ac64824bfb1272ee99ddbe919ada06acadc304e35ca7c47fef15d3cb928bed2e

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 00:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
Size 3.6MB
Sample260805-bbganavdrb
SHA256 ac64824bfb1272ee99ddbe919ada06acadc304e35ca7c47fef15d3cb928bed2e
MD5 4ff084e596352a40c6b9b743dfc613c2
SHA1 0446148a0c5a88da7ab8ae389045dc0bce7086a9
SHA512 82331efadf5a69a6b11378cb56806337f4d7e9296236d07980482fb097e10849771bf75f015fa88ab6885cdceac532a03421b97fb75750f4d4c3f14905da1ca1
SSDEEP 98304:XnCG4h7FiRA7WkAbJbrCmIZDjNJpvix8EVy:3o7RWkwamIZDjNJ8
TLSH
T16906BE21BDB18523C46303328D6EF67D316DBD742B3481C763CB3A5C69386E15A3A6A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5072	elevation_service.exe
5160	elevation_service.exe
5800	maintenanceservice.exe
1368	OSE.EXE
6116	PerceptionSimulationService.exe
2156	perfhost.exe
5892	ReFsDedupSvc.exe
1320	SensorDataService.exe
4132	ssh-agent.exe
5008	AgentService.exe
5856	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4bc2fe2d957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006a1e4a8a7524dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000081640ac77524dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000041fb07897524dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bad538897524dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000efc90c8a7524dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d03ce1c67524dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000043b1fe887524dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006a2e72897524dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5072	elevation_service.exe
5072	elevation_service.exe
5072	elevation_service.exe
5072	elevation_service.exe
5072	elevation_service.exe
5072	elevation_service.exe
5072	elevation_service.exe
5160	elevation_service.exe
5160	elevation_service.exe
5160	elevation_service.exe
5160	elevation_service.exe
5160	elevation_service.exe
5160	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2608	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
Token: SeBackupPrivilege	5892	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5892	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5892	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5892	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5892	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5892	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5892	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5892	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5892	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5892	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5008	AgentService.exe
Token: 33	5856	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5856	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5856	SearchIndexer.exe
Token: SeDebugPrivilege	5072	elevation_service.exe
Token: SeDebugPrivilege	5160	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2608	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
2608	2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5856 wrote to memory of 5012	5856	SearchIndexer.exe	102
PID 5856 wrote to memory of 6428	5856	SearchIndexer.exe	103
PID 5856 wrote to memory of 3208	5856	SearchIndexer.exe	104
PID 5856 wrote to memory of 5372	5856	SearchIndexer.exe	105
PID 5856 wrote to memory of 1840	5856	SearchIndexer.exe	107
PID 5856 wrote to memory of 4928	5856	SearchIndexer.exe	108
PID 5856 wrote to memory of 4968	5856	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_4ff084e596352a40c6b9b743dfc613c2_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2608

