63c21f810e6f20652741ca91cbf6d127d815fed9ad963dff3fbbf21ddfc145bd

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
Size 6.7MB
Sample261012-vcvdfst16m
SHA256 63c21f810e6f20652741ca91cbf6d127d815fed9ad963dff3fbbf21ddfc145bd
MD5 8916c1401868bfcf2c383f12e1b3e5ab
SHA1 f0eeca298a61a0c763bd42779442bdc481291641
SHA512 1c4652c8d20012a2c154ce6e48343dbf63d0efa52c179c45dd5ab95f3f5a99edd4eac334111f8255f0e267a21251e6bff9379a57f75c8f89b9bfa6c087b3b912
SSDEEP 98304:EB4BjfY7QDgILVjVoqcBjQ3JyxkCJqe8+tGfTlzNgaPJ:EBMBxrokCfazOax
TLSH
T11D667D207786C4BEE49202F05F2DEFBF445DAE250B6440D7A3D4BA5D2971AC31A32B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

bootkit defense_evasion discovery persistence ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1260	elevation_service.exe
5900	elevation_service.exe
3980	maintenanceservice.exe
1256	OSE.EXE
5240	PerceptionSimulationService.exe
1116	perfhost.exe
2800	ReFsDedupSvc.exe
1516	SensorDataService.exe
2180	ssh-agent.exe
896	AgentService.exe
4576	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 49 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\E:	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Uses Verclsid to proxy-execute a COM object 1 TTPs 1 IoCs

Verclsid is a signed Windows utility that verifies COM shell extensions. It can instantiate specific CLSIDs to execute malicious payloads under a trusted binary.

