96ac014b59547fbb22cc74aa4cd255f5323dc06e02c05ca30469a5b75b76da4d

Analysis

max time kernel
132s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_90cc21614db1356223e81f9adc99eed0_darkgate_elex_glassworm_mafia_remcos.exe
Size 1.5MB
Sample260712-ph4lesbx5s
SHA256 96ac014b59547fbb22cc74aa4cd255f5323dc06e02c05ca30469a5b75b76da4d
MD5 90cc21614db1356223e81f9adc99eed0
SHA1 9ba44937515ea5c56087e6b73932e1e923db4324
SHA512 775eb90f8bf7652f7975ccab6f8b3416846a5853d5714f33c1f33bfa9ccac685f59350680b793831b32fbcb8f712f70a4b3323df06c38822ed097c69a9655ae5
SSDEEP 24576:yvrHWdZcy20yzWfrCQHzLZTMV87BbkjCMvGdLtJy260x/+4QG1eNoZGV9YVJCLW6:msUO2QTVTb7mGVtw260d+4QQyoYViPC9
TLSH
T15575AD2237E58035F1B36731693A931499BABCB29839840E73DC666D2F70691CE74B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
5844	alg.exe
6052	GameInputSvc.exe
4760	GameInputSvc.exe
2768	elevation_service.exe
5660	elevation_service.exe
2376	maintenanceservice.exe
4784	msdtc.exe
5168	OSE.EXE
5856	PerceptionSimulationService.exe
5792	perfhost.exe
2124	ReFsDedupSvc.exe
5788	locator.exe
4428	SensorDataService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-12_90cc21614db1356223e81f9adc99eed0_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-12_90cc21614db1356223e81f9adc99eed0_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	GameInputSvc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-12_90cc21614db1356223e81f9adc99eed0_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\20626b5a23e529ce.bin	alg.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-12_90cc21614db1356223e81f9adc99eed0_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-12_90cc21614db1356223e81f9adc99eed0_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-12_90cc21614db1356223e81f9adc99eed0_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-12_90cc21614db1356223e81f9adc99eed0_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-12_90cc21614db1356223e81f9adc99eed0_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-12_90cc21614db1356223e81f9adc99eed0_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-12_90cc21614db1356223e81f9adc99eed0_darkgate_elex_glassworm_mafia_remcos.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-12_90cc21614db1356223e81f9adc99eed0_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	GameInputSvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-12_90cc21614db1356223e81f9adc99eed0_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	GameInputSvc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_90cc21614db1356223e81f9adc99eed0_darkgate_elex_glassworm_mafia_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4760	GameInputSvc.exe
4760	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4204	2026-07-12_90cc21614db1356223e81f9adc99eed0_darkgate_elex_glassworm_mafia_remcos.exe
Token: SeTcbPrivilege	6052	GameInputSvc.exe
Token: SeBackupPrivilege	2124	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2124	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2124	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2124	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2124	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2124	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2124	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2124	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2124	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2124	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5844	alg.exe
Token: SeDebugPrivilege	5844	alg.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6052 wrote to memory of 4760	6052	GameInputSvc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-12_90cc21614db1356223e81f9adc99eed0_darkgate_elex_glassworm_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_90cc21614db1356223e81f9adc99eed0_darkgate_elex_glassworm_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4204

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5844

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6052
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4760