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5072

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5160

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5800

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1368

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6116

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2156

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5892

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1320

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4132

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5008

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5856
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5012
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6428
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3208
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5372
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1840
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4928
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 34e91667228aeca5c0abe5a1a310992b85d0fb49f25ebe24c13363659b7f3239
MD5 1e5ac38eaf0b434cf04a9908a9943815
SHA1 d76fcefb92026b4e8cc4466482081493060e5af6
SHA512 77804b7b4756ccaf4224af703f60690b3f938977ff5ad373ed3e19592a81d0e9b9a4c18985b32976cfe135c97f532afe39d963b43baf7309fd62ab3b2399a344
SSDEEP 49152:Ab+632BuPkFKRrdE6ohmstBhuXjfS4LWxnxx4x8EVep:q3q6HjBmix8EVy
TLSH
T1ECD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 ae831e69fb90a03a351029e31924097b879157b0c5e33cf1a1aafdf6b8571384
MD5 96d7a744f94ec8f161e0b8b778d98cf7
SHA1 7256d125e4836e3b9a142612bebec84877a01304
SHA512 e01bbe314812674c3df65c0c3ede0f467adc4e83745d64bd7af1c78acd283a7cd79da7bddcaeff68df9553161d5af2ae09d1d24dc2457259e92c443558bfff10
SSDEEP 12288:W1XLsswWkxy2lRq2czA3+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:UXYfDtczA3yxknw4FYnshx8OfVe247
TLSH
T12A75F12877D508F9EC6B8139CDB28512E633B8554770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 71966cd44f08e08f18e0eb48ec0641d0eff5e541e83dce49cc9d3e85d627753f
MD5 6484092d95397ba6b7be00dd6d8d6c76
SHA1 e3cf1873e09cc4ad41b233f6cc98e564784a592e
SHA512 38b1be7cc98addca4c5359508b47684f61a3ad194474e063dace28c5273172121c91e9830732b4ec4c0b6f74c7bedb37c18bef7fd2a837ffb534c9d24e295912
SSDEEP 24576:G0Le5ji0hmx1rMWyxknw4FYnshx8OfVe247:GPji0A7Ix4x8EVep
TLSH
T1EE95AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 fa1268a09a5993ef31a76aac80f0676f10c17bcce021d318605cad6ab7673cda
MD5 1224026aa9673db301b5665f9a975b3b
SHA1 e1710eb467af6e68976d2d5611785182692af820
SHA512 8f31668984410e3315a5b28e59e7c215ce03639bec2337b6d4d61650c0ca9055703f2ee431f398b23ed101f85face3d9cf50f013e926bd0c870bcc19d5afccc3
SSDEEP 24576:3a7/ezSC6vUyD/aqgrvWE6q8wyugyxknw4FYnshx8OfVe247:6/ezSC6vUzPvxHjyUx4x8EVep
TLSH
T194756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2b8d78e8425fbb94cf9adc6d8620a93a587faf417fd64f1373a9b44ef7c7d260
MD5 acfed438db112cd8e01bccce21472def
SHA1 df0d5660cd23b1a6d0ce5fb7c0073ec0724d8436
SHA512 d2e8bbc83153e29da5d2367d81894f6ac57ff7b0b286f328a2ed258e83d318d3edef060597aada0bcad685361953739ff72b03c3be15351412326b6ef16786fb
SSDEEP 24576:nVbqPb88hv/l+6zyxknw4FYnshx8OfVe247:nVO88hXl+Fx4x8EVep
TLSH
T179559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 cf85cbb2a1547ff526865d7473b22eeef9dec4c1cb9b3a909ea467c3debb20ee
MD5 c7bda685b1733941364066baa024a3d7
SHA1 ba6df39661f9b6626d7ec3bf7e3b728f778d8035
SHA512 9c7d7aada942f6a43e1a18d6e564a6da75034504dbbede57ce31e9c2902a5b733355ea5dd75466c0d35d0b5d7f9b5efa53bcd8c2f9f687ef17e852ea7be23188
SSDEEP 12288:DNS+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:DNSyxknw4FYnshx8OfVe247
TLSH
T1DD65237CA7DDA4E1FA5E14331A7572623616F9A0DA74C11BCB78B15EE0F0C60E06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 90fb24e7007f49e7a5df6d5bc227a66624995fc86517cfc6d1d08d5ba8bb9416
MD5 e3c8a3633bb1881824fe9979f0f8c11a
SHA1 5f39261f2d8b69c6714b602663c2c9f0ea4ed6b6
SHA512 e015cf84517d6c0f0b335b4c882a8e5d0c31e8182d0447d20034a0a30520fa61a2705bc04549110b845a96574a9b0b277e6f1b1608d4ac6f77b51a35ddca8481
SSDEEP 12288:JeBNUbTVO86Ur+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:JJIUryxknw4FYnshx8OfVe247
TLSH
T17675CF7BEE28FCD2C27E4DB95B918600A76274704F6293CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 103d12ce94a0138306f1d01d0bd1cf3c3180d9ab3ac182a780d6318deae36b50
MD5 e294a9abc5b318e61bbad6106725d795
SHA1 a35a53ec123cc8a2acc68582eddacbd5d2226934
SHA512 f67d127d1605bf36ec28e3d0a7fe66de9f88f415ab0a65d81928b6a06e7d6de0594a60951c8f5296857039ba62db2fb34fe24f77bc1d75e3c782c064dd251a91
SSDEEP 49152:hQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH8:hQvGAdlCEL8c/yRNw5Czix8EVy
TLSH
T148267D656BF880F5E0A7E174897AC6B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 6ed14ca84b87da08d7d407683a8233421ddae54ac5aaf8817d843c99c6ea8ee9
