553319BDF06A4967A1F73BE0573EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LicenseControllerImpl.dll

Path C:\Program Files\Malwarebytes\Anti-Malware\LicenseControllerImpl.dll
Size 7.1MB
SHA256 14d0f6b8a3c404e7773458b731edcde63a94f3f09adf2489ff837e0e3b9f7098
MD5 fced76fd9efcc97dbfe06c4071ed475a
SHA1 adbfd23a4fb7848d9684eb66af5d907cfa090643
SHA512 ed4bbdbfd89b90ac2ec21ba202774e2837079aef9cb93e0e0a19196e3c38163f355ab37390507859fc084ea26c64ca4d6977374f93abcbb3d0d4e7af7f8255ba
SSDEEP 98304:geZ10ipuowSwUdI/xFf6ehXvat5LKnCJ5lM96R:/j02uowTqI/xFf6SXSt5xd/R
TLSH
T13C769E6AA7E400ACD4B6C27CCA678503D7B2B8154371D7DF06A4966E1F73BE0963EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBAMInstallerService.exe

Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
Size 10.6MB
SHA256 d10e04217f81b44667c6237971f1f2843d132220c8712e8a855436e9f1f73baa
MD5 cdd8c06c1f88f57727813906e3a58fb5
SHA1 4ba873161c0ab0f489bb0c82a267aac8b0cb91dc
SHA512 40fb64f723481e9b8e24d88edff74dbb85b2e63790595c067b01cc5986ac3a0fdeef0d8083e4c86c0e2681837cb53eb98e7bda2bcb22eb77d1b8330e2d72ef73
SSDEEP 196608:PRO3j3Ld/5Mo9/vEvt2teG35tTdnXo9076gZCN3R9i:PROT7d/6o9XEvt2teG3p42Yi
TLSH
T10DB69E17A6B400E8D4F7D238CA579A03D7B2B81643B197CF0690567A1F63BE19E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBAMShim.dll

Path C:\Program Files\Malwarebytes\Anti-Malware\MBAMShim.dll
Size 4.3MB
SHA256 dcc714dd199d9768faa0ca212e63efe63caa8aeb4cb11487fa389ff59f6cf98d
MD5 5be75744f4065e88aeda92344b999ada
SHA1 48347bd7c99adf4e1c8407c0f56b2017ef8e5525
SHA512 53cba40ed9450dc83c8fc6e522b567884c1a7b858f708930f164fb5eaafb4d6972625eeb35b7d5d01d754f7c7af7727ecf08efb37de6541ec637021fa06c6613
SSDEEP 49152:+6s9rQzE4CYJQEw34L4lvXYsFFXBulqfCbLqmsc/6ZeFYpA8aIJammPsQzUOu+/x:rs9rVzYJGrsSCbvyg8aeTO/Z2JgH3
TLSH
T138267D17ABE801A8D87AC23885A78603E7B3BC16077097CF1A64557A1FB3BD15A3F714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBVpnTunnelService.exe

Path C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
Size 4.1MB
SHA256 a67f94a3014d93b9b91f0c8427c81cc18cb13239a114d91c51f993702e60a580
MD5 88138b3ddd9b2800ea155743aa26fe87
SHA1 0b45bd01e388bf4821a3caa09e78033588f66667
SHA512 4f2f2f04c1b3c1d55731d7dc55fa3ee09385b8f77084e79ebde5252242008eb3362beb9b50b3ea8934acc471dcef67763f20d5268f6cb18bfb98926e4189c3b3
SSDEEP 49152:0JxO5tmuSoHE4RtMMoLPqf/nkMq1BmwlxMOqSv6bi36i6X43jtPQ6zU+5pAqIPIS:8Y5tY4RMk6lxMObN6/tbH
TLSH
T188168D57A7A901E8D8A6C23CC4678603E7B2BC151770A7CF0664627A1FB3AD25F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PoliciesControllerImpl.dll

Path C:\Program Files\Malwarebytes\Anti-Malware\PoliciesControllerImpl.dll
Size 6.1MB
SHA256 cd1e8f98551fb69d3d47837c09fea35be358dd7c27104afb7f1938a7fadbb2c5
MD5 436a5828103f6874dda5ca0b32e8e8ec
SHA1 7a5346221f40349881a65df91014114b1644c8f8
SHA512 a4ce868855d83ad112b528a4969e5a5f79a115eb92f9e3ef1f05eb09f7f39c099abb162bbf2024b298af715560d81d9f08c2457109d7b2b33c04dff9789dbd05
SSDEEP 98304:at69nEVAZKwY4Lka7NrGWeG0qwtEQ9VsAwbB:aAnEVmKv4Lka7NrGWJ0qwtP749
TLSH
T1C8569D1BA6E800A8D8B6D13CCA978513E7B2BC15177197CF06A4967A1F73BE05B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScanControllerImpl.dll

Path C:\Program Files\Malwarebytes\Anti-Malware\ScanControllerImpl.dll
Size 6.9MB
SHA256 f41c5a9754861fd06b05470a267fa9d6f801a0dce1834ad36aeec3212458841c
MD5 b1c32661f9f9b9d5c5ff2af1a10cd5b1
SHA1 ba17ac33a84aa99cd31c64c95d890d9d13a71571
SHA512 d7d1f0fb8a73c66a8c0276ee4686082bb6bea58045119ea0df2abb0595b021c7621beabfaedad4b3a602b4db0ddfc73748e3208653f5fb2ccdbc5037e43caec2
SSDEEP 98304:yO/wKetReiN+GTqOAbAgLq462dW5ljsN2OXRYwLiiE07pAQhh2HhFaxLzs:yO/wKeIXlLiiE07pAQP2Xaxs
TLSH
T10E767D1662E401A8D4B6D238CEA78513EB73BC554731D7DF0660966A1F73FE08A3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SelfProtectionSdk.dll

Path C:\Program Files\Malwarebytes\Anti-Malware\SelfProtectionSdk.dll
Size 768KB
SHA256 adb320971c4e2384e9754f12676cc6f94d5e58f156fc1a74f051c1b986499722
MD5 2c93d5fb5232415a75b957bb05d9ba70
SHA1 edc30f9bbb449cf39c427da196609bb53217536b
SHA512 3a2930e504cf96418eda0ff714ddb3fafc7c853dd69f2d408749d0ba3a895fcec3c65b23b967d90fcf951e62d6b3fed650af50d22a02a51997b235af7c32e5fa
SSDEEP 12288:He65xXlBeW9jjXLv2YpbKmRj+DYVZnKVhVVRCwHY84/wVBd:HeYHBeWNRtRj+DenKrNCwHY84/4d
TLSH
T18DF43C1796A801FCE07BE27C8A46A507E7B6B41A53716ACF0B9485731FB3AD05E3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SelfProtectionShim.dll

Path C:\Program Files\Malwarebytes\Anti-Malware\SelfProtectionShim.dll
Size 1.7MB
SHA256 e73a44cd76df665dc988b126e2e00770365025129c995e298b51191c5d98ee8e
MD5 dc6ef2120de8e060f2b79efbf5918cd0
SHA1 ec096dc6f3b112e145f9734c0aacd9c21b5982a7
SHA512 4af393f2db6d6ba49293c3b872101241a9e07090036b924ead73bd1d84fcf9b888aee8fe2fb05d0222bd54530570e7859043a3f3260f98493dcd223ec3f1746b
SSDEEP 49152:3EWWy/r6DbXWDWVZ76nXsLLeLWRBKI8GUfdd:0fXWsDY3dd
TLSH
T1D4857D6A93E801ECD47BD26CD645A507D7F2F4165370ABDF0AB84AB20F63AD1663E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ServiceConfig.json