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5660

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2376

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4784

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5168

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5856

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5792

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2124

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5788

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b59e2f084b4a7af1837cf3c5952c4ed0770adc23cd767dcf32b591e0de3606c0
MD5 a41eb533dcfd1ea556af127f53894221
SHA1 d80eefb7a24f0c3803b42686665e5bc7c6769cc6
SHA512 b082f0eaee218c934fbae99975cde499a64afb592600f5be0a0ce7d0c9919f13ec1f56272b3a987f210de5a7154240b728857187ddf97b5c13a766f4faceccbd
SSDEEP 49152:ywG632BuPkFKRrdE6oh7stBhuXjfS4LWxn/260d+4QQyoYViPC9:33q6gjBC03VG
TLSH
T1F2D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 05b638f1f4daf9a4e9f7f0a1130596fe517604053c19951cc6c6d7e1efd769b6
MD5 f9803f59863b87fa94651f8af7d7938b
SHA1 3f414b8f13cb770e5c107024622a83b045c40632
SHA512 c75f38c869f5856dfe63229a953387a4490480ce3bd5a24b68307993b4452d6a955aca0f63f90a45ed2e473c4ee3a64d3121153ceb1d1f9b7fa6a8b98b8232a4
SSDEEP 24576:FXY0qnczAtky260x/+4QG1eNoZGV9YVJCLW6:cnc8260d+4QQyoYViPC9
TLSH
T1C705022877E409F9ED6B8239CCB2C502FA33B85547A0E75B03A4D9661F232C85D3EB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 698f6af92674a5440fa63184c3ca89ccae00daf601b6b35e8f407ecfc5a651d9
MD5 c71b4ae2397ceeb08170deb5e71481c3
SHA1 00131b72eb9b74908a4e34d7efec72763b00754b
SHA512 5035d452081e86169b6022bce6cbb21ef4bee22e0a55f5aa1442ddf341cd0cff30f9bb548b9fb9dbcf3456c37a14e4bbc58d48da1b6909d676d609e354815080
SSDEEP 24576:u0JeOaw0h6/LrMgy260x/+4QG1eNoZGV9YVJCLW6:uqaw0cTa260d+4QQyoYViPC9
TLSH
T12845AE16F6748331D073C0B9C5D2A68AED7230865B308ACB4296D77C7F67AE6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a4fecffcb677193c5e5dc6f2a8886bfb83a6b5bec280e5e1d762b34b916f13a6
MD5 201b15a3d884e9540c7ad3107692c1a8
SHA1 fd141b1fc6f1e6b32a0090a6079e594d33fc5455
SHA512 7abcaae8a98f6b26fa02509b78c673625ef5ea196340501dac9806336748e123a4296c1a7ca39bf588c39a15eeb077eaf500dea6e69079aabc5c0b5f797b5beb
SSDEEP 49152:0/ezSC6vUzPvuHjyG260d+4QQyoYViPC9:gezSC6v2XuH503VG
TLSH
T143756C15F5788323D0B2D0BAC5D6AA9AFE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 ff32571847218330d22598d2adc05e9779a5f59f8e67bc0dc2a8a2fbbed9b22c
MD5 477827df9fb568828973490bcc14ee12
SHA1 4afc871f20a6bc1b2b98eaaa099a468c42e72f17
SHA512 fd2dfb8eae2bc3d2f73a70c3a58143203ec9c612ce1f8d4c54b9deac05ec092ec81b9d1338907d14cd187cf8ee35d2ac8dac6f1b67e60e003c2b896ebbc367f3
SSDEEP 24576:gablPY4bV7Xu+d3y260x/+4QG1eNoZGV9YVJCLW6:gaW4bVju+4260d+4QQyoYViPC9
TLSH
T19D559E66F6748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 53c84d8fe848aca1bc5e7821fd15f6e0057b34019bbe22e846fa6d650bca88d1
MD5 8e7df399abc980f92382a8f36c6e111e
SHA1 5eb697cdddcd50540a133021aacf68bb820ea64c
SHA512 04be58dc98834e5fb173e943c50f3087423ed749fcd8426304b91cedf38eae1552002056aa37d00e5de4ea09ed2554fe25a030e5d19bc5bbd519b7443395dc00
SSDEEP 12288:Au/RHZRyj66ypKWa8KgIL54+qVyjG16JC0NGPZF4V6eYzAifnhXp0LW6n:Au5y260x/+4QG1eNoZGV9YVJCLW6
TLSH
T18DD423853B791282DFED4B3338F79E03753ECC2A69D45938AA20FED78532485E85161E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 d366e92931f766b70c9bfc9bc1d58fed3ec0ce665fdfc4739895f745feac41ac
MD5 a8f14f7904c95f82a15dd2e771d71c8b
SHA1 28bb52adb0211d155ffdcb8c9b0ae8a5bd1565b8
SHA512 609259af510310a07efe87863d8abc6b60b9897f96af46706c95c95877ad9e85196003a0d73439f593f311d551e45d3e14014d713dd9d05f20d4e49658ac5f1d
SSDEEP 12288:UeBNUbTVO86Us6RHZRyj66ypKWa8KgIL54+qVyjG16JC0NGPZF4V6eYzAifnhXp6:UJIUFy260x/+4QG1eNoZGV9YVJCLW6
TLSH
T1AE15CF7BAE28FCD2C67E8D795A918600A77278304F61A3CBD174C20EDE235E15D79C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 04513862fe2c4ed52594144173e4407c50dcd0d9d42aba02e63530656a1acca6
MD5 e07513917aea130e4cc5f9d2784948a7
SHA1 af0961c533877554962efffddd24dc7301400c3c
SHA512 35ac887c105bb997ab0db2f001a9b5cc7360bb73ec9cca56113227d712a0f039b7c3c858bd3ed66188e099fe206f82d4dcfd29792240aca51cccbf36476338e1
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJ99DN5J8NRV3THq:jQvGAdlCEL8c/9RNw5C303VG
TLSH
T1D1366C656BF880F5E0A7E134897AC672F7B678421D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 386471f61561af626ec621a027120cb26aaa0a1b35bcc77ff868d7eb1d763625
MD5 5030aafbc7c75adc0f637f55f82f9974
SHA1 1ba61947717966316feb53cd350f40d54364fbaf
SHA512 7902818d8b098f24655da49b30010a7aa8eb1466942050da8cda5ed83fd00894fd689345ef087b51c5c03308952015986d1402f44c9c44e3be25e8c085f63ba4
SSDEEP 24576:ZmewsAjEy260x/+4QG1eNoZGV9YVJCLW6:Mlj1260d+4QQyoYViPC9
TLSH
T14215E031FE74E032C6BF0DB21B76C716247DB9204B9119C3E3A89E9E59301D26776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 14.2MB
SHA256 4a1e33c64fea9e0f6d9530b991e0cbd19912915f8fa061790deb2f640458fa37
MD5 00252e8e316e35f48f5bf0bf9ba6eb81
SHA1 13ba7ddfa46f054911ebe261a5235144149434b6
SHA512 0027ca7b4397ee0ab989f132137a123afb207799e8f15e87d8cd2e8639c8c6928bb464b974e51db3e13e56e5b013b504b609759768601a0e2a163ab8dd67dcdc
