6095a0196c450bc3bbda0d116c48ab150fc29eaf2531152daaacd9ed81910878

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 23:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
Size 4.2MB
Sample260929-3ccseaygmf
SHA256 6095a0196c450bc3bbda0d116c48ab150fc29eaf2531152daaacd9ed81910878
MD5 65e91b6d2ee9bc211d094bf4c84795b2
SHA1 af151b66e8143acd63e51975e3bd5be61ceed06c
SHA512 3cd72e44b161bb772757a710b1ff3437ae5607f3e8991cfb0ab84641a751993833ea57f11cd16498a8721289395ef4a2d81a4d4b1ce79ff53ab33d135d17d372
SSDEEP 49152:L08OhxtUg9OUi82w6aQp9dgS1GUL38XhCOYc3iJX69emEPGKOPkQThMYRMnm7LB7:L08vdsGaQNgS1+6e6ngKpqkLm
TLSH
T10B16CF12BA828472F5930271997EAB7B48BDFA304B3595D7D3D41A1E5D301E23B3A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit discovery persistence ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3516	alg.exe
1428	DiagnosticsHub.StandardCollector.Service.exe
824	fxssvc.exe
5004	elevation_service.exe
5112	elevation_service.exe
3536	maintenanceservice.exe
3156	msdtc.exe
220	OSE.EXE
2308	PerceptionSimulationService.exe
3976	perfhost.exe
2400	locator.exe
4112	SensorDataService.exe
1036	snmptrap.exe
1612	spectrum.exe
4256	ssh-agent.exe
4660	TieringEngineService.exe
880	AgentService.exe
4608	vds.exe
4024	vssvc.exe
3716	wbengine.exe
1788	WmiApSrv.exe
2952	SearchIndexer.exe

Loads dropped DLL 1 IoCs

pid	Process
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
	\??\F:\	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
	\??\F:\	DiagnosticsHub.StandardCollector.Service.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe

Drops file in System32 directory 31 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c8f44a8d862f6ed0.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104187\javaws.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DiagnosticsHub.StandardCollector.Service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	snmptrap.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WmiApSrv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DiagnosticsHub.StandardCollector.Service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b8ab59556950dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000037f686556950dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007a6f5e556950dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d67f09546950dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9938 = "3GPP2 Audio/Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000009f31e546950dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005b0551546950dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
1428	DiagnosticsHub.StandardCollector.Service.exe
1428	DiagnosticsHub.StandardCollector.Service.exe
1428	DiagnosticsHub.StandardCollector.Service.exe
1428	DiagnosticsHub.StandardCollector.Service.exe
1428	DiagnosticsHub.StandardCollector.Service.exe
1428	DiagnosticsHub.StandardCollector.Service.exe
1428	DiagnosticsHub.StandardCollector.Service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
Token: SeAuditPrivilege	824	fxssvc.exe
Token: SeRestorePrivilege	4660	TieringEngineService.exe
Token: SeManageVolumePrivilege	4660	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	880	AgentService.exe
Token: SeBackupPrivilege	4024	vssvc.exe
Token: SeRestorePrivilege	4024	vssvc.exe
Token: SeAuditPrivilege	4024	vssvc.exe
Token: SeBackupPrivilege	3716	wbengine.exe
Token: SeRestorePrivilege	3716	wbengine.exe
Token: SeSecurityPrivilege	3716	wbengine.exe
Token: 33	2952	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2952	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2952	SearchIndexer.exe
Token: SeDebugPrivilege	4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
Token: SeDebugPrivilege	4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
Token: SeDebugPrivilege	4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
Token: SeDebugPrivilege	4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
Token: SeDebugPrivilege	4368	2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
Token: SeDebugPrivilege	1428	DiagnosticsHub.StandardCollector.Service.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2968	2952	SearchIndexer.exe	114
PID 2952 wrote to memory of 1480	2952	SearchIndexer.exe	115

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_65e91b6d2ee9bc211d094bf4c84795b2_darkgate_elex_glassworm_luca-stealer_medusalocker_mespinoza_njrat_revil.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4368

