58ac90cbb7a273cf460f7ba56bb4b3bf7491d3df225a3550e3f88a97449aa296

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 06:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_57e8871e3535b84423314d7efce75a48_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe
Size 5.3MB
Sample260711-graqpsey7z
SHA256 58ac90cbb7a273cf460f7ba56bb4b3bf7491d3df225a3550e3f88a97449aa296
MD5 57e8871e3535b84423314d7efce75a48
SHA1 858c4f3615513ba59eeac4ca851b2d9ec8ebc9bd
SHA512 f6086f87e138f88d022e2982975dfbbb13460a36c1c58355ff553d538d927836bfbfc81358b15883892e6a86776f7e6a8731fa0542e53267af94978d1be3e677
SSDEEP 98304:aajqHTgFRDKAVYXKbO1EFsNOnPBpJVwjdIG3rUUWVtZE8grExHC:aCq8PCXpTOnsdIG3TugQH
TLSH
T19D46D022BED14173E5A303319AADF77D647DE660072580D7A3D04A5A2D302E37B3AB67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
4132	elevation_service.exe
1196	elevation_service.exe
112	3733.tmp.exe
240	maintenanceservice.exe
2932	OSE.EXE
1148	PerceptionSimulationService.exe
1588	perfhost.exe
4452	ReFsDedupSvc.exe
6068	SensorDataService.exe
2364	ssh-agent.exe
1348	AgentService.exe
5312	SearchIndexer.exe

Loads dropped DLL 1 IoCs

pid	Process
112	3733.tmp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 49 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	2026-07-11_57e8871e3535b84423314d7efce75a48_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	3733.tmp.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-11_57e8871e3535b84423314d7efce75a48_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-11_57e8871e3535b84423314d7efce75a48_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-11_57e8871e3535b84423314d7efce75a48_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\42b6caed763f1d8f.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-11_57e8871e3535b84423314d7efce75a48_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-11_57e8871e3535b84423314d7efce75a48_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-11_57e8871e3535b84423314d7efce75a48_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_57e8871e3535b84423314d7efce75a48_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3733.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000f02add2fa10dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e7e351d1fa10dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e263a2d2fa10dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e3ff9ed1fa10dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000098770d1fa10dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018e1c312fb10dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000444a812fb10dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
4872	2026-07-11_57e8871e3535b84423314d7efce75a48_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe
4872	2026-07-11_57e8871e3535b84423314d7efce75a48_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe
112	3733.tmp.exe
112	3733.tmp.exe
112	3733.tmp.exe
112	3733.tmp.exe
4132	elevation_service.exe
4132	elevation_service.exe
4132	elevation_service.exe
4132	elevation_service.exe
4132	elevation_service.exe
4132	elevation_service.exe
4132	elevation_service.exe
1196	elevation_service.exe
1196	elevation_service.exe
1196	elevation_service.exe
1196	elevation_service.exe
1196	elevation_service.exe
1196	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4872	2026-07-11_57e8871e3535b84423314d7efce75a48_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe
Token: SeTakeOwnershipPrivilege	4132	elevation_service.exe
Token: SeBackupPrivilege	112	3733.tmp.exe
Token: SeRestorePrivilege	112	3733.tmp.exe
Token: SeAssignPrimaryTokenPrivilege	1348	AgentService.exe
Token: SeBackupPrivilege	4452	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4452	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4452	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4452	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4452	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4452	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4452	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4452	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4452	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4452	ReFsDedupSvc.exe
Token: 33	5312	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5312	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5312	SearchIndexer.exe
Token: SeDebugPrivilege	4132	elevation_service.exe
Token: SeDebugPrivilege	1196	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
112	3733.tmp.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 112	4872	2026-07-11_57e8871e3535b84423314d7efce75a48_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe	89
PID 5312 wrote to memory of 4296	5312	SearchIndexer.exe	99
PID 5312 wrote to memory of 2428	5312	SearchIndexer.exe	100
PID 5312 wrote to memory of 4448	5312	SearchIndexer.exe	101
PID 5312 wrote to memory of 3728	5312	SearchIndexer.exe	102
PID 5312 wrote to memory of 4756	5312	SearchIndexer.exe	106
PID 5312 wrote to memory of 2532	5312	SearchIndexer.exe	107
PID 5312 wrote to memory of 2020	5312	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-11_57e8871e3535b84423314d7efce75a48_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_57e8871e3535b84423314d7efce75a48_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_remcos_revil.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Users\Admin\AppData\Local\Temp\3733.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\3733.tmp.exe" -u -product_regkey MobileGamePC
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:112