Path C:\Program Files\Malwarebytes\Anti-Malware\ServiceConfig.json
Size 621B
SHA256 8202edf6e6f51ad8df31987c5bf31d86d14b1d90b243079cce78f2e963238b48
MD5 f0a226f9b957efddf090a09b0b113267
SHA1 b4407a26db151916b315f324898b4e1c596f2fad
SHA512 1111ecdd9aaae5f3cc71696af6d8993a728e4e3c8ad311904d87ac49189a044d1eb9a954e25ed44a537d486e927ede77932d6d6e3c4ed7b82013edef2072623e
TLSH
T1DEF0AC12E96F42FB59B10BD882640487F724936E0215590FB7F8FE90DDB3C38AAD2C84
MD5 SHA1 SHA512 TLSH

Submit Download

Swissarmy.dll

Path C:\Program Files\Malwarebytes\Anti-Malware\Swissarmy.dll
Size 5.3MB
SHA256 9ad52208d95d536dd1dd77c9bd118c7ab0fffc795a4f0875fa608544d30bb931
MD5 60d217257971f73714b8c5e398d461dc
SHA1 9906053f88d7a409e8ba874aa9f66e5ead73c961
SHA512 8eb3304e904af5847c6b2cab99d1d3690b5b239fbe85467d164ed29a714f029ec163f467a7bebcc80e156e0d291436306145a2ae68766613f5a6b30f316b0250
SSDEEP 49152:5LG8qKNFeojCOg33h8pRdPSDIGRmqiZBmdWZyKYbHkEAoXvEPj8QF9yllBpP9aze:Zfex8pCIQbWZ0kd8xTdNhIcPz
TLSH
T1E3469D17A6D500ADD8B7C278C99B8603D7B3B81553319BCF1A64522A2FB3BE2573E701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SwissarmyShim.dll

Path C:\Program Files\Malwarebytes\Anti-Malware\SwissarmyShim.dll
Size 3.8MB
SHA256 7b7bef24ae682aed60edf136ef817d60b7b1a02e3ad3f86c7b820cc502e4edce
MD5 07a16e004bdc32df788c0f7144526105
SHA1 de6cb075bc813f25aea014eba71b1127299da2e5
SHA512 c0f2db7f9dc6b7e5575f4a7b5b5d60aa032777e3a9994b534651317326e4ae6721527422d9001fac8cf4280fc7876dd8e1f321a7ee65e3394417982b0373687f
SSDEEP 49152:s5AWJyZyVe6ZGVE96H+KLNjU1BWIaDLwOx/AJJKFS7JkC3zly0IPLRzUgT9dmR:bUemgTTwOCJJRDqyg3
TLSH
T100067B17E79940A8CCAAC23C85978607D7B2BC127770A7CF16B466691FB3BE1123E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TelemetryControllerImpl.dll

Path C:\Program Files\Malwarebytes\Anti-Malware\TelemetryControllerImpl.dll
Size 7.3MB
SHA256 d783c0ae649b6d267c330c3c9d613d4c5ab09bf1f594598484da1760f0b16e4b
MD5 7a1b3a54f39392375078dac7b2822ad1
SHA1 7008531c23e7f266e9a94b20bf98f8038aca5562
SHA512 518aa3b5060ee69f6d46cdc0ff5142109a1129b7b3481243a2291114ac436b2235d0bd6498a527a25686cf6901bfc3cdd2f5caa7d319e794eb587fa03b55d759
SSDEEP 98304:MJrBHlha0hhvIzoMzMk/Tm78Wi6bPtBrtkXb4:MJNDa0hhvtMzMk/TmQW5bPtB5Wb4
TLSH
T147769E5AB6A400E8D4B6D23CDA578513D7B3B8254331D7EF06A096791F73BE09A3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateControllerImpl.dll

Path C:\Program Files\Malwarebytes\Anti-Malware\UpdateControllerImpl.dll
Size 4.5MB
SHA256 058befee7a55f5d8510de91f4746053fd49393f2f1843c4f090c3dae60d7d540
MD5 150ce3c5de43955af87ef53f51c1c866
SHA1 43cbf73c227e208bd2f601c91a27d58962f08e51
SHA512 20855a4289f8985ffa840d00819efeb2d2f076fff7507f695cf1a3f6927a7b48cd85285e62ca8d25cd4d2593b00b6614c5bc88677cfb8b933f8138b09a9b48ee
SSDEEP 49152:lzY8o3OtUDkkGEVl0QFxd/X6LCzqlXB9eC24aeZSRBFZ24uFpei6tyP/ZNZoyP++:2en6yQIV2ZOFoxtFlwGYT
TLSH
T19C269E17AAE900F8D8B6D27CC9A78917D7B3B8150371DBCF169082691F637E05A3B724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbshlext.dll

Path C:\Program Files\Malwarebytes\Anti-Malware\mbshlext.dll
Size 3.1MB
SHA256 8af36217efcc1b2a677accc77839ed3b67ddbfcabfa16caaa42c7e95796b940a
MD5 d82467d25954c9fbaa91ca97e0de6834
SHA1 d7da2b4f83acd0d2aaf55de2ae403fa6cc44bfc6
SHA512 84a38b2d4a1b23439f4c6eca1fc148d618effd1444704f37e5812488877d15789b603944231281299ba332dbd0d3a0e51160c588c0adc1bf338675c62da45aa4
SSDEEP 49152:zHsR0cmbmDszn14AcKLfC659mLVD+Bjmo+2g5rCdPWD8i51l3z:zHBpmj2Am0D8g3
TLSH
T169E54A227A9540ECF866A23864FB8502F6F27A05236097CB0558727D1EEB7F106BF7D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbtun.dll

Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun.dll
Size 2.8MB
SHA256 f21a980316bd4c57c70e00840ab76d9ad412092d7d2d6a2cff4f1311f7c05364
MD5 2bbf63f1dab335f5caf431dbd4f38494
SHA1 90f1d818ac8a4881bf770c1ff474f35cdaa4fcd0
SHA512 ebb9834323329dc01ba2c87e5fad1083a4cb86f5ed761cb63299ac5336a9843a1aadd42fbed706797c2295117af1c00f96806422338352653c8e0255fecc2fd5
SSDEEP 49152:xNrdEZjzdAj9fdc4fDrN1OxOh5PgqdnBq30yPFZP7KVxSL:bBzFRkshaZP2W
TLSH
T136D58C1AA7A800A8EEB6C27CC6578603D7F2B8151771ABDF02A456791F73BE1173E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbtun.inf

Path C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf
Size 1KB
SHA256 4a350fc20834a579c5a58352b7a3aa02a454abbbd9eecd3cd6d2a14864a49cd8
MD5 5d1917024b228efbeab3c696e663873e
SHA1 cec5e88c2481d323ec366c18024d61a117f01b21
SHA512 14b345f03284b8c1d97219e3dd1a3910c1e453f93f51753f417e643f50922e55c0e23aab1d437300e6c196c7017d7b7538de4850df74b3599e90f3941b40ab4a
TLSH
T1CB4140BD48D20AB83C673356671B69C27BDC220145C920ADB2DE8606C88EDDCB905EB9
MD5 SHA1 SHA512 TLSH