MD5 e30a0693174b6c7984f69c335d704f67
SHA1 9b8e28b5a13c18b4abab39c7df9cd3d35ad1d482
SHA512 6c34e217e5dee5a43572fbbefd5df304c6c31befa8770ee043aa67f2a544f5a623a46a171cb61f0cb74dc1d3187750bc361b86bc995396c5f4be9bb8d60af9f3
SSDEEP 12288:mAwSfxL/2Dc3LDLLmt0LDQewsAjt+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr9:76ewsAjtyxknw4FYnshx8OfVe247
TLSH
T13985E030FE74E032C7BF0DB21B36D716142DB9604B611AC3E3E89A9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 33f40d18d9b8b67e4064fad69f19ade3c147760bfb35ccaa2da2fc0c9612270e
MD5 1b1f26e71a5e067728631a74d91085e7
SHA1 fe83caafd2f35ddb6974612a7e516f0d96d9d048
SHA512 3da1ea520161162cd091b9094c842463994b2e13c4be04c3f11312612d390f11fa286c882f66b6c4e843e0380bab73ce145198b33a667dd5e7e91a17cf4ba5f7
SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHt:5UEtQevvqc2W1cpV2EI32
TLSH
T123474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 581537447acbf71715663cb0cfc834687d995a7022a019c0c7f150bb5bb7cd82
MD5 54fb2f12b94199aa3e0ea9faa3e53d89
SHA1 f3238f5c97b2da0ed9a6d412af661cbf14530039
SHA512 2232bd5aa1400747aa4c48d804637500c907e761f0eec8fc46856b2a27da19da29a5d64cd06e72acaca275f07ae0b101bdb8e435eabef9f1149577d13d294006
SSDEEP 49152:hCbRquA/m2yL5zQfFiV+XenmE3/z4x4x8EVep:OoqtVjnm/ix8EVy
TLSH
T159D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 bc7812fa52adfbb5d5792cd39c9ee11e718d0d572d2fb7b526b334f6ff7e9cbf
MD5 2f90caa9179bb3ac58cccaed1c905bbe
SHA1 31d89944da3ad1ce47f3eaa1e621c2cd2b6cda7f
SHA512 127131501eb1165a229cab91da915b75ed40f81784b8e0bca4985cd052f9a8a3d9c8bbac7b5e0fe59f6678cd8eca618f3b4313f69f96bc8290ddc3d8adc4465c
SSDEEP 24576:nAhGLJIFoiwtA5l7S53Eyxknw4FYnshx8OfVe247:nAMyFoiq5Px4x8EVep
TLSH
T18E35AD80E7F955D4F5B3AA7899B69171EA76BCA65E31C20F2260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 e6200f808ef463260a0fa2e9d4da2c85971313b11a474887411ffc96ba53077a
MD5 e7c2ca8c01c5872c783382ea595612b8
SHA1 342999e22b6ceb2105c9ec3a1a03992512d7e139
SHA512 00d6a5917cd49883d01bf686e479a3ca62fde0049e2743d357d54cbccb026cfe363f1f0b5a3e6b00fe3962f39f00ffe098b40dd1f27df7261c7636a61c14e5cc
SSDEEP 12288:5mw5HEjsChN4BFgl0WDm+CA+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:UwuVOWxyxknw4FYnshx8OfVe247
TLSH
T12175F14977E91CF9E9A741398657D132F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 509296775c725020318df744030ac7d26f0ef71f013fbe152c4667a381b7e242
MD5 752b60afe7638e061050ec2844172e77
SHA1 243258680fb89ece9bc1eb91b42779ae6b1da188
SHA512 380b2a57c9685f177f99fd3b1f27b72fae03fde31ff69a0cc5a7c6ae866cba2af40b5f027cf865b0a3e862d0823759a0d1f073bf03712e22df5bbead74a1203b
SSDEEP 12288:8FZ1Iy9+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:eZuOyxknw4FYnshx8OfVe247
TLSH
T1D06512AC33E860F1E1A7113A89F15205E76274A2677183CF4768625EAF72DD09D3E723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 19de33fbc6c847844c0850f4c101e2574db9cc88c35803f06538644798ccf534
MD5 f498f77d59a441b7df87ce6b7f0a93b7
SHA1 abd9468784afcf6d8cc8dfb30a2859aae95a3b49
SHA512 720017ff1198b95cf556f45afb79ed79f2d0508a2b44b2f9277350ca8eb8cccd04f2de697edd3df327b4ca6724bf1b33499414e4abe78f0e19cb0171335719b6
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U:XQRQyi36YOcPQLvw2gAf+PN36ix8EVy
TLSH
T171667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c60671ce178c8b33283fdc8c002bffc83d191518d0d4869297d828459f51723f
MD5 7a63a8e95b5e5bd46520d1de2147f9ae
SHA1 66eb907689e25699dce995fd9fa73af0e2389f34
SHA512 3d89f4e4f3514f2e0864db1773c68686d3920dcafeedfcac6de443bddc227a9cf16076dd711a89789b17a73c388b0ede6c8a097c7f7f389a894a8c364d6f04b9
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U:HQRQyi36YOcPQLvw2gAf+PN36ix8EVy
TLSH
T1EE667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 90f588c227a4df9763cdffb8af7bb576c2bbc840311188511429b48826a541e7
MD5 777018676960a94996df778d0436f454
SHA1 2279e1f0f53165dc69e3671c68cd90825e918e6a
SHA512 e534711f6fcef1b9985ee41852817da702a3ddd81f0fe39b7c6dd139ded7c3e94ae0c10361f98724f510219c9eb5a8a653d4fb056139ce798f6081410abf573c
SSDEEP 24576:8wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0+yxknw4FYnshx8Z:C68Qg55nhheWu7PNU3/Ix4x8EVep
TLSH
T17FB55A33B2F600A9C44DE1769F46973196D27C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8d5acd9f9b0fc4abe9e6425fa2f329d31fcb8fe0a85a62cd32f11deaad52b8c3
MD5 cc8fe88ed7db14664df00ce452255b86
SHA1 d86ed20d346f9bc6c93c39255c9f9f71d40c27cb
SHA512 06ec89d1683d02ff88fbb66c6dc7689b3308b1a59fc0e5b997b4ca296bba2483bcf41772f84355d30b99c85ea8bec4794af79c9c7ee6f3fe1b008125810847fd
SSDEEP 49152:G3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99W:Xy5112gYy5azzVvL69nLKnhZNix8EVy
TLSH
T17D167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 66857c23a88d23e9d7f8f4a3651e6a550684a15a1ce6ae5b2fab921ad1ef913a
MD5 90b9514af38e2a30ef7761c5db3b10db
SHA1 41af0badb3f678c1e4a95044c003097392ec40f1