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4132

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1196

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:240

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2932

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1148

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1588

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4452

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6068

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2364

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1348

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5312
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4296
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2428
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3036 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4448
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3728
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4756
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2532
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3036 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 cb664a5a437d695f548e521b1322a7159063f14c980e6fa67371525ebbed3a51
MD5 41197fb333e088c636b6a0102923f6e7
SHA1 fabc30354acfe00e93358704a7011e8569df66f0
SHA512 b4350da4830d1fd8b178eea7d66c48346956d2ecbe4c53c0a9b0fc0b3b265757d94fc36a28794cbe1cc8241d77d2bc50b4768ab65519ec0e13ca26040d9ca51e
SSDEEP 49152:Wb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnLxHfJvYrPs9HHC:I3q6sjBigrExHC
TLSH
T11DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 74469e19eb547207a753b6de0608225dd773e2bb7d57113e00d5dfb091827996
MD5 9bedb65600aa5720c67c2f732f842006
SHA1 2cd2ca830be7a33b9bf936d9c9404897203cfbd3
SHA512 55bb5e70dd00f09f1f70453c89f390ac34f8866ad5bd9ded4016d90eae26dc435359f8b87a6eb7e816a8945b0628a5c79009f73d4089a0a56a351c3e70cfb4a8
SSDEEP 24576:XXYfDtczAexHfJaMJWTTXPPC1X9qSH9Y6VyP:CtctxHfJvYrPs9HHC
TLSH
T17B75022877E509F9ED27827DCCA28111EA337C5547A0E78B03A499661F333D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 12e8fac7c6806c8b8b4262e9f21ccdd363feed89094baa0c62fde9f20c260ae0
MD5 f9a6ed2635c5b5ac306237f9ec28ef99
SHA1 b0bc7fdc1d5792532aee4d2ab40095cd0f27c3ee
SHA512 3ca0662b864b671811bfff1b5d2baac5b924540ef325888abf845bbd86b60639abe16985b50fe8243e9adede762e42ebe382110f1354da1cef96f9fb9902845d
SSDEEP 24576:W0Le5ji0hmxxrMexHfJaMJWTTXPPC1X9qSH9Y6VyP:WPji0Aj9xHfJvYrPs9HHC
TLSH
T170859E16F6748335D073C0B9C5D2A69EE97130865B308ACB0286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 05f381898081046f7d97e945866d5e3f657bf450f9e47ee5b10b2df0c22ce18f
MD5 54d2ebba1b1f83591c46d1696abdff95
SHA1 50e8806bde85314098868a4d41e5ce55ae14a550
SHA512 3a3b86060ca366f07eaa2da5adebb689107193db8214897ffffc4f97b6eb8d249159c3a9a3c92c11360b0bc3736d54909f1d14ee70dfecbc62f51371dbf21da9
SSDEEP 24576:1a7/ezSC6vUyD/aqgrvWn6q8wyuMxHfJaMJWTTXPPC1X9qSH9Y6VyP:8/ezSC6vUzPveHjyZxHfJvYrPs9HHC
TLSH
T1AF755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 843ed31a6645ed0bc3fe3ee8bdbae24ff98464a3311278fa7cd35a7ef1135350
MD5 cc44bf854240856663e963e7398fcb09
SHA1 84994369d54365164695b5a73436ba85240b6b7f
SHA512 47ce395af6007dc3be0ce83db4da88a0d761be2f183cd1569f0fc84651f9ea54286cd6902103cff9c3a259c748ba5e5693e1cab4aae93ecf34144b7d3e65c88f
SSDEEP 24576:1VbqPb88hv/l+YvxHfJaMJWTTXPPC1X9qSH9Y6VyP:1VO88hXl+UxHfJvYrPs9HHC
TLSH
T149559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 db6b7e41934ebee127d4dc0128c5e1eb1a0a2da031e3bbebb4c03fc0608f782d
MD5 25ffd677f07296d06788eac0cc981af8
SHA1 bfd4e775e5bfc1e958b87c8b21c649e24b20e59b
SHA512 4cfc44b050a3bdf3e9cb4fd13be7338634cb65156a3b2485ca96171e7eef9cb5b7b3cf9fbe1811026e3fa1afb3aa6b9c78fc9db2a1bb45555d2b84aa14ede96a
SSDEEP 12288:oLCxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:oLCxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T141552352DEEE9375EF21037605D762580852BD6DAFC7990A1003BCCF263ABA5D00E8B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 816ab1277ace4919f7196d91cec015e153fb3fc4aa96bcce362e5d6a8a3ae755
MD5 e6f6b278ce73a5163788e9a2c874c781
SHA1 53cf515758f9107baa8e9280a87bce29068d54ac
SHA512 d297d59803b7c9c019be646a64ad563cc90aecd5f2ee038ba7f6f3a7c43ef8a349b50300f13fcc5642f78cb83080880b550166b81611193346360891f09c903b
SSDEEP 12288:GeBNUbTVO86UnxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyV:GJIUnxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T14775C03BEE28FCE2C67A4DB95A918340977278304F52A3CBD165C20EDE235E15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 63f337b04dc8126e9974d9abc33e54c26ba0380fe78968b4cdfcba5132afbb5e
MD5 1d0bd9c4ce53f2db19bb91601156fa9c
SHA1 ea8d723ea6a88a555ef8a0148184ecd2dea6011e
SHA512 500f7717b07c6b7e1ec0a49679c4c5367cd7152c1c3ac887776051c401a134903df173853a98bec29aaac6ebc14644184b8464dc1a58c96d06c0e3c0fb6e48b6
SSDEEP 49152:PQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THU:PQvGAdlCEL8c/DRNw5CcgrExHC
TLSH
T1D1267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 7c080f8e388c898e1ab426d18bdba3e8a934e62303dd5067f0d00a83d0f85401
MD5 ebe8a24424553310b30cfd623c939de3
