68aede89d8a1716cd659c44044a72e85cc9c492aadc6ce49085d760abdfda7ba

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
Size 5.6MB
Sample260820-nb8fcsyvhs
SHA256 68aede89d8a1716cd659c44044a72e85cc9c492aadc6ce49085d760abdfda7ba
MD5 de921f61913c7a7c00dd0fb3b19a9c0d
SHA1 0558d23260bbd74dfe25152073a8e6c76e473a7b
SHA512 0fd354396296c79fdf8b2fb79dc9c995b7919ed95a15a39974c1af582834e7f489ccd0c8adc37d562fa27a42b9de1a9234895731c5380da92e68ccf4b5e030ac
SSDEEP 49152:5kCv9MKZQttyVQBG5PVOvx+iig9w4qQv6zJ/TeJH0a0BihL67Sy5BpNTVb6SEiJN:reXttyVhPVMn0aHE6HLjY
TLSH
T18C46E642A2E944A4F1F32B75AE3619714A77BD115F38C88FA58CAC1D0BF3681D530B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3600	elevation_service.exe
3200	elevation_service.exe
2796	maintenanceservice.exe
5708	OSE.EXE
4964	PerceptionSimulationService.exe
1252	perfhost.exe
2932	ReFsDedupSvc.exe
4132	SensorDataService.exe
5772	ssh-agent.exe
1284	AgentService.exe
2424	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\vds.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6eefea41209659e8.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaw.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119890\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe = "10001"	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007d2ee9249530dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000056515e249530dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007aa128259530dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000576064629530dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac3d9c239530dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3600	elevation_service.exe
3600	elevation_service.exe
3600	elevation_service.exe
3600	elevation_service.exe
3600	elevation_service.exe
3600	elevation_service.exe
3600	elevation_service.exe
3200	elevation_service.exe
3200	elevation_service.exe
3200	elevation_service.exe
3200	elevation_service.exe
3200	elevation_service.exe
3200	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4460	2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
Token: SeBackupPrivilege	2932	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2932	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2932	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2932	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2932	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2932	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2932	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2932	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2932	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2932	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1284	AgentService.exe
Token: 33	2424	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2424	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2424	SearchIndexer.exe
Token: SeDebugPrivilege	3600	elevation_service.exe
Token: SeDebugPrivilege	3200	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 3244	2424	SearchIndexer.exe	100
PID 2424 wrote to memory of 1312	2424	SearchIndexer.exe	101
PID 2424 wrote to memory of 2988	2424	SearchIndexer.exe	102
PID 2424 wrote to memory of 4512	2424	SearchIndexer.exe	103
PID 2424 wrote to memory of 1180	2424	SearchIndexer.exe	107
PID 2424 wrote to memory of 5396	2424	SearchIndexer.exe	108
PID 2424 wrote to memory of 3256	2424	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_de921f61913c7a7c00dd0fb3b19a9c0d_darkgate_elex_glassworm_luca-stealer_magniber_medusalock.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:4460

