7ae23984bebf83729fcff4a2421afa40b294a2700b98f1015e0287b3c7439b09

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_8c1aa6d93e8b128cf9958c43c90b919b_darkgate_elex_glassworm_mafia_remcos.exe
Size 1.5MB
Sample260808-dpzehasscv
SHA256 7ae23984bebf83729fcff4a2421afa40b294a2700b98f1015e0287b3c7439b09
MD5 8c1aa6d93e8b128cf9958c43c90b919b
SHA1 d6de2722709a36dc9e7761cc980d98972550c4da
SHA512 d4bdd879c9117a180c0277830b00326e71cdc536157e4c77dcce4da55aced7783859a1c9b5af181b96e00e2f61052a37970095ad583bbb483dedb90c1fe0f2f3
SSDEEP 24576:ivrHWdZcy2NKcWzvJQHz4UTMV87BbkjCMvGdLtmT7Jckdwi6i9bNrqq4E41WFpWc:2sGuxQThTb7mGVt87Jckdwi3N7+WTW3
TLSH
T11575BD1277E58035F2B36731993A931499BABCB29839840E73DC666C2F70691CE74B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
4904	alg.exe
4784	GameInputSvc.exe
932	GameInputSvc.exe
1524	elevation_service.exe
4948	elevation_service.exe
5760	maintenanceservice.exe
2452	msdtc.exe
1688	OSE.EXE
760	PerceptionSimulationService.exe
1044	perfhost.exe
3772	ReFsDedupSvc.exe
2996	locator.exe
3460	SensorDataService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\bf99fd6783806d8d.bin	alg.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-08_8c1aa6d93e8b128cf9958c43c90b919b_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_8c1aa6d93e8b128cf9958c43c90b919b_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-08_8c1aa6d93e8b128cf9958c43c90b919b_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-08_8c1aa6d93e8b128cf9958c43c90b919b_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_8c1aa6d93e8b128cf9958c43c90b919b_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_8c1aa6d93e8b128cf9958c43c90b919b_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-08_8c1aa6d93e8b128cf9958c43c90b919b_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-08_8c1aa6d93e8b128cf9958c43c90b919b_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-08_8c1aa6d93e8b128cf9958c43c90b919b_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-08_8c1aa6d93e8b128cf9958c43c90b919b_darkgate_elex_glassworm_mafia_remcos.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	GameInputSvc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	GameInputSvc.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	GameInputSvc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_8c1aa6d93e8b128cf9958c43c90b919b_darkgate_elex_glassworm_mafia_remcos.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_8c1aa6d93e8b128cf9958c43c90b919b_darkgate_elex_glassworm_mafia_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
932	GameInputSvc.exe
932	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3180	2026-08-08_8c1aa6d93e8b128cf9958c43c90b919b_darkgate_elex_glassworm_mafia_remcos.exe
Token: SeTcbPrivilege	4784	GameInputSvc.exe
Token: SeBackupPrivilege	3772	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3772	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3772	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3772	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3772	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3772	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3772	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3772	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3772	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3772	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4904	alg.exe
Token: SeDebugPrivilege	4904	alg.exe
Token: SeDebugPrivilege	4784	GameInputSvc.exe
Token: SeDebugPrivilege	4784	GameInputSvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 932	4784	GameInputSvc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-08_8c1aa6d93e8b128cf9958c43c90b919b_darkgate_elex_glassworm_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_8c1aa6d93e8b128cf9958c43c90b919b_darkgate_elex_glassworm_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3180