SHA512 1c6b9b843f622986fbe75ccf2bf0ced3a84099b930f3ecb1aa7d3a9d693dcdc8d31fdf1fd7cefdc2c13d6a95af217b4b4f567cca00225f522fd9cf7464c16a05
SSDEEP 49152:uB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glyx4x8EVep:8u6JmVxd2dyix8EVy
TLSH
T1B7D59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b9124392c1658d09e29ae8ef6f653f06c0696ffb3379e1cbc8947151401dd2bc
MD5 c6ee4a33ac08b594be8364b2eed1c54c
SHA1 e396b276c12a305bdbd9f15037a876c9ff77d676
SHA512 294ba5548eade2c385e00b15650ab57db6e472a99f8f0e33106331ffc04b2fea11a8f4ba4219aa5f1359d5c20612b29e5688008aad8c1cf291306d06056a55a2
SSDEEP 49152:Z1hpsNoJpF1A6UU44CwH7R4xux4x8EVep:ZmifPbR/ix8EVy
TLSH
T13BB5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 6336ffb34d72eb37d7244dec772c54f482a99fd60ac774a150866311e0fa000c
MD5 7e69944f014722248b2e0b7b6d36dbb1
SHA1 5739265757c663c507532ad0c56b8bb211eb4d8e
SHA512 c919207eb4959bc1344723eb3d8a18f077a965abe92a10a7a96a4980f71b1d29992ed3f2cea58e8851500ca06a01d76e2864c00a2a0f6d44ecca898d987dc995
SSDEEP 49152:MSuZQIY0Be2KRRVtOnks6NMHqBx4x8EVep:u5dKTi61Bix8EVy
TLSH
T1BFC5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 aa642f7eaf08bdb1ff2aa0d001240d3e0ec6bf4eaf0ec3f7198040b488f2d0bc
MD5 3070e1a58f8ccb9bdf53a82378a402be
SHA1 8f196087c90f67edff22e4490fb3748335ff2e1b
SHA512 c1f3e0fd925425d2fad0f44bc66d476dbc86c2c35e5c3648f57995e5638ae7a1e94ed5ea82741980b39b112482d02a8d62ae92f994140877fa9b50bb242b58ed
SSDEEP 49152:5htSn8EApI0figngiDn0AP5wCx4x8EVep:IX2iyph7ix8EVy
TLSH
T1DF95BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 6560c1b0cb62e97052a32662262d168fa96ca963c076597c24d068e484a7cf86
MD5 93be918a3c5e676d4b0c05f8c9379194
SHA1 daf6cca78eea4c2c11ea58ba6da8cc86c848929e
SHA512 3458af341231992debca62ee1c9baeda722195c0a95345aa5c46f60869481c423df4a51e21e34c83d63bf79e7dd6cdb4715b65c59d97779a7d6c02e30ff03e7c
SSDEEP 12288:Wq+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Wqyxknw4FYnshx8OfVe247
TLSH
T12765237CBBDEA5E2F50D11734A7173626609B5A5EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 26d97a43ed2686dcb57a9f4a71bd9f08cf038d0ab90c1ee369a48ec32839ab92
MD5 bd83d6e1b62bd7d84cfb6bd6a71b4cea
SHA1 96a9fa3e6a03970e9a4386c0af2e85b9debd3856
SHA512 8fd5ffe78227c4c5292fad6ca772717b5352ecf4a1f3dbfd247e92e2423f6203ccfc826b95e66718acfbbc1505924c91bee210f39d32610d6558ab62fe3e1186
SSDEEP 12288:15+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:15yxknw4FYnshx8OfVe247
TLSH
T15065237CBBDE95E2F50D11734B7162626609B5A5EB71821BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 bb9866b3be265fbde202ad477aab82b6531a8971259a8658eeee59d964824ff4
MD5 1d7833f23dc143bcde16ea8abb8a4558
SHA1 86a295b6e052c9c2bc6dbc58ff712a461e6a5627
SHA512 f2d55e42008729a3d81ae4a3083c7a98b14516b0c31f49075b2a1e7fc3f855745f27ec456a7044d3f206257bca571d8a4cfc6df9ed411cce920ac71321ddc796
SSDEEP 12288:3j+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:3jyxknw4FYnshx8OfVe247
TLSH
T13C65237CBBDEA5D2F54D10734B7163626609B5A6EB71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 6b4fafd841bfdd2b10710a3a65086300e6618c03e8492d9634085b7faf3b23cc
MD5 3567f6735c0facce334f8d9c567e4a3e
SHA1 d4505c4029a4f02ac7d3dfb02d0974869fea0582
SHA512 e96dcbafbca25f005b19adc008f3c81e2378a33576adfdcd034b92d78c0738de0225a5a12a737ed627503423e37c763b73162c6dc97e9cdaf67bc617da8faacd
SSDEEP 12288:4Vk+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:zyxknw4FYnshx8OfVe247
TLSH
T1F865236C77EE50D1E85A51738A716222B365B8E5EB31C35FCB24710EE9B0890A43DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 69a7e3ba60541ac7841729b8ec5b35fd0b7ea293ca0a329b47f263ee1093bbda
MD5 cc638d6ab53f1e281e01db6485d6a525
SHA1 b386747d64a47a29aabe21fd0e6a6fd34c578e0c
SHA512 cee5df1daeef44d69c1dc4d86f22d8d6689e7111204854d15fea8cd508d7766782599520e5c38d2e0d35d9075cd9081286cacc6361c13969103d2000994ec084
SSDEEP 12288:Ks+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Ksyxknw4FYnshx8OfVe247
TLSH
T1DF65237CBBDEA5D2F50D10734B7163627609B5A6EA71811BCB6DB00EF1F0CA0A12E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 e84ccf1cc4e2ccd89c29935fb692a0cc06c76acab4b7ba9d4359bb6b6d179745
MD5 90db815eab5b0c7407e02e17b34cf4ba
SHA1 d40a7b5f6942b3ffdb1deddeec12de921af0795c
SHA512 e38be68b74cf306ca2ea82de539430ce9b73f040ec5a4280988fa96f831ba76edde7917a89369a40c0b8915d84bc49bff67c66c7ca2d3c860f08934e29f35951
SSDEEP 12288:Ol+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Olyxknw4FYnshx8OfVe247
TLSH
T12265237CBBDE95E2F50D11734B7163626609B5A6EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 e4c96a908755d746ab4f548db02c0706b1edc25a16aef09699872cda56fa2ac9
MD5 41d14df414d5c9433e2b65a98717e2b6
SHA1 cdd7634313b00579ef214a1b688a6ef3c9e61abc
SHA512 67c088f8a0f684c900c333ec2e033b6ee5715042a22a883299f52ed73ae6a3ba6bd6fb9e443740e2ff52c9e6c81f44395ccf726aca2c48bcc1666273b498f1db