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3600

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3200

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2796

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5708

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4964

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1252

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2932

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4132

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5772

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1284

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2115213192-531537726-3295841909-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3244
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1312
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2960 2956 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2988
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 2996 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4512
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1180
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2960 2956 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5396
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 2996 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b45020752fd901de4360d4f3f5c404e823b28bc48617de3cc6eb1a80d03665c2
MD5 97bed0b8ac1d8524d6738f48a768e7a4
SHA1 594ae00b8680f75f1140a808a30e01282b351bae
SHA512 1b5dfa3caace2377b22a15e7e63b8c2c5683d618be2fbebe3741cec4695a52e395a730b32c53cf91c976fa93c943aad3562d230f955b1b6f3f6463bcf0b71284
SSDEEP 49152:8b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnP8LiUqx:m3q6HjBXLjY
TLSH
T1D9D58D03F29900E9E06AD178D7469133E9A2BC890B34B6DF0790B7562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 4678126be1d8c863f9d4f86f1cd83279e368d2cbae4424c0067f62005a146afb
MD5 bec591f31afeb6e034e85188857bca6b
SHA1 d5fb1e2226c37f12ba1955a7b9e0f4ba05536b23
SHA512 0717e6ce99dff7b4a1b61eb613238305e015afd3301c304c108f6107ba919d16d7d17a34809699f6f3531deee688c4312fa77529c6aac9b207547bbdb7d0c434
SSDEEP 12288:U1XLsswWkxy2lRq2czAy8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:yXYfDtczAy8LwsXYHU9MPxMu
TLSH
T11C75012863D408F9EDA7917DCCA2C501E6337C5447A0E7DB03E49A6A0F336D85E3AB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 30925f59c3fd59eb2b45b0f426110426b63fb1e042dda8fb201c50637a69b623
MD5 b3c6e77a71c8349254c5d93241fda26f
SHA1 6f32056ff9df2f816aaf33e94ab051f702d88842
SHA512 9e17c92e51a098f698fa52f22a5adc06f7dd51f4322f01cecf0b3ce1ad0e99d8c198e28ea57820071f1944a28775ccfaa455f84ed17ca1985afae06e6e6115a7
SSDEEP 12288:kXZNYVLeyUji0h90ZD0wxpGZIVu8rHsH8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNky:k0Le5ji0hmxrrMH8LwsXYHU9MPxMu
TLSH
T1C6859E26F6748735D073C0B9C5D2A68EE97230855B308ACB4286D77C3E67AE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 98cc81e46387f0abe47aa865b9a89999e7a42485b8cc28b47690956d2207017c
MD5 02c3680f1bc4a9918935fbe38edf3a01
SHA1 413bb800f5337e05cf1e7f4b02d58abf9f5d1cd1
SHA512 4f3011e3d514934055db292ba2108ed32dcc4ebcb59b15da8f8d6e0ac8fa5e5773c409643d686bdde792fbb7e97b5d02f7cb510d84628b15f67e28710eba611b
SSDEEP 24576:ma7/ezSC6vUyD/aqgrvWE6q8wyuF8LwsXYHU9MPxMu:x/ezSC6vUzPvxHjyg8LiUqx
TLSH
T180755C25F5788323D0B2D0BAC5D6BA99FE3230465B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 26de251b373c6de853a04f810111e555399b9bdfcc5b1108c31ce68f34ea1c5e
MD5 9aab3fde51b8b7ab7d06c111c9d0f710
SHA1 2db11f9db3972011deee2c0936c0f6ae720388cb
SHA512 ed03a0f66055d7431972bcd3ce8dd8c674e68b5aaa06dc62d2580bcaab01dd164f080b9cd3763c0e0f512d094e36c2c499bffbc17137912e30c973f9181bbdee
SSDEEP 12288:PVJjBq33vb5O8M+l1D0hwsEBoW/lx4if0Im98m8+g7FmsTL0v0vCHSwu91GPTUQw:PVbqPb88hv/l+6m8LwsXYHU9MPxMu
TLSH
T181559E66F5748331D073C0BAC5D2AA9AEE3234415B31CACB1246D76C2E67BE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a2f456b2f724b0b8ff0145780579fb2c7124e4f012080422c33f786142a48a46
MD5 52d7ff93ed82e03d7997aeaba34e9d27
SHA1 28f3cc8cf033c66191b552c9bfe69691193ab234
SHA512 7051c1c5090a3fd931f21fdc314f858003251c7620b4e9ba1458fa8713db477839da20b0e6be0f32363db02e4e431aa4ad34a0a3efee6b23f8780f5d3ef14842
SSDEEP 12288:cjb8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:cjb8LwsXYHU9MPxMu
TLSH
T12E552321878938F2EBE6707AEDC1D74951277D68E8E4EFAB7450BFDA08718A0CD5012C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 e2d50aee1e3d8cf4fb9624aec9d96f50f3c08a44f1d02e896977f679850c7860
MD5 e58921e5a522e84b0a3cb769dda1c6d6
SHA1 aef23d0004dc5a2baea4e189bd3b7ef3b0e676e8
SHA512 6fc8b853be8b3ad980d7977f709a206acce01da6e5a41a3a67a89a7aed9dd4c730d31b9df84b489e674d6b755936c4d31faa78714e5c6a8403b4dc750785ac5a
SSDEEP 12288:KeBNUbTVO86U+8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:KJIU+8LwsXYHU9MPxMu
TLSH
T11975CF3BEE28FCE2C67A5DB99A91C700977278304B61A3CBD164C34E9E235E05E75C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 024e0e46401a0141155075121f9c02d1eeb1a7e64682dd9a0dfa65251179cb43
MD5 bfd81f40def7763b5fda49c76241ecd7
SHA1 c7e3640bf66bf91f85fbc6b496ec60cc44621200
SHA512 a03d1ba8b10b8fdf8f277a8496339d15f18a23770870bb9f9e591384f7d2e0c22ddcf0576862e7e8a6782d28d6737906a56f2115732ff14f2d0128f57bf1d613
SSDEEP 49152:GQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THw:GQvGAdlCEL8c/yRNw5C2LjY
TLSH
T194266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 33a905e3d9d1e079fabe519b706613a423fb996d8d46a65aa5d0eb2c536c2401