Submit Download

offreg.dll

Path C:\Program Files\Malwarebytes\Anti-Malware\offreg.dll
Size 140KB
SHA256 8e6c155a97666c8e6a3f9ea95bfc6f6e4f87beac53dd72164aba3ef33ff88db1
MD5 1659738d57a15a0983f0373b2faaef45
SHA1 efd4cd05ff6bd787a2ceabfd11daba1c0e475855
SHA512 4f62cfe0579e1aeeeb30edd5f42a2b1880446dd1075be051e2e0189da5071f9866e5425ff85547486fd7d952a28efa4e784db0cfdc1fcc428b34eaa89c6a7654
SSDEEP 1536:kXNnhdTcQOCr7LClg5lSYOurIt/0q9mrf0Xp2N7RibuQusR9YfIZRoU:cnXTcQ57LClMlSYA0q9mrf0XoNHFQZ3
TLSH
T111E39D5A73B420A6E8678678C569875BE776B162232087DF12E5C6B80F037CA7F3C345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkgvers.dat

Path C:\Program Files\Malwarebytes\Anti-Malware\pkgvers.dat
Size 78B
SHA256 c4f434b5e94c09c5a94d611d792f1fe17987ed09059a85300d938c60fe6a3f3e
MD5 f10915110ca27272da7753393a83cf5f
SHA1 6f459f3b4fccf67dce478d2f12ba6e7b683d39a8
SHA512 e519914800981d60abe2d8949476a4d6a3bb6f6a0ce1fbf2382797a1e79f12c444b7d2b6ab281202efb3f8a8b0dc4d77d2be380019fde46fb7516f808afe4d9e
TLSH
T1C1A01120800C030028AAAAF0A0B2E828320BAC2828C00F00AABA02A20A0202022080AF
MD5 SHA1 SHA512 TLSH

Submit Download

7z.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_e599211f7a8311f19a2c4e366854f0f1\7z.dll
Size 1.6MB
SHA256 bb01c6fbb29590d6d144a9038c2a7736d6925a6dbd31889538af033e03e4f5fa
MD5 3430e2544637cebf8ba1f509ed5a27b1
SHA1 7e5bd7af223436081601413fb501b8bd20b67a1e
SHA512 91c4eb3d341a8b30594ee4c08a638c3fb7f3a05248b459bcf07ca9f4c2a185959313a68741bdcec1d76014009875fa7cbfa47217fb45d57df3b9b1c580bc889d
SSDEEP 24576:29raURTF/5pe2g5RpBDxSjv9IrqLwRpFEDbt7y0MVoAAlziG3B:29hP/5petvSjWZR8DxO0mo5MG3B
TLSH
T175756D5BF67400A4D5D6C034C5276B1BEAB1B88B8330A6EF12D15E6B6F13BF19979320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBAMService.exe

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_e599211f7a8311f19a2c4e366854f0f1\ctlrpkg\MBAMService.exe
Size 11.0MB
SHA256 10715f7321fcf50ee7a7cbdeb46035634c3aa4bf314cfd02a0aa1c16d34b0669
MD5 9bc69b5b9a0e208b10c827d293d082cf
SHA1 ab4c6057954ab6fc9876bfecab7b4c984b5767d6
SHA512 624f7ca43962e8d480aa3f538ff91dd6c777399cb77c4b2624effb8ade932eab4d7c672a6cd4ce5bc90e6af8da0d59b22d16bd54b23af5bc22b0d1fdda4c9b75
SSDEEP 49152:tg9H/qoiwmX7ldbnb8hYI2PFgevvF+20DlSFBqgAK/wj5BykfcTpniZTHebm4Cy3:sHUD52ykKnZViQ43TLh6400HzPFC/a4
TLSH
T101C6F606B7F951D8F5BAD674A97B652AEE32BC618B3083CF1150560B0F32ED48E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MBAMWsc.exe

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_e599211f7a8311f19a2c4e366854f0f1\ctlrpkg\MBAMWsc.exe
Size 4.2MB
SHA256 7878a9b10903b8c0def49015deefd48a3ea0e46c0f5ac9ae755336994e020152
MD5 acbb82943fe0d5f1c5df74b1a7dccd2f
SHA1 c41e38f59eff5e40a6a47b14be44520dcd6d405a
SHA512 7092748502f06bf05df19bd2d4d5857f161a35a9b2e3a72645eaacffacae7a8dad10ab41ad3b80d3a63ff0773b6c818edf3769ce6b1f61b01cc92edfb755dfc5
SSDEEP 49152:dK5b4+V1qsR86LMFRbbX8DREqUaP7bBfnuF0JRlnPkokPmsBLdS4BPQRzU/81fge:i86kyaHF0JRlMhBpMyok3M
TLSH
T1C6166B06B6A540ECD866C239A47A8503E7F2B811273097CF066853761FF7AD21EBE7D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Malwarebytes_Assistant.runtimeconfig.json

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_e599211f7a8311f19a2c4e366854f0f1\ctlrpkg\Malwarebytes_Assistant.runtimeconfig.json
Size 559B
SHA256 ff0c15737963951550db7cc1bb116e49cb15c61bd93c61ac1861bd8e12efb61a
MD5 e9420939afed10ab831746dc22ef813a
SHA1 773f27f2a98cb5db97d26e65b992a653c2a07ae0
SHA512 a3285d5db3631bc6a3438b03412f1f8aff03102a3e3e35736df207af066e936fdd2c84d85d360fa7cff33ffb786d84220b47888a5c0288c88e203f243e7cac5b
TLSH
T11FF05969CA106DB708F9737AD12AC083EA30572B10002C56B4FC080C2F776B62121F95
MD5 SHA1 SHA512 TLSH

Submit Download

mbae.sys

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_e599211f7a8311f19a2c4e366854f0f1\ctlrpkg\mbae.sys
Size 155KB
SHA256 c990dd89b65d35d6c9b34e21c78d96e206ec3bcdd934716ee61ff79da0fa5251
MD5 fc98ddab2223dc73b950622801b31554
SHA1 997faaec1dfd18b9dd31e1c216440a28bc4cd612
SHA512 da08860f8c3d8a9204d1480f33d21f2ab922db5cbbf7734527ed05477c2d9c184deaedb63196876c989c9ff6c1b45b5792661f5bce92212992a7cdb664a793e3
SSDEEP 3072:hcj/Hk4/53QBvOP8JsUrLx1o6GwzfwKYdkXEnU/H0KBJT2:hc4wNQBvOEJvx1o6GwzfwZqEU/33C
TLSH
T1D3F36C52F3B400F5D8A6C679DB669213E6B2780D2721E7CF076085252F673E4BB39326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbamelam.cat