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4904

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:932

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5664

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4948

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5760

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2452

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1688

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:760

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1044

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3772

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2996

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ecba5d30066f23bce3a6451075c39373cea0b8b8f4d929f6469f4325b7773390
MD5 4be1fc20bf7a8d1ed56b0a1f14254eb1
SHA1 81f35b332d791df1768cb7e2e85212ec1f5423af
SHA512 38944933a3a73fe3ea06dc70a533c7e61af79af5981070aea2d684eb6f9714abc2b3337c2460357d9ace80a232becb26c5031913f949261223ace9da0478e5a5
SSDEEP 49152:guC632BuPkFKRrdE6oh7stBhuXjfS4LWxnu7Jckdwi3N7+WTW3:L3q6gjBDPdwi3Q
TLSH
T175D59D03F2D900E9E06AD178D7469132EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 0d063c8b3ba77fa94ab37f2ff0f6e4d2fae8c817120a3f60258349eb922f8153
MD5 71b618e81f511afab4e53ea36891c65b
SHA1 0876e76974d80e70313a6708600c4c58715e854a
SHA512 24fd6796e29757808f8b123c535599254abe0856e616bde05f852233ec7999db60d2661c4e3072be7269d1b4996f12f372ba4fd6d34375265a2892a27eca146f
SSDEEP 24576:TXYHDxczAzT7Jckdwi6i9bNrqq4E41WFpW3oRos:6xcG7Jckdwi3N7+WTW3
TLSH
T1C4050128A3E409F9ED67C239C9B2C511EA7378514760FB8B03E496651F233946E3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 0432b35c182652931d783d9ca8cd81e2fb22af3923f2146715930db87cf5e314
MD5 601be44a5972d9df4fae1720ebabd91d
SHA1 e2d7adb324be21a5847802f9f1364de01f79d56b
SHA512 a4e63e5c20e1272e6d661d602bf603dedcb2e418666bdf5632e40f6bbc1a02cf24f78983293ac1fdae1be1ab30b37622ee837b9a7c13d220da6199ebbf048662
SSDEEP 24576:T0Qeky90nlxOrMTT7Jckdwi6i9bNrqq4E41WFpW3oRos:T3y90loi7Jckdwi3N7+WTW3
TLSH
T1DF359E16F6748335D073C0B9C5D2A69AEE7130825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0868406839d37431bd704bd972c4155498b24b5a21f36dfe2b8e056a2814865b
MD5 a4431aa21153555aa6f262fe31ff9fe8
SHA1 a240efe93ca14652bf4485b6bc1932a4033c8c36
SHA512 1f8d13730c90a2da8401960815bb7b5169f91ca9ac128e8cfdda0d0bb897b6753c119373d77866db95c6d13641e6cd3af099127b77d6fd866f50d81667010c9b
SSDEEP 49152:I/ezSC6vUzPvuHjy1H7Jckdwi3N7+WTW3:8ezSC6v2XuHyPdwi3Q
TLSH
T1A3755C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1991d1c71240a2b9a25db138cb384194592136c6e0d31fc75339f00ca5d53135
MD5 029c870db998662631b0e73175928aad
SHA1 cd54f61790e8e0e68b3d46bebdf165c7b3c0b458
SHA512 b170fa08a56bff6f9216b39e83916c057c490d7fe0ae502535a238df7fb159a23dc20618025ffc6d4820e54209dc76ad32aada45ea82234129368c976b5fb050
SSDEEP 24576:eabdPWwkYv/l+dUT7Jckdwi6i9bNrqq4E41WFpW3oRos:eaAwkYXl+I7Jckdwi3N7+WTW3
TLSH
T17E559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C2E677D6D73A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 fa47cf0829b9c8050b2faec46cd0adaf22e87baf6457cc33e3ea7c1370595d2f
MD5 301695ab009e8eba7220042800e1d939
SHA1 a0ce5aa1b20eed5c1cc55c0237b0f92e33d2e430
SHA512 d323021e4212515d4fc0fe3db84d14564b95b936858be7dad3f112a7183c0feaad9cf4e46cfdfc443f2561d7826fc14d2024de4e555e35ff941816d877cc1004
SSDEEP 12288:QU+T7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:QU+T7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T173D4234CC65956ABE3A7D231827DE6E4FAE42E423955BE0547A473A0543D340B38BF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 460ffafe113d9a9f7c53d80c2a73002eff6ba86dee17679a498a6080629a19ba
MD5 7394310ea2c21f06cb92ee282395ca9d
SHA1 e837b2617bf128ed9a290391a6ee516dbffe1cb6
SHA512 430c1aa1c8b4eff91372aa6a82a44cbb3ee9165a0c765ceb0095a329c1104358b9bae58538131770191dbc2a9eed5f2a6cb87af2d4d6c0ead10969614ec87275
SSDEEP 24576:TRIU5yT7Jckdwi6i9bNrqq4E41WFpW3oRos:TRIU67Jckdwi3N7+WTW3
TLSH
T1D215CF2BEE28FCE2C27A9D795791C640E7B278314F61A3CBD164820DDE235D05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 dc7460421eff8f07f5ef9fdff5bdd6bf33c08a8b146cab4a525fe465cece0fb5
MD5 d61b52ff850fe0ecd3ebb8e62fd2f04d
SHA1 1352dafe519ab6e617616c3ba4b2de240de3254a
SHA512 ff811392e48444798afd3356f059d55e0a9400a15d1032763658bcb5385646a6540a265af3f52ff72c76294824a9aaa3b7e8f84d6439a0b959d7eaa221c02a9a
SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJN9DN5J8NRV3THR:DQvGAdlCEL8c/NRNw5CJPdwi3Q
TLSH
T132367C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 7e794f13f7ddfd06894df53880a20cf28f83e8e1925863329068452fb56e2289
MD5 fb880647f341de1b57d5d0104b4876b1
SHA1 9c2be9f4ef06f2ca458fd62444c81666a7400bae
SHA512 8c8dbc9bd726afce34a2b92f62d39905d19ec007ae39aa90fbbc143fdcd82c5bf518757846e31218a0a89f814b31f1a4cdc8bc09485abd5285e3ee58196e0884
SSDEEP 24576:7mewsAjiT7Jckdwi6i9bNrqq4E41WFpW3oRos:Cljo7Jckdwi3N7+WTW3
TLSH
T11515E031FA74E436C37B0DB21B36D716647C7A204F612AC3E3E85A9D59342D22376E26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 24bb9d1d3cfecab6f32fe3d74999c921840219df59e60081768094400190e19b
MD5 7d0dfaf1729c4d75c4a1a7439a15b394
SHA1 25f80d7f084435e7f41a9613905589bef936ed90