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLyXFldD:lUEtQevvqc2W1cpV2XFr
TLSH
T19BE65B9667F802E5E077E978C6A68573FFB178410A31972F01A6C71B1F3B6A09D2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e0096344316da37ff4855f760c9c082ee50992465825204dbe94a8558c7d3d69
MD5 1e66db5eac1b32dde92a29c971c1b4f1
SHA1 15345c9b2c1dc44273dd1098f1a7f9058418706b
SHA512 5cbf7aa52b065034e4286d6cd5b2e34f91e853c0d8d9759525793c99a1f5b685ae5a45d9861eaebe9eefe6febce663fa0d811ce4738acede8c1db5abd95aafe0
SSDEEP 49152:ZkbRquA/m2yL5zMfFiV+XenmE3/z2260d+4QQyoYViPC9:koq1Vjnm303VG
TLSH
T141D58D0976B8C2E4D1F6C77886A2C647F37178154B34A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8ddc1927525bff36f57abe0857b30f9531af1cd77fd6b59bc324834d4fdb0914
MD5 4826b4e45dce97a1e9aa6bba299cd7df
SHA1 e5a10b9b12b67bbd97ac967ff508bb16a35fd047
SHA512 6a1a239a19fb889b3a7429226b3803e623b1a3d284c0d7e99506a703b46407af5a63175f79f85af4482bc18c0a8681cf83781ef5583f608d89e502bd495f8ef3
SSDEEP 24576:RAhGLvIFoiwtA5l7S535y260x/+4QG1eNoZGV9YVJCLW6:RAMcFoiq5w260d+4QQyoYViPC9
TLSH
T17F459D81EBF955D4F5B3AA7859B68571EA76BCAA5E30C20F2160D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 703d87c7f40420f80cf689780cbe2478e1f77ccf1404635150115e9bae3017c0
MD5 32c6576592be91b9d5f3aaf331971b40
SHA1 aa94f444a57202e2d5bb02994e7809b4aae51972
SHA512 583827b3718d1e5423c985bcc793e05e8e9c276639baef124c4e4cedfc19ed0d4cb77d9e777bf01c134185993a77857879a4f5f2106a4678cd217faec5baa57f
SSDEEP 24576:uwuuOWMy260x/+4QG1eNoZGV9YVJCLW6:uwVOE260d+4QQyoYViPC9
TLSH
T18F05F14637A40CF9E9A7863585A7C536F7F2BC122A60DB2F1760C65B5F33251BC29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 e4a33294e8c412f17e0b2f20523dc7e385dfc2ba04bf0ca37c10f2014fc7d6ed
MD5 f81d442585d27cdff5f41162e5044005
SHA1 630a161c371fb9b7822d0028157564d1ccf0aa2f
SHA512 d50a9a3185e625befb49a2acb5e82513881ee840f891694dcba8e2c5a0f2392c03e546132f8943d99d63e715426bbf0255bde43bd7a83e10d383c8e4f52e2300
SSDEEP 12288:Bfg1II2RHZRyj66ypKWa8KgIL54+qVyjG16JC0NGPZF4V6eYzAifnhXp0LW6n:tguDy260x/+4QG1eNoZGV9YVJCLW6
TLSH
T175E4138937E420F2D9E7473658F29B06F772B86727B443DF162086A61F23AC19C35726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 fc2550c3b4d5267de534c1c8b515b9c2144e7de8720e9e3593bf4ebc29dbb8de
MD5 5da80140da070f776a27f95986433d36
SHA1 08a08fb43607a659efc1d9155060316a55be17d2
SHA512 a55a5badd6dd1cef8122ea96cb5b0981eef1dfb2808afde3d8d59292aed5bf9209a1c8ec4faf0a6e0884812337f8f7bdd0a0ad3e767b4ba0a15c3583854906f5
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U6:CQRQyi36YOcP8Lvw2gAf+PN3003VG
TLSH
T16D667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8332eff6fb2d931bd2a8c34102831e4a95148f3f9130210a08a4cf922b0bb405
MD5 c7a43556968d54301aa263c811ac9d12
SHA1 55eee97a7130e6294aa9bc3b982f762b1afba2d0
SHA512 10a098da9574a540de365ddca1893002b42660b426cc3400320ba1f27c95efa4b34d55359f6ed92c8e23a205a1ea4c0b3e3f0cebf83dea91adb96ba4e955f5f3
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Ub:CQRQyi36YOcP8Lvw2gAf+PN3t03VG
TLSH
T1DB667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 05823deb6716c1ce50209175daad48c4b169aaa0c4e0c66fad537efb97d2684a
MD5 4f96537728867cd10931a128b9ceb477
SHA1 210185e0769be257d1aabe534e674a2c0457aaa6
SHA512 00251bdd195867ab037edbb9eda7586651490ce2416f0ead9d7dc029b5f411e64f0ea4f59a8946889a49b40541fb16a5a486059fd9825033131c7f4d4b858f59
SSDEEP 49152:268Qg55nhMeWu7PNU3/d260d+4QQyoYViPC9:UthbRc/Z03VG
TLSH
T10BB55A33B2F60099C44DE1769F4A873196E27C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b2a37e6e395627ee45899651d9115b68f6fa10cc64938c73ad12f8fa0b033650
MD5 8521ef5b63fce99ce4af9a48f40c34f6
SHA1 cd0bef21cb82471d74dcd0cd5d58dc85c3478872
SHA512 9ad0ddcfe94663e77e22a4780a06c5d421d528b1dbade76cb07064f2d0d8a5f68a74f1ca421b2276f999f9ca19e38b3fd0d3dd620f8726cfc044799f6fea71aa
SSDEEP 49152:D3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99v:Wy5112gYy5azzVv569nLKnhZW03VG
TLSH
T184167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 afa2d9f581f4d7515f4fcf1b7f3837e3209a88bd9255af07a7a2b5100431ee87
MD5 e80e44b7ea11b8d2153609fb27635d50
SHA1 72ca00418b9b46778f1b7383560732aa3393fa2d
SHA512 c123f53c527be3f5182d3976f94e0819889aa6d715f6ed6dfdf37622b7d1f2929c2c73b4e1fef0ab31004321094403f7c94bd0ecf4df73bff9cfd5969d99d92f
SSDEEP 49152:QM+taZ3usBWOBr4tEGp0bqx0z+n217aau1glD260d+4QQyoYViPC9:Xu6JmTxd2dv03VG
TLSH
T1F2D59D13F1DA01E8D06ED578974A9233F962BC490B34B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5f227874eb1f2530dede14bac9991cc0e599ce5c7cbbe3b97b41da96e1ee9f1b
MD5 f3fb8bf3fba06bd402e517dbfd9f8d42
SHA1 0ea951a60fd44a5eb48c4383deab2a219f07c3a2
SHA512 f31db9204cb86d974ed7373137261feec512a64b49c748d83734fa09dfb72a7df459584de7101f24500fe9b83acbf87020885a43986d0a913d3730930e1dcfa7
SSDEEP 49152:J1hpsNoJpF1A6UU44CwH7R4xo260d+4QQyoYViPC9:JmifPbR703VG
TLSH
T19CB5BE13F2D901E8D06DD17887569232EA72BC460B34B6DF0A90B7961F7BAE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 08908e1fb5cc432cef5e9f82f751bc8cb61fe250ab5e0e5e12c15ae3837957f9
MD5 ccabce71fc5387d4e72bbe39f44f5faf
SHA1 6f6a32c7e3d5e138e36b8623fa0af480eba0c03b