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_e599211f7a8311f19a2c4e366854f0f1\ctlrpkg\mbamelam.cat
Size 11KB
SHA256 64416d564725416c6869ea951878a2734b1f6940b11f7961a897c45f0d8c6625
MD5 bd4ceae54af081d6b1dd91ff584c5d61
SHA1 5ade462d66e042da58bb1447d1b31f1aad901b68
SHA512 37e7abd312f694ee2c8ea54ecf50ed12c16684f1007c61d9a6d1d01cba958be511c5e4e11cd7393a5cd57349fda1c552bebca42962137e0d11695c195761ebb0
SSDEEP 192:oBxybp/yRpJCSEbhLxyKR/2FWQFdbiI/Ex6RMySX01k9z3AgEhrZg:oLp+eFRvmoMR9zJug
TLSH
T11A320AE58A6C5083DCA7AC6087E8E5D77C3D67C71D00987921DAFB5409933CAFB2816D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbamelam.inf

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_e599211f7a8311f19a2c4e366854f0f1\ctlrpkg\mbamelam.inf
Size 2KB
SHA256 e26c2d3347e5f077da92713c9df3cd3eae438fb7e29810bd5c3afe567d2d3125
MD5 5d8c05cc4f9b4304d57ea10b87f2dcf0
SHA1 2cabe3d39aa5ec16c54c7818284a2ee235d2ddbd
SHA512 55bff23fee9852f229246b71721b3659c916079787935d400a97641449dfda752fc8fbf36f9ea3dc4028f05daeb9006a99660284a61aa5d5a466af0ee966c738
TLSH
T164410454AA538BB8697B35B81E472883BF5412205076384032DEC8C99B6DF0C93757AB
MD5 SHA1 SHA512 TLSH

Submit Download

mbamelam.sys

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_e599211f7a8311f19a2c4e366854f0f1\ctlrpkg\mbamelam.sys
Size 21KB
SHA256 ded569e249e590314d095f740c6b8934a5a797e4f3edbe0f78eac9d333f12a2a
MD5 8da81aa1f6b89ce1d2e216e3ea351c59
SHA1 4baf79cbade9a5584630a540e6368d547579fb12
SHA512 6d611bbd9d480ef2defd745fd06c4ab86e181267cf689d9d0e124edbaf22fd30fbe2310879cc7bb6dde5bae72c4feea1d329cdecfbf101d95634f85dd0769119
SSDEEP 192:C7IlO/ZnEc+PbYv6/i0RtPH920QvVUKjnegqdsW++w/y1wVWQ4uW/+O68RwX01kd:wIlO/i8ChLIxUKjnev6+Twc69R9zING
TLSH
T108A23B6549780283F6BBC570C7E4C927BD38F39677408AEB0591E5681DA37C2AB3192D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbuns.exe

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_e599211f7a8311f19a2c4e366854f0f1\ctlrpkg\mbuns.exe
Size 2.7MB
SHA256 0385b06957b7f5b2c3c7132f8ebd8414f64f00407ea2baf07acbffa8d6eca334
MD5 b2416edb738fa965cc0d0405322a24c1
SHA1 d09de4354bafc2026084c1d3a8f59514a1d430f3
SHA512 a4409884cefb389bf12f2f8ab2f0b74539e1a1c8b63f885728f4424091886450facf4e18e137bc6e5cb1e92329957de57099ad04c0433e9a4bc086e5a1238a76
SSDEEP 49152:yg9zAA9HY7oomwAeyfvE0Z3R0Tnxn1o2d5Hptj4LC:BdAA9HY1AeKtwnW2f
TLSH
T112D59E31B2D18020D5B39270297EA7EB5B79BC256F7640CF32D8B6390B725C0AD75B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

srvversion.dat

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_e599211f7a8311f19a2c4e366854f0f1\ctlrpkg\srvversion.dat
Size 9B
SHA256 b3e9c3ae109bbe9c08500dc2caeee7ecb59dc2f0737baba2133306ecfa3e7fd3
MD5 6d78731a933c88778ea4891954ba8aab
SHA1 2aceac7331a21c1929a5fc2c66fd4a9cbfbf3889
SHA512 6b039f66cbf5c7a82e6e68f791e56dffc429e8df6ac465055185dd6c3b683892ca3442f47778324d771e3f29b0d712b0a4ec08115feb1ef191316a13b7e82440
MD5 SHA1 SHA512

Submit Download

MBAMCoreV5.dll

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_e599211f7a8311f19a2c4e366854f0f1\dbclspkg\MBAMCoreV5.dll
Size 8.7MB
SHA256 15ea0e58a63840c705681cd9bdd4024d347816f99e5bcce7194b475e27f040b0
MD5 ab40a369f9e8bcb02ff6b9bc50eef776
SHA1 e9948cca99f31f3c4570d90159d998e4b9e229a7
SHA512 b75fccd077533d5eb5ecf14c911978d844d637f5ad0eb9f25dccd39543ffbaa10590091dd67113bfe60fe22d280e9d3a1ffd648c45fc6a769e5d6748ddd43a49
SSDEEP 98304:pl8GfUDU2vmrPfU7fWGl1oPvBtFuIiaW5iuewLPQzL:pJfUQ2vmLUuGl1oPv7FziquewLPQ3
TLSH
T186967B2BA7A400AFD87AD37889EB4502F672B811537397CF16A8A1761F637D09E3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.version

Path C:\ProgramData\MalwarebytesTemp\MBInstallTemp_e599211f7a8311f19a2c4e366854f0f1\dotnetpkgtmp\shared\Microsoft.WindowsDesktop.App\10.0.8\.version
Size 50B
SHA256 42559a4970a981aa61f3ed59ad44d05214fcc5eb97c35d06a88102a0b747a45f
MD5 9072ad106b74f3900d25ae80843c8a24
SHA1 b664a23dea5a5591c21fe0f4a9b5f344079d94d1
SHA512 ea866258bbcccc0951f95367f3309db65d437ad27eb6fcbdfe12e08b9f76265050d6216091b89f0dc92db66b24f8238c8d6cc98ce49e6c3bb6b051ee037e56a2
TLSH
T1309004444445D47315D3313453015154F00C5D3C5D34CC11D05F707CC4D705CC55C301
MD5 SHA1 SHA512 TLSH

Submit Download

LicenseConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
Size 12KB
SHA256 0837b5bd24a65c2b82d6beb13d09964c7892ae0eed1f117d8e60fe9c5b9e66c5
MD5 7b7f22a775b687552669380722b384e1
SHA1 4177c7560f984ed040ad38f9175f0655ee95c824
SHA512 4c7fa36474e8cfc90eacdfc8c84d094da1922c4bf65603eaf24f7f92b3c81f2b3109b1284d58a1ec5065ca6146aae55957fb13573244fe6cb43d137c0fbba1b3
SSDEEP 192:fDmf/FYgVMzhrgHTb0MAJUKfVgH8BZ8ZFnPx:rmlYgVMzhrgHTb0MAJUKfVgH8BZ8ZFn5
TLSH
T112425327D1B5AEBB66FD613661B40782F364C75F08414C07797CC88C4F7BD2A62C2AA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LicenseConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\LicenseConfig.json
Size 12KB
SHA256 2e59781f10c4ed9050d68ae54ba35fa0984805eb1af746be054bbf2025466b88
MD5 ac93a32d9bd0d35a567fdb504fd7dc5c
SHA1 409ce827ad2ad6f06b369ace403c281736afb729
SHA512 8557024a11f25746b4c6546edbe7aed78e91bda9f5cd36aa77ce8f9f48279ce8a9dbea1d527f002a4e377eae90da447668b2e2292cbd2435eb69b3e951807ce8
SSDEEP 192:l2mf/FYgVMzhrgHTb0MAJUKfVgH8BZ8ZFtdPn:smlYgVMzhrgHTb0MAJUKfVgH8BZ8ZFTf
TLSH
T189427426D175AEBB66FC623661B40782F364C75F08404C17797CC88C4F7BD2A62C2AA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PoliciesConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\PoliciesConfig.json
Size 814B
SHA256 5a4ed19eaf6c069f645fd8774e0e637138332fa590c97e184b9d2a18802ba1c2
MD5 5ed41df6f714b9c2dd886f4058127e09
SHA1 f8c6b502d96f8de3957f931448ebb3fe160e00fb
SHA512 f972548eaea42aad2a690508153ff4c13b88e619a8fdfa71b8e4055dcd9066e9a3196430c47796636b06bca78b6e13cb424faf20642c917d5fee79f7cc018153
TLSH
T119014766984480FD297C416C8227D8C2F3A1875A35191C2FB7FDEA0DEDB7D3B2486985
MD5 SHA1 SHA512 TLSH