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3516

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1428

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2548

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:824

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5112

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3536

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3156

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:220

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2308

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3976

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2400

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4112

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1036

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1612

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4256

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3004

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:880

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4608

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4024

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3716

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1788

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2968
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f0438a861aad126763422bd6d6c0d431e054dd90a311a2cce4e47c977063e855
MD5 cc3ce9f96c4556af893e00335fb5ec44
SHA1 78e54d3f3b5063b8d4b2722555bcd707e75f74d4
SHA512 3afed91904bc5dc25204e98bc51312fc9215b23d279d98311eaca31f949c1ace4804725bba92fe6edec598d6caae4ce8ed22fcc81d7fd549402b5a6059d90dda
SSDEEP 49152:Kb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnYQ/lFTjN4:83q6HjB8Lm
TLSH
T13FD58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 995bbb75c2791bcbabf134b87b83fa87aa7781c241ebc39277d0e57fc1d72f6b
MD5 b3e6471d025ddd6e205c1548c3cc3a82
SHA1 4b1ae583991f289803dec5935cb1bdd0c198282d
SHA512 58363bbe18ae6a411d58ee8262304c3a375064e0b0f92e4f70c08a7d001f75ef01222eed8d8ffed43cd1e38be793f10ddc1d784610ff1ef65e327036ddb4aa2e
SSDEEP 12288:u1XLsswWkxy2lRq2czATGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:cXYfDtczADnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T11C65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 2b72e8a22e0fd52b463af9566306cf2607949f4f24e3201e2f5b173f8571c12c
MD5 c37fac49e65be51d4323fcafed751b66
SHA1 657dada5b24f7e7d93ae5b284b460d89b6e57184
SHA512 22cb43ba1d38963af85166575481862c313ec442f060941033eaa1e88d21d477a7b02eaf189956d4f3e0298d3a99168453f9ebc82b786026d7d370e23d8de81a
SSDEEP 24576:u0Le5ji0hmxLrMgnQ/tbw/2Mkjy6Fr7g0ow:uPji0AlVQ/lFTjN4
TLSH
T1DD859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 9cf70ecdc65672e08efeb390380b5b533ede14b103b5606cc3c5f5d8cf641f56
MD5 19fd9ce4cd092fd08f011222d2726724
SHA1 235e72d7e871e024d1b9326fc962c1b211985413
SHA512 ee7337aaec741434fa598306dc3f622fd9cf2187d087bd79c0bcc9ac8424ae819002888514222a853ff7aa0f89c88189c7ec39ef6faa9e12a2e3eb2e20cb9862
SSDEEP 24576:ha7/ezSC6vUyD/aqgrvWE6q8wyu+nQ/tbw/2Mkjy6Fr7g0oR:g/ezSC6vUzPvxHjyRQ/lFTjN4
TLSH
T167755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 16c2396de7ec0e57c4efeab2126355aa9aca5c2a59b888da2a587aa7c3f0df6b
MD5 61b258f9a3e57499b6a4a5c225c182eb
SHA1 cc9d2bc060e8caed3e768cc76362b437aee41043
SHA512 312085139707ef2703ac2a0d6e7866fe6bf506628a52118fdff2eb9f35bddab31b2a48f71835b8757f63fa14af09853923881522e7e688704e852ebca6391e48
SSDEEP 24576:qVbqPb88hv/l+6HnQ/tbw/2Mkjy6Fr7g0on:qVO88hXl+MQ/lFTjN4
TLSH
T1A5559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 c1fbc1c6d67a1a440ec0e110bd5723e1af23d82dd6913abc5829f95f0ca66455
MD5 d96846fd9d1f1f2fdee2bff2b55444a1
SHA1 98f15489aa40322667e5a1abd2200687199eeb43
SHA512 48cfbf8b100ea448584e0e066b49dddcf7b249ff8cbf2e43658f1a759854b4c542210b18ffbcdf7cf4dc30bd700583ec60726f1ce37ed84b4a6975105690bf45
SSDEEP 12288:IzEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:IzknQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1CF5523696A24F897FF2B06B15C8384826B7B0EC1BFD4A74E7B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 43f59a6377cd1f6f21d99299d61d5f7757cb1f524fa1d16a5eb21c1509cc479f
MD5 b69670afd278ac26670346f14687cc72
SHA1 5f35abcfe541cc0b80c0dbdfa4d136f470f84f08
SHA512 4fbf3ecf3064e32292999b2321d2ddaa961672bb9989b4ed5c976e65b8355d3f1fa1891d3d1ffa281395c0d85d54e7963941381037342c17de6400eb217ae0ef
SSDEEP 12288:NeBNUbTVO86UvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:NJIUPnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T14675CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 fef2f6b2a333fe393d4d824b2a31b66b6e16f29fcb1b5fdb3d46cb444732b8d8
MD5 e1058b19b528f671d9c00b25a61f9f75