MD5 64ad6c238747f50f8ddc9301feadd80e
SHA1 0f896f6210a26baffebf85b2c0f0741ffe9d05d0
SHA512 2673d6b9f316ecc6879029cb1fb7ebc99c1b8deb595e707ecd65dffd7c659fe0313ebd70283e07051cee954cb21e6637fa705ed7f31d46c10efa43de3a1d282c
SSDEEP 12288:cAwSfxL/2Dc3tDLLmt0LDQewsAjE8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:BgewsAjE8LwsXYHU9MPxMu
TLSH
T13375E031FE74E432C7BB0DB65B26C706143D79204FA11AC3F3A89E9E59701D26772A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 99c1ef57540fd25f8464c30a2a8e1fc173f145192a6f2c057614d1b40cfe0251
MD5 615159d64d3b0b1b9633d3a3b4b815bc
SHA1 3d139e34532a54bc3267668be6b8a2f62faf35ea
SHA512 11f5f1e1efde7d0b3d5073d8e39d07e07882154fbc38b987d6deeacb5fc4b821f0c9a5da38dc586746310fe4a3a624f21ecdd48391cf38c0e74fc9e9f586dcff
SSDEEP 196608:YUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHJLj:YUEtQevvqc2W1cpV2EI32JLj
TLSH
T199474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ad85103bd16cf52a5286b1838b21b272e1f1959d7ef8db5ddb8c8d4fe8a762f2
MD5 0d21714d9bec35711ed146a6861b34b0
SHA1 95ba97635b5a15608824caa90942d0ab6920c96e
SHA512 386090ed4f35cab844a6ce12d0a29e1cb8dbcd0e363ade1ab28ad9c535646085afb138fdf875ae8af091ceded354cb1f56130686be3645bf41321dcb9aa47339
SSDEEP 49152:RCbRquA/m2yL5zTfFiV+XenmE3/zk8LiUqx:eoquVjnmSLjY
TLSH
T1D8D58D0976B8C1E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2ed13048c68e7326b62e8dc3f53cc9a5557028b795ad54dedff1dfc03d588735
MD5 4d99eb15062114012c6d69bf19cedd87
SHA1 5bcd9291bffc781bdd2fdf5a24a21b583fd47d1c
SHA512 3d6fae972932c7a700cdfebc61b69731bfd8528064fc0430504538dde74144ffa0ababd2aaac90f247cd92312609c8e06b02bbd8d60e6b7c06aae0b5b23e8f27
SSDEEP 24576:0AhGLJIFoiwtA5l7S53x8LwsXYHU9MPxMu:0AMyFoiq5h8LiUqx
TLSH
T1DB359D81E7F955D4F5F3AAB899B68171EA76BCA95E31C20F2150D21F0E33E509D20B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 75ae125c9fc9cad6d0a561c781e0c6b2c43b3b38c9f5b6d61eb2c6c99fa16eb6
MD5 71344adb9ef55bcdc5983ba66e51556e
SHA1 6f72b492b49942eafd2c1ea598b572bb6c09b238
SHA512 3e9080a1e04ac0cbe7a0f3d2f026926f7172e5aa5c4e84f7151e4fe3d0642699f4094ab727c398414dbd6ea1901e79c7e78076611cfa8fa9925267db5c5754d1
SSDEEP 12288:wmw5HEjsChNGBFgl0WDm+Cl8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:twuXOWA8LwsXYHU9MPxMu
TLSH
T16265F14666E81CF9E9A79139C987C136F7B3BC112A61DB1F1760C75B1F33260AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 375734055776fb4742d0d8cdf15a66edd304345c193ee9472387b51520a2dd26
MD5 e92dd3d84c6dce5384e3273861aecab0
SHA1 0191d8ea06ee91ee1165b12c5678c083b74bbdaf
SHA512 552bf056f7464605a62fc7e491bea2a1df12505c89cd035c2a678e014c1cb58855e6a4a0e2d0abe537e20fd9fa54a49d67e7c49dded2acf026cf59bf67c3f21f
SSDEEP 12288:FHZ1IyU8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:FZuf8LwsXYHU9MPxMu
TLSH
T18855126A23D830F6E6E3617DDDD18609E372786567B693CF216087AA1F739D08E31324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b4a18335725fedc033038e90d3b3e1086bee8494667ec6dc694a5db6460a2d90
MD5 9e03dcaf60193fad7d02c9c85273ea32
SHA1 579587672eccba9906913ba9f5223169749d6957
SHA512 5ceb92db894bc5656024f1806bcfc267d06b502c221dc7de0b80d699ffde8d52b9453d7b0e936ec5cba6cdd8d6333e16425ce8efa7bd84a734b9a1645ece1926
SSDEEP 49152:Xj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UE:mQRQyi36YOcPQLvw2gAf+PN3rLjY
TLSH
T124667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 01bbf06cdcbf85378acc19a68cc566c2f764c66e968a36ca344b1a83525ca26c
MD5 1b860bbee29c620d4b3cbae82557ff91
SHA1 a6a080bcdcf00b46b3795f091d95edf24aa67645
SHA512 7980368634e98f21c3010c48309ba79b4f5821c7105fe0899194e8227a8e9b0b6ddde9b3f8661fe97c5542e9e468113f5fec3d2a3e8767ecedec0141f88e08dd
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UE:HQRQyi36YOcPQLvw2gAf+PN3rLjY
TLSH
T15D667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 df4b3901d4ebc9642b5aad463cca4329e98ed9d7acb703ca910b3d09c28a0dba
MD5 863982cc3f78f59c4c8b0ef6637fe780
SHA1 2246fd4892f943596fc8050487c6255b79222f0d
SHA512 f27da5bd9c71014db0069097e78d9cbda59f70032bbbd34544625a086cd43dd3a85ce35ce0887cd89a83983f37239a49c60e8ee9bf25d8a7ccc59560517961c8
SSDEEP 24576:iwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0P8LwsXYHU9MPxMu:c68Qg55nhheWu7PNU3/08LiUqx
TLSH
T164B54933B2F600A9C44DE1769F4A872196D27C758FE1E3DB851173061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 209314c815951970bfdfc03144d0b67e88505d08c61683879914af0d605d34df
MD5 b1c15b8b2212709f5a8c290540001384
SHA1 6d43b15b0afa8063bd5eeeae29457711a6cebfac
SHA512 28c35a52971bbda9021a22dd7131ef45c272075042b0cb971097567022623ea80e4bbb1fdb554ac75e362c4017b5798aee802e3c6d6feec2d1c8c9c9fcc26dc9
SSDEEP 49152:C3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99q:Dy5112gYy5azzVvL69nLKnhZgLjY
TLSH
T1B5167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 39c205ba825ac6e7ddc598c5220992485172faad6c6a55663f4492a22fb4d0cc
MD5 040c8bb319e619751a83e4015d0e9150
SHA1 9843afe067162773cb9100e435a1c37de4984eb0
SHA512 659bf12f43c2c76ed3a1c3261b1ad1bf960ed944b2b7115408300b9a13af88f166fedcaa339106f137ef731b2544987584f84624f412d18186f115ef1830c4d5
SSDEEP 49152:YB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gli8LiUqx:yu6JmVxd2dDLjY
TLSH
T15FD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 ed6509bd1eaf2628fb16187c4f45a49eecf7906dea84435de6c43727baec36f5
MD5 f3a2e96a59fc0976880f3a9c18b9243e
SHA1 7ec859175ac33ccfe84d3f90d5d15e5303071e81