SSDEEP 12288:th+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:thyxknw4FYnshx8OfVe247
TLSH
T11265237CBBDA95E2F50D10734B7173626609B5A5EAB1821BCB7DB00EF1F0C60A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 3b88459e3d38287e970167924d37c37c4459af88a9e0f33b40fa6aedcbd0c11f
MD5 0b25efaedcbf1498874eaa8cbcfbc3ba
SHA1 58db412ebeb8498cfe3eee4cc5071e23555d814c
SHA512 f798787d30f5960de0c085dd4ca8744847da0d2a28f0401de4c4079fd48b2f7ef066f672b6271cf37906f116e6e6cce41ad9a0de59b9fa3705bf8fe33201ca6e
SSDEEP 12288:9iZwbZzzFEoS2cPvyZ+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:AZMdzFVSOZyxknw4FYnshx8OfVe247
TLSH
T14C7501A8B39018F4EC67413ECD259916D6B27C694B70C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 0d50644751a034c3cf5879df29cbefb8afc7c396974fed2451d62e792c7b429c
MD5 658fc1df28e7e6497d901ff45a3fce28
SHA1 c56a534a6404aec97237b5961b0b6c7fecbb5b79
SHA512 24556a719a0a55f6a84a7293ff8a03cc91173db1ff13259a04a73af9148bad6a0df29c487b88444a7613bfe51ac095f004be351b883bff2d7ebefe5785d42ede
SSDEEP 12288:Le+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Leyxknw4FYnshx8OfVe247
TLSH
T1F76523BCBBDEA5D2F50D10734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A12E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 5c95e3be6ce93d17bc3fcb994fe19dccad99737a24cc5c978b564f84caa45e25
MD5 2a4eb6441dbfbb0d3584f6e5c6af1ca9
SHA1 2cec0326a863d11142807947c84fc2e6c10f2172
SHA512 3dad9a9afea16985b10835d697103260ac3ec6bbb2c4a379b211ce2b4ae2a29b79bcf48d63f7f7952e900a24a5c83b2502e50935e35a32d5ed829adfc70507e2
SSDEEP 12288:bi+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:biyxknw4FYnshx8OfVe247
TLSH
T17E6523BCBBDE95E2F50D11734B7163626609B6A5EA71821BCB7DB00EF1F0C60A01E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 d8ed675eee1f1d9c640b0396eca055e110bc7bdd9de8776a864bc311929a5e5f
MD5 590b5bba75cc9091920c769be56f82ca
SHA1 832ea6874eb99d9ef2c23cb2472bb44f11edd879
SHA512 c8e21555ca3e5b6cfc35ccf9da0ede7b47334cf494a3b60dbc297fcb9b7a91fae0f431b64c801d49f083f6ed3b25cbfa6a74b40e1095907ec8dd973fe2e143f7
SSDEEP 12288:MyPz5L89+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Vzy9yxknw4FYnshx8OfVe247
TLSH
T11475125B73E530F5D13A423689621612F372B8724B3086AF87A4537A6E735E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 310d737ca35ab879511ba401df8a1e825f1fe8b67606a24d30e52fa8e60d28d5
MD5 774dcaf52aaef194029f1848026743ba
SHA1 acec2a4793267788c153ca6082a01a5faf943545
SHA512 5e0b8af7d9cc6c7cfbf8e5fea6eb9bffcebef23449b2a5b7ff7bd1a87aab0737f94e68662879b056936ca4302e732c58fdc7871bd6df300755a7fe78fc197265
SSDEEP 12288:+e+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:+eyxknw4FYnshx8OfVe247
TLSH
T1CE6523BCBBDEA5D2F50D11734B7163626609B5A5EA71811BCB7DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 2bd5bca0066412d848a5204cb4db80bebe924cdf84e5c767c3e77cafb28dfaa5
MD5 386b374c264f9781c577f6d17fd5278c
SHA1 804a622f2a0eb68d78f5e185ebf3f74ceae5879f
SHA512 2e3b574fd81360556b145c8de5c50693ec09403e130ce2a134b70e665ac3514dda884b8587ba5224b98fdb2677e5e5878cad5b1e8421942425ca64c754f5f70a
SSDEEP 12288:Oe+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Oeyxknw4FYnshx8OfVe247
TLSH
T16865237CBBDEA5D2F50D10734B7163626609B5A5EA71811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 231f89cf6a650a4d7be2a5e944c1beb2e4b6e486b463e22c2a543ffb258b7663
MD5 7c0cf929d6dfc8f5b2804254cca6ac0e
SHA1 a9a40b55489505923246697486ffd6022fdc60ce
SHA512 630ae841393a8f75217404ee9337eb7f28a3df4ac21caca8b65ca8961af2ec07705420edf2d1b6b27b5585a99e260092979de821d64b640a8fbd244f4a8bba3f
SSDEEP 12288:syPz5L89+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:1zy9yxknw4FYnshx8OfVe247
TLSH
T1EA75125B73E530F5D13A423689621612F372B872473086AF87A4537A6E739E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 3102566e069aacb5f1b8f05762fb28150d230abd13bd15a160ef7ff92a157333
MD5 17ea9ea7bf1bf373d1aa2471c03bae46
SHA1 f208e53a268790e158332191251a1d70377b3d81
SHA512 f221e6274fdcf4497ddf8f0560f765cc6342ab671c50f0387cdc6d0045f6c7aa939b9ae49a84363aec189f73e0c063822650dca498a926a266b9452c4a681bb9
SSDEEP 24576:rTGaLl3z0zDTyxknw4FYnshx8OfVe247:rTFLljjx4x8EVep
TLSH
T1977502A8B39018F4EC67413BCD659916D2B27C6A4770C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 73cfb9234a340d76665ef771ffa12587a701b3d7b2d698de7764f6deff70ae3f
MD5 ff3eee7be5e82327eed6c8012cead0e2
SHA1 2a59c692509b5a3d27058930ee9981c396ad6b25
SHA512 8cd6e7754bb796088f4d31ab84c0547550e0468b4d3c2f488b0e4846e7369006707e824a38d6c956f8db9e02d6e9487a9bda51141cabf2e855c494834e02ecfa
SSDEEP 24576:t3Xd9CHKy7GZvyxknw4FYnshx8OfVe247:NXd9CHKyaAx4x8EVep
TLSH
T11F95DF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 3994d95f223de0db9d4a753108c7ff529df5fb19f0dc3a8f48041d939464b469
MD5 26cf4a1748b4ab26b6def35d57fd6d24
SHA1 0951f7be694b153164f5c8d5796e7ce553d96df6