SHA512 0fcea9b0e8e5c3584660a1db717972507dfb1967afd346d6d1e0b42c5c80e7fcd3abac3d8ed77ef00e8369fd1dbc58d5964a88c659a7003a2e750e31aef9c276
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLyX1ldPlbuJHzPdwi:FUEtQevvqc2W1cpV2X132zPdwi
TLSH
T162474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 545db86f043c5775665bcb475006b0b972a53aee92a399faed99be1a7ed0cf32
MD5 4c242871260d8da513159472e200174b
SHA1 b30cc13d0b9f511f7aa2c35b8f75939041e8c9cd
SHA512 59d67a3d516a2d30f249f319a5002a95819a1a6e41313d784456a23677571bb87e56ea51b71448b268d37f0e99cc039fc94969d765335a8e2329ddf5f66ceeaa
SSDEEP 49152:JKbRquA/m2yL5zM9FiV+XenmE3/zc7Jckdwi3N7+WTW3:ioqLVjnmpPdwi3Q
TLSH
T133D58D0976B8C2E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 10831da74a4762a2142e989a39dd147e07b3439214655b81755a283e3bfd5b53
MD5 67d552188cd6869f809b24c33b3ad6a5
SHA1 a70086ebd2b849a941d4c7d195320333072c1abe
SHA512 bc531256889b77970f274b02f54463c647723af8cdc31e674a1991bb80647703a3e860254770a54808607022451376ce754121d38de36ef2f2a1e65054141f51
SSDEEP 24576:BAhGLvbFoiwtA5l7S53jT7Jckdwi6i9bNrqq4E41WFpW3oRos:BAMPFoiq5v7Jckdwi3N7+WTW3
TLSH
T1ED45AE80E7F955D4F5F3AA7899B69170EA76BCA65E31D20F1260D21F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 3ca9459582e84d9ffcd02da1d7f6a99485995bc1ec8a11c13a84975d01cb3d06
MD5 e082f845e6cab7eeecc905514d984168
SHA1 6135401b345a12b2550b2e67fcbc001b641f7b27
SHA512 2741936f35b9a98ecfda88d52c6bd801ca886aa7b9144141dc41a4f295ef231b70eccd09fcfdaad9ebd603982c88ede00fa3a88427bc63a75963917c084c1f80
SSDEEP 24576:Owu+OWUT7Jckdwi6i9bNrqq4E41WFpW3oRos:OwlOB7Jckdwi3N7+WTW3
TLSH
T1A105F14972A40CF9E5678239C65BC535F7F2BC022A25DB1F07A0C65A5F27351BE2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 675KB
SHA256 ea5ed89b84038e4a0b7c8f3dd72ba98b6fb7fb49fdb425beffaa172c8bb3244f
MD5 8b42b3323370fa7421698e5bff455a49
SHA1 dfc56aed5f8f039d59a852d8b4a6c1424702b6f4
SHA512 de34f461440d9d95c358c6577be9d2131e9f352da40104e434c6ffbc7c41714d7852f0e5030af67f68004539942797ec1c127550c27205f530988ea5870f40f8
SSDEEP 12288:FXL1IB/diT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:pLuST7Jckdwi6i9bNrqq4E41WFpW3oRB
TLSH
T185E4124D23D421FAE2A39239CAB99644E7B138532775A7CF076443A41F277C16E3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8cae91e6f959c66e35318a86d6e0b17b2ea8ef7d74cd941697adb4a65cfbd236
MD5 a7a0c4354ee0267b685318939b99f369
SHA1 1f06055cabf1f5675dfdf3228e226557c40adfbb
SHA512 32efbbce337d7cb2105502f9171fb8c9f31da26815f8f4adb219057b227b3cd1206f1ec96b2145f704a4127773c5ff110e3e1cdfd63e7547608383c7049710c0
SSDEEP 49152:CJsdh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Uc:rQRQyi36YOcP8Lvw2gAf+PN3VPdwi3Q
TLSH
T1A5667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c64d38f1b617b0132b594ed7aa23ee95257e04bff57547907355d530a5ee03a8
MD5 234923add9ee27991d9c74faac6e9487
SHA1 0dda942ac8f341b5e2c01c95d4196446103c1f6b
SHA512 5abfeb41dbcaefd25dc85d598f5add4cec784ed881689138f02202525271b841bf92b676ffa04c1820ba78266543db7b8843c7c60320e073e6a59f6eeb3e1607
SSDEEP 49152:CJsdh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U7:rQRQyi36YOcP8Lvw2gAf+PN3KPdwi3Q
TLSH
T186667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6be10c1271d3fb4ea37d8e136cc00be63577cb73a99ce36bd201c269177970ae
MD5 3f648ba5cea730ed9633e419e7bb9ae1
SHA1 6e5ee828647f1460850773c3c026ef2c8ec1d447
SHA512 8c57dffad62db41b95f509be47dca64ea349c6ed1c04e62e06c7c8a736ce01f27afe0f6bb19144b20eddd58e2b3f99fec27b7a237afa430f45145efd6eb0c610
SSDEEP 49152:E68Qg55nhMeWu7PNU3/f7Jckdwi3N7+WTW3:uthbRc/VPdwi3Q
TLSH
T1BEB55A33B2F600A9C44DE1769F4A973196E17C718FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c04cc13f9f00bb8c95e5a3772181dd8313663b35a0996f7a5a729dcc5ff48b5c
MD5 01af8732289ce7ecbce6831961c0b5ca
SHA1 dc791eaffd335d1c2a3aae48fbf4036c81108cac
SHA512 275ce883d8db5f58d5943008b7b162e9ffe37f7739414ee9d0c09160e3b010fb93b96156aaf1ed7b4a9bec5662de9ec49cfe8e3acbb408de93121f9a080e418b
SSDEEP 49152:23aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99T:ny5112gYy5azzVv569nLKnhZ/Pdwi3Q
TLSH
T1A3167B13F29900E8D05DD1B9874A9232EA72BC474B25B6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6878a4149edbe70016ba9fdf1be66b6f1e3bdd527d591215041d134fc176ebbd
MD5 333987f296410e7b806190a44c1302c3
SHA1 5f25b88b2857a8e246d52dbc23da2f1f05d4690d
SHA512 87f203cbae044069deb795a6d40300a5356faaee9bce56c2e367b1180e2e8a3f030678bc90fcdfa2835ea158fc697971c3a58e6fa845b3ea9a8ab128208ff37d
SSDEEP 49152:TH+taZ3usBWOBr4tEGp0bqx0z+n217aau1glk7Jckdwi3N7+WTW3:Hu6JmTxd2dCPdwi3Q
TLSH
T1FED59D13F1DA01E8D06ED478974A9233FA62BC490B35B6EF0A9073552A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a4cebebc73574f337ce33a739c817d679fe094146d25473bc0653cd242a1af11
MD5 c2bb4e7f50498f0b16809498ef476271
SHA1 7573ad9d0d4cf921347809c576f355dc09238801
SHA512 b25007d263f0bb0fee7113cc492843bc3322eba6b487703ac866f61d2f7cb429f485b1558a7a4cdc40f2c8787a6f5259593c9ae89830ffb6f282d91fda8d3979
SSDEEP 49152:I1hpsNoJpF1A6UU44CwH7R4x+7Jckdwi3N7+WTW3:ImifPbRdPdwi3Q
TLSH
T15DB5BE13F2D901E8D05ED178875A9232EA62BC460B34B6DF0A90B7951F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b90a1f33f12bb6628b32b51247c94f5dd25c5f7864a0f133f7df7abb9a875ceb