SHA512 a54744a92de4c4621604d7d236ec5b153f12ac31d5fcc74c6bcf9b6d1d41a3bd86a9060e6fc29006e6ade5246693915aca16311fa685044a8e9f2833d8a9ac29
SSDEEP 24576:Nhv8E1hps0+ogd2z615uCMVF1Agz6bUQ1zNOgLLwH7ReaQXx3u8LwsXYHU9MPxMu:n1hpsNoJpF1A6UU44CwH7R4xe8LiUqx
TLSH
T1D6B5AD13F2D900E8D06ED17887569632EA62BC460B34B6DF0A90B7961F7BAE45F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2cd786a8af2abea82f0ee436cca6219f0eda58906a2640d484f4ec6f7af3f5b2
MD5 1ac94a40273063b123e13ab2fed62557
SHA1 e983b00600e382085b79aacbead7c86ae0c9ed2a
SHA512 db673579f9699288b32f4ef2af6cb4551cb1b7e58a8800b57af423c27bde4e41b76e074cf89852b4aa37756a162296288c47a99c278bda1f9a25bca842136db7
SSDEEP 49152:0SuZQIY0Be2KRRVtOnks6NMHqf8LiUqx:m5dKTi61ULjY
TLSH
T1B9C5BE13F2E940E8E0BEE674C7669232EA72BC464B34A6DF064072551E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3b344c68f76a66f9c89f9e6aa44cff64f6e3316347f7a3460108881a66cee0c0
MD5 38e6ec9dd8a6d8ef3cfae056522e8de1
SHA1 b3fcecef4f9fe3ac1a9017d2babca6836493444f
SHA512 bbc0f536bfb389a661dee64e9a3d8d3731a067e9d6af427329b3c26cc1615d5ced1a5f835ac261ddc958738e38e7226d4dfcafc11fc7af77e97f6390b207a3fd
SSDEEP 24576:uhiavrPSLT8EARn+FgyUgd0fJY6Bni3iy9CTn0AP5+2QLu8LwsXYHU9MPxMu:uhtSn8EApI0figngiDn0AP5wy8LiUqx
TLSH
T15C95BE13F2D900E8D05ED179C7468632EA62BC150B35BAEF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 27d449b224aa90fe238c27a0e66339ad9bcfcf1a1b0856bc932966e18b15d1c0
MD5 d7734a837ef7dfd52b25b1ec137eb4e6
SHA1 fab4b5c17a05981b41455093c4fec1b23ea55da4
SHA512 153447f623f1252f82b9a60d611e0534d88e907f1c40e4c16d1c294a609273520c9cbb1709a4e33031c5edbb3f4b50177bdcd055c52964c5d63eae349b935d56
SSDEEP 12288:GT8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:GT8LwsXYHU9MPxMu
TLSH
T1D055232586CE28F2E9D571BBDEC1C74861273D6CF9E5A7EB7440EB9609B18B0CD5006C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f4f838d2ea52bf282524d4349e1f4ef981dc635a024f87863c7e2ce10c0d80b9
MD5 abee75762dba00a6d2bd977ab60562ee
SHA1 b15b64c1bae080c43b76ae535fdb6d5839dcc20f
SHA512 a5364cf6312db3692a81e00037643ffa5e5cb62cecb6abbd473b1e43e470916c42fd24f9918f4f4402ea443e4063836082c81ded18a8a7e8b86f0a0d849002e4
SSDEEP 12288:Po8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:Po8LwsXYHU9MPxMu
TLSH
T17055233586CA28F2E9D570BBDEC1C74851273E6CF9E5A7EB7450EB860AB18B0CD5046C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 7154a23668996692ed654daf6073b3efa415327a253dcdb7402a8186fede5e66
MD5 467f969c9915def80770d0ebdb874a6f
SHA1 e6de4e0df65f35705302a46cf5991a61e4b53609
SHA512 80db4fdd23111377c8d431a4384ea4fe0f80a78444677f28a93faab3b7f4e68ad48d5426cf75f42adfd48c54e992aca85b3f1643119ac0dca670bbf316981346
SSDEEP 12288:RW8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:RW8LwsXYHU9MPxMu
TLSH
T1A955232586CA28F6E9D570BBDEC1C34951273D6CF9E5A7EB7440EB9A09B28B0CD5006C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 0b164d79bc945b894bfcc9a9397636d80f4817a440c90521c73721212c7bd1c9
MD5 fbb757f4d325196a46aa5dfa89ca34fe
SHA1 e6b2bbe5b39c823d8909f7a543d369658f600385
SHA512 df189e94b80bfc555d8b6eebbed1935eba26fd5cb577821513450c92fa91128a22f3fefd91417d5c533fecbd7c2d18833c6833fbd1b1b948aa12a608ff0491e5
SSDEEP 12288:GVR8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:88LwsXYHU9MPxMu
TLSH
T11B552325479A14F2D8E6F17ACDC2C209A2777C68E7B1A7EF75005B8A0EB15A0CD7066C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 6bc6b9a1e1ea9d4f9f84df1cdaf5addb6c63bbfa3d4db9e411f94a8b0220609c
MD5 0bad217d98ac7d6c338162c8a22fc55f
SHA1 823c7aba40de6b957befdda08f88774011b5786d
SHA512 5e184ce715d301102f1aca5ee22f691b54725b1a3779daca0bc60062b104c4c56aac8f55438805fa70972f4eea8efd8c89360f5c307743bc2f988e4b08c47b07
SSDEEP 12288:fZ8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:fZ8LwsXYHU9MPxMu
TLSH
T11355232586CA28F6E9D570BBDEC1C34961273D6CF9E5A7EB7440EB9A09B18B0CD5007C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a1de9d1867da194e97843ae22c85d69d6cd92a78bb3a1917221eea46a0beb5bb
MD5 116377f5edf569e731a666f6acef986f
SHA1 a2ef7d4ad41e8f1db888394028b4f653b67de293
SHA512 93c501e8c7d04dc3c971061a02ab55332e55172d533718e45fba9fdd97a44fbcbd95a6662c6642637be4d9bae5cfd05213c69f8bc42008e2a49bec51bb83c9da
SSDEEP 12288:Nc8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:Nc8LwsXYHU9MPxMu
TLSH
T17955232586CA28F2E9D570BBDEC1C74851273E6CF9E5A7EB7440EB960AB18B0CD5047C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f257cc2ef57e06c479e0415a4b09874afb625a8be10ac78f57efb2aeca6b779e
MD5 99bdfe16c13ae1ef6466501a0e674729
SHA1 b594b07522b41a87211744fae9886910fd06ef56
SHA512 129474aac042976f75edc8a593f04d6bf98e3f6f2c17867eb259c8c59909937b660733fdbc0244c2a2a231d7698b8012d90936fa01a6d154ffc51e2b39836d43
SSDEEP 12288:6w8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:6w8LwsXYHU9MPxMu
TLSH
T1B555233586CA28F2E9D570BADEC1C74851273E6CF9E5A7EB7440EB961AB18B0CD5007C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 b5581894d3f94c1a9d8cae0bf74e635b91f0e1466160533d9b5be8a4b9bac2f8
MD5 743a2a16d3ce34a1ab7b50298c6c1dd0
SHA1 a5b7e8452e934cf02d814e8e47616fca71afef51
SHA512 45e3d243919bd32c2ba3db7bc8003745d383afa8e1060a27c11da120680ec030eb917bc37f6cbe534c6182b5aa6ee1c970af9c630cdea37b9c2c27c4ed0240e6
SSDEEP 12288:ciZwbzzzFEoS2cPvyI8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:/ZMnzFVSOI8LwsXYHU9MPxMu
TLSH
T1977501A5B39018F4ECA7813ECD518906D2B27C694BB0C65F13A4376B1F733A05D39BA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 c0b78e92ff9e8e6801718551219f74bb1b59ea0d1ac4a1e85d029919cb104039