defense_evasion

Verclsid

T1218.012

pid	Process
4984	verclsid.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe

Drops file in System32 directory 40 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e1ec877f7465cd71.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_119046\javaws.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_380048692\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_380048692\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_1958298463\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_1958298463\nav_config.json	msedge.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_1728919560\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1872	msedge.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006d554df0695add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d06b19f3695add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000736233f1695add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bdb3e62e6a5add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000979540f0695add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{CC2083DD-BB18-47AB-AC30-B1D139A1CC17}	msedge.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
1260	elevation_service.exe
1260	elevation_service.exe
1260	elevation_service.exe
1260	elevation_service.exe
1260	elevation_service.exe
1260	elevation_service.exe
1260	elevation_service.exe
4596	msedge.exe
4596	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5784	msedge.exe
5784	msedge.exe
5784	msedge.exe
5784	msedge.exe
5784	msedge.exe
5784	msedge.exe
5784	msedge.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
Token: SeBackupPrivilege	4828	vssvc.exe
Token: SeRestorePrivilege	4828	vssvc.exe
Token: SeAuditPrivilege	4828	vssvc.exe
Token: SeBackupPrivilege	2800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2800	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2800	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2800	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	896	AgentService.exe
Token: 33	4576	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4576	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4576	SearchIndexer.exe
Token: SeDebugPrivilege	4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
Token: SeDebugPrivilege	4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
Token: SeDebugPrivilege	4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
Token: SeDebugPrivilege	4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
Token: SeDebugPrivilege	1260	elevation_service.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
5784	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 3660	4576	SearchIndexer.exe	102
PID 4312 wrote to memory of 5784	4312	2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe	103
PID 5784 wrote to memory of 4104	5784	msedge.exe	104
PID 5784 wrote to memory of 1872	5784	msedge.exe	105
PID 5784 wrote to memory of 4256	5784	msedge.exe	106
PID 5784 wrote to memory of 2604	5784	msedge.exe	107
PID 5784 wrote to memory of 4256	5784	msedge.exe	106
PID 5784 wrote to memory of 4256	5784	msedge.exe	106
PID 5784 wrote to memory of 2604	5784	msedge.exe	107
PID 5784 wrote to memory of 2368	5784	msedge.exe	108
PID 5784 wrote to memory of 2368	5784	msedge.exe	108
PID 5784 wrote to memory of 2368	5784	msedge.exe	108
PID 5784 wrote to memory of 3716	5784	msedge.exe	109
PID 5784 wrote to memory of 3716	5784	msedge.exe	109
PID 5784 wrote to memory of 3716	5784	msedge.exe	109
PID 5784 wrote to memory of 1672	5784	msedge.exe	110
PID 5784 wrote to memory of 5724	5784	msedge.exe	111
PID 5784 wrote to memory of 1672	5784	msedge.exe	110
PID 5784 wrote to memory of 1672	5784	msedge.exe	110
PID 5784 wrote to memory of 5724	5784	msedge.exe	111
PID 5784 wrote to memory of 5724	5784	msedge.exe	111
PID 5784 wrote to memory of 2992	5784	msedge.exe	112
PID 5784 wrote to memory of 2992	5784	msedge.exe	112
PID 4576 wrote to memory of 2872	4576	SearchIndexer.exe	114
PID 5784 wrote to memory of 3280	5784	msedge.exe	115
PID 5784 wrote to memory of 3280	5784	msedge.exe	115
PID 5784 wrote to memory of 3280	5784	msedge.exe	115
PID 5784 wrote to memory of 4588	5784	msedge.exe	116
PID 5784 wrote to memory of 4372	5784	msedge.exe	117
PID 5784 wrote to memory of 4588	5784	msedge.exe	116
PID 5784 wrote to memory of 4372	5784	msedge.exe	117
PID 5784 wrote to memory of 2920	5784	msedge.exe	118
PID 5784 wrote to memory of 2920	5784	msedge.exe	118
PID 5784 wrote to memory of 2920	5784	msedge.exe	118
PID 4576 wrote to memory of 5996	4576	SearchIndexer.exe	119
PID 4576 wrote to memory of 4120	4576	SearchIndexer.exe	120
PID 5784 wrote to memory of 5912	5784	msedge.exe	122
PID 5784 wrote to memory of 4016	5784	msedge.exe	123
PID 5784 wrote to memory of 4016	5784	msedge.exe	123
PID 5784 wrote to memory of 4008	5784	msedge.exe	126
PID 5784 wrote to memory of 4008	5784	msedge.exe	126
PID 5784 wrote to memory of 5372	5784	msedge.exe	128
PID 5784 wrote to memory of 5628	5784	msedge.exe	129
PID 5784 wrote to memory of 3940	5784	msedge.exe	130
PID 5784 wrote to memory of 3680	5784	msedge.exe	131
PID 5784 wrote to memory of 3680	5784	msedge.exe	131
PID 5784 wrote to memory of 5140	5784	msedge.exe	136
PID 5784 wrote to memory of 5140	5784	msedge.exe	136
PID 5784 wrote to memory of 4936	5784	msedge.exe	137
PID 5784 wrote to memory of 4936	5784	msedge.exe	137
PID 5784 wrote to memory of 4596	5784	msedge.exe	138
PID 5784 wrote to memory of 4112	5784	msedge.exe	139
PID 5784 wrote to memory of 4112	5784	msedge.exe	139