SHA1 e1e470535eaa59a1c25e53981a50c97178bbe3d2
SHA512 9b44182425c6743b9487bba3b71945ba8442636b9c8b1bc5c5fd681320decd62832797aa728eeb5bd09b1e979db929caf4ea5749a8a891700bd03250c398a887
SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THP:bQvGAdlCEL8c/yRNw5CJLm
TLSH
T182267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 6319f452f63c050bffd6f76bf9f272f36285ffe1972be58cecf900293f84365f
MD5 294e84c844bc893c0e93019104cb9cdd
SHA1 203446c31eab09e34836582e43c56fb069d8fc13
SHA512 714095309755c1890caf42fc3b310336c4fb58973dccb7320459bf1395b87d55709c64310bc1f176a110811cc4ca2ff37ef43aab5b4f5028f622510126dced70
SSDEEP 12288:7AwSfxL/2Dc39DLLmt0LDQewsAjlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgd:kQewsAjFnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T10475E031FE74E436C77F0DB61B22C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b95a43294b0ece20afb2f20c748490cfd79c1562f3e6597d076a23208c3c33a7
MD5 f8c043a197a100da1d3f8fe693024905
SHA1 13cfca4129d20d2ae8a00a27cedb5684d9c8b6be
SHA512 dc2f6a175491a94bdeba1c37349bb933010be2df57a2a746c1b47b8a1b98746863a8a2865d9395794ef81d40d2acfc29e0c02c4754c53cf9a23fae64265a2570
SSDEEP 196608:UUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHSL:UUEtQevvqc2W1cpV2EI32
TLSH
T16A474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 def7babab5817c00075163682f1b79606cd1a8b51ef0be14b5ff0e2c00c7b6c9
MD5 f3b457d729e02fc58cf888650c1370f2
SHA1 a8e41f2dbe7b5acd93e55afbee5d272c3728f33e
SHA512 da905efa56916645f077a52c96dad8af172ceb3ba4ec739173d5515e57f73ff9984c08294b539b7355f35910fa66421d0aa712675f22b4c293dec5c68f423266
SSDEEP 49152:cCbRquA/m2yL5zQfFiV+XenmE3/zlQ/lFTjN4:VoqtVjnm1Lm
TLSH
T130D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3530448897027910c33e5655ca15c72d7234fc3c9c84b94cd6f8a82e3c4f7fff
MD5 eb290f9b2fcefb2cec75f3ff8c3b231e
SHA1 19b09639dd88765959062cb35985a7d3d1e0906b
SHA512 69492e1b2dc30d90a39c0995529c4260cdada348c5fb41310d87d77d1d8f28187f4f87a02ed5b0a6ce15f26334c5f7ffed8af0ca897ea1093e8507c4e19c2075
SSDEEP 24576:wAhGLJIFoiwtA5l7S53anQ/tbw/2Mkjy6Fr7g0oQ:wAMyFoiq5qQ/lFTjN4
TLSH
T12335AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 a06820809f87f51ea1da760786e950062e1663863a4e9b3d014e549810924657
MD5 c16a03eee50c4de825064a4e5fcb49cc
SHA1 60ed7949c67b4da849799d5cb7a7937313400998
SHA512 df938bf35123ceef9e515645e016b73805b4e5f7038b795e9b2ca1b62916a46da46030eaa029dd79c83ffda26b03897b2d9229e697f984e827ebae775ea6e97b
SSDEEP 12288:jmw5HEjsChN2BFgl0WDm+CeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMb:iwuHOWxnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T10665F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 964769d56d92a102e256aaa0107dba6a270ea8ef5a176c6285d69817c293cae6
MD5 caa449938e81a1fefd5d0a6b56313394
SHA1 2b26d5ae815bf33bd3b51e7504416ecf9c0f7e7d
SHA512 f114652aac321ed581b88cd9f431b7ee6e294c2d8e64d3c21dd9e9d0851f35267f5f776105f878f9392a30d94f33973d1fa5dcb89d0da2c90e4826b30a0a748d
SSDEEP 12288:xXZ1IyVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:5ZuInQ/tbw/2Mkjy6Fr7g0oH
TLSH
T19255126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 78fefa4f8c884e666a38bd2a6820b6b37f1199e054fedf5e2d041c16e4738215
MD5 aa0649de27441fb12dc6aa763c0f6cb1
SHA1 e3b51f1b2b6dc7688b17a3910799ad660b88e348
SHA512 262de66e2d2f4ef687f87d9d0efb3b645efdbbf16218a114ae5808cea6d0d7daafe1e1ce262eb67559f7c7fe2aea69347b9fd7748e2f2aadbef69009c7bb65d9
SSDEEP 49152:Hj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ub:2QRQyi36YOcPQLvw2gAf+PN3gLm
TLSH
T1AD666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 cdf922abf26bbbfe4902394b0f52dc702876eefebd69679a2d2488ff957b8c85
MD5 ef3aaba15794cba8e7ffabe4e28fa2da
SHA1 f632bab1e1555c46877a79795db3cbb30a08699e
SHA512 4508281ce26887aafcb9da610d3ed8ccd972f4cb779df6af5f00cd612fd05f45f34a0a05385e0f5401188d57684f3d8c286e2af75dd17be0543dc9a8dfd96fb2
SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ub:GQRQyi36YOcPQLvw2gAf+PN3gLm
TLSH
T16E666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d4df1dd6c5406ebc4f57cc126dc994a7d3d7e34f6ae0b39c9c5bb2d59a124693
MD5 6bfb52d82ccbfebc193d6ab28f5d9189
SHA1 060d1e10ad515917f361f91d10b8a1e98717f621
SHA512 85611335868f14c203ad031a4dc24669dad36444fad92cd9270e652735d85e247a7f576c7a7c81294d2be5bd035b28d4064ed9b4942140ff9906b31ddda9ef20
SSDEEP 24576:6wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0YnQ/tbw/2Mkjy60:068Qg55nhheWu7PNU3/VQ/lFTjN4
TLSH
T1E4B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7d896711a7d57642dd441c034dd1ffa6fcb5d1685672bd327869f4b4986561b9
MD5 f5066fd6dca22f2388984e142900948e
SHA1 1b80c8f41a9479cbefbe333c122e1972fe895ca4
SHA512 3bf0e0f77446fc2883712edcd25e7a186ef8084f5fa04097d5aa5f11b3180356b43431ef31ce404ce2727e5155a40de9859b1308925c8fe86ce566ed36b270d3