MD5 93a7ee64a3647a4a6639c8c6a80cd957
SHA1 bce0b84bc42336b3c035f9777eaf26b2b1f682c3
SHA512 f71e0cff6d1f689ddaf72b4dc2ff319474f5a912856249a5f02aa833c50fd75014807e0666db05b9a05b6e8fc1271fe3ef7a9b2ad3b5ef5ffb717d8dc655c9fc
SSDEEP 12288:Mv8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:Mv8LwsXYHU9MPxMu
TLSH
T17355232586CA28F2E9D570BFDEC1C74851273D6CF9E5A7EB7440EB9A1AB18B0CD5006C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 0705ce0603b08dc56aa6e3f05c0a61f8d388d5db609afec50011874faec47a42
MD5 9be4b4bd42adb476bbf06aa3b100b50c
SHA1 b26dd1dff089c2a5f5f3bc75ffe1e882f6ea7d2c
SHA512 50bd87b5adf89bca5b57821c695f5e033a009041a41df474eb51f35a564c3966cd729a9258a09cd50025aa76f0715bf6cf46c2511ba9ccd9b382f7d546d1e11e
SSDEEP 12288:Pr8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:Pr8LwsXYHU9MPxMu
TLSH
T1EA55233586CA28F2E9D570BADEC1C74851273E6CF9E5A7EB7440EB9A19B18B0CD5007C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 e6752713e483c4413e3f2b0d446eeab77202bfb5bc8ab33fc1bf68848302f8ee
MD5 eb475cd76ba37c9684fbc5d2880f72b7
SHA1 09e142805c6545c22853431976ac0d376f92d4fb
SHA512 eb55a2815755e9586e88c355f52e8d5671bcd197cb05e5c61d2323e36891ebfc788c4a057f5cd7c42d972afb98ceb7e03b006becc7a91fa49bd4b78f1991bd93
SSDEEP 12288:PyPz5L8U8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:izyU8LwsXYHU9MPxMu
TLSH
T1F965021763A530F9D1B6A239CC924A05F3727C3557609BAF23A0477A1E336E09E36B74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 4d92258b22dab5b8b0667642240991daf26bdbfe42acb692b2db26866291eccf
MD5 63342df5317ec3fb99119659bcded8b2
SHA1 02af5de37baa98a4ab5a26bea5db22e911472ad2
SHA512 a24255c5eb3a35377c08fe7bf8966f9e40c975bd2bd4bdc18078c1aaf3050d739d081389580ff6c9251cb5da95905c8d30dd9636d9dad0c888cb4945f0814d3f
SSDEEP 12288:3v8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:3v8LwsXYHU9MPxMu
TLSH
T1E455232586CA28F6E9D570BBDEC1C74851273D6CF9E5A7EB7440EB9A0AB18B0CD5007C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 1f19d44feb9051057a9d33c8437e01a730e8d0fac2f07c48d83c3aff2e0b03da
MD5 fd984ebaa80946ab5ba433f8e12386eb
SHA1 bc9b0fffe806d35744e5a317ccda1532b6eb5d28
SHA512 0832faf63df456cc3e88312dc0822fafa0677553d92b59ef992c816d89b26093b7dd7073ae73cda6627423f53edfd5d968456421455f1541216ef44060dc3cd6
SSDEEP 12288:ov8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:ov8LwsXYHU9MPxMu
TLSH
T17155232586CA28F2E9D570BBDEC1C74851273D6CF9E5ABEB7440EB9A19B18B0CD5006C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 901fd5e4f7430a512122740dbcd3a2b48e34d12c1fc162037a7e63099caa1b1c
MD5 f57e2eea61df83515caf0e469fd9d9fe
SHA1 5a3df318480743d62cd01a50bdbd252f6f923b0c
SHA512 c4c547e8a93756731618a1f591f44227ee96f02bede05c356ba402b8b84da6865e17049f27bf4d050e2e807b9c9ecd770f5bed3300ae953856561f51c8412038
SSDEEP 12288:yyPz5L8U8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:vzyU8LwsXYHU9MPxMu
TLSH
T1FB65021763A530F9D1B6A239CC924A05F3727C3557609BAF23A0477A1E336E09E36B74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 c062c862130e6801571f3546aabfe370301f5dad4cd10f1b1992e5d8d3d4084e
MD5 b1fa8db964a77754bd0a088dcc672451
SHA1 20f1228a461bb6d77d53d9ddff893a0809cdf5d0
SHA512 82f57f922977270fc7590ed0ddaa694818097daee6109ed372973a54be1f203732a83ed990611abb38bc84eb3ca94d2eb12b94e4bd30a9733d507f3d0456fd21
SSDEEP 12288:lCd99WYoaLHF3z0z04PDvhG8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:gTkaLl3z0zDG8LwsXYHU9MPxMu
TLSH
T1D47501A5B39018F8ECA7913ECD518906D2B27C6947B0C75F13A4376B1F333A05D29BA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 fdcd2117dfa0b48beeea898b69f38283791e42d1f605d3b48d84af2d60f57cb7
MD5 85ee58237d1d0b21ec9dc83dc2b5648f
SHA1 4b685361c868772620f9826c5ae0e62eed10e5d1
SHA512 5679789c21f8bafc9941a61f05a0e274c3e86041ed8bb28270acfb568e3282b995bb9bc08007f682a72b7fa3a3c3d0f9502649b2e9aa6c6fe42fa29f2d2253ad
SSDEEP 12288:6i4e78RdTfgwCHKy7GLbbdIvN8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:63ld9CHKy7GZq8LwsXYHU9MPxMu
TLSH
T19085CF90F3E814E8F0B79A35CD628501DA767C695B71DE8F03A4665A1F33AD18D38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 447247966c03e28e38f80fad072188a2794cb01e29df03c0a3ae30dac16a7beb
MD5 c7e817b2664bdd8eb0e1a417c1f79c7b
SHA1 f0f6cf8014e516af9f5b5f6665a9d82db35925cc
SHA512 886936c4e6e365c6343627712fbe1a500594d3aab2c280ffebf41a0b061113a670f595d4d7e6d8df65060f0d296c9468b9dbe5754359356b28c5abe2710030d8
SSDEEP 12288:L28+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:L28LwsXYHU9MPxMu
TLSH
T16E55232586CE28F6E9D570BBDEC1C34851273D6CF9E5A7EB7440EB9A09B28B0CD5006C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 f5ee48cae0634587b2cfdd498ab0189ed48c66019ca5c143b6f6742d8ebdb5b3
MD5 abdbbeee00db939a3c6171eabc7523fd
SHA1 1a328a35f12b5312507eb3bda24cde236fc66a9a
SHA512 c4e3dc21126dbbe3b8e90a6c12b531dcc7eac1a2b69a0bda1752850feea6fcd9974642a0941146e4126f29b330d2ff66c6a1a2fa5c96389250373c525bc9d496
SSDEEP 12288:d08+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:d08LwsXYHU9MPxMu
TLSH
T1FE55233586CA28F2E9D570BBDEC1C74861273D6CF9E5ABEB7440AB9609B18B0CD5007C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 03b05cd08f82317bb761c52370640fad29ef1c7320c2ad6392ef1348ac0d1073
MD5 13e1e04d8cab656caef75d10a7b746dd
SHA1 1439bc25ccf33ba538671ba36277797765723f3c
SHA512 0e48fc23046db6ab8ef74a506c97568fa9ce668c62e9378a5bde15675cbf8577de38914d3d24d0c627f37f51e413cc06e483ac3122aca78445318dd96a04ac6b