Submit Download

ScanConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\ScanConfig.json
Size 5KB
SHA256 c6d44f784ff49e0d6cfb7633a87266339c0123878501748d53cfb8d8eef60073
MD5 3010f61d846b9047721489af5c9ca9c0
SHA1 e3fb969d1d633af9639fa24ebc246d14e4e2ebe7
SHA512 a611f8e13791182dcd7ab39446915271797984961de9ca5e8ebb65e9807a7dc4617d0faf00d8c1c39d2c15f081f21772e7c6d20742fed8160c273bb963a32a84
SSDEEP 48:8T5JtUmVSfKuGQf92Es1kV8ENFmduwtp8qXKeWQX92MEnAf3wsaA:gZOfK5k9JykfNFYfrXKBs9RsAf3wsaA
TLSH
T150C17B16D9105CFE18B8E25EDC288186EB2083972202186FB5FD859C5FB76333686EE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TelemCtrlConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\TelemCtrlConfig.json
Size 1KB
SHA256 9f9f8d90d3cc932c47087f7372c1b37d6b71a0bba02dee30ecad91c23ab8a8c1
MD5 8d3daebd4b1aa57d20b5158cc3a08541
SHA1 847e2375e478473e14061a91efc1bb88a0c8845f
SHA512 e33e9bf11b1c533bf6d4cc5c49ba1fd6c287694cf810daa44ee1c5f0e068c9c2082934d46159435fd3639bb58bef2d1047d55c4569aad9c0d2a6c9c2c86f3b5b
TLSH
T1473126128A2845FF28FCD284C9B88717E7A0531B61561C1FF6F8DA58DD7703237A1998
MD5 SHA1 SHA512 TLSH

Submit Download

UpdateControllerConfig.json

Path C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json
Size 1KB
SHA256 4b18886f38793bfa57ef37b14baf9ad9888154b14a26fe3e812b8d7bd688f8e2
MD5 9792867aca06c8f4b8dcf0f32cf15f89
SHA1 07980537a9d60da323cca1d7ab278c850cfb7f57
SHA512 a34634a6efe9a8da5510315d503e21fdae423e61151af705d388757f9850b6c62df99664145860fb7b7041bef368bf1b7f501f94c5b2b821a5f36329aa2c7c6b
TLSH
T1F5315923892888BF1275974DD9B48002E760938F66A05D6FB3FCD848DE739342487A8D
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 f9580ab63aaa4874a3ee7eb94e59604bf388e71ff1e9109a7038ca474afc9101
MD5 c0ee64909812324c7ab0141c800363ed
SHA1 3d389161d9b3f7342a8d27516164d4594ed01ec4
SHA512 0df331b26e81c15387934db5d423bcf9015d57f9ebf5b0ee8e64419dc716006d10e1622567572248cddfece228108a89738534ac9f33095f5810b3f68cc04b59
SSDEEP 12288:jl7Hp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:JHp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1B4D42319CFA58E24F8880630357C480CBBBFB371CF29474F6658664E7A726DD9E71A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f5eb790c97af2b58c89ccc4b4e8b886c599e3066263bc76e76fc19e266727b60
MD5 0a82256a21c6848f63d4555acae16e97
SHA1 1d7319c1e4963a687c0f9cf9be294350e99675e5
SHA512 e5eb5fccf6007883259a280f34f656101425de6d9bfff4bfd87a23232994ff898b804692bc2d3afa4e64c3191d5ab72f435e85a1a62369c7542b815625eaf819
SSDEEP 24576:Lgb6bmBIi49WNNFpg1rSvFv7bYEp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:Lgb4mBIBhGFLWS1SZBnHTAsi
TLSH
T17E65AE1E22EC02F5E0F9D2B89DAA4417D6B378164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 65KB
SHA256 e3627c05c7a9d074efd20b60e1b49bab2dede3fe7d08b7a9a71f58171ffbbaad
MD5 a55d47e0681775abb3cea935a0cd12bd
SHA1 29e2952faa52cea531a0340d4caee39688c25142
SHA512 55f7521227cffede2981f417902b850157f0547834a5db58e16b664d6a211a9e5d32963a9f4377d361d7b0d7d2422902203d35e060464fe51d5849bf61c566c3
SSDEEP 1536:2LaQb7Q8psAgfSDbv/ij6aTYa6kY8YOyrG2McAcKAUQoT8Oh6MLCyQSTm6oFul4h:s0K3
TLSH
T1A3635049B4EC8608C5B30FA67256FD72C91BA59BB70B4DA530AD6300DDC3B452FBA06D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\CatRoot2\dberr.txt
Size 65KB
SHA256 bcc59abd90a6569141c586cf0a5f15553ca2c4d348924fa16bade3a343a95e62
MD5 dede0b17d46832cd11589ab2dadbf6d3
SHA1 fad47b4dad865d56ef5eb998464696f3e35c7c41
SHA512 dc601f82841e5ab82078c68bf0dd73a7a1e8cb79150a4e31cd484c27abbf0a71068ae9029de9da3f9e7481e37696610362eac8e3cff11c3fc4e1e16c826fd3e7
SSDEEP 1536:2LaQb7Q8psAgfSDbv/ij6aTYa6kY8YOyrG2McAcKAUQoT8Oh6MLCyQSTm6oFul4H:s0K5
TLSH
T1E9635049B4EC8608C5B30FA67256FD72C91BA59B770B4DA930AD6300DDC3B452FBA06D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbtun.inf_amd64_add82795013a7c3b.ini