SSDEEP 49152:s3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99V:Jy5112gYy5azzVvL69nLKnhZXLm
TLSH
T1BD167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a73901f1bc12e094702a49745fa0b7f6b0860ab0ae1b3bb58cb7405a0b0e700e
MD5 0cc4b77f5ebde5b8d1e0b733d0ee4909
SHA1 14e45fa6d54d00f1fca5872785776dba279ccb66
SHA512 07abf29c40a459ded86918c22e168fcbfd4f6f84e7aa8a97e98dc7cb6734ef5643cbf845f10b7364bb992743d2ef3bbe104b8fa13bc92a6f41def15457f1baab
SSDEEP 49152:3B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glTQ/lFTjN4:Zu6JmVxd2d4Lm
TLSH
T139D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 644f478ca0eed698bcdb60d9ecc76be7453041a7405836acea03c2b9d1d58942
MD5 942dc5acf80ca7e6cf3cda5f3baa8b9b
SHA1 c8d292ea571f650b8e5a543af35586b7fb10d897
SHA512 71648cda691e8dfa2e8c1326b4c5c30c9ed5784f6da700e6b917ca295017dcb020b43f0eb5e589f7ae415258895b6f7e437a851c93c1e3af8b56819377a6ad7d
SSDEEP 49152:e1hpsNoJpF1A6UU44CwH7R4xvQ/lFTjN4:emifPbR1Lm
TLSH
T11BB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 b90a6669aedb85c570fe1960719e07275f6dc2bc4191572e46ce4582227b5433
MD5 86eb3c5aa638c90ab1918f674b99203e
SHA1 8e9a8e0cb9e9beb23ea80f162e1d52ea189d7551
SHA512 4df60e8afae0571bebf08b75c1d4461ee8568110b7226bd8b9ba491a1b3556d48efaa11baf33c4cf758be32021003f4a41fa2c669bbc0fec30f469202dfd6702
SSDEEP 49152:uSuZQIY0Be2KRRVtOnks6NMHqIQ/lFTjN4:g5dKTi61rLm
TLSH
T1DAC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8a4c23254600fc7a71a859d38f47421f77eb3aebdf199b2542f9b3dd34d64ee6
MD5 8cbae6f78caa9e724e0080828d5d8bd6
SHA1 cf2c75f32324eaeb805a846fb94841ef37fe6d06
SHA512 dd626b5ff8a8cffb987e0bfc6634da813f31a8372f3417a27a3487244ac3bd22bf0495e56c92c9b9d9e4d502bd6faea1493796af97e9925cbe55c0a2721704b2
SSDEEP 49152:qhtSn8EApI0figngiDn0AP5wDQ/lFTjN4:LX2iyphRLm
TLSH
T19995BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 135cc2cd9ee0be54830c22459c1095e1e99582ed2414ef4fa0b9c04b986e8051
MD5 a280a7b281af9ab079b8dfe7976db50a
SHA1 57fbd9d006ca0258e166ad4e2b34960ef7dc7de9
SHA512 0f39e746397bb3713a395f680bcbbc6ea03a7665e91ed90df0cdf3641d6726806512dd2e41ae3cc02fcebfcbc2924a4f188d6a55e1550b30246d1d26624741fe
SSDEEP 12288:mMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:mMnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T19D5523697964F98BFB1706F18C828182973F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8eb28eac6f8c3a4c694e5a3b42e0bb98035211672ff95acd6225d3e4b576bbcd
MD5 6f7246fae45b349e982690feb4821bb5
SHA1 64c762afcd8dd08908a4978f0d0c78893d5468ec
SHA512 d811850066800e9b75f12527bf02d283e3a496a176b273b8b6767d22550f52d797e15dff0362f5f778bda44ffe2c8348817223cbca273e6e6b70bc6b51621236
SSDEEP 12288:E5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:EJnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1F95523797964F99BFB1706F14C8281829B3B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 6776cd44bb8a05cf8b7df5b2c92e8ffccb982b404dfcec7faf823f9b16469db3
MD5 6137321f111d151469389a804d5fac1f
SHA1 6348bce10ae09cfac0d5358dd5cd575be2f32b94
SHA512 1debdfb4019d15fcce6a3d55eeea848eb5aefd26c58dcf1e8a5c01b609048a23aded54a18b3047e5d03fe24643d276de5889cc88153aa5c096ae6a8da091756a
SSDEEP 12288:F3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:FXnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1765523697965F98BFB1706F14C8381829B3B0DC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 37d1a8077b91fe12f723312b0a0555c0b5ffee1a2d7d15785388e9fba2d51de8
MD5 a95f28d0c8059fd7bb1db4ee2b64b8ed
SHA1 4398772d09b1a679fb3399e218984baf489c5312
SHA512 e39f2fef23c3eb354f06d882164922b2b82518e7003c7b3946677cd19cb615e68c81a18c2f5a89ead48555a6575a6712a03c19c7d30243c9320c2307e9a85fe8
SSDEEP 12288:NV6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJp:SnQ/tbw/2Mkjy6Fr7g0oJp
TLSH
T1B05523693A69E4C7F92742B4CC938142E77B3DC6BBA1A38F7B04111D4E793D419A9B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 c50e0dd79473895425bf8d261a92b0dac4ce9b798505f6a7dc69c8dcf27f2be8
MD5 faff5b7195d9507c9741ced84d3b4e11
SHA1 5d50ef66098a644399b70873c34e6ce1c1038f75
SHA512 794eb0e5e80e127bda83ffa19c6f0da851d54ad7cd3986dd9b75b4d8f0b2fd6ad2f8907054df77d1fda94fb468a44e247de7cec44090e47f0f9d1d59d874de83
SSDEEP 12288:gSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:gSnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T15B5523697965F98BFA1706F14C8381829B3B0DC6BFD1938F77482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 693dabddcb40995c31f08eb95f7ea83b1dce490305efccf89aeca4dac48f16e8
MD5 9549bfdc3776a1864aaf6eb4c2a488e3
SHA1 74a58c782fd70c584c510d4b5fad280c216e4a6c
SHA512 d81b49a5596c7a07b4f9fb033c3c814754fa66346d480fd40f36575b0555c09ca2eddceb96393d4197566768d787a34a346282b83f1d7a8be26e59ed040c4a68