SSDEEP 12288:eN8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:eN8LwsXYHU9MPxMu
TLSH
T1FA55233586CA28F2E9D570BBDEC1C74851273D6CF9E5A7EB7440AB9A09B18B0CD5007C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 1efac25866762b2e7f8b120a866dd95abf5711a5a0dd1b51c47987db2b9e8990
MD5 ecea375d39189bcfa0213a4d67a75a10
SHA1 273d0ab401c290c35451e8f4ed12fe91ea279bb3
SHA512 49a1edb797f713134b3296aed663eaa8f33b97eecc63f125689195dbce85b55a971800b6340113154d26a7e0c11f799fa60cb0c5d503a1413b28ed9c3aa65b50
SSDEEP 12288:2v8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:2v8LwsXYHU9MPxMu
TLSH
T18655233586CA28F6E9D570BBDEC1C74851273D6CF9E5ABEB7440EB9A09B18B0CD5006C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 05928e1a2cadc06ce47f0dae9586a134a78820bba1b92577fed3193aff9b7d53
MD5 f25d9f916cee09e1b3298fd5324e65c9
SHA1 6b8d14c6abbebcd969fc1ec6cffee0b284bd7cec
SHA512 56dfc8c5e76573502e7294858e0f4925936e728df71e9b2eb49312326110e81156f57647f4e0d1749f6599421ec8ad3f5c28ca5063801e8413ae2aa08431ad87
SSDEEP 12288:W28+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:W28LwsXYHU9MPxMu
TLSH
T13255233586CA28F2E9D570BBDEC1C74851273D6CF9E5ABEB7440EB9A09B18B0CD5046C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 ce8a82bb3a4624047c18b6f4112cbe2739d43d047354f36ab5b2a7ca2cc219c1
MD5 d18c33bc62a48ab4ce6841ab97c90907
SHA1 ae5a7956c3db469f6f4842a72a69aa4d7dc4e63b
SHA512 3a61ea556b09ae141b4aff2a628a7c3f7941949de94ca54600e7777b58d639fdd28ab10f100d68e9c51aaddd78de0f6f43c77811b19e31aa0830f9e4415b743b
SSDEEP 12288:Y38+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:Y38LwsXYHU9MPxMu
TLSH
T16455233585CA28F6D9D570BBDEC1C749512B3D6CF9E6A7EB7440EB8A0AB18B0CD5006C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 20f403d3d576ca04a6ccb150a72f5a89b7fe3312a6c044b0b5604767e3f97070
MD5 0fb42d237fc262eacfe79a5995001f75
SHA1 29d60180267f094521af98465897514b9fdaf1f6
SHA512 b94eace3c24b863be318293312d7c17094a597f44cff35fde43c8d538a021c52e1dd6106ebd94c3a032468bc97569764b9893c25be33f324ae30c3aa2d13bf6c
SSDEEP 12288:8Z8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:8Z8LwsXYHU9MPxMu
TLSH
T18355232586CA28F2E9D570BBDEC1C74961273D6CF9E5A7EB7440EB9A09B18B0CD5006C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 c4a77b22ad3dd49b344994286cfbb7e49c45c0c2edc1084413ffcc6b9d7185f5
MD5 fb3360a7e43450eb07fa9610bd87962c
SHA1 88763fa5881f6cc40fe5544434c698728b550b61
SHA512 d6dbc074929fe30da78550439a5078ee427e931b8c878d928c36fcb5a372521be65f3590f39c41c4e6ee93b55fa456410cd6554a59eaac4f47e526e40390db67
SSDEEP 12288:LO8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:LO8LwsXYHU9MPxMu
TLSH
T18755233586CA28F6D9D570BBDEC1C74851273D6CF9E6A7EB7440EB8A0AB18B0CD5046C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 e93ab76503c666cf0c9994c6774afd65546410fca58ea9f361df6e0363d0159c
MD5 ddc9c88737be8523281186bb8b4d0f0a
SHA1 11fcc5c0f88eb56a44c532213aed5de9bdd13433
SHA512 234612997d6cd3c35bf1d1c9904ae64bd13c1f1a7ed5660592927829095c70703abc4743ae83c3e19d0e5bb18d2a0b33188d786212dc60ff9e8dcea7a6a5fa05
SSDEEP 12288:ZZ8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:ZZ8LwsXYHU9MPxMu
TLSH
T12055233586CA28F2E9D570BBDEC1C74861273D6CF9E5A7EB7440EB9A09B18B0CD5046C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 4c7366df589034672ccfd461f366c614d1654fc5a80f47f1b6ac4e230be83c67
MD5 daba360f5b22ebd8c2b34d3c1f5cd486
SHA1 b237e77d5130ad98f378be838561a52e1c53126a
SHA512 f18b5279b677023039bde1b473f1c255a9af164139b6ecbd4f15947534025a98160628ca368a37a00388c3afe3bb5a039221d8d2e5aa4bf97fc1b71cb3e328e0
SSDEEP 12288:YfwvD5uw64Lk3tRX69qkyAI5V8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:YfwvPk9RX6wkyAI78LwsXYHU9MPxMu
TLSH
T13A85CF29EBDC04E5E1B7913CD9A3460AF2B178685B71C6CF129953AE0E33ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a563a25edcfdfd89293878f627b0fb4ba497f09e36681a6cb74fa692dacc51c9
MD5 cb96692ab0771b56de71f57628abf6c8
SHA1 fea4b43215f15b261b947bfab002825511676365
SHA512 7b38b6683a9c8adef24d04fcf7c9085fe9a14caf0297d32abe949c05d1aaece6405b3bec58d26e99139325c056c0d135342010e8582051802c0f14376d6d513b
SSDEEP 49152:0YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0S8LiUqx:6ySzPLLjY
TLSH
T10D066C96A1A801D5C1B9C1B98F0BCC1BFB7134490335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 586f92bfa8c9e1a0ccbab4b2e08d38ef07e58407cf26cfcdd0964c7e1f237722
MD5 5878b90bd445e6d4a404e9692f769672
SHA1 835629227e6505b0fd22cbbfe270adb35f69b9b6
SHA512 6fffef90eb24cb09906a6186bee2dae48da5b4c62d409370189e92d0f7908e87614a7760f391531116b7d0d6e1f5229936a6e540393c05a67b72399a534c4c3a
SSDEEP 24576:g47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYY8LwsXYHU9MPxMu:g47JUQj1irIhCnDHUPfF/i8LiUqx
TLSH
T15B65AE1DA3EC01E5E1BA927885154A5AEA71782D1F31CACF2270837D6F23ED48F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 6f17d704142798b858647a19ae08156837331f89326d97bdc841aaebfc9597d3
MD5 494be0462ed5fab960ab282410618012
SHA1 c27c9af3bab3b35281de2cd7657936633abf42a8
SHA512 8bb2dc16d64816953526393dd4658bdacf0807bde051fd2318a4eb7fe1ba5183fb02b70fceeda6ece2584e79d64c2059fe85f4f0ada781be9e7d5856397a15d0
SSDEEP 12288:V8sff8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:Ff8LwsXYHU9MPxMu
TLSH
T137650119C29811E9C0AE617ACB828A41B3337C6897E1E3CB62D0F67E0F765D09DE5717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 4629272927bdf85efc7db14f1d02eb0af482c24e5657af5d0a988bb48eaf7106