SHA512 2464d5c0cbdd134a759b6ee1c3102823f11ac2d611b516e5308888e73bce68c0c9a04fa6317cfd1db487586586c18b0f89ce53ce7fcf0d916cb0eef57abf88df
SSDEEP 12288:5D+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:5Dyxknw4FYnshx8OfVe247
TLSH
T1B565237CBBDEA5D2F50D11734B7173626609B5A6EA71811BCB6DB00EF1F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 e3d9f8f638223aefcd390ca6c71af741dc755f6288531d3dbab751874b72846d
MD5 8fff438bdf13dbf1ed220d61fcfcbaf7
SHA1 b92c67550f170ace8557806038713c6b6694196a
SHA512 75a217eb30d06a6d8bc53dc02f27755443dea1e485ba857a456a40ef5457bad6cd149e8207e42a34ec21381799e783b21c63bf276bc0b53b04fdae15e9b2c3f0
SSDEEP 12288:Jd+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Jdyxknw4FYnshx8OfVe247
TLSH
T1C965237CBBDE95E2F50D11734B7163626609B5A5EA71821BCBBDB00EF1F0C60A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 c3e02b4d8b428f8d81cfdff6b7f1e14000c82939c53aaf19886353bfc2d42da8
MD5 f0d50d5e70f42f647f77b63d4d1a06ca
SHA1 9d5e5819cf0e430d398023c450247381e8607134
SHA512 a9db6b599fad22d70b60d069cf33387765b575ec26e75ef0c1c3ee838edd8f0ec90be15e08aa31cc96bc70f0a9e3d5bb9df3af7f1b1c9ad39631062e41e69a13
SSDEEP 12288:oo+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ooyxknw4FYnshx8OfVe247
TLSH
T19D6523BCBBDE95D2F50D10734B7163626609B5A5EAB1811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 47d66cba837e44a0690d082b2bba33690a57f039dee64ccb0324117e97a95019
MD5 a29ebba845386a9dc95229aec891301a
SHA1 e644d65d0caa95b427bf28656afb47174039597b
SHA512 f57cacdc6de4f73eb887408d3e68d6c94243af20dc73fb33e8ad96e99a6a9bdc98df5576a74135628b5e3ed94e6a14155bcfd425100a9020bcef2f5ee30a9787
SSDEEP 12288:Re+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Reyxknw4FYnshx8OfVe247
TLSH
T1C065237CBBDEA5E2F50D00734B7163626609B5A5EA71811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 6154cad56cc3eabd0ae121d62ab1d361870877a52293d97ef1214865479ae230
MD5 86d7622397e650bf9fe800092f1c1a1b
SHA1 30285f6196c55e35055731c09b71be1456f8869a
SHA512 3dd6c9a01614579d89455f452ba75275a47db345b19c1a6ed626458e201e7a5a7f99e61b9471fec262061d19132b81a4144fbe7a1b3d8d39341566d73d565001
SSDEEP 12288:AD+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ADyxknw4FYnshx8OfVe247
TLSH
T1D965237CBBDEA5E2F50D10734B7163626609B5A5EA71811BCB7DB00EF5F0CA0A02E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 94bbcf0ab714a6abb06d786bb36e549b546ba374073db908f033a7f7f3263066
MD5 577e8a7ede78ffe62fbc017cb37f7c65
SHA1 22433fdd68e4591efed3e880d8bb447421e2932b
SHA512 f7dabb8eb7c4696656084faf686da4b98a9855e7c975d15d60e082d7fb6e5dd3802921a72b6a35e7447c4249d7d32ba674a8e66db2f7467f51bc7d537c4552cd
SSDEEP 12288:hG+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:hGyxknw4FYnshx8OfVe247
TLSH
T18765237CBBDE95D2E50D01734B7163626609B5E5EAB2821BCB7DB10EF1F0CA0A01E523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 d8a3d43671a5101983d7b56a1b945f054677c26d57242f58bfa2d047debdf1d1
MD5 c68311adf296098d745484c89b49ed70
SHA1 5d8c223e06cfed5e5cdc64688c9cf9a51536d42e
SHA512 add706211d7fa207c35c7bd21c7bf6b8ae773ba80c57421b2c1f6b8d6fe6f592b8b2bd10758d40f0e52302ec80adc6edcfbd52775813712373e5e4c5093a267d
SSDEEP 12288:9s+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:9syxknw4FYnshx8OfVe247
TLSH
T1D365237CBBDEA5D2F50D10734B7163627609B5A6EA71811BCB6DB00EF1F0CA0A12E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 9abf0f7ecb80233ad07c061a859d4174d6dee6c64062593c7faaeaea92b2e320
MD5 9a3d3be7ee9c05699cd4e9db5d500d70
SHA1 8013bb87373f7b9aba393544954191989310046e
SHA512 a0af6640f1cd59e40dadc46e3a3c4ca7022dfcf6e090832afd394e0cc91e323eaf6e7aa79041e23edba4f867c1e504471d4fabd52d9a0a8aaabca6b947c81280
SSDEEP 12288:X7+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:X7yxknw4FYnshx8OfVe247
TLSH
T15B65237CBBDE95D2E50D10734B7163626609B5E5EAB2821BCB7DB10EF1F0CA0A01E523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 4d1d137a9d717a96c72d8aab35a34ae59210819291a07607415d36af3b74fb5f
MD5 2485c075c1ccc56e3a525aaf0dc985dc
SHA1 ff41b7fa9e3459e56fc8172e6ec0b1a815c0d6d6
SHA512 1b43e340ee0a86afa2a15f4b7fa508e73f3b34af03bf248d85ce068fa69ffaa163d043e3c4365fce47290e65ebf6c6c2a4d794cfcc5bf12292b90ffbfa999ef0
SSDEEP 24576:9fwvJk9RX6wkyAIyyxknw4FYnshx8OfVe247:CMnYItx4x8EVep
TLSH
T1E595CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b005103fdd1f08207d63c2ff8c2133a11471cc3d209f8c81ed5de08038ace3d7
MD5 715db03ac5ce1c7cd63ab48dda62b1fa
SHA1 39f9b064330819387817aaa7f4a959faf2b3b1b7
SHA512 ebe6d769218d3dac1579510e01ab803f0b4b63b88eed555ae65c57871d857c1cd6968da2fd77f83c6dcca36e5092d590e5274e7d3d582253ee04029428c35c47
SSDEEP 49152:pYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ix4x8EVep:RySzPaix8EVy
TLSH
T1EE066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 aa65509ba3f29d80027c672fe75d3ba3bc95afb5c6f42af793536b08b583d70c
MD5 9bc1c5ecbcf2948fcbe0f7597655c944