SSDEEP 12288:3tGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:3NnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1055523697964F99BFB1706F14C838182973B0EC6BFD1A38F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b24ced82681c5157fea54b9ca693d958bf233582dcebd2c0430d66c536b19bc6
MD5 889871cfe1917bd825e0ae1f8b531f45
SHA1 512b11f2cbe741be65defa3cbb45933a6fc0b53b
SHA512 d0784d60ddf012fdead2112b5a9214aff4433f4f3d1191f9ddcc7c4d77c692496702d983dabde9b295ff3ab76b03fbe192fba95e0f5ba2011c6587dedfb1926f
SSDEEP 12288:VxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:VBnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1A55523797965F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 8dfd28cf92e3a6f0b49d6ea351edfdb17bed8e690d70b9f80948ae7ba20b0df2
MD5 eccbce8f6f4c307214c6be73fd998ff1
SHA1 ad439fb4bf785b11be4b1fcaa192fd591f0bdcb1
SHA512 9d7f6af057bb652bfd44f4c1423dddb26a51165bfe7cc4563d5cffd1ae15ca6beac10d0633e781ec5f6dd15de072d1e383349fd98d7bf9eac1787512d8eb6fb1
SSDEEP 12288:IiZwbDzzFEoS2cPvyZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:LZM3zFVSOpnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1377501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 fa25e9cc1a914bb855941a1d823c9c793ffca2e537e05d91a40c799b1b07748a
MD5 2b2ff62dcf3881ec190313f065dd0415
SHA1 fc132c20197d856fcfbf664b950f3bfcf63178b0
SHA512 f40f7ff6bc15ab03585b664a9789945f1374c2c52a3bbfc0f6ce8da71ba6b2e45dd4217ea1a23d93ed8fc9fb79aff3285f180196e1b6334ddb6d41782cdac337
SSDEEP 12288:94GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:94nQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1565523697964F98BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 407b40e031c13f2029139ef450bdbcb3607e8a31fad8c7d025910564db165d66
MD5 d54b77a94099be64b1d17ba6e6fe4c37
SHA1 310060d265bae7cd6ac6646225f19e4c9940abab
SHA512 d4f60cd9694f7413bee05d2aa2337cb387e61e6fe2e5f679f814385bf863e78b66f6def04270cbf68972cc652683afdbefc5be5bfe953303452f7e43fd59f31d
SSDEEP 12288:J0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:JUnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1D95523697964F99BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 162730bddc28310fda5b88def03921fdd84ae79d66f2d77911a76c61d2ecf25c
MD5 209b1ce8ced112b8b6e38e1472623ad8
SHA1 a7f70270d8091f0cc98db7ee417d125e1e4e7b2e
SHA512 919ad8ec992f2d098c20b58a59bfb2235e85fc936239e23ba8508b92993dc8dadb4602a0dd7deaebae938fe5ef8f560866fe506c0199da115d1e2b65ac2eaa36
SSDEEP 12288:EyPz5L8VGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:dzy1nQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1EE65021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 f7bf5fa9d41898e3b85350cac339940d895261f6e75fd77b1b144587b9a39022
MD5 68b73f4c97675567b79b9ebb0f928df4
SHA1 7d578310bbebe02c8f72c1122b15aa0e4672b93b
SHA512 462e6b61509622f925527263ccfca4e62feda1058ee388455a96b9b8e3fce463685ce340090d393c2e7a627d48d1a127347a0a4d9a74ebc2a99ce0aa28ac9300
SSDEEP 12288:x4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:x4nQ/tbw/2Mkjy6Fr7g0oR
TLSH
T18A5523697964F88BFB1706F5488281829B3F0EC6BFD1A38F7B4C1128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 8f578831e7f6ee85b868ad892c3f246c19f3947a790ae655b79c10bb54825259
MD5 d55adde2d7eccbd5d95fa0bb5209833a
SHA1 e7e36ae3614b696c9790e5bbaa6e5e4cc73c3422
SHA512 51e12e4967e2792095ec226b88b5b818911e4a87b3097464f81dd081baeaf9afa2eca21bc55f05dd364339844cedd916eacdd979b51a45adab06baa12a8d3677
SSDEEP 12288:M4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:M4nQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1A25523697964F98BFA1706F5488281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 1e2032b80792d4e3795fc59e2c01764d57df471ff44c6f7a6850a6070dc6fb70
MD5 2ba38d56231e41f32c88faa76b4891cc
SHA1 cadc4b57d2b85386f99fd6b7311d08fd909ac042
SHA512 9859644e54a24d3343076a65d301373b7b6092cf4fbd69e86cbdf267b531210063e10a7125092a241bebb4ed0974af7f4f9855f1741cb1cc541953270ec54108
SSDEEP 24576:tcP4mcvIjkGOxhKP2l71nNKbrh/8KBwnQ/tbw/2Mkjy6Fr7g0oE:SP4m4IpOO67W8KuQ/lFTjN4
TLSH
T16965AE2DABDC0096D0BB917485658A4AFAB1742A2F3286CB1160933C7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 a0f1b35ef3991a9f7166d183b1782b133167a0d94ac2dd6831d6e6ece50fc54d
MD5 c32b5844911428c2d77247710be6ea2a
SHA1 4bedd76b718c0ce9e2c9a474fcfbb5cc3ad899eb
SHA512 aabefe062d22eca58f852652035194914887d4c4d59881a47e189bfa64b3a37c81b9f4e22a08ac4d7628bb8c81f3f2fb48bd682fbcf539bbb69737cf2b309e3d
SSDEEP 12288:/ssfIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:TInQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1E565F119E29852E9D02E5279CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dr.dll