MD5 7b38dac598c93115114c1577252419e3
SHA1 a9359d88d2ebcbc95f7c813ba43cf34e9a543cb0
SHA512 3c626d5be562b7ead7efef1845af46ad8c9d9b3e0cfbbd7b7ae26c7e74ae0d0894dec27d5fe9a3b20c92efc89bce183863d813eb8e3b55516c2e6cfd6b3e3cf7
SSDEEP 12288:FiXkFU3fgXf3W2C5wi3vgNz57LuXPaRJvX+QBrHZq+P6:kXIUP0DevgNz1wPaRJ/+QBr5
TLSH
T1D8351840762AC75FC6AD40325E32D6CCA7707D11EE456F0373C88B3F9576669BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 c8c43e1a4bd7dd2d77dbb9ff2b4c350943beddc0997d3fc511c1838d965be3a6
MD5 b0f1904876553f1da67cf680eba0b1a0
SHA1 0c7562a4504f6cf428e09291a380684cb39e5416
SHA512 3e5a4b98609602feea9beb01ae5ede9bb65b892acf52e378b7a95fc2a1afa9a9ea4549e52a43a0768d9a3608b8af3a00cdec4fb7c02bed8e4446401483e9571d
SSDEEP 12288:YcVOSRT4MOmykZKU0EoLKzNpSNlYxAV6dT4Sc:YcVLRQtV6R4x
TLSH
T14365F9816037A38FD1FB6031072A5F4CA764EC16B7496F227388453AD86AB25B4BD3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 485bfbfd09c0fcef667e1c91ff33ac5797ca69d41741583350cbbfbdb085ca1f
MD5 03c18df1cf2633f39136398cbefa1f5c
SHA1 d4859b981d54beecdf36398078632520a1086ea0
SHA512 84d653886c4f372cae9b1d02e91106fb7803ba1d0e8dea9fd2e74a5d43731fdc2686bdfd44bdbe91690ce0788fdf9503721f037da8880bce79588a3c470d3222
SSDEEP 12288:/S7n8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:+n8LwsXYHU9MPxMu
TLSH
T16E552331879D28B6E9F571B9DDC6C208212B7D7CAF94E6EBB400A79A1971CE0CD7052C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 04bc2a761b091bf7a854b2692d9015f48bf661a03edebcb3a82570f7861a89fa
MD5 41db1e167e8eba6314748b4cb44d57cf
SHA1 e944d2e99950219259683e4d394ed1dd4d6ecde0
SHA512 df2df75fc17bfa51a36d9a772d3e737de714f2a7714c6937e291415f4a0cc6ac91a7dad67639c7fe7cb3f98f5ade2829aaa44a0d6eed0a382400395b6dfb8255
SSDEEP 24576:tgb6bmBIi49WNNFpg1rSvFv7bYF8LwsXYHU9MPxMu:tgb4mBIBhGFY8LiUqx
TLSH
T1F165AE1E22EC02F5E0FAE2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 4abba51676ece0143734dcc659697152832b0af1940688eef064dafb4f5ac70e
MD5 b8142dcceced14f0867dfb146deefae2
SHA1 15b0bd28f9758a570b6245fbfc5a3bcef8a9b295
SHA512 f9d1e7b1a1fe2f9b3555d328d50311721ca0b7e4a15ea84151fb7600395c3a3a6f519c984e8caf960fbd77c682424859dc8e0f91f0163724176e6bf934d7e068
SSDEEP 24576:2G88u8FpJqH1gzria7/mI8LwsXYHU9MPxMu:d7ZFPqV/a7/t8LiUqx
TLSH
T1D985F16567E101F1D4B7E138C9824663F6B2B8251364EFDF06A88B551F23AE04F7EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 fe7bbe00fd36b2eb5c1ab2f6ac1f716b27141d84c14efabdfc783495b8090839
MD5 aa5b5ebe098ad49ad651100722cbad90
SHA1 e4f0c829d05761b5bb4c6b57a5fe6496f9c74fe3
SHA512 009ea709586da6eaf84f95e862c44e862f3e4cb7f89b058f4f51a3193fb85d80dbccc906abca4542189ea20505a8277c8c7ea1bc58bb17874807c05c6ba45564
SSDEEP 49152:QBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjc8LiUqx:LG05lO43boLjY
TLSH
T1E3D5CF6A62EC11F9D1BBD17CDAC6460BEBB23815033556CF02A486A91F23FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 60f82806aede82deaa21f573db11b01e099252e417b314bddaf945ff0397ab37
MD5 68726404aa0fa5235bd5a2b616924f84
SHA1 9bd4d16831644387ceb2bfa8e87fe1d848d67104
SHA512 e7f0606283f1a0ea19d8ce6a0b5d3ba96386bda93764f3ac19dc0f4cd690d82d193bef0f96b5b74916c65099d06e704ecef393e2b9113454c3f6abf1b908f9e1
SSDEEP 24576:9fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnS8LwsXYHU9MPxMu:Na5POZ3+Jt2pasx2+m08LiUqx
TLSH
T10D65AF5EA6FC00D5D5B9D17DC583860AF5B1342553329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4467c99cf2a46e17b9f8b5491fe0b9b6bc63a7edba1aa909c4d939ef2052f49f
MD5 74e1fdb5784171e08d6fb10f20728bf0
SHA1 38a3107f52528b726e5b52c8e93b74f42408f30b
SHA512 760d72f255b5c0d16b90a3f82f44e5a64571abe380a68874fd2d5679d8b1c7a38674f5899fd762c9fcc86b9c0b80cec484f9b5e8659675a9f2b55b742a5f6038
SSDEEP 24576:RNcwHdjbyQ4nLC18lb/EOjowL7Fkg8LwsXYHU9MPxMu:RNc/zEOVHFN8LiUqx
TLSH
T123858C2623E901E4F5BBE1BE89679546FA71786953308ACF0291811F1E73BF45C3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 55b4d7f6d3005e347ccca886bd4ab3db2de51e525cf6d3ebcf755dfee1a88451
MD5 f1ccaf62c9f2f0c7ffbb803146419b5a
SHA1 dffde97f318c742fbfcd25c226dffdf46dd7d58e
SHA512 af260443efeb2d936dbd737ef450082cb45c2376427ecea4ad1cba7ce4417c9a98806cdeb6ac4bca2a03ffd3bb02d66f843e9f197779a29fdc3df45c9b69be66
SSDEEP 24576:P8kNvNnaFeYhJNtmZBmO8LwsXYHU9MPxMu:P8MwBtOmO8LiUqx
TLSH
T10155AF2EAAF806E4D1FEC6B5CD238512E6727861173293CB5290C13F0E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 e08c80f26ba9a3d92b3d52e2c00b0b98f75593929952d8212e13c5d46220e9cd
MD5 739a2fa204ff23efe408a8e9a2bbf199
SHA1 9cfb956e5b16aa292793181597b79345cc265b33
SHA512 dce30104c742ce6e48ce64b54361bad1c2f1a353b69670b28e137fcc77b4475c16f66ca1750b8a744126cea3086f17747c2ffd7eb6d5a6ca3dca7b923604f7a3
SSDEEP 12288:BHvUrBFrEjwaQs8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:BPUr+NQs8LwsXYHU9MPxMu
TLSH
T12365E12F62ED18E5E676A17DC9828709F77278611751D2CF02D0827E0F63DE8AD39B24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 69f04278876c4e48d23a92153711c0a8d6496774759f723297067a0fdd9a118a
MD5 6ed8b45731054d57b549cc92fd160fed
SHA1 6ed6532fc5cac8284b187fa620d28a76690a6305
SHA512 b8b2f128bc451b5a87c4fa0e4daaf21ebab67ca258fb29601e009d0f673f3c35a4fb890f471ccd197522a713deaebbdf6d2454b7765d7a1cfd92efcd479da878
SSDEEP 12288:aQcMxWDXN1Dp/fshBItT1IQgAz8+g7FmsTL0v0vCHSwu91GPTUQ7MyQNkj+:ID3FHshBIYQgAz8LwsXYHU9MPxMu
TLSH
T1B575E13DD69C04E4E57AD1BCDA538A06E77238AC032266DB11D4C2BA1F67EE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1252-79-0x0000000000400000-0x0000000000543000-memory.dmp