SHA1 985a44f13b9935b26edf672f7aedf725c8b82849
SHA512 d49c82bbb5521cd7eca155268fe04ef3d31e4b3db5a1950fafcd16651abc7aa2a156554516949b3399e4763335f0d033c7091c28e62feae1bcd6cb74d38c21b9
SSDEEP 24576:70ewsAjNxHfJaMJWTTXPPC1X9qSH9Y6VyP:YljNxHfJvYrPs9HHC
TLSH
T1D675E031FE75E036C77B0DB61B26C716142DB9204F9219C3E3A89D8E59342D2237AE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 838a57025f44417fbf9ab79f2d1487d95945bc248ae7e248c7777b8f63651ac0
MD5 3e6fd2cbca11fa9828044c82cdbec074
SHA1 bf60ee6f5a75c2e20d8ba513c2c511952f07eb7d
SHA512 06a1cb676b2a4764a8e866f5b57540620020265b4b48bf0f19718a69e5c7bb74163434fc9eceb000ad31f4e76622f91f6210114a1a7451d0d85bcb7f69ce3cdc
SSDEEP 196608:BUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHVgQH:BUEtQevvqc2W1cpV2tI322y
TLSH
T143474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 779ac2c3e8465105e7e498d340c57d7b1dd46da88f9c1b8c5fe2ea6614d88fe9
MD5 59490aea76b7a776e6f003164c8b8267
SHA1 0f66e9163942eacbddc65c5059acef35674bafec
SHA512 bfcda9c50961d07090ffa2876a608b3b0847fd449f48b4fba5a8c54aecb20f90dd42ef95101bea3dc102ef63a1b81c19014b2b946f4ddf8e74bea86248a22bc9
SSDEEP 49152:HCbRquA/m2yL5zLfFiV+XenmE3/ztxHfJvYrPs9HHC:Qoq2VjnmIgrExHC
TLSH
T162D58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ac5e42dce7ed313361e0ae25b28015351e2cede455f8bc4572bcdee1113fdf77
MD5 c51d457ba9d19db23fbf41624040b108
SHA1 4410dfc8ff4e7e427cab50ed435ed5054a44ee9a
SHA512 d9b413b1d0d75b993ad570e74f9a70d649f4c9226917f342558f2e9ecb69aa980984c6c086c00023301d5b101fae3db2b1b90f627f396b0eb28b8e55fa9e49c3
SSDEEP 24576:/AhGL3IFoiwtA5l7S53oxHfJaMJWTTXPPC1X9qSH9Y6VyP:/AMUFoiq5YxHfJvYrPs9HHC
TLSH
T14835AE81EBF955D4F5B3AA7899B69170EA76BCAA5E31C20F2150D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 1105b544b6413715bdcfb2178c87576e6a5b34cd5a729fc8a6a81a6b10f3cd31
MD5 f74ce92715356f6e55f9049caad1589c
SHA1 0e125e834a2fae53706cbb0aae79898d73d64b29
SHA512 945b77dee803257dd85bd2017732145ad3be24174dee42ae222d3c2359ac135f36d62254f66db7e589e1e0d04eb149e6bfe25720368320c9c5352ad80448dec6
SSDEEP 24576:rwu4OW5xHfJaMJWTTXPPC1X9qSH9Y6VyP:rwvOExHfJvYrPs9HHC
TLSH
T1FB65F14676E90CF9E96342398597C135E7F2BC122A62DB1F1360C64B6F37361AD1EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9f1e523868c8ba64368cd85f1d44396d6cc1c84c4855128276229783abf75394
MD5 6f311619c19a5cf33fd12b093d3da574
SHA1 e0d04207ac4a040fe91cf99049d3e37bb3961958
SHA512 ecdd5f65245b4cf64309990bd727911cbed23555a4555fb8ce713185ea9b1d7045c1b62b8c9cc7f19d1cb2c6f6ff5bf05f67753558c868724bb53c0d5c0113c0
SSDEEP 12288:BeZ1IydxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:UZu2xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1E155125A36E861F9E623427D88E252048772786667B343CF1111A68B2F33BD15D3EB33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b46d3ede0047ceb666bc487ba84f996834bc305898af196238b4525641449db8
MD5 2409181bc7c5f41da17f854b5862d2c8
SHA1 e19ab6ab41ae3f59d5ae19d90bafe07acd7dc0cc
SHA512 2b57892ce76c8b9bc4b90d791c70740f9e8342f72ab30364a0f7222ae0062e1ea93d8442c78913deab537f22c3b3d033e1a776682dddf07969c72edb1a857079
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uo:WQRQyi36YOcPbLvw2gAf+PN3jgrExHC
TLSH
T132667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2dead1c1c1461bc49f051e9a573e96d6b36f4d1b245a99d4e34e14805ea7ff66
MD5 8c6a916053daf514ef44b9d2dad995ef
SHA1 b883c8bf608ca299c0888456a85548f5fe1e5f78
SHA512 15a63509e35a9f1a644e4088a8fe30e985c09a397cdaa139a0e140aa3ea2edf35488502fc37d168855759585c4130a9e9d74f353edde233401f598508755d3cf
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Uo:yQRQyi36YOcPbLvw2gAf+PN3jgrExHC
TLSH
T17E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4a85a5906bfbc5c2f23c5ff2194cc5216036db5d648013e10f36b2cbb2174d31
MD5 6a73fffdb0338b766c26f7f166befbed
SHA1 514d53997c1eaa56610cb5073fed093953b16107
SHA512 158e1d2b2c13aad6a6f502cedba12626f4d1b7e1ceaa16dc37e6eb3d708fff4e822582d70b815289d3a6a016d05edb5e3d1dfddffef397bd1713f288c33143c6
SSDEEP 49152:V68Qg55nhceWu7PNU3/9xHfJvYrPs9HHC:jthLRc/9grExHC
TLSH
T145B54933B2F600A9C44DD1769F4A872196D27C758FE1E3DB8511720A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1b77a2c6b291f13942cff8b2cefd3ca0cd4224cc873a0b1891c1bf73c8943811
MD5 0279d5dd78d42953251bc19138eaa9f1
SHA1 7f23d41a15293ea7e78422737aa4af5e7b4222fb
SHA512 9426146437a5b027f08ba84074d629dc2f55c30b4f504764dec1dc4f201a271c0f73b5478ce4bf15e04e0af124e68a3ee386856d2ca494ada8af2ec512c4e914
SSDEEP 49152:v3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99q:Cy5112gYy5azzVvt69nLKnhZCgrExHC
TLSH
T192167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9106799fa8671affc546db37e068eba597abebfa749e375ee3af2b7ca9747c43
MD5 b53d9094d6e392e9b565f12a793978ba
SHA1 79b7644cdcb5d4da1150818a0bf1415c1aac5ce8
SHA512 793192c227a20aaed6a7782d9683afe2f0d71b233ce2fe813d9e1af3fc1721ffea2b66b07c25e230bfa44d1a9b84b74b39ab9d0651358f11cd469f56dfc23071
SSDEEP 49152:/B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glOxHfJvYrPs9HHC:Bu6Jmdxd2dOgrExHC
TLSH
T1D7D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ce0d5ffa77b7d78209c68acb973933cb24f4fe19011cf6e968a30616a1a34913
MD5 8fb2b937718c2d5b997a567bf8d669d0