Path C:\Windows\System32\DriverStore\FileRepository\mbtun.inf_amd64_add82795013a7c3b.ini
Size 409B
SHA256 b1334a26c3f3ddc14259c10d269bc667331059d144c36898b6fb8e9206b7b6cf
MD5 3f3cc11bc02254ce2782250b55870a84
SHA1 a54c9b6d8835bb1a082ecd53d071dadacb4a7f16
SHA512 1d8d3bc58ad9ee961f87c36016884e7ba1e85320c6a7c44f4d7078dfff360285f3cfd6bb8bc068d5242860d21d3ea200385ad5593dbb534b2afbb83c59535bdd
TLSH
T199E0EC816024115EF846B95DD90C1E96C565B4091C313059FB14414C7713D87BFDAD97
MD5 SHA1 SHA512 TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 694b806bbf2d65f5b06bb91e049344c25d5e3ca1551eca81f9b9d3690b1463c4
MD5 1037731183a37284049fa69c3b8fe7af
SHA1 e4cbfd19183069d94e2652302bfc3a71fe84e93b
SHA512 0a39eedc710c61e9b23e110dd05b99eb15d6b3fca8640436be5afaf58bdf3aa63aef18a6d5f94dcee42de6c1d0fbaf1d45bb0abf5f7a426c8b46d80eb069a9ba
SSDEEP 12288:7ZGfHp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:tGfHp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1A2E4231D8AF149A4D8A847356434480EBAF37271CB2917DF06E4E63E9F226EC6F39D41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 ba7fd76830c4ea5077d95a5bc4b0739a1c5a22d29fccd30c33b823f154f0508c
MD5 487d491a68f6ab3b0fed629e0e82d484
SHA1 3291e7f466e2af8e8f130dfc45b5b0f8938061aa
SHA512 e9456a22eec0df70f88e0ebb99cd117000ce429f07e0ee02002b90acab64250c5dead69ff2c7cc947098006c214fbadc818947a2b93126e206457c7598d0676b
SSDEEP 12288:Sxp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:Sxp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T1BED42348CE648E64E5C40A3135384C0CBBFB6362CF6E07CF1698A64E27636ED5F75982
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 a9091b2f6546683006534f67fab877a78f5f63f8863e3f89c946623d650eca9b
MD5 49148693083ebbdc3d20467f86de6201
SHA1 a43edfd593ae6bfc57070e759d130f4c58ff6bd0
SHA512 6608e2307cf9a2fc9614d28b208db9c08f1d7e47ab04dd801e7704ebd73455c661333b1f4d3daa80e8caad4b1e1a501cb4f33c3e3dec4f70888c71e29043167a
SSDEEP 24576:dAZ8u8FpJqH14zria7/m1p8SXdo8ke5i5Xh6wnBLTHTAcZQ/:yeZFPqVna7/6WS1SZBnHTAsi
TLSH
T1CD35F165A7E001F0D47BD1388A564667F6B2B4210364EBDF07AC8B551F23AE90F7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 9a694ae12fc539752491a873cbeee87196a92a6a21a04c8b6c3ef8f2a7e7b27c
MD5 847572a87c1babc069e076972286aa22
SHA1 2b0f0c64a417e7d86c96e8c6d29d9837d110c0f5
SHA512 d3432db66e7d14a4b6ce7ba6504e06711c1650a5649926a4905e445ca13c14bc838600cd3175866a3f18fcadbac75e710434bf5b3c2aac7b336ac469e4e31237
SSDEEP 24576:iPUr+NQ7p8SXdo8ke5i5Xh6wnBLTHTAcZQ/:iJQ7WS1SZBnHTAsi
TLSH
T15805F11F66A80CE5E676A13D8995460DF772B462471293CF02E0817E5F63EECBD39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 c40d976f5be97d0923fc4baf19e3be9fa5171af73237c2970d1848618705be2b
MD5 8e4fc9a872d96867cf26e16200465806
SHA1 0e3263842c4a6b0ea90e24abc65b29a996d4321b
SHA512 7656b67e8dde093ba2c880192dd2c07d158b6df51762cc7ecd0a767e1307de2414dd453e945a4340bd230795c20129c3b86ee7b89a22293347d523f217421d2c
SSDEEP 49152:FBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjCWS1SZBnHTAsi:OG05lO43bbcNzAz
TLSH
T13CD5BF6E62EC01F9D1BBD17CDA864A0BEBB23415033556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 f6a7b1796d1419b462747f0d0e359a72109cf871df3c628e4ec24f2e13d6c433
MD5 9d508b4ab83f7cab7e23af5256adadf1
SHA1 9d72ea0933469a50478860c214a6b18f8cc8e0d2
SHA512 1c348671736d6c043e2ac0be31355d3887f16d68dbf43ce0553bfc54e2c9d36b995d7907c2b94a37109dcd8ad77758e03c94694f7ce012ba45514836a19e9921
SSDEEP 24576:VFa5POZ3dpbWVM50JicR2hG0lasx2+47eidnkL1lFY40YZWQD93Q77wP4G45HA:ra5POZ3wJt2pasx2+meL1E402h5WB
TLSH
T14665BF5EA6FC00D5D1B9D17CC583461AE5B1342653329BCF126182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 403044cb17f1444337e797b7b2aae28d336e745ee7c74f70b1d8346a9d238d58
MD5 91f2618fc6fb052bf8b15fd7787b7dcb
SHA1 a0baaba6d161b1a5e467dde17b3897a42654fccb
SHA512 dc130cb18b15e0258bc3fca2a00a251c3e0e3f795c4caeb1d0e3dbc40a26dd08e65b84a746fd4e1f65c01aca985d471b9e60ef0a012cdb4c38c93f0babdf352a
SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7FkSp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:HNc/zEOVHF9WS1SZBnHTAsi
TLSH
T1F1858B1622E901E4F1BBE1BE89779546FAB17865533486CF0291811F1E73BF85C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 4100fbcc259f216b769f2f974d1276af88297b2da19eaada916d72d5c3052acc