Path C:\Users\Admin\AppData\Local\Tencent\TxGameAssistant\TGBDownloader\dr.dll
Size 74KB
SHA256 5904a7e4d97eeac939662c3638a0e145f64ff3dd0198f895c4bf0337595c6a67
MD5 2814acbd607ba47bdbcdf6ac3076ee95
SHA1 50ab892071bed2bb2365ca1d4bf5594e71c6b13b
SHA512 34c73014ffc8d38d6dd29f4f84c8f4f9ea971bc131f665f65b277f453504d5efc2d483a792cdea610c5e0544bf3997b132dcdbe37224912c5234c15cdb89d498
SSDEEP 768:2fqePMS8NxKDSYkK7U0H8zAqaMRmnJD+7OX4ubjJJYIn8n28zaTQ8PfcQWZcRZip:sPMS8NxpYZCrFiZbmnzIQ+cQtfiqDVQ
TLSH
T15A737C472A1540F2E2C66231B6A5BB3196F5ED610F5A1683C3EF82DC2FB6787E211207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 8ef8dc5400dedb85a1aa08e4baea49c15ea7022bd6f0d848d13d1655fbc0bdea
MD5 7db18b511e8137394be99e6ee2e876fd
SHA1 16027f7c02992436178688c367dac90fe68f3eeb
SHA512 9136a6e726690e6a460076a7244512c37a08938bb1ba0521c4a94d75bfae18b3ad031c2bfbcfb752763fd4212a07b6f7d0aa3806700c044ee0e1e133ec12147a
SSDEEP 12288:/oGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:/onQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1935523296768F94BFA3B06B05892C152673F0EC5BF90D38FBB08222D957C3D40DAA745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 12be2fa11f47a73bffc2ae87a47b8dcd482f602e4d083b4da905fa6e87e2b1c8
MD5 01641899612a4ba72e867af1e1e439e1
SHA1 17471af29995c42e38137b0bc6262bdb8d8df7c0
SHA512 d7b5b73dede1e82fd3f6da2bd24a33c90116b84725a03534e82a0744284be3aa9ed5479b16deea8654770b1d7121f36c19b745f9f4ac81a957332d1b2749f081
SSDEEP 49152:na0h2GEkuAe73q3pp46zwwQSQ/lFTjN4:na0hNYG4JwSLm
TLSH
T1C3859E1E67EC82B5D0BAD278C9A6814BE6B2B4261B3156CF1150853D3F37EE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 abe6eb800f64a5d52bf3acbb792dfc33c8f5f589b79a2b804ee5ad7cc69d0024
MD5 fc64b2df9341677278545f0967ae1294
SHA1 3c41aa7a413abf90c48c502a79eb898f13ece72f
SHA512 0dbb5844a52a782c750af24c93b951f853aa69e44f1fc015ec214deed06d28c3fd02c3c7758b76e040abab77fd92715c80a1b325cfb7d9a46bc620a3f384ac80
SSDEEP 12288:ohbHjfXJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:ohbHjPZnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1D955027E26AC30DAF63692BD89928546D7327C552B11A3DF2380427D4F3BBE40D79B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 b30841d18a8c97606e15e6a2f333f9141bfa7822e1c1230f25106ba89dc0f2a0
MD5 31913cbd71f65198a29612bf357673f5
SHA1 7028ca439f214efb395174956db82b07b2d3a21d
SHA512 db7fc6f686465e1118f10a5324ac4368788d040ef2ee2b4c2d926522c031bcfb38752b159868194997e133c89b30cf400c1a3a881d566cfcceb9783a5e22c60f
SSDEEP 24576:d3YgnJcRTk4yti+R5dBR/xnQ/tbw/2Mkjy6Fr7g0oH:dIgnaTk46pBR/xQ/lFTjN4
TLSH
T19845BF2DF2B910B9D8AAD236450147B5FB71782D1F209BCB0170C538AF1AEE85E39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 54634d9157bab47d34b73293cbe824fd7ae97a80971735e2bb92fb1d00665ad7
MD5 8e9ad509183f03ba722726db23a8a8ee
SHA1 585715c1bce071a01717c398788123a86786bd41
SHA512 0c7f32e3f60c7d50d81152b463d821f5f52b29aa35b24b423ef3070c3cf7b7cdba4e1f314ba642a88025d871a465521e4d6b102787062dbdc28bca2bd934abdf
SSDEEP 12288:PkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:PEnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1E95523687614F98BFA2B06F54C838546673B0EC17F91A3CF77482229967D3D41AFA780
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 8fb746d9f46a1edd265913a4de82b3949a9b7918895ae2bbed29e1000dbf3767
MD5 af5f137db976aa015218d32f67b295d0
SHA1 e7abd2e4a13bb8c1f5754f2d9278f257302d03a7
SHA512 bc7c24a691595a2be772b61ef0a4a517cde77fed5f5de8c96a08fdff85e1c330c5dc3680d4d0da11db7fdca0a659140baea6695d6eefdb6d75c43fd1ef31a190
SSDEEP 12288:POb4A4LWOsvAYFTTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:QwL3UTDnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1A575F155F7A450F9E92B813CC8A28A16E772789D1764E7DF03A84A691F333E14E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 99c365fc6ffd22d4126e804b7daf2d5ffc4ff9e2a76f7cc74e7e534cb7f159ac
MD5 906a55c063cfdbbf9732e9a8f827d429
SHA1 5662f393f7f8636f9cfcd517b548542e4d76b17a
SHA512 2dd9a9221401dbe287a6c943e11d44aa2a508d1f185ca5e83037d4e86fe65f2c723b984cc27f26e1dfb35368356973e1ad8d62479a7c76a57d7ada5814a97b35
SSDEEP 12288:RpFtCOPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:KOvnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T13455022D36EC60E6E536527C89838249D37278921B6253DF0780817E5F77BF81C7AB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e89fee9c12d30432099155b257cc2e48eb5541b06a0c4299f48719aa4ecb86fd
MD5 b1100f0045a41e12d3d995c7a19c2030
SHA1 cb3072842ba007c7ae9716460c3513b4e7b9355f
SHA512 752718a9fbe51c0fd02a03b6ba5ad9ea6b399cd112d9c37a430dc91ec9cbc81d3fd1e0109182195fb3e7c30aa57b0b2c34fa30c894f92f8da9e5694ba5c27537
SSDEEP 24576:l7NM9YqZqmWMUkPjZM48Mv6bEhs4nQ/tbw/2Mkjy6Fr7g0oX:l7cBWMpPjN8DbEh5Q/lFTjN4
TLSH
T160659E2E6BAC81D5D577D13DC9E28206F6B2B4611B318ACF1152833E6F37AE44E36721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 3ba337c18e631834c56ee3270740bc866b68754f4e0727175ab685d0b3c110b9
MD5 d02b3cb7e5db07ffcda2148dab55cf55
SHA1 bc32e253246c30ba043de9ad13a882b55e990b40
SHA512 d29032bf85318ceb268247db4831ea901be4c0d13b0bb341fb64736e205fa95c84a19eb6f8f49ab62c637df03ce85f0df9c5f2a82112dfee135c13b6d0eb3141
SSDEEP 24576:wW6BApg2YuyuNDYTabvcdvNYf8km1WnQ/tbw/2Mkjy6Fr7g0o0:wF2YuHNETovAvNYf8kmYQ/lFTjN4
TLSH
T19E857E6927ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 2be95a35d70a48f2bdcd9ca0afe89e0f14d04ff909953c94fadff2c0c0f2f884
MD5 0b7e3161ef863283368ddd733cc37fa8
SHA1 07dba75e9d56e4d2d37903c9ada3d96a368d0c6a
SHA512 9afdbfd64b95fd33932a98ac727256b691ebe693a715114dfa2a0a0b3404f20fa561344f54a08560671c6ad0dfc968cc9d32219d7c9d604a1474d93427b16ace
SSDEEP 24576:NAFs06+Omlf3NXEbToLnQ/tbw/2Mkjy6Fr7g0oN:CFs060lVXuyQ/lFTjN4
TLSH
T11165AF2F66AC00D5D07ED17D8997C91AF7B1746307256ACB0260863E7F6BEE81E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 3a05ce1cedcb6df58e63ce265d2c38e4385f7af5710742f3ef3bd2eef6214802
MD5 e32818da0791348f6fd3b85ec13446c5
SHA1 ca2f0016bf844cbc9adf0c6d173c8abf6612558a
SHA512 fdaf562b934f8925e6fcb37f9e31fd1736a969fc9de4025ff83466a27073782fd3603745ab6bf312a450f9f78d43c50cc7e9e1344abf1ad3ac5da06210e7d7c1