SHA1 3b2a4a05fea47eb430fa8f3a942619e1068473b2
SHA512 cbc12304d361c481996e5e3c432ec2a956989a5bec6377d77c9900c8f998aeed9fe1908ca9e74db1247e943a1938fef063f0bcb4bce7f8ad0437dd7c559fe76a
SSDEEP 49152:A1hpsNoJpF1A63U44CwH7R4xHxHfJvYrPs9HHC:AmifPWRIgrExHC
TLSH
T192B5BE13F2D901E8D06DC17887569232EA62BC460B35B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 075758eff8b83c7326b59819c902d31c41c412d96f0601c595971290a5506200
MD5 4a9b9474a7562c0b50dd2ab6166d75ec
SHA1 f882dadcd2c03c1048f592cac59e17acaea40519
SHA512 b222cfb6ec354b2aa9a59e794ebd7493e6965e8a02b29b6e7289bca2edff0c8f17a5ea89b9ffbfce11b249301b51f5658df41d50eb07ec5dc9dda572f9241fc3
SSDEEP 49152:aSuZQIY0Be2KcRVtOnks6NMHq2xHfJvYrPs9HHC:E5dKii612grExHC
TLSH
T102C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e1aee8451cd4f047d73ffc0d258bc35f7795c0253181b1397b7576438723459e
MD5 ad2e13b6161215f26cb8d63cae2ca438
SHA1 a02918b80074c46cd6d4d5961c8599817cc66b02
SHA512 821a9da13575853f94b9ebde43e21b1869ae5ae012a8efbf69dffa5e9f467b1fc1ee77caf29990650b269084a1e1ac436c588c1da86bfd4a7fc5b049c464d3b6
SSDEEP 49152:7htSn8EApI0fig3giDn0AP5wrxHfJvYrPs9HHC:aX2imphkgrExHC
TLSH
T13795BE13F2D901E8D05ED178C7468632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 d5b58a02e52290b892d71275c13072ca32e4dc95dc6418c9419c77b960a147b7
MD5 a67efb7d43f3347b839fbae32502221c
SHA1 ce58e960c85e3181eab436a9bc7e430b1b060bba
SHA512 10168cef130d02404bd9d45f6778cf9afe9dfdb5b85e0c501fa502922c63219e57f43d6a0ed20371a0d624c5c40e3b241343ecb16004e0921287c3cd2d9e80ed
SSDEEP 12288:VaxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:VaxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1B5552315EDEF8379EA1103B6459253880856BE6EFBC3554A2103B88B377BBE4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 1dbf2d42c2c4bd6b60662679c664d1036b65a267272bff199a4158a0c48bc4bd
MD5 0f9cf2a5618320446770051cf22811fc
SHA1 be22743cfb2b4b54e4a18cb3b32d7c94f3227253
SHA512 c6d14cc1f43963d0c3f1ac9b6edae06f27bad760c85bef0f326ce6a5848ab363c0a95f4b3a81f22a7de3cc08491b272221c14f8ef28ec9b36fbadd699bfe7ec5
SSDEEP 12288:whxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:whxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T149552315EDEF8379EA1103B6059253880856BE6FFBD3554A2003B88B377ABE4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 871e6a5d1f9ce58962820ec94d5352cffa2bf1fe084b41e1eefd92e69bbb3d07
MD5 134d34b3cff116822dd083f6a194d193
SHA1 5037c014d09222caf730f048f0d270d8c997add1
SHA512 3632ce6294550bf7ff16c1cb109d60662ecadd6a5540e0196e014b07a044755fd3b436c7917f4c7246ba9f9729cdf8b903b1974b90873cd9680d530595300d8b
SSDEEP 12288:lfxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:lfxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1DC552355EDEF8379EA1103B6059353980856BE6EFBC3554A2007B88B367BBE4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 b104a948c74ffa80b3cfdfc6b5969b4974b362f9c7abca693543cec149b8bba9
MD5 6143d644466c59b333df892b4ed84cd4
SHA1 4d9459a8170ada43b028f6887dd789a84fb8fb7c
SHA512 d0602f279bde01967cd87d5224cb99191d7fa0327074c3e837c1801b786ff51ead714320162fe6a41f0806275acc3175b3c7066b6d4720720cb207908476e8ed
SSDEEP 12288:nVIxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:KxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T13F5523116EEF82E5ED21837989A352540572BC6EFBA3568F1102788B2F727E4540DEB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 ade291f51f86f221fc7dc7f31c6773d472d9900d5a31710469f4b18a82f30ffd
MD5 d6d52d2c4f530b0e75702b6dba3386cc
SHA1 8f3c1d1ae3b865102bd05e82433b2ceeaaf76216
SHA512 8c02b5ea62784b54f0714e1b04ffd4dd2e7126a67df718a63e849e65f2f4ac35856bb2399b3b1a9bbfd8383bf832fb1539d0159f8c0d8b5b8847e947e1662565
SSDEEP 12288:LwxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:LwxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1DE552315EDEF8379EA1103B6059353980856BE6FFBC3554A2007B88B367BBA4510E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 01a6a1c12dbc376ea69db6ebf69807fa681d2d1092aec7cfb3886ade26629ebf
MD5 4af710a1a94ed991e65f080b148e4e30
SHA1 cd7ce1037b73185cabb2a17f0428ea19675ed4cd
SHA512 e0d3655b97c7732ea10f4046e69c99867d83449c894371bad26971a94ae140bd0c9a12bd5185e39d79e25d5df9a3065a4c415a401cadbc8c5acc4b3264e30c1a
SSDEEP 12288:LlxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:LlxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1CF552355EDEF8379EA1103B6059253880856BE6FFBC3554A2003B88B377BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 55059ed8955762400a50c9c7d4ec145acecf46e31fda375d0404405dab6537fb
MD5 c1e2619c167071400ddadda24c7439d6
SHA1 2d5bc8f4de2769c8e0ed063cf6bab51466503c97
SHA512 93619da5ac40f1b035c678ae377a6a6508c159fb7274f483a653e72a5e640719291bb09ea620509be7082edc2493f144e6c3d30a2226763ec88f767dee75bf0c
SSDEEP 12288:SpxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:SpxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T174552315EDEF8339EA1103B6059253980856BE6EFBD3554A3107B88B377BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 db303b839dd47ed80933a7bf0121ee5545fc077d143b8c74a2dcdd13d903b797
MD5 33a8999fb87cc5f70d6a3542116619f8
SHA1 11917539fde6de1e48512e20b7f79af542cf0176