SHA1 0cdebdafc1bde15902dcbd81a6ec07905a655547
SHA512 a419c5bc3dfad2a9930922308839f8deb6ee6c749db58ccdd3f6fd95a24da3ea2a3567b4944818d4fadd91dc8a9845aa3e82f3a78c7fe6584164a7916cbce8c5
SSDEEP 24576:B47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYpyxknw4FYnshx8OfVe247:B47JUQj1irIhCnDHUPfF/yx4x8EVep
TLSH
T1B065AE1DA3EC01E5E1BA927885154A1AEA71742E1F31CACF1270837D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 083a024fc3e295ef5266815171313ff1ce595300e3e600ad9aac009ac92bd71d
MD5 fc76ede290125acd1cd73eb7f0430d2e
SHA1 7922fcc3dfbdb5e8f8ce70894e15477b124962d3
SHA512 d2a34fe1dd2984fc881a702df3a7be5ea383b49cfccbf618d6dad16ce167da65b1b220ebaf1003cbc1382b14e2fc3bbf3109378b03927830b142326adbbd4b56
SSDEEP 12288:o+sfO+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:oOyxknw4FYnshx8OfVe247
TLSH
T1F775F028E29802E4D06E2176CB625641B3237C6597F1D3CB97D0F53E1FB1990ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 37a0414eb436d0d29d46e9cc9c71e43e22628e8f6087bc5690da46fff74ef8d5
MD5 1823081977cdb889c8299997a29e03de
SHA1 ba5d90526d3e787686911563d7413609f638885e
SHA512 75376b0586fb6d5abb4af1c3d3416892af8c43e2c9ad6fa96020cef0790b12e03bbda146930ea8aec2c9d9ec90245330bc22495188765560fbecbd40df6c8101
SSDEEP 12288:GRBQ8U3fE5TrzIkBjSspY+bXVocdbVgt9wHVe7OF0Q:GRy8UPCEkZxprgt96wOO
TLSH
T1A6350700766AD75FC6A944321E32D1CCA7707D01EE45AF0773C98B3FD576668BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 f255ef73bba40a7560301b8a4d0138734154848bd2d0a0562691af7100aaa3be
MD5 7f89e938edcd5b9fdf766ae70ff25c22
SHA1 0360bd544e9ff5e17f85c639691d3a6c3e09c08c
SHA512 c83bcb4fb6fde438f8ad30b17043970f83a74c6ad6f81bcc5e1265ee7b571d3f675c36d6145d469e3de3f8e5f1f8a800ee34bd26a96c3d674e56b9ee2fa668a8
SSDEEP 6144:tzG4lPsyHa9JNDNTY/Y6GuZ+kPaPptMxdPptMxf7dWg74gZhFt3pJ1:NPiNDNTYEkPqhh
TLSH
T1C155E8815537A2CFC0FA6072072A5B4CA764EC06B7096F26B7C8453ADC6B725A4BD3C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 b04207ce0fcf260522c46a0b39067fd958a92f1a0be4af27b4b9befa2e64b7b8
MD5 e97990a9c4052bea9053bb4698d69c0f
SHA1 ec9b1d4da41b6c98c33ba0a4bf41335b5b975820
SHA512 e2b5d5e228e8a6ade245c65b63460297073341937a37599885aee3a3d6fa7e7ddfd5d88ccb06c39d872e98eb4f7cafcef4e8ba2109adf24223de823be8e29aaf
SSDEEP 12288:g472+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:l2yxknw4FYnshx8OfVe247
TLSH
T1CA65237CA7DEA892F86D11730675A221360AB5B49B70C1DBD728B14EE0B0CD0D97E617
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 375c11970921bdd50d5011f74a90ac0168e89acc02e5093f043a2885273ae928
MD5 bdc20ed89961792604cff14821eb5f6d
SHA1 cb789b039887195c86786a8a9447e46a6906f2d7
SHA512 df7af7a406012e14ee18f0e2f7747ece7ad99a829dc2f27a39acf151a6fb8710ec600ca0ea278d27ba89f57970f55ba6c5d4abd083a2b9e70ff24908349ab990
SSDEEP 24576:sgb6bmBIi49WNNFpg1rSvFv7bYgyxknw4FYnshx8OfVe247:sgb4mBIBhGFsx4x8EVep
TLSH
T18365AE1E22EC02F5E0FAD2B8DDA64417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 36796281f05a174bf9dd92955e7558e27243fe78bbd8581b34f00195185346f4
MD5 ac9a7a655328ea11c2ae471350768f25
SHA1 8dda17e08208c4fcb89572a84b63134c654afe15
SHA512 55184e464d23d66528e0c753fcb2ef89b0daa6abdb5c4ba9d6de7e70295f7f50fccfeb126fdaf95f2d02cb2b94cd5594298885a9fc3971a75649bd658e0744db
SSDEEP 24576:dG88u8FpJqH1azria7/mZyxknw4FYnshx8OfVe247:w7ZFPqVla7/rx4x8EVep
TLSH
T1A595F16977E101F0D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9a00559749fd3d67bf34e5052d7ec15528933a1e8af97172898af167fc96bec4
MD5 8a007a017974ceeab858ba63ff228005
SHA1 b2e5f2a238fc5beb386bacd390969629d71db8fc
SHA512 f6b46d995937d7d3143a7df978520d33439d291611ed47e9aa51bf97428a91935c6ff9d306f6a8285935854c0722bcc76e6c76eab686280df584d498f7a5bdeb
SSDEEP 49152:oBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjwx4x8EVep:DG05lO43bVix8EVy
TLSH
T159D5CF6E62EC11F9D1BBD17CDAC6460BEBB23425033556CB02A486A91F23FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f96a36cee3078d3d70060b53e71c5732550a356cf6a55378a75b8c2fec49653a
MD5 faeab783ebdf6c6103cdeec37ffeaa55
SHA1 8257a48e6e50154006b0c553957c58a5db05ba8c
SHA512 07af1307650fa159a5563e394d4e51796f3068584ba8a332cd4e7f44844f3bc1d5975ed493b9e7b9940ec867ce08d3d98e460015f3dc9b411b262a3ef75582c6
SSDEEP 24576:6fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnXyxknw4FYnshx8OfVe247:Sa5POZ3+Jt2pasx2+mIx4x8EVep
TLSH
T18C65AF5DA6FC01D5E5B9D17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 33032cf553baf34806125953aac445b8e47b1161aa1eb194fba57cc424055ab6
MD5 f3118834be2f387c0445f60700fe4b43
SHA1 f4fa2df757a4b98b510b2450c694c63e2757883c
SHA512 5a24828cfa6623a348b7f84d11701bc9eadc1c8e8e4da61bdb04384ea9fca9e9da24dc06cbacb360101a00527e0e2f51ce815029fda76d84e6e08276ef21ea9c
SSDEEP 24576:LNcwHdjbyQ4nLC18lb/EOjowL7FkRyxknw4FYnshx8OfVe247:LNc/zEOVHFLx4x8EVep
TLSH
T152857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1a35856e708de843dbf2a4c326b55109e9ef8b97752d23032ba37e9284dd0a1f