SHA512 d6d4e2b979a15114deee10be2517967c91277e076722a4d2072c6ecf2052d3c560d10fd5d6fe18abd9bf052ad5d534a5cfdbf8fce2a171eafae3386da48a7fca
SSDEEP 49152:iSuZQIY0Be2K6RVtOnks6NMHqB260d+4QQyoYViPC9:85dKoi61t03VG
TLSH
T10AC5BE03F2E901E8E0BED67487669632EA72BC464B34A6DF064072551E77FE09B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 005622922f7b6e2a9a0ad3f0fd848aad266e1386206746741feb1e5aec056d4a
MD5 0c984a661828950350a1233d06583dfe
SHA1 5ffc82ac9342da0cfb45bec38c22424f9ce044a7
SHA512 00973503630c18eabadc76b5f9879be6d5fecb8db8b73edaa9fb25b825348496660205b764d54636d4a26d41d86e3a9a4018d743a7be8a3ccab2b2d833589fe6
SSDEEP 49152:LxfSn8EApI0figTgiDn0AP5wJ260d+4QQyoYViPC9:MX2iyphe03VG
TLSH
T104A5BE13F2D900E8D05ED175C7568632EA72BC160B34AAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 c4f9b38906e041f4b6aade0a40855dc266435912a3a0daa58bb952586a2e2e45
MD5 910b6995cdb9ad42094b0794fb50c7c3
SHA1 231908e2be7182bf2cffb14308c51f7b298f03d0
SHA512 2a6961a6364453176bccc4ed1e55166826eba52be313feda849a82c6de4d3e12d0f2b96b0c5d68ccf3c1fc2dd98905c06f46a0416c89ca1d3c27ae3b8a2ec59e
SSDEEP 12288:88RHZRyj66ypKWa8KgIL54+qVyjG16JC0NGPZF4V6eYzAifnhXp0LW6n:8Yy260x/+4QG1eNoZGV9YVJCLW6
TLSH
T14CD423853E7A0283DE994B3334F39F07753EDC6FB9D441397B24EA939622885B850A1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 4f4678a07d97351642a67cacf956db577a8351c87b64fb7507aed87cfc7e40f2
MD5 3d4234feb3874eb3b9a5fb495d6048aa
SHA1 dd8e3cf9f185762f1feb685e0789315e249e4dd7
SHA512 22453b664791ef84c2b4a852d24927ce3e8ceffbdf2150b535defe1856f5e8bde6b9099d0be2c378f0b87336fc2b37c3a51060bc6029081f196560d4e99c5660
SSDEEP 12288:aPRHZRyj66ypKWa8KgIL54+qVyjG16JC0NGPZF4V6eYzAifnhXp0LW6n:aJy260x/+4QG1eNoZGV9YVJCLW6
TLSH
T12CD423853E7A0283DE9C4B3339F39F07793DDC6FB9D441397B24E9939622885A850A1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 201719e8adbc138db0d6e542192e399da13b2b10a064dd7aa854c0eedce164b4
MD5 e01cf8625065a09db5164c5c37f1ad67
SHA1 dbea62206cd55e02af24d2ff53fe91a56a1a02ad
SHA512 9648280648ec030754f0230956dec4ac4f98b9b3eb2b08911ebc47a0bdf903ab1eef8a54d792abddd421168aed0a8d2a818270d0adb9a0f9a339ad6eb27be89e
SSDEEP 12288:0JRHZRyj66ypKWa8KgIL54+qVyjG16JC0NGPZF4V6eYzAifnhXp0LW6n:0Dy260x/+4QG1eNoZGV9YVJCLW6
TLSH
T1EFD423853E7A0283DE984F3335F39F03797DCC6FB9D44439BB24E9939622889A85091D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 623KB
SHA256 db7212a6a3cad4fc27186b020a45cdd84212832872fb071c6f3c45b592bf9fc3
MD5 fc6d76cce5ecb73e58d7a05448f958cb
SHA1 55bb8f598b2b97281171cc6c4e5a44a82a7c42c9
SHA512 d39718d6265a3e5d2d9b8c0c547ab9c321151bcc1124e727de1017d1de3b2b558e51716e08ef645c93f153a6e095906a0bc02b8f7715af20b0e6c265d0b39507
SSDEEP 12288:8lQRHZRyj66ypKWa8KgIL54+qVyjG16JC0NGPZF4V6eYzAifnhXp0LW6n:Py260x/+4QG1eNoZGV9YVJCLW6
TLSH
T1F8D423453B7901C2DDA9C73358F39B02B679FC6ABAF4563F5B1099970E22684AC20F1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 95fec763a32ede699471b53872172d4919280c92f2db0ab57287750dc36c0585
MD5 cb81dd1a7e0ca2cd664c4ebef18b6266
SHA1 edaf138ef258b1efaf7143be916f466ac3a983f0
SHA512 f785946577550d015de427e3be8206625e9296b276fec5558e4beb3abcac1b7a0d0bed7d2a8dfa481ea40424dda1297d12f82a02b2634bf30401f83a8ffa0f27
SSDEEP 12288:j/RHZRyj66ypKWa8KgIL54+qVyjG16JC0NGPZF4V6eYzAifnhXp0LW6n:j5y260x/+4QG1eNoZGV9YVJCLW6
TLSH
T109D433853E7A0283DD9D4B3334F39F03793EDC2FB9D44539BB24EA939622885A85191D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 d1b94ef22d3f69fbaa62fc24eca7cee6f6575edef412838ffc3992b288e1994e
MD5 68ddf262df073dcb86a4c91fe4e37110
SHA1 5a55ce614c499f61554001bb657bb363c28f6922
SHA512 49ee5db79999e9fe21b3dfef07936cab3e4fac73816b5e3a69a0f3255f8b515e7f2989340c38b617d3c2606965b4a963195a6168df1121986b3b111a6b85af3a
SSDEEP 12288:w9hRHZRyj66ypKWa8KgIL54+qVyjG16JC0NGPZF4V6eYzAifnhXp0LW6n:wFy260x/+4QG1eNoZGV9YVJCLW6
TLSH
T13ED433853E7A0283DEA98B3339F3DF07753DDC2FB9D441397B24EA939522885A85091D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 f92f80d495572a3f40606b1cf609fe677f622a50472d666a6ca98140ff4f9797
MD5 47208a003c67d58a8f2b2fd108d892b1
SHA1 42fb43d57d431fdd9dec2bcbde75da44ca4572bc
SHA512 cd6990981972fbb37526d71678014cc4df9db7565cf756f571af7e52524bd3b2c5915ee5bae0f50c95b0cb1e795966d9c9c67b201d9dccbfa57286f4ea14c4a2
SSDEEP 12288:DfwRHZRyj66ypKWa8KgIL54+qVyjG16JC0NGPZF4V6eYzAifnhXp0LW6n:Dsy260x/+4QG1eNoZGV9YVJCLW6
TLSH
T11ED423853E7A0283DEA94B3339F3DF06753EDC6FB9D44139BB24EA935622485B81091D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 864KB
SHA256 f426bdfe78f70e3d1e6b824707a2d6f1f5bad8edd7979bab0288435a12eaac44
MD5 8a391c0414cfad23b5e6a02a11fbb7ea
SHA1 c29e5e3d48fbf20e2764f3883756da46e61f3d32
SHA512 8fe8a610cf154172d108b27723f8c00da9df4aee689ad8cfcbe59acff26bbb4876f6a50a99f95ff25270ce5311aa071034f25bb345338d51ef0d9219b9d6a915
SSDEEP 24576:RZM0zFVS0kSy260x/+4QG1eNoZGV9YVJCLW6:RZM0zfe260d+4QQyoYViPC9
TLSH
T13A15029573A018F4EC67823B8D658D06E6B2BC1A1AB0C61F13B436675F333915C2EF5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 acc32a1a16d9dbb08dfd7d2a2e3417340b065daf91280c43928e4f5845731b42
MD5 75921da0d91616b497dffa2d66526334
SHA1 129cdf70b2966d27276f3ee928d550984bd348a9