SHA512 68f24adc725f11b980c3734be65af0c250711fa0877a5bdb29601fa88886a5de21a40aee975d8621bf650a9cfbad125afe1770e528de62acf9a993b933c4283f
SSDEEP 24576:YZMRzFVSOBxHfJaMJWTTXPPC1X9qSH9Y6VyP:YZMRzf1xHfJvYrPs9HHC
TLSH
T167750295B3A018F8EC63823ECD558905D6B27C5A5BB0C61F13A4365B5F333A11C2EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 cdb64f120bd52818eb1f6e8bf76b616e3104563930f860ce1e81cce17afe56b3
MD5 08f2e90888a3cfbc9b277545f60fe24f
SHA1 2e4acf70daf3dbe0b10f1327f6174cfbcf61920a
SHA512 ed58986dea175863695b41b5d072e964f3cb87312849f5ec785b8e42b68b63df7d6a8ddb5f2979b0756c82910cb44abd0b8b218a1fcea4df25095df13950e891
SSDEEP 12288:TGxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:TGxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T16A552355EDEF8379EA1103BA059353880856BE6EFBC3554A2007B84B377BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 9ec1a0e40baa7d10da9387865767102cc9b0d41497e8fe8529044880f66dc01a
MD5 e2a1e64f778c296ae303452d16f16819
SHA1 d3c35965d95b9b73eea6d32963a5bbb5937b8fef
SHA512 87cd41623147a19bf7abb9e88b13060a49cd84b11deaaad948a808aa339e9a35edbd365611fe7bd6fb53b2f7c3f1ab815cb6ff23ce620f58030e9bfd575591af
SSDEEP 12288:8SxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:8SxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T188552315EDEF8379EA1103B6059253980855BE6FFBC3554A2007B88B377BBA5500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 c46dd7f0862eac6ad732a46b193703e7dd8dbb4f765b4fc48f937426664d02fa
MD5 4c62ebf56fdc3a90b61b7aa235c4219c
SHA1 c41c2853a422b0bf2bfb5933e44c490371f393ae
SHA512 81b70fa6cc6f1b6ee75131a667eaa58edfcea5ab8d87b59b85287425c785acf495b7d7f896195b6dceb6e5d55120e8571bf45eb098e8df54988c2473677ecc08
SSDEEP 12288:WyPz5L8dxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:rzydxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1BF65120777E631F8D532823988A21601B772BC365B618A9F1360567B2F377E09D2EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 700c76a466acc4e71a771d8fcc0d1b14178c2ffdcea2295cc013236d439cfb74
MD5 a0d111840a325567add6c826db207291
SHA1 1685e9d230a2c9163e7fe80972cdbfbf2a1e6fa4
SHA512 263b51551dc4ab60bafe2cb1fc89a535a181da138bd3b56e45b38bd1e5b1c968541bb556de5fd863fb079b85dec5dc8591632f45e8cda9deeed2f2aca036d8da
SSDEEP 12288:8GxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:8GxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T19A552355EDEF8379EA1103BA059253980855BE6EFBC3554A2007B84B377BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f4815eee1debe40f906fa5d8cac068bdee5046b25c05a1f27a2dad43ce221e6d
MD5 eea32811a732338ac064e1fe8ad449fd
SHA1 1704c87e7d1622dd8d0a5a6017b7b861cd737319
SHA512 a662edcf4180b1c2b6199cd33f5a21a3a06242fc5fe0a4c4786c2f1265337cc1a1626909ce6e2238198374c23ce14a64e04fc57661e8dea71424c598cf10451f
SSDEEP 12288:jGxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:jGxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T129552355EDEF8379EA1103BA059253980856BE6FFBC3554A2007B84B377BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 949fb549b58f328766461730d9c51b966e8b1f86c461130bb5db0ec35e93f97e
MD5 38422fa71c556169f384546ace326c2b
SHA1 fe2502cdd7e7a01097a501a5ed0ba4ccb463d17b
SHA512 a95451e56842dc3a92cc2e7d80c02e43d46eba50bd96e9d47bc981b8f6b72d97a976add7224fd9639dd627956388e022e8d220533ab03eb04041068da4ccec9d
SSDEEP 12288:7yPz5L8dxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:2zydxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1B565120777A631F8D532823988A21601B772BC365B618A9F1360567B2F377E09D2FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 46b6138a4611d9d0102f1a119b203f7ee2237b280029db22eb1caf1c6f7d9375
MD5 5b55a4fa613a69b0d4ea430cdb693c00
SHA1 65aea31235397fc931e627bcbc11bc0602b32681
SHA512 a7f7e955986db9a910a6b16afb24bc43ec5c6c464cc57a9d972ee25fff3cc561513d4c38eddb3efde308d820fd0d03df35ba58502973c40a6aeb4c5ed1c67d77
SSDEEP 24576:tTDaLl3z0zDPxHfJaMJWTTXPPC1X9qSH9Y6VyP:tTuLljMxHfJvYrPs9HHC
TLSH
T1157502A5B39058F8EC27823ECD568505D6B27C5A4BB0C61F13A4365B5F333A11C2EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 5a3710194ee5a1fab4ebd20a2d15dc31d425bc382882902260040fbd1d0d88f6
MD5 901df36d2d66008f294e2caaca72f901
SHA1 c903da851f4885a572921275be89ff00c8b295c3
SHA512 09ad0a9dfa098583ed8bcad1c9d7f9aa64f4165ca6e47dd1d7db49140c7234489cf4e148104a36b0cc44fcc9c3758bbb1419e31b92b48fd0f32844bb5247b56d
SSDEEP 24576:j3vd9CHKy7GZDxHfJaMJWTTXPPC1X9qSH9Y6VyP:Dvd9CHKya1xHfJvYrPs9HHC
TLSH
T19685CE90F3E810E8F0B78A3589764511DAB67C5A5B71CA8F03A4665A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 e758d292c1964fee4dbf70fbe029d282b3e44e454df1b2440ce43cb49152e4df
MD5 a9ddaeb89fd943dec865082ef3db2eaa
SHA1 c51d688ae68b44cf864700906e17169656f8225e
SHA512 4f5795399c85a2471797c50e8074cac66c1725aa69af60cb18a5c0ac9dabe1ab810db3c41b0e42dc60dd378033aaa48692a8d79f8da306bfb75ca49f7ac593a7
SSDEEP 12288:5/xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:5/xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1DD552315EDEF8379EA1103B6059353980856BE6EFBC3554A2007B88B377BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 b2a68cb4d454e3d22716061eb87dd99cd8fa278dd0ec8c9dd1934aadf8bc5595
MD5 e40bbb9d17be7e395038dfd81dbff9cd