Download

memory/1252-306-0x0000000000400000-0x0000000000543000-memory.dmp

Download

memory/1284-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1284-121-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1284-120-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1284-127-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/1284-132-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/2424-365-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2424-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2424-139-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2424-138-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2796-48-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2796-41-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/2796-64-0x0000000140000000-0x0000000140181000-memory.dmp

Download

memory/2796-54-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2796-42-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2932-362-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2932-89-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2932-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2932-83-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2932-378-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2932-379-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3200-29-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3200-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3200-37-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3200-30-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3200-137-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3600-25-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/3600-16-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3600-107-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3600-17-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/4132-95-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4132-96-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4132-102-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4132-363-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4132-360-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4460-7-0x0000000002840000-0x00000000028A6000-memory.dmp

Download

memory/4460-1-0x0000000002840000-0x00000000028A6000-memory.dmp

Download

memory/4460-82-0x0000000000400000-0x00000000009A5000-memory.dmp

Download

memory/4460-6-0x0000000002840000-0x00000000028A6000-memory.dmp

Download

memory/4460-0-0x0000000000400000-0x00000000009A5000-memory.dmp

Download

memory/4460-313-0x0000000000400000-0x00000000009A5000-memory.dmp

Download

memory/4512-376-0x0000028B995C0000-0x0000028B99C40000-memory.dmp

Download

memory/4512-395-0x0000028B995C0000-0x0000028B99C40000-memory.dmp

Download

memory/4964-303-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/4964-69-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4964-67-0x0000000140000000-0x0000000140177000-memory.dmp

Download

memory/4964-75-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5708-288-0x0000000140000000-0x000000014017B000-memory.dmp

Download

memory/5708-62-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5708-52-0x0000000140000000-0x000000014017B000-memory.dmp

Download

memory/5708-56-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5772-364-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/5772-115-0x0000000140000000-0x00000001401EA000-memory.dmp

Download

memory/5772-109-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download

memory/5772-116-0x0000000000D80000-0x0000000000DE0000-memory.dmp

Download