SHA512 56d3b0fc086529a6933078128a05d5add54391a94771cf07652be4b20a58a0c3d0459c720c8dbb5964156cbca8f14cf414d2708c2dafe3e50a3778a580eaec41
SSDEEP 12288:cURHZRyj66ypKWa8KgIL54+qVyjG16JC0NGPZF4V6eYzAifnhXp0LW6n:cwy260x/+4QG1eNoZGV9YVJCLW6
TLSH
T1B3D433853E7A0283DE984B3339F3DF03793EDC6FB9D44539BB24E9935522889A85091D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 50f4d011c26b09e0448c0bc0c84bc3e0a002116def77018e0ea2218ab5043e23
MD5 278a68614201e979e7d7d445e3f0c449
SHA1 819884335951ac098d20c710a195392588a472a7
SHA512 c0903c82e834b35bcbbf75891ad64212a5521d529bf12317ecea5f001ffb7c331c7571e21519846922f6b9e0095f5ff6dfc23f73577fcd34cf821a0962442de5
SSDEEP 12288:SCRHZRyj66ypKWa8KgIL54+qVyjG16JC0NGPZF4V6eYzAifnhXp0LW6n:Suy260x/+4QG1eNoZGV9YVJCLW6
TLSH
T110D423853E7A0283DD994B3335F3DF07753DCC6FB9D44139BB24EA939622889A85091D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 35f01ac4df21088707ae32b47f9a1704128182aa6730c1a5aee27e299472ed54
MD5 a2ba497185522afac3793095ebd92aef
SHA1 2da638570f0a315710950e5cc52bfc659a2757b3
SHA512 3dd2b3266fcac1491df44dd98467a92f8a7b7ed97e9a01562c7b6062d55bf94d3745092f74d2390647bcabe4186e109006651e7f6f8204cdd93b5e0d8cace5cd
SSDEEP 12288:5aPqrLdYRHZRyj66ypKWa8KgIL54+qVyjG16JC0NGPZF4V6eYzAifnhXp0LW6n:gq98y260x/+4QG1eNoZGV9YVJCLW6
TLSH
T1D6F4124737A531F5D576833288B21E02F776F8365BA08A2F176447772F23691AC3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 0d01365b1830efb3fb2d4395aabd636b90f922d4248fda27deb34d801d3a2d80
MD5 5bef19f4b5e417ef89d917b59dc5d0bc
SHA1 4b9cc79c006b9df5e0c513fd85622fbac4f86c27
SHA512 5a360c311a5bb279a531ddbf2559619078e287b6864a38d74aaae2216536d8eb82785834c81bacd19bb21a3bc3724993541ae88caf7ac088dd231e17ca5175ff
SSDEEP 12288:QVRHZRyj66ypKWa8KgIL54+qVyjG16JC0NGPZF4V6eYzAifnhXp0LW6n:Qny260x/+4QG1eNoZGV9YVJCLW6
TLSH
T101D433893A7A0283DDA84B3335F3DF07793EDC6FB9D44539BB24E9939612885A81091D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 a5636bf619f9eae474f0a109316890a545e65961262cfa3a2e45ba260b92fbac
MD5 66b236ee1cad3c73fc48bbf4672e376e
SHA1 a78e8b4742a4cc693a42e7442e52049f501df2fc
SHA512 edfbcedafb466518e7a1c89e310c14698fcdf8c5c99cb6aa5183a2cdcdcf97e23b7b54dcef6ea91f22f9006280237b01f7003bf48a9859846a4ba15f66c29f19
SSDEEP 12288:YxRHZRyj66ypKWa8KgIL54+qVyjG16JC0NGPZF4V6eYzAifnhXp0LW6n:Yry260x/+4QG1eNoZGV9YVJCLW6
TLSH
T1EED433893E7A0283DD984F3335F79F07793DDC6FB9D44138BB24E9939A12885A85091D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 ac9d27024d6af79876b38869506bf4a6b5518ef5310fdeddedb551c71634b867
MD5 35bd2fa65be8c3e912510a6e316ca562
SHA1 836ca8b77941eed7dee9425314c79300f27a9d79
SHA512 b9883267c2ec31ba200465a7ae031afc8d4ff8322e12bea6b73692654dbf3ae7d67ac470df867ea39832681d5267ba229289095e63eb5cab72929a994b01aea6
SSDEEP 12288:MaPqrLdg7RHZRyj66ypKWa8KgIL54+qVyjG16JC0NGPZF4V6eYzAifnhXp0LW6n:Nq9gy260x/+4QG1eNoZGV9YVJCLW6
TLSH
T195F4124737B530F5D57A833288B25E02F776B8365BA08A2F176047B71F236919D3AB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 864KB
SHA256 ddf00c0b18ff6b8091e14c700fc1adbb1663feb6398480500256a63d47e81b7c
MD5 0cceb97d9a308535b731d17568f368c7
SHA1 f3e2c5d81ee7ea4ffaa6ba8bf1a1af9148b467c2
SHA512 56ca767ff9baaf00d7d0449d0b748002ef22492f228500cef6792c88751bac08af2111c253621a78350a9eda7cc4e12a1b87a19e71f4660e5d23fbc0df732ee0
SSDEEP 24576:sTtaLv3z0z3qy260x/+4QG1eNoZGV9YVJCLW6:sTgLvj4260d+4QQyoYViPC9
TLSH
T177150295B36018F5DC67823B8C668906E6B2BC6A0BB0C61F13B436675F333915C2DF5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 43c647cad5fb82b2f6905bc7ede3924e9aa69a10c0ade363412f7db88129a28b
MD5 de5918528e0f4c3fd6019d5da8e25a9d
SHA1 639bb5aef6376476f6b21c4ae166a5762b003914
SHA512 021e2319665e00e57330d7ff08e14bec45705bb49d9730b84436e702c98ccd38c489effa5f6e876b7c5de71e54fc94e45d71e8f787b1d324f83779c11f0f27f4
SSDEEP 24576:C3qdRCHvy7MJNy260x/+4QG1eNoZGV9YVJCLW6:kqdRCHvyY+260d+4QQyoYViPC9
TLSH
T18135CF90F3E410E5F0B79A358D768512DA76BC5A1B70CE8F03A4665A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 3a572d3e63a18335877f51fb9038afcaacf2627e2059ad310e14450571426edd
MD5 2c1b5efba6726a62948d8111d6b9f20e
SHA1 40ca62241ac7c6b93507db9ca41f49189a3c65f9
SHA512 ad71fb0fa1dd5338ed4d1ff639982f590305eb2eae6892d93fe6ddf759cd2da64a47cc8f0e92884aa4518f71febf04f90083c106975540b9bfe262136515143c
SSDEEP 12288:+6RHZRyj66ypKWa8KgIL54+qVyjG16JC0NGPZF4V6eYzAifnhXp0LW6n:+Gy260x/+4QG1eNoZGV9YVJCLW6
TLSH
T1D8D423853EBA0283DD9C4B3335F39F07793EDC6FB9D44139BB24E9935622889A81191D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 603KB
SHA256 fed8cf23bfbf4e72e3c1353bdab0e694db8d2c86d1baeeca6be55cc5441c6960
MD5 4cbc5de5ede59bfb7e4de9faa1ec64e1
SHA1 09daa340f7bb5dab66fb86af3cf81640c4ac6374
SHA512 ed13a7c58604e38f6679c8a74726802b71705770bab1be4f27cd054839f445cdd482c1684a1f8b5bcaab14fe2c028e0c0610c63cf1fb39d067fcc111b16ef550
SSDEEP 12288:4RRHZRyj66ypKWa8KgIL54+qVyjG16JC0NGPZF4V6eYzAifnhXp0LW6n:4Ly260x/+4QG1eNoZGV9YVJCLW6
TLSH
T1B0D423853ABA0283DDAD8B3334F79F03753EDC2FB9D44539BB24E99396128C5A85091D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 92f5a9a08ee00b9c3bc21ca204f33fa09c52b9ad5139a8925a0b7f99d20db29c
MD5 4053c455334dc8d47d1faa17e30efa84