SHA1 440f5119f1b259633af9d6c788c5d2f5f05b729c
SHA512 0e245bbaab3a02cc5585715a455bd5acc99698ec32c364d24da2daec66d8ad45487477dd1baf10a6830d54f8fde4f0f7d8e6ae1e23574c3543c57c929ed10243
SSDEEP 12288:N9xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:N9xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T10A552315EDEF8379EA1103B6059353880856BE6EFBD3564A2103B84B377BBA5500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 956d5762662dd7c09775da7705cda970518d92d713879ea4d2bc82d0a1c3c13c
MD5 762a45ec7d2388f736456a09cfc9322e
SHA1 6ec31861e98a07f74349bae09692bd80b5a8f217
SHA512 dae4df2325bbe46bd20a70746cd5534c69324314de7ceaeac3d8c87c8e516d3e75803d297ba72899f48a2fda0b6a26479ac1f7e08c0967851e316b6ba02b9132
SSDEEP 12288:H0xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:H0xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T148552355EDEF8379EA1103BA059353980856BE6EFBC3554A2007B84B377BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 716c778538c3c773485378e8f25c0c326d3ab21f7b623e6e51b86a037c89b48c
MD5 f6b246659d157353dc9823578f9419b7
SHA1 b06df59d6694da391b0f02a0f65269e53e4a585d
SHA512 a37ef169b8f949303690ebbb809043d4612bd4d0effaa9091184385900395b0424698e33c6cb26026941aa974a1e04e418805032ff108ca2c66e20be96d139b8
SSDEEP 12288:WGxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:WGxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1BD552355EDEF8379EA1103BA059253980856BE6FFBC3554A2007B84B377BBA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 525611be0164b1fda8aad93815b121900684b90af3e788a84a7512a31b99d67e
MD5 9d39a4c2e7a6d4d0fbdd9c69fe342296
SHA1 95a4ff5feb8369ef16c3d05cbd93ed6c4018a5c6
SHA512 3cf779a50a54a562433fb4e10d071cc67d820541b80a5cb1abd456c67547c816822f319f67480a640beb7a3ac416e44243fb1d125a670a19e1098a96af3e1911
SSDEEP 24576:xfwvUk9RX6wkyAIixHfJaMJWTTXPPC1X9qSH9Y6VyP:rMnYIixHfJvYrPs9HHC
TLSH
T11485D029EBDC44E5E177923C89B3460AF6B178691B31C2CF025A53AE0E37ED45D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8faf3d6b9cf37686ce1e03b544dceef634e428f7ca714a5b12825c9d1056d5e9
MD5 ef5c9d305734dfb5eb73b16356cb08ba
SHA1 5b378b9f63484cacfd3bf302c7d6d0ce68a169c1
SHA512 2c597678049ec95ad605bf6d8960293a521a65c5a8c5f72efa9b8b0f7978883986b504bed79b6deb3f367b948c15b4ca9b336fc691efadd95106f407d6c57221
SSDEEP 49152:/YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0LxHfJvYrPs9Hi:qySzPDgrExHC
TLSH
T13F067C56A1A801D5C1B9C1B98F1BCC1BFAB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 832f0a5f3afdf332b1998436b67b3209ab39fbae2cae0ce38381f031df2e7b2d
MD5 c8741f29ca376660831eec7b7a819c41
SHA1 063c33f1fe54c99f08415ef74871a6b0ead0f756
SHA512 742e511fe76736ec62bdd522cd03f1985d628dda49b1eaade0b442081c31fdc28948a1561b88579e8e14749193cb2245bf77b6804d601c2adfc5e45b7f7ed79a
SSDEEP 24576:M47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYRxHfJaMJWTTXPPC1X9qSH9Y6VyP:M47JUQjTirIhCnDHUPfF/bxHfJvYrPsI
TLSH
T1E565AE1DA3EC01E5E17A827885154A5AEA71782E5F32CACF1270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 40d5dc020d77685030096ba542ad3d9842408487d092a4c13baa3e147c028ee9
MD5 195cbbe01d08d45f959dd60fbe117117
SHA1 d069c8ca2a24a7a97a04e84833bb230bbac6f9d2
SHA512 addd2ac87973c9b48d46fab7849f3ec071b83f4a1e6b87e2b084c0f7f8dcdf020e1f32c68e111a0a8ccf437855720179dd58d90c1e8f8661fe2e7856cc17a41c
SSDEEP 12288:Rbsf2xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:s2xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1E965011AD29842E8D42E5279C7924640B3337C2997E2D3CB22C1F47E1F766D09DEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 736b4acaada85254af5de432605dcfb7e5b7cf3fcde191dc8913e59adc4ad1cf
MD5 11bbc58f4136ddaf633d2a1a706de15f
SHA1 622d4b7c3a020432190959f6b3c98755ec66e73c
SHA512 423fd941e9b78e5fae3e9bf908860e68ef146216c91732ddcc24a60c7d442b0fa67b7d1a23640145753078116699aa5a52e2f3719a033d9bba45ec1df43f41d0
SSDEEP 24576:0o3UPFUy4iTIkknTHOOO2s40OU0fKRgYh0d:h3Uqy4i8jTuOPBVpWgYh0
TLSH
T10C453951766AC75FC6AD80321E33D2CCA7707C05EE45AF0773C8873F8576669BAA2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 28ca88f25be0b9813eb59fb9591ab7e2e2cb8427d3cced6c19c8935a12bdeb6a
MD5 e4a83810f5ab54dab896c43f3c9e5150
SHA1 53a49baf4b9a709f04eb0097b70c42f5237cbbc6
SHA512 263c1739a184dc27f9586ad2616444331e42c9308955a8f6c89036c719a95811e0b7a2d986fae60278d5991ae21e64fb0d7c1ad74dfb49bed17facb92a780000
SSDEEP 12288:f1j/2/P5vufFxENAXGmnmzcNA9lu/eZtkNOgTdYAuoprvXQTHcuk0qAFd:J0+0qod
TLSH
T1D765E8815537E3CFD1F76032072A5B4DB7A4EC07B7496F26B3884539D86AB21A0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3733.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\3733.tmp.exe
Size 5.3MB
SHA256 58ac90cbb7a273cf460f7ba56bb4b3bf7491d3df225a3550e3f88a97449aa296
MD5 57e8871e3535b84423314d7efce75a48
SHA1 858c4f3615513ba59eeac4ca851b2d9ec8ebc9bd
SHA512 f6086f87e138f88d022e2982975dfbbb13460a36c1c58355ff553d538d927836bfbfc81358b15883892e6a86776f7e6a8731fa0542e53267af94978d1be3e677
SSDEEP 98304:aajqHTgFRDKAVYXKbO1EFsNOnPBpJVwjdIG3rUUWVtZE8grExHC:aCq8PCXpTOnsdIG3TugQH
TLSH
T19D46D022BED14173E5A303319AADF77D647DE660072580D7A3D04A5A2D302E37B3AB67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3BC7.tmp