SSDEEP 12288:6CJnJ5D3VkrqzxYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:7JnJ5D3WaynQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1E575D03DD2A810E9D477C2B4819A1746FF72386D2F226ACB2864D5357F22FE05979F04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 8f3ab60c123434b63d458ec889e46205045586bb4dea61cc296dc2230ad61ded
MD5 caec2212fb2580b653d09ada3a883097
SHA1 f1a8614f498fbf761af0ec3e0890a12fe744667a
SHA512 0c82d60ff48d0f2675302b1dc0e3561bf53666c1bc355a18024dc202c986b2e2e61f5556e19c231b70b854807667bfa3322f99f180290ecd62615184ad39559f
SSDEEP 24576:pEPghm6/7IIXdwcXrif7qQncjlP65i3VuxnQ/tbw/2Mkjy6Fr7g0oe:Og06DIKdwc+eQnSt65aVMQ/lFTjN4
TLSH
T1F6955C16B7EA5294E8B3CAB1C96291169B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 5752d3921876b213c7e8e73cd7c3dfa29f2c909f8b28b5d4335e594573b5a3eb
MD5 8b23b833dc83a747425740a7ec093475
SHA1 279fee6e20df32ed80e610098dafc1526aa9332f
SHA512 2378c8d8c6fe9a59e2dcd4d0f129aefd8f2257868f1ba9a2315aeea0612483ced803a0ea31843119d3e055dbd784a58c617b204cdc2f611f22777ce735855391
SSDEEP 12288:3EP3RSeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:8SenQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1AD55126D37ACB0EAE52A517D84918145D373F4A16B5267EF2680823D8F3B7E81E3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 4c13d510c618107ee0d0269e2f49191a88fb7587123ff8e526d19c247b2d4ebb
MD5 507e23ba1c806778b1dde07724da48ec
SHA1 4492ca95b6a921214693e939847bbbbd939984a9
SHA512 ca91812ba31c41e6af382c88ab11380ab29a6ed2bb90d69b0e8b23a95748f4dd5d14933f7da322fa3456ea45f95c4e5eefcead780d3210c1b7615faa73f318ca
SSDEEP 12288:Hjky5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:HIyJnQ/tbw/2Mkjy6Fr7g0or
TLSH
T1116512186398F4CAEA7A06788DA381919B367C506F2193DF6280F33E9F3A3D45D75B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 14203828fa7490eccdcfb7c8bc8eff3e3ee793e427b84d967324b73d9a3717cc
MD5 b325aef351d34f7843e7499e274a7edc
SHA1 f975239344a37b7068c5cf8fdd3c634a5e0b9669
SHA512 8d1c0f93fb07f95ef603f94add5f41be231f299404d80fd7d689711d9f2192183a3d810c1e1f139fdcb8af48efb50a6906ee9270a3c8c598dd6a7177a3915bed
SSDEEP 12288:+0/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:ZfnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T13D55236C2625F89BFE2706F448928542973B09D17F9163EF36886239CB7D3D416F6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 4160ea51131711e18cc1d9d02323c18bec1f7bc496b0e11812dfb5357bc56441
MD5 27fe9809ba8b350d4192179acf14cc2f
SHA1 f528baa64f38782281f662de838cb008806c21a7
SHA512 8571b93adebe64ba6d3d72700d863b8491ff50ab621dcface4eeee4921db6b7b8d057cfd3b67793550e41cdb0ee04856a889b3484ab3491d3f3c5a3c86658911
SSDEEP 24576:nQ9MxZKdcz9dw3AnQ/tbw/2Mkjy6Fr7g0oD:nVKZAQ/lFTjN4
TLSH
T1FE558D2DABE9199AE177D27594A240C3A633B4311B31D6CF2448D03D4D7BEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 2aa200f9b426c7367472a909fbd9233130b79db789a892e7c3364a46bcf1050e
MD5 842320d23095ec830b543c1ccf0b55a7
SHA1 6f80c2c60d40aeff231b14ebf3df5fe26c552153
SHA512 1206f995285955b4cbafca6df92781ee9c8d07b02024154387b5fbb2012b4dee29481b6d4e0e13727b778ed9c03b4edd226e4425d73ac7449831179f6bbc2f4f
SSDEEP 12288:hyoKo20Rple9plGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:hyocSApFnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T10865E01FBB6990A2E136813C89818745E773B4706B6263CB6681C33D8F776E87D39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 7e0a23df704518614b5b929d65a750724a7ad3cbe313a1d47935cf4dd47b2563
MD5 2b5ec60aacbc013649fb4eec13615d13
SHA1 c58f88c7444f37794e630f7623fc8896641597e5
SHA512 18725f49454b1454a4ec865916ea9c01afc1923d7b0a5cd391cf09bb008c783c97edcef47fe529d3f6999fbeeefe853bf84ef8fb60d3523e55c1cbaba4ef459e
SSDEEP 49152:BWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKFQ/lFTjN4:50zuNIoLm
TLSH
T1CDA57C3DA2BC00A9D8AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 433adfa11e92cd7baf3215c7b99e2b40f7c2b6918594165f2646170c7a9c07f9
MD5 38c15dee55614da13c41602b9783d0eb
SHA1 e0a6140185f02d4f1902b1150a61d7d3e075bfac
SHA512 185000677f1795d926500b3a3284b57e94be5e171b6dce0c4d3521ff92bdbf42ff7fa15aade0a0e8009751f0b89101568d89a03b7743ed561e2b2567ef52fc18
SSDEEP 24576:U1QT7EcpfxR+N5AWAz3ooiYtjMqbenQ/tbw/2Mkjy6Fr7g0oo:pTDxR+N5YzTfjMPQ/lFTjN4
TLSH
T12655B02EA7F855E9D17E86798A23C502FB727861033193CB42A0C17E1E7B5D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 bbab559ac2e331fa970b3dffcc332f82b252fcd20cb1982f8d8832ccdd4624e8
MD5 130badbc7f800fbb98c795812f965095
SHA1 834245733ff3a5b843097e05e28f237651e09d20
SHA512 ae92d16c5e84655e957ad743a7e5df8d99753eafd9c4618576e7fc902f33960853fb4a8287f0ea68c2a70d97a73d423faa53dccbfa5e27eabbb9b9ebb6a28f44
SSDEEP 24576:YTMdOz0FFS+1mSL6nQ/tbw/2Mkjy6Fr7g0o5:w0K+1mSL6Q/lFTjN4
TLSH
T12C75E17E636D14E5E53BC27D9A438906E67334620322A6DB0690C17D2F6BFE4397EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 1f6b01f9d4660e2437a1def0e9b062e208e6466ebc81a158f8d4b13e67d41891
MD5 f0ab5194cd9f535361343f550e08be12
SHA1 bedc16ad9c9e6f69d34aac8541293efea5395bea
SHA512 13a0ea8540b53d0622b1ccfdeea32dc85575f375b9cb147e55c6c150aa654c1618784d310a6674975ad362675a8b240ff9f1b15e5e332672b6ae3e37bfd73c2b
SSDEEP 12288:I4TTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:vDnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T19B55122D23E8B4DAF93752B48962414697327CA2276167FF36C4C23E8F3A3D44979B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/220-94-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/220-84-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/220-90-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/220-162-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/824-36-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/824-76-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/880-160-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/880-158-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/1036-227-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/1036-126-0x0000000140000000-0x0000000140141000-memory.dmp