SHA1 18b9a55f57a866d3f528af0a45e1a1b87e0a4478
SHA512 04c487c8c8d503c715273d9a3010a9453a4e590bbea49df6ec69029ef76cc9a51ba7370478e4db267a3c56c867bfc37b580241442539f7997b0d9cb7c849cf58
SSDEEP 12288:NlRHZRyj66ypKWa8KgIL54+qVyjG16JC0NGPZF4V6eYzAifnhXp0LW6n:N3y260x/+4QG1eNoZGV9YVJCLW6
TLSH
T1ABD423853EBA0283DD9C8B3335F39F07793DDC6FB9D44139BB24EA935612889A81091D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 50647146163b599b2cb9f982a6105ca364c761002e5c2775dc68290a0cffe33d
MD5 4db7b7b4cfa0129e61fa675d93656cbe
SHA1 50613ecb513dfd0a53e6d167bce38aaf68d84dcd
SHA512 fd335a12a2d23159911d2f235e8819aab1da72646e4c679e44620c03f48321d1de70254d144ea03d7fedaeab044bfea687469348a7e659bcab9598ecbcc6ba84
SSDEEP 12288:i1RHZRyj66ypKWa8KgIL54+qVyjG16JC0NGPZF4V6eYzAifnhXp0LW6n:iHy260x/+4QG1eNoZGV9YVJCLW6
TLSH
T1DAD433893E7A0283DE9C4B3335F39F07793DDC2FB9D44139BB24E9939612889A85091D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 602KB
SHA256 dac6afea22a8ffa8b1626f39069dbd48f4e4ffbdc6c95cf926ba52c929dcd63f
MD5 cd41b29cf8acca1bad50677c21b0e401
SHA1 7217893e2ae4aa6d01f32a24d6b419494ec50ba2
SHA512 9250bcfe4d47267d0d06c04e45bda9aa7ac3965a1d5a46abc6b3eac158d556ae04a6ffd507b15ebefbcac566a828d966adcf188ace02aef6300c817460e54a79
SSDEEP 12288:ERRHZRyj66ypKWa8KgIL54+qVyjG16JC0NGPZF4V6eYzAifnhXp0LW6n:ELy260x/+4QG1eNoZGV9YVJCLW6
TLSH
T18CD423853E7A0283DD9C4B3334F39F07793EDC6FB9D44539BB24E993961288AA85091D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 602KB
SHA256 ba3c8c89e63f345f0bc27110feb4964aeaae6d6e59bee33fbc58e949ef18a023
MD5 6e1ff777c610fe4ad7c68519124b744e
SHA1 0723f483bd1a9a58bb4ef5950979f9b90ba85bb3
SHA512 e4fe61db1b1198d4871bf51fb4b51548e062d967dfbb3212528f251fca001caa6d90cbb8a0929cfbcf8aca0b44b2b8c920db9ba10606a3bfb7d0daa4d266a68f
SSDEEP 12288:PJRHZRyj66ypKWa8KgIL54+qVyjG16JC0NGPZF4V6eYzAifnhXp0LW6n:PDy260x/+4QG1eNoZGV9YVJCLW6
TLSH
T16FD423853E7A0283DD994B3339F39F03793DDC6FB9D44139BB24ED935A12886A81191D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 602KB
SHA256 c34eb992b9178a71373f5c5f361afbb548b0567708200d16cfe9a0ed6df97878
MD5 334f635838cb5c96e94dbc9ccf2eb522
SHA1 ed7a9be515f1fb996063377208d4e671dc50070a
SHA512 d065559e7144affa4989d37765dfa4cefef7f2a9b695b8e67c0223268c5192a6b977b5eb86e4b178d72a717299171655f9bcf6f569843640d620e34da461165f
SSDEEP 12288:W4RHZRyj66ypKWa8KgIL54+qVyjG16JC0NGPZF4V6eYzAifnhXp0LW6n:Wcy260x/+4QG1eNoZGV9YVJCLW6
TLSH
T1EAD423853E7A0283DD9C4B3338F39F07793EDC6FB9D44139BB24E9935A12889A85191D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 602KB
SHA256 e178f0c210c7beace6b4b2dd0620d5a46edc28aadac0bbba5ace85d3e99aecd5
MD5 fe008981f460372001629bd02da2fee1
SHA1 05340ee548cdebfdfd7beb99d89f139b8a80ee6f
SHA512 f2f0cb0f0aa85d8ad1f335d4f0f94044d8a7ce700112509ffc98685c69851ec31b85db9a10b514aac6b54d2d8bfc19cc3455aa1f7bf7b856a0692be32ad20bc3
SSDEEP 12288:HmRHZRyj66ypKWa8KgIL54+qVyjG16JC0NGPZF4V6eYzAifnhXp0LW6n:Hqy260x/+4QG1eNoZGV9YVJCLW6
TLSH
T19ED423853E7A0283DD984B3339F3DF03793DDC6FB9D45139BB24E993961288AA81191D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 602KB
SHA256 619b724bdbb36d9c5ed0492f77332f3f959b974dc74bbe1119291dc505e401e8
MD5 cbbbe08b5282662732fc072f1f9766e1
SHA1 1a25c99827860ac5da39007598bb9f6d30d2cc61
SHA512 12da35e861db3b9680f5a68a453e82e99540de8b66dc8dcc703aade4d94c12d15fe1105216cce065d6f7702d9dce6f9ef17a36148ea7b27b76d3f4cec1c3b01e
SSDEEP 12288:XURHZRyj66ypKWa8KgIL54+qVyjG16JC0NGPZF4V6eYzAifnhXp0LW6n:Xwy260x/+4QG1eNoZGV9YVJCLW6
TLSH
T185D423853E7A0283DEDC4B3325F39F03753EDC6FB9D44139BB24E993961288AA85191D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.1MB
SHA256 610bc1be063a0ae2e2aaea7b4873e8f7beec6b6b52275f9a328bb5fb879f63d8
MD5 3f6635eac145c4c181994ecd9be8cb6b
SHA1 e6c4fd69475b073916c452933379c7b7f4162a8a
SHA512 3786096b0693dcd1ff0ec4f6102e5eafef3f77ddd7e9a162a5375b674dfdeee5bfa7470b9a059408cb693e11a41c491f09c55ded8da8cab1a65b20aa342c5211
SSDEEP 24576:Rfwvtk9RX6wkyAIry260x/+4QG1eNoZGV9YVJCLW6:eMnYIO260d+4QQyoYViPC9
TLSH
T11F35D029EBDC04E1E1B7923999F3460AF6B178691B71C2CF125953AE0E33ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 a7d6d6cc647b25f8e800df37eb71719faa0282743a779a4f2e0fc4f58263f19e
MD5 1e244c26b94bfce8e5549fab82834051
SHA1 4ddd1ea42891953bbd5489ab1192f676b12183ce
SHA512 7f4b98df088f51aaaaad647e8b3b2b46da629171cff2e5f65f8b34c9e3dd3a956dd714f851399080bd4785ce98a229a7e49661c3b8bed64d2bfc56472b5f18b2
SSDEEP 12288:Uk0fIRHZRyj66ypKWa8KgIL54+qVyjG16JC0NGPZF4V6eYzAifnhXp0LW6n:qsy260x/+4QG1eNoZGV9YVJCLW6
TLSH
T1BCF40249E2A802D5C46E5232C7A68A01F737BC2597F0D39A67D0F97E1F32590ACD9B07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 cd71df3e56fa6a20479379a2de63d8c216fc0d7a7854b1cda59865961b785eb5
MD5 09524e93ea4d1376fcd5455039492119
SHA1 d92d3b27b655c94eda68aa397e2b1618315330f7
SHA512 220c95fc9cac274deb9b3367581b94833326100f36b68ecceb2c325cd0a2ad382e0e7b0057103159e58993a4b6ed35b879ed685c1ca383ed718b2d13fd206623
SSDEEP 3072:5sHJ67RD5ScpA6lVnRJ8rPIKYA2vvdK7jf8vajStCPH:szwA
TLSH
T18CF35386856D84BB34534BD3D7AA6C684A660559437E0B2C71CFD2FE6444E038F2E8FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 5540e64347d2c27d1a74b5d6de015c5e50fccf94b956604912125562c733bb5e