Path C:\Users\Admin\AppData\Local\Temp\3BC7.tmp
Size 414KB
SHA256 7083bba256b59c5e9ba62f700b858e0968169653cec8284e5e0c6e0098e9e191
MD5 e58c7d21a08f8038f2d69cbbae4e7484
SHA1 3be5356e6a32a52d929b3bd2bc13f234ae82801d
SHA512 e1429957e7a7c9fd8299d9ba451006351457e4e6b9485ee5ed74d427c8b2807270c101ec1eb57e1f20b62541655c8a615dc07056b62ba944cbc19c314e85d65f
SSDEEP 6144:+n1u7dN4R/tyONmaXc01FNoqgM01sBMxiftccUMf9uK6+TB8Gm1zSPqIAOimUo:81iyKONVnGP1sBMxifQWuJ+TWGC27V
TLSH
T1D1949E12E7828032D4FB16B0BAEA4FED93F9A4101B2954D7D398494E1F312D3AE35797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42b6caed763f1d8f.bin

Path C:\Users\Admin\AppData\Roaming\42b6caed763f1d8f.bin
Size 12KB
SHA256 7c7ef75bedb34d7fe549ee388859ee60af4a2d200f5e5a186243712574224ecc
MD5 a9d88f5638a965d1b463b4e6fed61faa
SHA1 2f5c02afb3930f2dfdff06a6507a74395d86fda1
SHA512 44332ae74e96af86762ff821db15ba6c376d9f8d1aff4b1e613ac3dfd0be4a05cd1b5cb97464879f655d0548e5becf5846fafab6cd555b0395714ef62f8f1449
SSDEEP 192:01YDtQXZ6ZocKgcJFr6sD6bZXsuwXKBcJOaFzsBSERBbiuD0oK8Qs0iOcK/6:4YDKJqpK/eNbZXrwdFoB9ieQ/iOcKi
TLSH
T19C42D08EC3DA9436F644FF8C6483CF12AC05919421929B0171EBAA5888BADFCDBD0556
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 29c3978d6a1bda2196e6ffa6b2db4b0c499245b35298085b3b700121ae5ea564
MD5 fcd00ce420b871d45ca0780dc8e6ceba
SHA1 55c1beb82c8ed4407d33ef7b9dbc280e706bc6c1
SHA512 1a5edecb8cce9c2320378bb1b786b74557ced20392a2b65e0b769523935254d09e6cd53b6fce0eab1b13c6782ac5766e450730ebf19e58371d96e635ed6103c7
SSDEEP 12288:vF7+xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:l+xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T133552312EEEE8725FD3503B504979224141ABE6DAFC395CB3002B48B3636BD49D1E9B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a32c7a24d1c6fbef8505edaf842e6e748bdc156623711b683b065321aa83cf94
MD5 312f14c24af540bec59875d3b9925c5c
SHA1 71a0c975b15afe1e90bef0cbfc742bdd9541f673
SHA512 63c6df9cc6bb302b613d5557a286c69d1da85c49cd2c3687cb0c2e56e521a9644e0bc03cd0b775cebe16f94003b7c4a9c30cf7e3b6d084e2ab4bda8d07a3d9b6
SSDEEP 24576:Lgb6bmBIi49WNNFpg1rSvFv7bYMxHfJaMJWTTXPPC1X9qSH9Y6VyP:Lgb4mBIBhGFRxHfJvYrPs9HHC
TLSH
T12565AE1E22EC02F5E0F6D2B8CDAA4417D6B278161732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 4491526016aba0ed056b04b61bed1f7a55f4b6e6050710294cbea9b5486a3ce8
MD5 8386b91632579ac71e080ba40a76f66b
SHA1 03f9718aafb54a4113c3ee1d0de307330d38f0b4
SHA512 8c4c48949bb1f3c86f7340bb0812cbd3827c1fa21e20213353f5bb62546d2068387abf9cb933db8d11179d0445996686755dd7a661b21365690bc0298be63888
SSDEEP 24576:vG88u8FpJqH1bzria7/mBxHfJaMJWTTXPPC1X9qSH9Y6VyP:e7ZFPqVea7/UxHfJvYrPs9HHC
TLSH
T16285F16576E102F0D477D13889824663F6B2B8251365EFDF06A88A461F33BE54B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 04cc594b99c45cb91b5a8b1a52d16d53a66718b22b39b590298aeb385eadb660
MD5 cad4372b38b9e59f9c605d95511f6dc6
SHA1 aef811c9cfbb28300e7c4087273918ed0cfa8fa6
SHA512 5f1d76a99681048ef243e472199e5dea8c4ba64614f196cf57aac2186f3a561781bda783e98f36fea0460891f2bf7b2aabd33d4aed78921e434533eb49753368
SSDEEP 49152:nBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjlxHfJvYrPs9HHC:YG05lO43bqgrExHC
TLSH
T1A3D5CF6A62EC11F9D1BBC17CDAC6460BEBB23825033556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 411a6118600eaf897380686687d3bb52210575e465cf0318df06f692aa620803
MD5 e2389755328d6e0f3085d6843631f084
SHA1 096b2c89e956064d8d5054ef27b738958a26953a
SHA512 59d5a012ce6408f1940e52de6ddeb5e49566c3917cdb97a80292e9cf39783ad6c81da931639dd99d0e6de7a6c6daf8f72f509dff6fa155af88f2bbe1c016fb50
SSDEEP 24576:mfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnLxHfJaMJWTTXPPC1X9qSH9Y6VyP:+a5POZ3BJt2pasx2+m9xHfJvYrPs9HHC
TLSH
T1DB65BF5EA6FC01D5D579D17DC583860AE5B1342653329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 18b72fb828f4ebe0689878371907048c9e30d58272a82133d8240f2895f615d2
MD5 69ffb9ca1c053764fb2bef2a61d596c1
SHA1 0ab77d1a348cf8d9810b8e3f9e82b91efe44d90c
SHA512 4d2ddeb21d2bf2a020ce3a214aa3e82eb1e4a31f9826f88ab346fd6bfef67dc4ddd82c218e45f2c67c775bb7f7fe31b9dc2cedac9e4b5d8cf49ac9c276a51eed
SSDEEP 24576:5NcwHdjbyQ4nLC18lb/EOjowL7FkZxHfJaMJWTTXPPC1X9qSH9Y6VyP:5Nc/zEOVHF0xHfJvYrPs9HHC
TLSH
T11E858B1623E901E4F5BBE1BE89679546FA71786913308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a3ce8a380b8cb0cbfcc3e03ee78bb5c401e53db5ae35cbfdaaa69cfad4d4cc27
MD5 a25b536bcb8d922befb05d664b4a359c
SHA1 104bd07eee623c27f0f892300792dec697227662
SHA512 ad30931fe2f1f6a8276dccd83fb3d337d77badd32af13985126167ff2d48447abbe217e57f73faf1b71a6eff5b820c55b97b1763f65fd38aa14307a64c880992
SSDEEP 24576:mTkNvNnaFeYhJNtmZBmKxHfJaMJWTTXPPC1X9qSH9Y6VyP:mTMwBtOmKxHfJvYrPs9HHC
TLSH
T11355AF2EBAF846E4D1FAC6B5CD238512E6727461173293CB5290C13F1E279D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 72867bc7173ab2c1f2f99be62f46c5472bcaa9f5a454574378c49b2fcb366f56
MD5 fa9e93a22524247fa64a2aa91804171f
SHA1 5646f63742a65d00aeb5485bd79aa19b57cf7275
SHA512 18f71e750e6bb9f9d1c80c44cedbe673b87af7f1d39cd57f9c22676c5ae0a813a730bce93b75b9505592353c7d0a6a3a9e87807269a9442c65199d887a29365c
SSDEEP 24576:XPUr+NQ1xHfJaMJWTTXPPC1X9qSH9Y6VyP:XJQ1xHfJvYrPs9HHC
TLSH
T1B265F12F66ED18E5E636917D85828309E771B866171292CF0291817F1F37EE8BC3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 990f1b5821a3507064dac285500e73e0ec5aa2f1f850f64fe70addf52e4a2ffe
MD5 9e402a2875e78e1d0b53554e506ca024
SHA1 90589b74a41ec777362335959ce8551083f1b862
SHA512 d7892efd1c09eeb52bff33fb05bfa98843008600a0ff6a277e637accac183910b3a09493d63f0c9f27f6f27e693199d398865a7134263bcfa552cd659b69520f
SSDEEP 24576:3D3FHshBIYQgA6xHfJaMJWTTXPPC1X9qSH9Y6VyP:3DVHeBIAA6xHfJvYrPs9HHC
TLSH
T14775E13DEA9D04E4E57AC2BC86638606E67138AD032256CB0194D1BA1F7BFE46D3DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/112-162-0x0000000000400000-0x0000000000969000-memory.dmp