MD5 8fbb316a6d8ddbf4dcb6152e1126f3b2
SHA1 34c130b5416e7e59403b1f29b2d69307e3c9d4f7
SHA512 2f6a11bff020064ae42c9b0b63484730fefad618ea3d09ce24ecebdc7b5eb7ca0ed3a995f8a04c86aed91d8e7a581bc2f67fbb63a81d25d5a1ea4dd9188ee77e
SSDEEP 49152:bSuZQIY0Be2K6RVtOnks6NMHqM7Jckdwi3N7+WTW3:J5dKoi61qPdwi3Q
TLSH
T1F3C5BE03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8a36c9ad3e1638e64fb0352c1a1fc7bc6a3f8039de3242540df4cea71e9f32b4
MD5 c1ca3a48eedd8f3af9a8cde343a1e355
SHA1 2033cd3454a6bfa30f3c00d7a5eac03df61c66da
SHA512 618a88576749ddffbbb52be699af7ef789c24a31c3100ebd32452618d5bc739326d43b493bd9ce260e42d8f6916f5f32f4ff9def5c0d7af3e8c0bc7838143c2d
SSDEEP 49152:PPSSn8EApI0figTgiDn0AP5wN7Jckdwi3N7+WTW3:zX2iyphiPdwi3Q
TLSH
T179A5BE13F2D900E8D05ED174C7568632EA62BC060B35BAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 598KB
SHA256 31f96e626be84a03f195f2b68408a389e276dc4dda51ea4c39ed8a4eb9c84e79
MD5 f639da0233e0f0bbbca934b1bbfbc5aa
SHA1 41901988e19f1d853dcd870e0838f9cb06e46661
SHA512 b357c453c5869708baf44ba2f2fcd8e5060a05bb2f2fe4546402c31d0b6301ed9e9c065d12f9369a97857e45748498a78717fda6a2d77d56686ee7b48be327d0
SSDEEP 12288:7OT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:7OT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T10CD4234CD55A46AFE353E232C33DE6D8FAE82F437955BA05479862A0555A340338FF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 598KB
SHA256 bfb018845ccfe9abc5b1489ce9449f5b3ec06ac45ea05849b9c8e2e79e28e7c3
MD5 39c08dcbe2b968f0ce485bf3a395dc24
SHA1 1e3fca1dc36a0f440b11695ec0400d85aedd87fe
SHA512 5ae7b92983eefdc109e1ecdc179f215b283e590f2d6af3d1fe64f5a8c7bc6f85a56625ede493352027f624a804c90601ef51f8154299f8ab3bcdf788d4e889dc
SSDEEP 12288:RRT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:RRT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1FFD4234CD55A07ABE353E232C73DE6D8FAA82F437965BA0547D862A06519340738FF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 598KB
SHA256 e84d961e0b75bbc7db2f57ea4997678f66449bf107fabe9c4314a95dcf63f1fb
MD5 bcae9f1c59cce09196620ae504eec80e
SHA1 4a3ca1117a50aea5d77ea555f0a157291c595079
SHA512 ea39ed1fa1605d670781e140f16fa8626d5fe9980bf321729c39086f478804cc394b986ec1fb158dcb5c8b0bb9105aad9c047ea9994745a494c719f08ebc512e
SSDEEP 12288:TrT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:TrT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1FDD4230CD55A47ABE353E232C73DE6D8FAE82F437955BA0587D862A06519340738FE38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 619KB
SHA256 c450a838e14717be70381c2f2059f64db99b717f59b4acf36a8aa3ec70714e2a
MD5 a04356b6c4810d8a36fcb4db1f6fc8f2
SHA1 8206cb69c111fafa5f07abe26482e07aba521705
SHA512 251defdd835433e71b15a1a3b207355069d8946ab6f5c53834aa65abef0119df49bac50ebb2eba648847dc40c34bb461fc5aa63ff845e6aa1d35bb9767d247c0
SSDEEP 12288:KlCT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:jT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1B9D4234C975A02EBD663E231C63DE698F7F83E427A36BB4F479012A01965340776AF34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 598KB
SHA256 feb633c4434d6a17d64debd3c1883fb054a05a6844a1b41c61a4ce38aad90217
MD5 03eae5287f13f0d751741506f9b5785e
SHA1 cad563b95b7aec696f40699d9fab00861572b561
SHA512 06a3850d24cdc7711c671a8eece5de01441e4e553bb83c36395a6911191f0007ba641c123e02e1be1774069bde246f530c9f66940c31729a1b96da14d919d6e3
SSDEEP 12288:C/T7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:C/T7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1F2D4234CD55A06AFE357E232C33DE6D8FAE82F437955BA05479862A0555A340338FF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 598KB
SHA256 9c1757669070440121968c9f255c599529785d79b4ed6a52355bd5bb845ecbe4
MD5 9f25c47369e419971533ed0d4faa0a56
SHA1 d7ae9e0e17c9572ee0cdb1609841f89f3aa9f404
SHA512 c93b9f328b418f381f5f3e545d117f54ce0eddb06e86ad302d4268fc136e57d346d5d86d4055b7659add5bc1d656a03e3dcaadaf8bd5bbc7f20ab877448514cc
SSDEEP 12288:xUT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:xUT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T14AD4234CD65A07ABE353E232C33DE6D8FAE82F437955BA05479862A05569340338FF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 598KB
SHA256 15a16768199615311526e661f3c6ab270a1b9876db660815b02db13fbf8843ae
MD5 6c0c3a504a2dae78cd9b7972578c052b
SHA1 db8480bcacbd69f3a34b0cb578e0ba70abe22a5f
SHA512 a969ca400f60193237d6b907066a3c0c4b976663087b8637717b4cd03fa8946888f1b06236c21acc5fc22197c20fe3de98f9f1a7dbb289fc261353b0749f5da2
SSDEEP 12288:eST7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:eST7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T168D4234CD55A066BE353D232C33DE6E8FAE82F437969BA05479862A0651D340738FF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 860KB
SHA256 d6e71d3c027ba4c1dda9b62f264a3efefcc7fa5cf7b1e22a22fb466bec58961a
MD5 3fa541b4ade1b20affd40d55be8a9642
SHA1 4fe9ecab6b26761983daae3e9c46625eb124113c
SHA512 85ad35b335e8621602b04a27726ed77d6990163221f8061ba1f7ad69fdafdc6aebe6e13b25dc7a874a2a72424fad4da56cb765bb32d0270c374d5ab7e445ff42
SSDEEP 24576:BZMlzFVSjjT7Jckdwi6i9bNrqq4E41WFpW3oRos:BZMlzfc7Jckdwi3N7+WTW3
TLSH
T18E150298B39018F9ED63823EC9299945E6F27C561B70DA0F03E432665F333911D2EF69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 598KB