Download

memory/1428-28-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1428-29-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1428-27-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/1428-21-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1428-118-0x0000000140000000-0x0000000140154000-memory.dmp

Download

memory/1480-407-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1480-408-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1480-388-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1480-398-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1480-402-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1480-404-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1480-405-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1480-406-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1480-409-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1480-410-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1480-411-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1480-403-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1480-399-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1480-401-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1480-400-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1480-396-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1480-397-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1480-389-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1480-390-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1480-394-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1480-395-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1480-392-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1480-393-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1480-391-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1480-380-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1480-381-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1480-382-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1480-385-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1480-384-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1480-383-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1480-386-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1480-387-0x0000021467DC0000-0x0000021467DD0000-memory.dmp

Download

memory/1612-242-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1612-129-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/1612-135-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/1612-138-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/1788-176-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/1788-376-0x0000000140000000-0x0000000140171000-memory.dmp

Download

memory/2308-166-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/2308-105-0x0000000140000000-0x0000000140156000-memory.dmp

Download

memory/2308-103-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/2308-97-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/2400-175-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/2400-119-0x0000000140000000-0x0000000140140000-memory.dmp

Download

memory/2952-412-0x000000000EFF0000-0x000000000EFF8000-memory.dmp

Download

memory/2952-377-0x000000000CF60000-0x000000000CF97000-memory.dmp

Download

memory/2952-221-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/2952-378-0x000000000CFA0000-0x000000000D3E4000-memory.dmp

Download

memory/2952-370-0x000000000CDF0000-0x000000000CDF8000-memory.dmp

Download

memory/2952-205-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/2952-379-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2952-189-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/2952-180-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/3156-77-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/3156-157-0x0000000140000000-0x0000000140164000-memory.dmp

Download

memory/3516-96-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/3516-13-0x0000000140000000-0x0000000140155000-memory.dmp

Download

memory/3536-74-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3536-61-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/3536-70-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3536-67-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/3536-72-0x00000000016E0000-0x0000000001740000-memory.dmp

Download

memory/3716-172-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3716-374-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/3976-115-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3976-113-0x0000000000810000-0x0000000000876000-memory.dmp

Download

memory/3976-171-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3976-108-0x0000000000810000-0x0000000000876000-memory.dmp

Download

memory/4024-167-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4024-373-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/4112-375-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4112-123-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4112-179-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/4256-148-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4256-142-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4256-152-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4256-338-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4368-93-0x0000000000400000-0x0000000000837000-memory.dmp

Download

memory/4368-8-0x0000000000A00000-0x0000000000A66000-memory.dmp

Download

memory/4368-0-0x0000000000400000-0x0000000000837000-memory.dmp

Download

memory/4368-1-0x0000000000A00000-0x0000000000A66000-memory.dmp

Download

memory/4608-372-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4608-163-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4660-355-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/4660-155-0x0000000140000000-0x000000014018D000-memory.dmp

Download

memory/5004-137-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5004-48-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5004-39-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5004-45-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5112-59-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5112-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5112-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5112-151-0x0000000140000000-0x00000001402D4000-memory.dmp

Download