MD5 28840757a7f1be1567c446bc70b5b4b2
SHA1 f838496913e253fe37412822122cdd59b57942fa
SHA512 2a65676ea5fd0e85685aee8f4ddbef0587d0253e3125ab6c204c50b6fd307fc83517eb9d4062d1e4e4c50caaa54104724925dd4d8181fd52e5f41a4019ebc2a0
SSDEEP 12288:RY7uRHZRyj66ypKWa8KgIL54+qVyjG16JC0NGPZF4V6eYzAifnhXp0LW6n:qyy260x/+4QG1eNoZGV9YVJCLW6
TLSH
T11AD423557B790242EDBD4B3324F7DB12753EE83A6FD48027BA14EAD255328C5EC60A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 5cc53d0723f33c31d41d4ee39e2ad0bf8aca70fa78d3a867c0c5fc6fb98ca1cf
MD5 1e4375819d5b6d67d12cabb48f00727e
SHA1 4ac31c4b4a18fbfb85ff4a01422eaa6d019ffdc1
SHA512 be75e1c68b93a5703d56a0d2751daace37c056f17dbfdfb0908a16a806e937e2be3c1596147af425c31c642748a8df5c7e1f0f37d2d4392e2891ae76cdae8f4d
SSDEEP 12288:TpGiRHZRyj66ypKWa8KgIL54+qVyjG16JC0NGPZF4V6eYzAifnhXp0LW6n:tGOy260x/+4QG1eNoZGV9YVJCLW6
TLSH
T1EEE4236D36FA21C1CD79C73328F29A137875B8756B9415FF49A0E5B28B229D0B838D0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 9e2256691d0e0707aa041ab8579eea5f207e80f510844bae3a7507a1241587fc
MD5 1460d44e6ca1284905ef11f5980d6de5
SHA1 728fa48a65b21d2e2e16cb0fda15d9c00573c577
SHA512 3e7ce02df4d0e04df87108d32e9f165777dac507d9c9d9eaf77898c396511384bf0ab9bce8a87db6c5db109f0426e2ce96d0a7ba1eb366b0f0e02fc7ecd77f13
SSDEEP 12288:wED5RHZRyj66ypKWa8KgIL54+qVyjG16JC0NGPZF4V6eYzAifnhXp0LW6n:w0y260x/+4QG1eNoZGV9YVJCLW6
TLSH
T177D423853A790283DDA94B3324F3DF02353DD83ABBD415F7B624EA9355128C5E870A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 11b66bbfecd7288a039c23b874e68a461430c6d08a0f81fa84f3b5f1e7300335
MD5 aa5749ba567c3b21d538af8780a0df99
SHA1 6748bbee6a32c246b1a654cf8fe5e38c72d3d8da
SHA512 18828924311b3023cc0fabd1d2b08e6df22cc1a0c33cc7bb500259485ca7d921d68bd99cbdaab4f6bcc6e46a5ed9c2540a63ab80bc9182444ff056d1d102544e
SSDEEP 24576:DPUr+NQRy260x/+4QG1eNoZGV9YVJCLW6:DJQY260d+4QQyoYViPC9
TLSH
T1D305F22F36AD18E5E67AE13989928709F772B4621751D2DF02A0817E4F23DD8BC3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 29387ba493507a623cfd8e79517487d2f45147ba0b77824659b6ee08f0528553
MD5 2c91a41168ea9268dd6ccbee629d2bc5
SHA1 a55bf6a1429dd9b8c589a24292f06af7d122655b
SHA512 d190f6437c3b83f7a4a08b901990adaaf94d2f1341b7905aed7795b4a4612bb09ee5fd302ee4ce1d546a03be4d14fe0bf7a2198227d86b482817b53e16c25576
SSDEEP 49152:EBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjc260d+4QQyoYViPC9:nG05lO43bH03VG
TLSH
T14ED5CF6A62EC11F9D1BBD17CD9C68A0BEBB23415033456CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c43134da66f89b7ebbafc197f81a52bce49d1c48e4c4a7d7b5aafd2463cf47bc
MD5 09223148a6454705fdfadab077aac800
SHA1 28fbc8d89ea86f34d5c91a4946bc14dc5c99a8eb
SHA512 e48f28055046bb83b33b5104fca960b527161ec795d3d2998e2ef5a1637743cd7a2546b44b6457d567b4198e8f1c1c1154d1fcd5567c2497015c9d1827df8270
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7FkDy260x/+4QG1eNoZGV9YVJCLW6:SNc/zEOVHFv260d+4QQyoYViPC9
TLSH
T1F2858C1623E901E4F5BBE1BE89779946FA71786513308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 fa488ad8beb0588b7095ee81ffe0ee7825ba411703885c41fbdf004b891d05fc
MD5 ab4133623cb22ebdad34f4eb7f05f376
SHA1 a1a2a514c7ddb099b933a8187d35be1a87ad8532
SHA512 44a06c4daffce743e0050963932d01672764492b936a3429fe2cc980338241ef9e2bfc26fb69af6f9634b8cd0b306af38e23e57594da8ceaec547e7e793fb266
SSDEEP 12288:bYHck6j5ZI7qdRHZRyj66ypKWa8KgIL54+qVyjG16JC0NGPZF4V6eYzAifnhXp01:m6DIcy260x/+4QG1eNoZGV9YVJCLW6
TLSH
T14305025D337A10F6D0BBD13A95934602E2B2F475975159DF0BA4C5BA8FA3EC8B838E01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 f65d89b0fa4737dbe84dda4506810526d580cb523aacf973323017bc4485bf9e
MD5 28c1104a016974752dcbe4132f5ecaeb
SHA1 8d8b391d940755e98f08415ce679344bdb3d16e0
SHA512 3d737020925ca92d47949cb5c40ac73cb57043778ffd68a4cf175753c8cfe6da5e3522d3bbe30d5e233f73c72eb8adaabeef1375f95deef5135e8edaa68cd9ce
SSDEEP 12288:cG6kyCRHZRyj66ypKWa8KgIL54+qVyjG16JC0NGPZF4V6eYzAifnhXp0LW6n:9tyuy260x/+4QG1eNoZGV9YVJCLW6
TLSH
T1EDF4130433A411C1EDB9473159B38651AA39FC256BA052EF65A0EB3F5F32BC4BC30B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 598afebdbfc0331f3b234c0c3907b5cbbe7297b271250d2b32fc5269f1304fd4
MD5 4ef852b1103d11f92a090626bbbe5508
SHA1 07fd516ed8bb1bba2335e6af6f92a6b19d965baa
SHA512 d0d3ed23ed74d3b629aec9e9bb70ea4d28982c156fb91b4b64f989357e1b7d8f6e308bdca178c716b5b8e7910a19133b54a2517fe36ebe89b8b6f9da5c235488
SSDEEP 24576:3TkNvNnaFeYhJNtmZBmvy260x/+4QG1eNoZGV9YVJCLW6:3TMwBtOm6260d+4QQyoYViPC9
TLSH
T1E955AF6EBAB806E4D1FEC6758D238512FA727461173293CB5290C13F0E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 772KB
SHA256 0882fbe9b557303aceb48ef3d00a275dd96bebfb7e56796802b009154862fc90
MD5 ed5fe9ee79bcf6b7226f59d5875e8c56
SHA1 6943c0d1550e9fb62f25623bfdd940760050dd0e
SHA512 229de73cdb6987d572727fe610daf8dcac509df8616190f1bc19e057eaa9284fdc4d16070e91eb012a75e3fb5cf5f375ac37df25b1d8665d5c5c51429bf8be9d
SSDEEP 24576:q6UqjpYy260x/+4QG1eNoZGV9YVJCLW6:q6US260d+4QQyoYViPC9
TLSH
T17AF4124D26E420E1E8794730A8B282269175FC3627F455FF72D4DA7B8B329C4D83AF19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2124-300-0x00007FF7D1210000-0x00007FF7D1954000-memory.dmp