MD5 dbb99f85d42d02bd7adf640abd34dc68
SHA1 2d14e59eefcc09f8241277e9df6f0b6691a20b43
SHA512 e7b14bf15b2e3fc4f49cdfd216136ca3023877991540335503313133e610f4cb2ada1194b127d03e22f22e0dcce8f024f27d0db3dea4f9add91c23bdac77a5db
SSDEEP 24576:U8kNvNnaFeYhJNtmZBm7yxknw4FYnshx8OfVe247:U8MwBtOmex4x8EVep
TLSH
T1CC55AF6EB6F846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 0f54a98e13958c58d0cbfb9f827c4731b3e36ca9ecc087b54e3ff0635b70deea
MD5 706f108ecfb7cefeeaa0869bf01a22a5
SHA1 cce518aaef368950ab191153ef14a1c77f1e11fb
SHA512 9bad920e14cbc2eaf96042593214c556af84a514f1e11929b33b90e383d7313a71bbdcde65e9d79ea4ad03c8c9def4301a22e76682b0879c3acdd64e97bf4560
SSDEEP 12288:NHvUrBFrEjwaQ1+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:NPUr+NQ1yxknw4FYnshx8OfVe247
TLSH
T16475F12E22ED18E5E67AA17D89928319F771B4621711D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 378cf0d06ea924d4b4b44a177d95dbed00bac4ca20e1d9ccc3f5227f7280063d
MD5 23c33ffc6b75c6ea58a1b1f9344f6a1e
SHA1 8ea85fae77e184d67fbbce89b695a2d8d739c2df
SHA512 889550302169c552b647e3696301e5046a8fb3e91b17b66a0d1530e6f169cefb8b3f90cfc636132de943064032f2dbfc1842b7b6e9ccfc10eb09544f0b0bda0b
SSDEEP 24576:tD3FHshBIYQgAKyxknw4FYnshx8OfVe247:tDVHeBIAAlx4x8EVep
TLSH
T13B85E17DE79C04E4E57AC1BC8A638606E77138A9033256CB02D491BA5F67EE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1320-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1320-313-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1320-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1320-108-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1320-101-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1368-253-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/1368-55-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1368-61-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1368-54-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/2156-85-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/2156-309-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2156-78-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2156-79-0x00000000009E0000-0x0000000000A46000-memory.dmp

Download

memory/2608-1-0x0000000002820000-0x0000000002886000-memory.dmp

Download

memory/2608-8-0x0000000002820000-0x0000000002886000-memory.dmp

Download

memory/2608-0-0x0000000000400000-0x00000000007F1000-memory.dmp

Download

memory/2608-77-0x0000000000400000-0x00000000007F1000-memory.dmp

Download

memory/2608-325-0x0000000000400000-0x00000000007F1000-memory.dmp

Download

memory/4132-114-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4132-312-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/4132-120-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4132-123-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/5008-128-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5008-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5008-134-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5008-136-0x0000000000CB0000-0x0000000000D10000-memory.dmp

Download

memory/5008-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5072-22-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5072-14-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5072-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5072-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5160-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5160-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5160-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5160-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5800-50-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5800-38-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/5800-52-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/5800-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5800-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5800-46-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5856-317-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5856-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5856-144-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5856-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5892-95-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5892-89-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5892-380-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5892-381-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5892-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5892-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6116-67-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/6116-65-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/6116-73-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/6116-294-0x0000000140000000-0x0000000140197000-memory.dmp

Download