SHA256 058e146c65cebd4ac91669af23ae04e64646d4f19bdb7959eb642ffdcd15c7e9
MD5 4c7ef917fb3855df6b1dd9ccdcaddb4b
SHA1 551e14d4e601b621ef24f9dc5736c954c7fe2b60
SHA512 b79f4d0ba34fe36b26c144477bfd949df5a233d867f65d917e90360b556020a528f7954a91b24cdf372c85067837386458be22e0032ecbbe2da58a7e68e6fdcd
SSDEEP 12288:jMT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:jMT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T148D4234CD65A06AFE357D232C73DE6D8FAE82F437956BA05479862A0551A340338FF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 598KB
SHA256 6fdf8b33ff5103669b2c3b03fca44d441e37ec623425014f049174b438fee179
MD5 5927dc9b67c0b4ad5d10d923fa0d9095
SHA1 539fd3fcb60f0a24b62557684d0b65f4c8c2c67b
SHA512 f8f7756079425a01633c07eb768e1a9d59c1513c0d65dfc4740c16187354b1195e3fe923bdb8ca97002a43927e3897bd01b21a5d9efec7075ad2b5620f425253
SSDEEP 12288:ZchT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:ZchT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1AAD4234CD65A06ABE357D232C73DE6D8FAE82F437956BA05479862A0651D340338FE38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 736KB
SHA256 b37d215d95ede366153398d35e101196c6e98ba5e0e985f704616e28a795f7eb
MD5 992c8765bdd56a548ee61049ff87dea2
SHA1 09e7025d2806d04e630c35ececd01fdc932fedb4
SHA512 7a1f837120185a3a772160ba713faed73a6667d8d8d90a22b1c782a6e11c184726d79ffa55d7eca6bd3cf255f8bfd6e57e84245f06f798c895eebb85b440abfa
SSDEEP 12288:BuPz5LAq3T7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:Izyq3T7Jckdwi6i9bNrqq4E41WFpW3ov
TLSH
T197F4020B63A521FAD167D235C9665A45F7B578321B24AF5F03A403B52E27390AE2FF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 598KB
SHA256 3562fa68a031e37750e3524c55d76b41c53b27a4be682e2c58e720476b923535
MD5 5c2bfc304692fa76873f8b66490f2480
SHA1 64d55887b9a4ea1a83879e14dab79ca3ad3f0f50
SHA512 5bc1b273d380557bd9b45458f513d14417d7a6df408c89737ef60bdbb5118f7006bac1cc307761201c69768276289082d6957f5536990ccb09ffb0c1645b418e
SSDEEP 12288:bvT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:bvT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T149D4234CD55A06AFE353E232C73DE6E8FAF82F437955BA05479862A06559340338FE38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 598KB
SHA256 7e64c5e6a45e9d3c2be95e39e65659313aa89b017580f8eda09490bbd224f40e
MD5 3f0a11b2ea8659078bb7af04c4078fc7
SHA1 5ae41b7a8bfc8c6ee5a85d201e66621c703ebcc9
SHA512 706f31f2cd59a7fab996dde8dfb4f4f995a3a8d7c0d785db5204bf502e9e93dd1a45733cfd8372cea15d59db3263559ebed3e9a12b830dec6816066a298719ff
SSDEEP 12288:fDT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:fDT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T145D4234CD55A06AFE353E232C73DE6E8FAE82F437955BA05479862A0655D340338FE38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 736KB
SHA256 5a1d8a85991b5bab74be40102e6c7483da396e1c99a78237bf24b707174c63e2
MD5 dc1f029127863d998668d349b5db5774
SHA1 e97065782d177ac640668375f3952fc2b892bffb
SHA512 78dfdc2be0597b0a0721f196675ffbeea7ed27caf1979c5a445afc53fce6c431d9c8e6cf78604149b0f75940de420ede840c9476b674cfd12a3a94b6eee9a4e1
SSDEEP 12288:guPz5LAZJT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:VzyZJT7Jckdwi6i9bNrqq4E41WFpW3ov
TLSH
T107F4010B63A531FAD167D235C9665A45F7B578321B20AE5F03A403B52E27390AE2FF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 860KB
SHA256 d7b84577a11e5f6d6f5d3227dd6732a512cacb7d1011bca3372a10b6ef40b8c7
MD5 0d8be415dc3a35f23437543413bd7507
SHA1 2f25b089d8b14b4bb2600e58a87cf2aeea887fab
SHA512 e64148867a05986d6208ac61680621bf927169f9c5cad3a8af69300b8e8a05da18e1c0652eef65009892559cb9f6e2b7b13ac682247a473fde1750748b487f25
SSDEEP 24576:nTeaLl3z0zDZT7Jckdwi6i9bNrqq4E41WFpW3oRos:nTtLljs7Jckdwi3N7+WTW3
TLSH
T1F4150298B35018F9ED67823EC9298955E6F27C560B70DA1F03E832665F333901D2EF69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 625d058eee5e9b0b9b394cab75538c0652ef59322eb1c842d47cfd28048cbc61
MD5 d0a5d908516c1cd41cb95d7555debda7
SHA1 3f3c85f2c7ab433761ab4f2ece77c5eb83ea6ba7
SHA512 37b81a3ee292b70230f506f929ef765ad82cbadeac0dfc0241bc533ab8ec2cc6c04b701bd2d17c1388f25aa34d85ee18cf8c2ea8f5bead1c61d2ccf646e132b8
SSDEEP 24576:y3ud/CHay7YrIT7Jckdwi6i9bNrqq4E41WFpW3oRos:Uud/CHay0+7Jckdwi3N7+WTW3
TLSH
T19D35CE90F3E410E8F1B3DA3589769511DAB67C5A1B21DE8F03A4265A1F337D18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 598KB
SHA256 6d5df56658ff5647e9015988240ffde253fd2dd05c53be6fc27f3eed26c52c9a
MD5 224c55d55ac538d46152281ee3e05e83
SHA1 eb04ab1719f833ebb77008e146853d3d47620a2e
SHA512 2359a54f17f879df581b88612e377e1872bfcf03c287ae4490edf0fc5ed97f1465dac758642cbddb36817b836632f1577d12fb2d5fbb97decbdedb79c4375e1b
SSDEEP 12288:FbT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:FbT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1F7D4234CD55A06AFE353E232C73DE6D8FAE82F437D55BA05879862A06559340338FE38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 599KB
SHA256 140f11e0f93c87a93293b0ac417067372a16109db3b5cc38a6e6e5f7cf2d7727
MD5 2ac4cc7f4b1df816d1be87641f6dbea2
SHA1 25cafbdea51d8af1bfe6d424a848f30ffb618a86
SHA512 76a1575841c12c48b034cff91e3d6831c88ca3c05b1a2fccee524da4e704ad07ba7c0a86027d8ef1f4dc8d69f1164e5ae0ed7c6480fe3f299814bebf574390d3