Download

memory/2124-175-0x00007FF7D1210000-0x00007FF7D1954000-memory.dmp

Download

memory/2124-134-0x000001E2DA060000-0x000001E2DA0C6000-memory.dmp

Download

memory/2124-132-0x00007FF7D1210000-0x00007FF7D1954000-memory.dmp

Download

memory/2124-133-0x000001E2DA060000-0x000001E2DA0C6000-memory.dmp

Download

memory/2124-298-0x000001E2DA060000-0x000001E2DA0C6000-memory.dmp

Download

memory/2376-83-0x000001BFAFFF0000-0x000001BFB0056000-memory.dmp

Download

memory/2376-78-0x000001BFAFFF0000-0x000001BFB0056000-memory.dmp

Download

memory/2376-77-0x000001BFAFFF0000-0x000001BFB0056000-memory.dmp

Download

memory/2376-76-0x00007FF75F820000-0x00007FF75F988000-memory.dmp

Download

memory/2376-85-0x00007FF75F820000-0x00007FF75F988000-memory.dmp

Download

memory/2768-60-0x00000198DAB00000-0x00000198DAC48000-memory.dmp

Download

memory/2768-61-0x00000198DAC50000-0x00000198DACB6000-memory.dmp

Download

memory/2768-62-0x00000198DAC50000-0x00000198DACB6000-memory.dmp

Download

memory/4204-7-0x0000000002C00000-0x0000000002C69000-memory.dmp

Download

memory/4204-0-0x00000000029C0000-0x0000000002A9F000-memory.dmp

Download

memory/4204-6-0x0000000002C00000-0x0000000002C69000-memory.dmp

Download

memory/4204-1-0x0000000002C00000-0x0000000002C69000-memory.dmp

Download

memory/4428-179-0x00007FF788490000-0x00007FF7888A7000-memory.dmp

Download

memory/4428-177-0x00000130ED5A0000-0x00000130ED606000-memory.dmp

Download

memory/4428-158-0x00000130ED5A0000-0x00000130ED606000-memory.dmp

Download

memory/4428-159-0x00000130ED5A0000-0x00000130ED606000-memory.dmp

Download

memory/4428-157-0x00007FF788490000-0x00007FF7888A7000-memory.dmp

Download

memory/4760-37-0x000001C7726F0000-0x000001C772756000-memory.dmp

Download

memory/4760-36-0x000001C7726F0000-0x000001C772756000-memory.dmp

Download

memory/4760-38-0x000001C7726F0000-0x000001C772756000-memory.dmp

Download

memory/4760-35-0x00007FF6BD2B0000-0x00007FF6BD379000-memory.dmp

Download

memory/4760-131-0x00007FF6BD2B0000-0x00007FF6BD379000-memory.dmp

Download

memory/4784-89-0x00007FF6795B0000-0x00007FF6796CA000-memory.dmp

Download

memory/4784-90-0x0000025497640000-0x00000254976A6000-memory.dmp

Download

memory/4784-91-0x0000025497640000-0x00000254976A6000-memory.dmp

Download

memory/4784-170-0x00007FF6795B0000-0x00007FF6796CA000-memory.dmp

Download

memory/5168-103-0x000001D597460000-0x000001D5974C6000-memory.dmp

Download

memory/5168-101-0x000001D597310000-0x000001D597458000-memory.dmp

Download

memory/5168-102-0x000001D597460000-0x000001D5974C6000-memory.dmp

Download

memory/5660-68-0x000002B411A70000-0x000002B411BB8000-memory.dmp

Download

memory/5660-69-0x000002B411CE0000-0x000002B411D46000-memory.dmp

Download

memory/5660-71-0x000002B411CE0000-0x000002B411D46000-memory.dmp

Download

memory/5788-176-0x00007FF63A520000-0x00007FF63A5CE000-memory.dmp

Download

memory/5788-141-0x0000023EEBD40000-0x0000023EEBDA6000-memory.dmp

Download

memory/5788-140-0x00007FF63A520000-0x00007FF63A5CE000-memory.dmp

Download

memory/5788-142-0x0000023EEBD40000-0x0000023EEBDA6000-memory.dmp

Download

memory/5792-124-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5792-174-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5792-125-0x0000000000790000-0x00000000007F9000-memory.dmp

Download

memory/5792-119-0x0000000000790000-0x00000000007F9000-memory.dmp

Download

memory/5844-17-0x0000021A83B30000-0x0000021A83B96000-memory.dmp

Download

memory/5844-88-0x00007FF6B0EA0000-0x00007FF6B0FC3000-memory.dmp

Download

memory/5844-15-0x00007FF6B0EA0000-0x00007FF6B0FC3000-memory.dmp

Download

memory/5844-16-0x0000021A83B30000-0x0000021A83B96000-memory.dmp

Download

memory/5844-18-0x0000021A83B30000-0x0000021A83B96000-memory.dmp

Download

memory/5856-173-0x00007FF7D63F0000-0x00007FF7D653A000-memory.dmp

Download

memory/5856-109-0x00007FF7D63F0000-0x00007FF7D653A000-memory.dmp

Download

memory/5856-111-0x000001F596FB0000-0x000001F597016000-memory.dmp

Download

memory/5856-112-0x000001F596FB0000-0x000001F597016000-memory.dmp

Download

memory/6052-26-0x00007FF6BD2B0000-0x00007FF6BD379000-memory.dmp

Download

memory/6052-27-0x000001CBDBB90000-0x000001CBDBBF6000-memory.dmp

Download

memory/6052-28-0x000001CBDBB90000-0x000001CBDBBF6000-memory.dmp

Download

memory/6052-30-0x000001CBDBB90000-0x000001CBDBBF6000-memory.dmp

Download

memory/6052-118-0x00007FF6BD2B0000-0x00007FF6BD379000-memory.dmp

Download