MD5 105d2c7becba1dd68f7b2d25bf80d2f0
SHA1 355743fe7250640110e75e31d380b4d885f1a1e0
SHA512 7bc6850c9971dce64deac7e6ec96a5204b416b9e2fb691965004d02369505915dbf2746686b42d33198f483b58cad21fb79ac695bde86014a994dd2addc17b4b
SSDEEP 24576:MJnJPbzB4Sjp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:MJnJv6SjWS1SZBnHTAsi
TLSH
T1FA15E03DC2A810E8E4B7C27481191A59FF71347D2F266ACB19B4D5353F12EE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 f8dfa6f7d1eb36b195de6478c2303b672b02a9302fd579e87455cb0d8d4fd1b5
MD5 fc4721f052122e810035c0232c4c1ea1
SHA1 a46d6d3f722f04f73f8e1d09a02e51027def1596
SHA512 b44bef24a3266d763768c6ca226eed57c87c6532404800e82b2bc90cb221a44516472ff64f9be9ca9ecc8cad30275d1a622d15a1d76b212be8742377b1a9cad8
SSDEEP 24576:8CLHGL0MoeVtFumTijCmlKQWDkOp8SXdo8ke5i5Xh6wnBLTHTAcZQ/:8CLHGeeV5ijCmlDWDkOWS1SZBnHTAsi
TLSH
T1FEA56B05E7EB4184F8F3CAF5CA2694169A327C509B34F7DF4A80CA6A1E32BD5D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 fa86218271d1e990ffbf464a0bbb02116930513cfd5e104a9162792fa2e0ce52
MD5 a9e72d0c77a3d1e076d58144e190f6ac
SHA1 eae2bc97f182ff00f0fa6f9ac6a6eaca4722421c
SHA512 ee721b150c8a338e8efef3cd3f1bb024fc252c823f5ac0264ec2066e5ae0bf9bbc7c19b7637107b70cb488901a35e64226f046761c93577c80ebdd1c667dea20
SSDEEP 12288:q1Hck6j5ZI7wp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMi:W6DIsp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T14AF4F15C637A01F5D0AB903A96920405F6B2B171C7261ACF0BD8C5BE5FA3EDCB939E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 1d5b7100587a6261b8eed04dc23f315e8237e0ff1fb23a3dbe3dcccd2d0ef566
MD5 68111107c868c9ba3933e5cee254b2ee
SHA1 415e28b26cfe6564f021640a62e0540b84408c83
SHA512 2183515f03ac4106bb8e6db1e79c0f4a5679ddd49960a6e9434e5b8d1fe01a3a3495e329ad0886d1e2a7545d2795585a65f7dbbffbf0aedd35f2bd15d390a07d
SSDEEP 12288:dG6ky9p8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:kty9p8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T199F4120887A449A4F9A90634AA754448FF76B9218F2647CF16D0E72F2F327DCAD71F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 28c8da695d38a4af51ee89d6b5aed5620a091f9f69a47aed290ff7924ef33922
MD5 c50a02532c3cdd7fb222f8c63613e97c
SHA1 8895591d716bba35a8af75390637b41ca55ea11a
SHA512 aabd59ff0bb7557c26e5ba4a4c786fef43f5bc39eb1bb22fce4a93c47a15d54f7d15a0b021634ea4890755b6c928a0fc03bbaeb646e9f83ae407957b5feafabf
SSDEEP 12288:LIyp8SR9nDpo8kR4Ooi5/HHXhIZAxz63GnxOoi4p4ZyPTHTGBQ40mMQ1jws:Uyp8SXdo8ke5i5Xh6wnBLTHTAcZQ/
TLSH
T10DD4235CCA658E64E8840A3135384C0DB6B773718F2A07CF1AD8EA6E6B632DD5F71D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 71ecd2d9591dfbbbf625bbc60c07b48d1cec25a38c9cc67d73644e1f4052eba8
MD5 60bb01d59f623e12f0f5e96a61a39c2b
SHA1 12dd2388239ff38265545c9436618bebf44661e9
SHA512 00b65149470eefc4ab968815a2be2eddab621741b6418ec6b5831bacc7ee9cbe01bcd7493a630f63d61ce13a334968937af14194c67db76f69a8c2f6ca14cd9d
SSDEEP 24576:tMgdLoTfaidZ8p8SXdo8ke5i5Xh6wnBLTHTAcZQ/:egyTrZ8WS1SZBnHTAsi
TLSH
T1D9558C1DA7EA09DAE2B2D635D8621493D633B4315772C6CF2448C03A4DABEDCAE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 a444d3ea054d9db4dacb7b3e8eab226b43e2725799bb0a67c78a10ffd1c4a579
MD5 92ee919a3e6d2cef641256576ce884e9
SHA1 c2a5304860b3ddb3da122fdb866145129f18fa63
SHA512 d5f80245f40de74c209cc90c648206ab09d0f9e398345dd718f18e0603c4aa27b4bf2005191b6d13df7b4eeeece548ac69f970309da55cedd8ef72d502ea74a0
SSDEEP 24576:HrcmRMRL1lFY40YZWQD93Q77wP4G45HA:LcmR2L1E402h5WB
TLSH
T16E05010EB6AA00F9E2BB9138C9820556E6B37031632267DF45E5C77D4E279EC7E34B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 7a4b551e30a9d07871078c899243b506886587549ab64280b0eea744b0bce6d6
MD5 1a205ed4882de8859e1d624db91b9853
SHA1 a466be7efb741758849e54cc4c72175d9530624d
SHA512 77f403a4c7d89856b114c0f0914f908d188f3a3c117585b6b59002fc6fa53b6a0779178a57804191a40c5cf62ab6cdd114987d36d83a3dd160abdca645d22084
SSDEEP 49152:ODL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS34L1E402h5WB:P3Upow8sBPN0g5WB
TLSH
T175A58C3DA2E810A8D9AAC379C54213A6EA71742E3F3015DB0174C578BF1BDF19A39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mb_506E.tmp