SSDEEP 12288:IxT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:IxT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T137D4234CD65A06AFE357D232833DE6D8FAE83F437965BA06479862A0551D340738BF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 598KB
SHA256 8583774bdd308f25622c1f89e99da7c17db71b95548513547fe6bf1a2795b0a3
MD5 aeb9a1b17a34974b72960e00e602dce9
SHA1 39a1493479f17c8d2689345b4c3ac03fb1071834
SHA512 a62ec87fdcdd3ac730eff1e75b115712a9f7dd4f5eeed7a8d23d33d80eb7cf755255cc2abe538b1a4f1b80873ec5fe39505719729c08964b06a6e188b98345c4
SSDEEP 12288:GnT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:GnT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1E2D4234CD55A46ABE353D232C33DE6E8FAA82F437955BA05479862A0655E340338FF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 598KB
SHA256 7c1f35d809a48a25080c513a63614ab510566677e83ac421f86133346e9db89a
MD5 5940cd3628b9bb32f1b58c70f7ca1aba
SHA1 0cc2984e683c1b9e16b0729c15586a6fde12b123
SHA512 b71c4195d160fd90a9283683109dfdb4de6449818fd9087426c31ed7f4779d79ca370e2b068dc18d9aea374645bacea417cadf0f7c5f026462ad17ada1737a18
SSDEEP 12288:5SEkT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:5SNT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T17CD4234CD65A06AFE357E232C33DE6D8FAE82F437955BA45479862A0651D340338BF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 598KB
SHA256 6ecbbfc842b5a56ec97e169c31aa803ae7433e563d7b50786e12af532f5fc156
MD5 39e40b3049b4f75099c2dd93aaa2ebff
SHA1 6e16df1725871ec5e8affbcbb2a51d0b05af2ad3
SHA512 7722a976757b8ef1c84366df046bec3ac6bae687f01ce1cbfc26b0f5945a7d20caa65c7c507dd91e17b786725180df5857051a42c38c4d88599d90a5870cec58
SSDEEP 12288:3OT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:3OT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T15FD4234CD65A46ABE353E232C33DE6D8FAE82F437D55BA0547D862A06519340738BF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 598KB
SHA256 4c79a27e84c51dc93db6c76ff6324f60d225c35fe259dbfbe1089935a72c18a3
MD5 8bdee76ac0c131aa7336ad78a5b48111
SHA1 48bf511c03c6daf2b44c7ee2e7daca755f3164dd
SHA512 0d8d5e973580b151040766f7c022d7ba8aab58d622e7b299a721a809414dc9a03004dfadfd5090b3381ad400a451f62afecac925642a42bf06791fcdb2ff2b93
SSDEEP 12288:0eT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:0eT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1F3D4234CD55A06AFE353D232C37DE6E8FAEC2F437956BA05479862A05519340738BF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 598KB
SHA256 d0ee38a92a81b2baab63f08980695bff2cbb953bdd16e10aaf175ca2047e5683
MD5 1ec6be34f867e2bd2a1fc76d6f640942
SHA1 2fe8036992ef2980639b77a555d8655ef981bd77
SHA512 26f9a31329b42325419100996f65a211c25c0ffa7678614562c2281f3149fed681dbd710963fb8ce5572e551aca9e53727af1beaca8a660e1106d4f59324a757
SSDEEP 12288:faT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:faT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1E8D4234CD65A46ABE353E232833DE6D8FAE82F437955BA0547D862A0651D340338FF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 598KB
SHA256 125cfa13b47a4cd1eea0eee1fb9d328b339e6f43e719dfda54b60db39009c6ed
MD5 75dc24658cc609dc2bd2be084aefd70d
SHA1 b36ba023cb0fdd3c850b49ce92d8ded34c219c2c
SHA512 1adcad831fb5d6e1e999ca2d89c52a464b59cfb81954140c71e5ef7ce30b919f7acbf7f74caf2dd465e174087238cfaf62bb6c6eb9a00b23a2042e17e78e3988
SSDEEP 12288:ezT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:ezT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1A8D4234CD65A0AABD357E232C73DE6D8FAE82F437956BB05479862A0551D340338FE38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 598KB
SHA256 5f955e18ecfd1fb4d42b6b4fa2e7d02815fcbdcb5ae62acce899ef5a88ba0f48
MD5 cf8a6e0ff1c19c805fa1827285979f5f
SHA1 b2acb255dee2afcc6aa8dd0f3ac477719a37ab38
SHA512 cc8ffe9a9f3a22d001807024bbb1d372fad95cc2add10d6b938c3353db28e767167dc9f87b8e13e99b2fc148e52d66d1e408bc259978b580c270fc78aecd3168
SSDEEP 12288:y9T7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:y9T7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1E4D4234CD55A06ABE353E232C73DE6E8FAE82F437959BA0547D862A0555D340338BF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 c3e25ab7a732281338b9483d67fc6f787348d4ae045d63e358fdc54a61bbfc10
MD5 e858c5a4a1e63085792c688864ddc99b
SHA1 c05aa37412a83abdf32b7f2ea13102f077500a00
SHA512 cc875a453d082c53cc5273da5044c9e19b81f812b0b87c756c8c594a5dff2ad0f6c1b97e9ba9fb7195267475146d9157476c8d8c58d5c83d4df1261d855a9f5a
SSDEEP 24576:Fgwvtk9RX6wkyAIyT7Jckdwi6i9bNrqq4E41WFpW3oRos:fMnYI47Jckdwi3N7+WTW3
TLSH
T13435D029EBDC04E5E177923C89B7460AF6B178591B31D6CF029953AD0E37ED06E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 719KB
SHA256 690df0365da2d8d401378d3fff71a0e260dd41f25aa3f9e8da99b2775e4b52c4
MD5 6b35c70521b06691df5eff82eff76604
SHA1 67ecedb06c77857257e6511f1b977745e2302040
SHA512 f1a4496150b7baff06b7e0c442868adc66e8f1e1383525bd96c3fe8e152af0993a61874b42560f0a14b690c66a4536a06a12c449205d1276731ccf76ea3f3981
SSDEEP 12288:Gpsf8T7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:T8T7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T13BF4F009D29802E9C16EA235C7699680F7773C2157E1E7CB52D0F57D1F3A2806EEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jusched.log