Download

memory/112-45-0x0000000002720000-0x0000000002786000-memory.dmp

Download

memory/112-51-0x0000000002720000-0x0000000002786000-memory.dmp

Download

memory/240-82-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/240-61-0x0000000002370000-0x00000000023D0000-memory.dmp

Download

memory/240-79-0x0000000002370000-0x00000000023D0000-memory.dmp

Download

memory/240-50-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/240-55-0x0000000002370000-0x00000000023D0000-memory.dmp

Download

memory/1148-301-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1148-86-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/1148-94-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1148-88-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/1196-121-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1196-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1196-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1196-36-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1348-153-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1348-146-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1348-155-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1348-157-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1348-147-0x0000000000BE0000-0x0000000000C40000-memory.dmp

Download

memory/1588-330-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1588-104-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/1588-105-0x0000000000A40000-0x0000000000AA6000-memory.dmp

Download

memory/1588-99-0x0000000000A40000-0x0000000000AA6000-memory.dmp

Download

memory/2364-142-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2364-333-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2364-136-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2364-134-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2932-69-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2932-77-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/2932-75-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2932-271-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3728-348-0x000001BFB22A0000-0x000001BFB2920000-memory.dmp

Download

memory/3728-415-0x000001BFB22A0000-0x000001BFB2920000-memory.dmp

Download

memory/4132-24-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4132-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4132-15-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4132-98-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4452-109-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4452-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4452-116-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4452-110-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4452-350-0x0000000000400000-0x0000000000460000-memory.dmp

Download

memory/4452-352-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4872-44-0x0000000000400000-0x0000000000969000-memory.dmp

Download

memory/4872-1-0x0000000001120000-0x0000000001186000-memory.dmp

Download

memory/4872-6-0x0000000001120000-0x0000000001186000-memory.dmp

Download

memory/4872-8-0x0000000001120000-0x0000000001186000-memory.dmp

Download

memory/4872-0-0x0000000000400000-0x0000000000969000-memory.dmp

Download

memory/5312-337-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5312-163-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5312-170-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5312-164-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6068-334-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/6068-336-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6068-122-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6068-332-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6068-129-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/6068-123-0x0000000000770000-0x00000000007D0000-memory.dmp

Download