Path C:\Windows\Temp\mb_506E.tmp
Size 107KB
SHA256 ad820dd54edb13e255d34eafacd71f278d6514e2f7e4c2970401f922a774ceb0
MD5 2df8ff40bec48460845f851a54b76fe8
SHA1 8e19f3d76c87d590cf1af839ddbe98af381d44e7
SHA512 2177f5dfd6901f09ae2b8a0d6bea7b5fac3d00a721aa297ca6c35666cf2549d6c8d8655063a332224ccc8e0f00bdc84334636e9f1527862c850cc4ceb96d7d61
SSDEEP 3072:dAZdoamZdgBjLpSXussssvYssssnC1c9RvZfy74hfp:dW542pSessssgssss7Nea
TLSH
T1B6B3F1F78379B8D9C513DA3B93874B110B28426B2C8A7E45A84DDB158D7E66181C3F8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1288-89-0x0000012F22810000-0x0000012F22903000-memory.dmp

Download

memory/1288-91-0x0000012F22A70000-0x0000012F22AD6000-memory.dmp

Download

memory/1288-90-0x0000012F22A70000-0x0000012F22AD6000-memory.dmp

Download

memory/1400-106-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1400-155-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1400-107-0x0000000000890000-0x00000000008F9000-memory.dmp

Download

memory/1400-113-0x0000000000890000-0x00000000008F9000-memory.dmp

Download

memory/1508-177-0x00007FF6EAF30000-0x00007FF6EB250000-memory.dmp

Download

memory/1508-178-0x0000022B4CD40000-0x0000022B4CDA6000-memory.dmp

Download

memory/1508-179-0x0000022B4CD40000-0x0000022B4CDA6000-memory.dmp

Download

memory/1508-183-0x0000022B4CD40000-0x0000022B4CDA6000-memory.dmp

Download

memory/1508-185-0x00007FF6EAF30000-0x00007FF6EB250000-memory.dmp

Download

memory/1604-44-0x00007FF63CD60000-0x00007FF63CE82000-memory.dmp

Download

memory/1604-17-0x000001A83A060000-0x000001A83A0C6000-memory.dmp

Download

memory/1604-15-0x00007FF63CD60000-0x00007FF63CE82000-memory.dmp

Download

memory/1604-16-0x000001A83A060000-0x000001A83A0C6000-memory.dmp

Download

memory/1604-18-0x000001A83A060000-0x000001A83A0C6000-memory.dmp

Download

memory/1644-433-0x00007FF6CD4C0000-0x00007FF6CD74A000-memory.dmp

Download

memory/1644-318-0x0000013B781B0000-0x0000013B78216000-memory.dmp

Download

memory/1644-317-0x0000013B781B0000-0x0000013B78216000-memory.dmp

Download

memory/1644-316-0x00007FF6CD4C0000-0x00007FF6CD74A000-memory.dmp

Download

memory/1788-2746-0x000001D6F7F30000-0x000001D6F839E000-memory.dmp

Download

memory/1788-2832-0x000001D6F7F30000-0x000001D6F839E000-memory.dmp

Download

memory/2248-128-0x000001E9F5560000-0x000001E9F55C6000-memory.dmp

Download

memory/2248-175-0x00007FF6758E0000-0x00007FF67598D000-memory.dmp

Download

memory/2248-126-0x00007FF6758E0000-0x00007FF67598D000-memory.dmp

Download

memory/2248-127-0x000001E9F5560000-0x000001E9F55C6000-memory.dmp

Download

memory/2472-148-0x00007FF725540000-0x00007FF7255F3000-memory.dmp

Download

memory/2472-252-0x00007FF725540000-0x00007FF7255F3000-memory.dmp

Download

memory/2472-150-0x000002718E210000-0x000002718E276000-memory.dmp

Download

memory/2472-149-0x000002718E210000-0x000002718E276000-memory.dmp

Download

memory/2524-223-0x0000023083930000-0x0000023083950000-memory.dmp

Download

memory/2524-203-0x00000230801E0000-0x00000230802E0000-memory.dmp

Download

memory/2524-239-0x0000023083D30000-0x0000023083D50000-memory.dmp

Download

memory/2524-255-0x00000230942D0000-0x00000230942F0000-memory.dmp

Download

memory/2524-225-0x0000023093DF0000-0x0000023093EF0000-memory.dmp

Download

memory/2524-201-0x00000230801E0000-0x00000230802E0000-memory.dmp

Download

memory/2980-426-0x000001B25BC80000-0x000001B25BCE6000-memory.dmp

Download

memory/2980-427-0x000001B25BC80000-0x000001B25BCE6000-memory.dmp

Download

memory/2980-432-0x00007FF6786E0000-0x00007FF67880F000-memory.dmp

Download

memory/3044-380-0x000001C9C7E70000-0x000001C9C7ED6000-memory.dmp

Download

memory/3044-378-0x00007FF776F10000-0x00007FF7773E0000-memory.dmp

Download

memory/3044-449-0x00007FF776F10000-0x00007FF7773E0000-memory.dmp

Download

memory/3044-379-0x000001C9C7E70000-0x000001C9C7ED6000-memory.dmp

Download

memory/3180-79-0x0000016DF3150000-0x0000016DF31B6000-memory.dmp

Download

memory/3180-78-0x0000016DF3150000-0x0000016DF31B6000-memory.dmp

Download

memory/3180-136-0x00007FF688430000-0x00007FF688549000-memory.dmp

Download

memory/3180-77-0x00007FF688430000-0x00007FF688549000-memory.dmp

Download

memory/3672-101-0x00000217F0F80000-0x00000217F0FE6000-memory.dmp

Download

memory/3672-99-0x00000217F0F80000-0x00000217F0FE6000-memory.dmp

Download

memory/3672-98-0x00007FF78CF70000-0x00007FF78D0B9000-memory.dmp

Download

memory/3672-147-0x00007FF78CF70000-0x00007FF78D0B9000-memory.dmp

Download

memory/3904-72-0x0000015A275D0000-0x0000015A27636000-memory.dmp

Download

memory/3904-74-0x00007FF636580000-0x00007FF6366E8000-memory.dmp

Download

memory/3904-66-0x0000015A275D0000-0x0000015A27636000-memory.dmp

Download

memory/3904-67-0x0000015A275D0000-0x0000015A27636000-memory.dmp

Download

memory/3904-65-0x00007FF636580000-0x00007FF6366E8000-memory.dmp

Download

memory/4252-159-0x000002359DD40000-0x000002359DDA6000-memory.dmp

Download

memory/4252-160-0x000002359DD40000-0x000002359DDA6000-memory.dmp

Download

memory/4252-158-0x00007FF7BEB00000-0x00007FF7BEDA3000-memory.dmp

Download

memory/4252-359-0x00007FF7BEB00000-0x00007FF7BEDA3000-memory.dmp

Download

memory/4508-26-0x00007FF6ECE50000-0x00007FF6ECF18000-memory.dmp

Download

memory/4508-27-0x000002275CC10000-0x000002275CC76000-memory.dmp

Download

memory/4508-28-0x000002275CC10000-0x000002275CC76000-memory.dmp

Download

memory/4508-45-0x00007FF6ECE50000-0x00007FF6ECF18000-memory.dmp

Download

memory/4616-453-0x00007FF7667C0000-0x00007FF766CC7000-memory.dmp

Download

memory/4616-387-0x00007FF7667C0000-0x00007FF766CC7000-memory.dmp

Download

memory/4616-386-0x000001D5860F0000-0x000001D586156000-memory.dmp

Download

memory/4616-388-0x000001D5860F0000-0x000001D586156000-memory.dmp

Download

memory/4752-37-0x00000211D6F90000-0x00000211D6FF6000-memory.dmp

Download

memory/4752-50-0x00007FF6ECE50000-0x00007FF6ECF18000-memory.dmp

Download

memory/4752-34-0x00007FF6ECE50000-0x00007FF6ECF18000-memory.dmp

Download

memory/4752-35-0x00000211D6F90000-0x00000211D6FF6000-memory.dmp

Download

memory/4756-143-0x00007FF6DC330000-0x00007FF6DC746000-memory.dmp

Download

memory/4756-138-0x00000251A9800000-0x00000251A9866000-memory.dmp

Download

memory/4756-189-0x00000251A9800000-0x00000251A9866000-memory.dmp

Download

memory/4756-348-0x00007FF6DC330000-0x00007FF6DC746000-memory.dmp

Download

memory/4756-139-0x00000251A9800000-0x00000251A9866000-memory.dmp

Download

memory/4756-188-0x00007FF6DC330000-0x00007FF6DC746000-memory.dmp

Download

memory/5052-118-0x000002220A540000-0x000002220A5A6000-memory.dmp

Download

memory/5052-123-0x00007FF714850000-0x00007FF714F93000-memory.dmp

Download

memory/5052-119-0x000002220A540000-0x000002220A5A6000-memory.dmp

Download

memory/5052-424-0x00007FF714850000-0x00007FF714F93000-memory.dmp

Download

memory/5052-173-0x00007FF714850000-0x00007FF714F93000-memory.dmp

Download

memory/5052-421-0x000002220A540000-0x000002220A5A6000-memory.dmp

Download

memory/5376-0-0x0000000003020000-0x00000000030B4000-memory.dmp

Download

memory/5376-7-0x0000000003200000-0x0000000003269000-memory.dmp

Download

memory/5376-6-0x0000000003200000-0x0000000003269000-memory.dmp

Download

memory/5376-3-0x0000000003200000-0x0000000003269000-memory.dmp

Download

memory/5420-57-0x0000019A51310000-0x0000019A51403000-memory.dmp

Download

memory/5420-61-0x0000019A51530000-0x0000019A51596000-memory.dmp

Download

memory/5420-58-0x0000019A51530000-0x0000019A51596000-memory.dmp

Download

memory/5568-169-0x0000018438790000-0x00000184387F6000-memory.dmp

Download

memory/5568-168-0x0000018438790000-0x00000184387F6000-memory.dmp

Download

memory/5568-375-0x00007FF659F00000-0x00007FF65A094000-memory.dmp

Download

memory/5568-167-0x00007FF659F00000-0x00007FF65A094000-memory.dmp

Download

memory/5764-436-0x00007FF7280D0000-0x00007FF72840F000-memory.dmp

Download

memory/5764-460-0x00007FF7280D0000-0x00007FF72840F000-memory.dmp

Download

memory/5764-437-0x0000017224E80000-0x0000017224EE6000-memory.dmp

Download

memory/5764-438-0x0000017224E80000-0x0000017224EE6000-memory.dmp

Download

memory/5812-49-0x0000025F6F120000-0x0000025F6F186000-memory.dmp

Download

memory/5812-48-0x0000025F6EFD0000-0x0000025F6F0C3000-memory.dmp

Download

memory/5812-51-0x0000025F6F120000-0x0000025F6F186000-memory.dmp

Download