Path C:\Users\Admin\AppData\Local\Temp\jusched.log
Size 164KB
SHA256 ea9bc818a5cb4ee839e339bbb9135ef8ca0d6d262f678812e1da3f9390277aab
MD5 181a41d5c09c5eaaf1e918a1c2570d64
SHA1 edfe07f5416d4169b46be83728cdddb6dd071158
SHA512 59b8514b5e2bfccefe3c5efa187232ac7ef084871a58ceedf0a8c2d03a12bf1b2164d2a3851ce9c81e7f4b27d52e027ecc7f6e053b7ca4cd34b27c282740d0bf
SSDEEP 3072:YsCVL+3m+PvFz6AZEfeTdmo9Alec55oTg2MzRYYCtDlefHeAPRCRM:Zz6AZEfeTdJxch
TLSH
T17DF32186852E44FB34138B8783BA6C7445A6355F53AD891822CFC6EF76458038F6F4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 5aa95b6068a786ab64963f4d35fdc8f455675c026283c40d4a7682c2bb087df2
MD5 f998abce3ef06b54bad01d437c13ceb6
SHA1 1fe047c88126a0a363c5b3fb3ba0ed6fce3dcd42
SHA512 4b9c3981d02bb7421bfe0bec92d528aad2131d46758536f6b00a31294943075a824dc6c96a0dadac1afbdfe2c131b8dd00bc7e8dda419a393a61ab4544e45fa3
SSDEEP 12288:cM7ST7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:hST7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T1C4D42308C75D5A5BE277E231823DD2A4F6AC3F523F14F987874462A054293807BABF39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 64dd03078dc7faa55d46d6d4917779ee58f582f125165eae93cc153aecb2818c
MD5 1fae74844803390ce29a74b67653daaa
SHA1 2811a3ac51166095e107317fc7a9107e6e81711b
SHA512 88d671bbfae4d1d75e252f7d9ebd39b87887751b9df9fef536f21bca4ac7e416ead752b17209fc3b5eef4be039feca7fc66eb69d1179446a2d5cdcc939b40c0b
SSDEEP 12288:f9GfIT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:1GfIT7Jckdwi6i9bNrqq4E41WFpW3oRB
TLSH
T191E4230C61AA35A9C637C231C53DE5A5F9F03A512B147AEF46D0E2B09B193D0777EE28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 3a23fb23ded60b67c4987f32f253f6ed46b76a802aa025eb7dbfe46dbf34b0b4
MD5 148cd242607bb2d12b804730b0fb37bf
SHA1 16572f42ef80ade97be50accb4b492abc077e1a8
SHA512 11b417bc900be91013bca907ff7cbaa96a3cb4b9c2f318aaa15b285cf73aa3bef8edcc7511f1caa14bdc2ec7a8ad2b9eb949b51b3889019d13254bca879bb3f6
SSDEEP 12288:ZUT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:ZUT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T18CD4234C9249569BD353E231823EE694FAA82F023B55BFC3469462A0515E3C077BFF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 66917adfb821c9a78ca148b0fd3f9eace966cb5807f9136adc9058b96fc19da2
MD5 79c379afb5b7a7ed5efa4509627d0365
SHA1 f1497eebc797f0ddb69bf8cec83a84e8115a934d
SHA512 f5833b5fa50d2cf1e4405df439708fcc9dc8c0c98ba5b1c10c1e4ae28cab2393d00e270738f129d56fc72d30c88ac0d97dbe6094d020acc53f2d7c58df2028b2
SSDEEP 24576:vPUr+NQrT7Jckdwi6i9bNrqq4E41WFpW3oRos:vJQ37Jckdwi3N7+WTW3
TLSH
T14905F11E62AD18E5E677E13D86468718F77178621712E2CF02E0817E4F27AD4BD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 7bed51c8392be145df44c73d0e3561bf692085f74731de405ff64835bc0c3abe
MD5 575f38ac325cd3b90c432135fc8d6db4
SHA1 27c6d5484d863f1cac181a4db4471872243eaf16
SHA512 8eb3c4fa923febecc0d05dccfab7bc7ee94206a30ea9da154fcdc3cb7dd476e4c3299b557bbbde0c3673a0a25908abe03fd964979513db24203ee8522e885983
SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj27Jckdwi3N7+WTW3:SG05lO43bNPdwi3Q
TLSH
T187D5CF6E62EC11F9D1BBD17CDAC6860BEBB23415033556CB02A486A91F27FF0667E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3147861bf23df24ac2af448a399e103edbe91affb0dc805cd2e8ccf7a4037749
MD5 45637f9da47ae03fa5e1eeda206db365
SHA1 61e9a033f3076820ed1e7140a15554c8b3dee71a
SHA512 b18dce8b83eb55f8a4502601920a29922cf33b8412b1ef657cbf6022ddc496d5eaa2a776be041b5c05506a858f14309bd0d2193ac806a905a65dc2e790759294
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7FkbT7Jckdwi6i9bNrqq4E41WFpW3oRos:tNc/zEOVHFQ7Jckdwi3N7+WTW3
TLSH
T18E858C1623E901E4F1BBE1BE897B9546FAB1786517309ACF0291811B1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 111877758337f01d999da33414fa3a1fbe2484d3dfd566ccbc1fc76681c28be0
MD5 73e829e25dd930b1c6fef7024b700739
SHA1 01c7cf1f56c74ba417df711ffebdcd2becd67041
SHA512 195681d0bedf7426490fe92b0e1d1c27d3b4a6dbb6f92707b3094e6f0923f9df329084d2057861e1d551147c63c3ab79fcf69887d9a2c3de96291d51afa7a9c7
SSDEEP 24576:gLDI1T7Jckdwi6i9bNrqq4E41WFpW3oRos:gLDIV7Jckdwi3N7+WTW3
TLSH
T16FF4010C637A10FAD167D03EC6974551E2B2B57197226ACF07D4C1B98EA3EC8BA3DE50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 1b63225d0eadd0deb2663e24c75636ee349af842a44804e56588adcf91cfe036
MD5 2f0013e6c8917954b89a229c1c09e4ff
SHA1 2324c67c12adf3669580556dfdf6a26bb3238f57
SHA512 c5811aaa38a27bfc639675cfc72b6567ece219cc4ae84581fc05f19587f399c7b72a9c2446575b8bcb583dce6963e782027b3f3d6cca2c64599be6021edc7735
SSDEEP 12288:CG6kyqMT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:rtyqMT7Jckdwi6i9bNrqq4E41WFpW3ov
TLSH
T16FF41208539461D9E6B79234C63682A4EF747C116B21A7CF46D0E33D2E3A7C0BA76F25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 89e483321266efb233dc7fc960617e33da36296592f6d9e05ccf698e914a5c60
MD5 3a9514ed585f30386648096f2112aef1
SHA1 b62a583d30bcdf3961e01e388d63396d76282118
SHA512 db3452bba241d8f6f5d0d7d3b38f85c3280c5cec3fce56f97f6dbead98bcf629843068d3fa5503bda7749413630c98b0929fed12f25eeb759e9a77ca2d576dc8
SSDEEP 24576:/TkNvNnaFeYhJNtmZBmQT7Jckdwi6i9bNrqq4E41WFpW3oRos:/TMwBtOmC7Jckdwi3N7+WTW3
TLSH
T18355AF2EB6B846E4D1FAC675CE238512F6727461173293CB4390C13E0E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 768KB
SHA256 5ef7bf3485fff5928003e1c58ab684744d9850be33a9f976df6225f434e2d25b
MD5 7382733e994ccf8db23e5a6db7ff88e8
SHA1 53fdfac3321b8cf3023ff5cddf4f69cbda66bc0e
SHA512 e26ac3aa82305c2ff05d97e239688924c24c63e86baafd20d1086eb1242e4ff731ac1afe0bbb763312ae668a2b2086967d16c653a9d736e390448f5a0a2e2a50
SSDEEP 12288:oyQ6b3IkxjbBzidzHT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGty:E6UqjpOT7Jckdwi6i9bNrqq4E41WFpWc
TLSH
T1A0F4124D52D424EAE1768230C639C264D5B47D322775BADF62D892798B36BC0A63FF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/760-109-0x00007FF7EA4E0000-0x00007FF7EA629000-memory.dmp

Download

memory/760-112-0x0000025F5D7B0000-0x0000025F5D816000-memory.dmp

Download

memory/760-111-0x0000025F5D7B0000-0x0000025F5D816000-memory.dmp

Download

memory/760-173-0x00007FF7EA4E0000-0x00007FF7EA629000-memory.dmp

Download

memory/932-38-0x0000016815EA0000-0x0000016815F06000-memory.dmp

Download

memory/932-139-0x00007FF65EF20000-0x00007FF65EFE8000-memory.dmp

Download

memory/932-37-0x0000016815EA0000-0x0000016815F06000-memory.dmp

Download

memory/932-35-0x00007FF65EF20000-0x00007FF65EFE8000-memory.dmp

Download

memory/932-36-0x0000016815EA0000-0x0000016815F06000-memory.dmp

Download

memory/1044-119-0x0000000000990000-0x00000000009F9000-memory.dmp

Download

memory/1044-174-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/1044-118-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/1044-124-0x0000000000990000-0x00000000009F9000-memory.dmp

Download

memory/1524-62-0x0000022CCEF00000-0x0000022CCEF66000-memory.dmp

Download

memory/1524-61-0x0000022CCEF00000-0x0000022CCEF66000-memory.dmp

Download

memory/1524-60-0x0000022CCF3E0000-0x0000022CCF4DB000-memory.dmp

Download

memory/1688-102-0x000001B5D9510000-0x000001B5D9576000-memory.dmp

Download

memory/1688-101-0x000001B5D9510000-0x000001B5D9576000-memory.dmp

Download

memory/1688-99-0x000001B5D95B0000-0x000001B5D96AB000-memory.dmp

Download

memory/2452-89-0x00000202E1FE0000-0x00000202E2046000-memory.dmp

Download

memory/2452-88-0x00007FF72B0A0000-0x00007FF72B1B9000-memory.dmp

Download

memory/2452-90-0x00000202E1FE0000-0x00000202E2046000-memory.dmp

Download

memory/2452-170-0x00007FF72B0A0000-0x00007FF72B1B9000-memory.dmp

Download

memory/2996-141-0x0000026AC6B00000-0x0000026AC6B66000-memory.dmp

Download

memory/2996-140-0x00007FF752E10000-0x00007FF752EBD000-memory.dmp

Download

memory/2996-176-0x00007FF752E10000-0x00007FF752EBD000-memory.dmp

Download

memory/2996-142-0x0000026AC6B00000-0x0000026AC6B66000-memory.dmp

Download

memory/3180-7-0x0000000003470000-0x00000000034D9000-memory.dmp

Download

memory/3180-1-0x0000000003470000-0x00000000034D9000-memory.dmp

Download

memory/3180-0-0x0000000003260000-0x0000000003375000-memory.dmp

Download

memory/3460-179-0x00007FF66C240000-0x00007FF66C656000-memory.dmp

Download

memory/3460-177-0x0000021E66500000-0x0000021E66566000-memory.dmp

Download

memory/3460-157-0x0000021E66500000-0x0000021E66566000-memory.dmp

Download

memory/3460-159-0x0000021E66500000-0x0000021E66566000-memory.dmp

Download

memory/3460-158-0x00007FF66C240000-0x00007FF66C656000-memory.dmp

Download

memory/3772-175-0x00007FF7621B0000-0x00007FF7628F3000-memory.dmp

Download

memory/3772-133-0x0000012456520000-0x0000012456586000-memory.dmp

Download

memory/3772-132-0x0000012456520000-0x0000012456586000-memory.dmp

Download

memory/3772-131-0x00007FF7621B0000-0x00007FF7628F3000-memory.dmp

Download

memory/3772-300-0x00007FF7621B0000-0x00007FF7628F3000-memory.dmp

Download

memory/3772-298-0x0000012456520000-0x0000012456586000-memory.dmp

Download

memory/4784-128-0x00007FF65EF20000-0x00007FF65EFE8000-memory.dmp

Download

memory/4784-28-0x0000014066B10000-0x0000014066B76000-memory.dmp

Download

memory/4784-27-0x0000014066B10000-0x0000014066B76000-memory.dmp

Download

memory/4784-26-0x00007FF65EF20000-0x00007FF65EFE8000-memory.dmp

Download

memory/4784-29-0x0000014066B10000-0x0000014066B76000-memory.dmp

Download

memory/4904-108-0x00007FF7F06C0000-0x00007FF7F07E2000-memory.dmp

Download

memory/4904-15-0x00007FF7F06C0000-0x00007FF7F07E2000-memory.dmp

Download

memory/4904-17-0x0000025501120000-0x0000025501186000-memory.dmp

Download

memory/4904-18-0x0000025501120000-0x0000025501186000-memory.dmp

Download

memory/4904-16-0x0000025501120000-0x0000025501186000-memory.dmp

Download

memory/4948-69-0x0000016DE10D0000-0x0000016DE1136000-memory.dmp

Download

memory/4948-68-0x0000016DDFE80000-0x0000016DDFF7B000-memory.dmp

Download

memory/4948-70-0x0000016DE10D0000-0x0000016DE1136000-memory.dmp

Download

memory/5760-76-0x00007FF6B6BE0000-0x00007FF6B6D47000-memory.dmp

Download

memory/5760-77-0x0000022ABB550000-0x0000022ABB5B6000-memory.dmp

Download

memory/5760-78-0x0000022ABB550000-0x0000022ABB5B6000-memory.dmp

Download

memory/5760-86-0x00007FF6B6BE0000-0x00007FF6B6D47000-memory.dmp

Download

memory/5760-83-0x0000022ABB550000-0x0000022ABB5B6000-memory.dmp

Download