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-11_8916c1401868bfcf2c383f12e1b3e5ab_amadey_darkgate_elex_glassworm_luca-stealer_magniber_njrat_remcos.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.ccleaner.com/recuva/update?v=1.53.2083&l=1033&a=0&lk=&mk=F37G-N6IR-IZ76-52V2-YICT-5F82-JRDS-9BFI-SD8J&o=10.0W6
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x31c,0x7ffb0291c188,0x7ffb0291c194,0x7ffb0291c1a0
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1728,i,1761094460842773775,898541569288828966,524288 --field-trial-handle=2604,i,15724196418728066697,5965004370884076349,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,18032116447280634210,9162363541346085963,262144 --field-trial-handle=2604,i,15724196418728066697,5965004370884076349,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:2
    3⤵
    PID:4256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2228,i,16971943595152279962,1033556567760140326,524288 --field-trial-handle=2604,i,15724196418728066697,5965004370884076349,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:13
    3⤵
    PID:2604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,1076704363247778723,5470165724986492120,2097152 --field-trial-handle=2604,i,15724196418728066697,5965004370884076349,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,7263943832686044461,16846985265004530610,2097152 --field-trial-handle=2604,i,15724196418728066697,5965004370884076349,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
    3⤵
    PID:3716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4340,i,15353710598412185032,10976447910547313169,2097152 --field-trial-handle=2604,i,15724196418728066697,5965004370884076349,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
    3⤵
    PID:1672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4408,i,14402083307950853666,8820481478760305095,2097152 --field-trial-handle=2604,i,15724196418728066697,5965004370884076349,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:9
    3⤵
    PID:5724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,15158684392519903197,15610735766157813412,524288 --field-trial-handle=2604,i,15724196418728066697,5965004370884076349,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:14
    3⤵
    PID:2992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5500,i,16734561058292593472,4819973780812701376,2097152 --field-trial-handle=2604,i,15724196418728066697,5965004370884076349,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
    3⤵
    PID:3280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,16382746957013965694,8823179132832265974,524288 --field-trial-handle=2604,i,15724196418728066697,5965004370884076349,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
    3⤵
    PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,6116635920125181402,8025097172584166411,524288 --field-trial-handle=2604,i,15724196418728066697,5965004370884076349,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:14
    3⤵
    PID:4372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3360,i,2430545720109391415,5525279753571366037,2097152 --field-trial-handle=2604,i,15724196418728066697,5965004370884076349,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:1
    3⤵
    PID:2920
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,17004383800373847652,7734506600739182845,524288 --field-trial-handle=2604,i,15724196418728066697,5965004370884076349,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
    3⤵
    PID:1496
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,17004383800373847652,7734506600739182845,524288 --field-trial-handle=2604,i,15724196418728066697,5965004370884076349,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
    3⤵
    PID:5912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,1537069806235333555,16073055281059481932,524288 --field-trial-handle=2604,i,15724196418728066697,5965004370884076349,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:14
    3⤵
    PID:4016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,16254854479186796617,18103326589434467908,524288 --field-trial-handle=2604,i,15724196418728066697,5965004370884076349,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
    3⤵
    PID:4008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,12279582687481173601,3191763807534853430,524288 --field-trial-handle=2604,i,15724196418728066697,5965004370884076349,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
    3⤵
    PID:5372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,1831598661721159010,13211342878849652898,524288 --field-trial-handle=2604,i,15724196418728066697,5965004370884076349,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
    3⤵
    PID:5628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,6830622304569952613,2635007430613913386,524288 --field-trial-handle=2604,i,15724196418728066697,5965004370884076349,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
    3⤵
    PID:3940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3356,i,12556777779363047520,5224642677154573628,524288 --field-trial-handle=2604,i,15724196418728066697,5965004370884076349,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
    3⤵
    PID:3680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,1656133082392869068,1269195700309430496,524288 --field-trial-handle=2604,i,15724196418728066697,5965004370884076349,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
    3⤵
    PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,1698008139916650663,16003574360111792976,524288 --field-trial-handle=2604,i,15724196418728066697,5965004370884076349,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
    3⤵
    PID:4936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6864,i,5655379821343966430,8023187567295074698,262144 --field-trial-handle=2604,i,15724196418728066697,5965004370884076349,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,7740924528375323639,5929535123825847204,524288 --field-trial-handle=2604,i,15724196418728066697,5965004370884076349,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:14
    3⤵
    PID:4112

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1260

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4828

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5900

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3980

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1256

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5240

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1116

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2800

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1516

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2180

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:896

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3660
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4154726816-2055034831-2297277433-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2872
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 3036 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5996
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3068 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5372

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {9E175B8B-F52A-11D8-B9A5-505054503030} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
1⤵
- Uses Verclsid to proxy-execute a COM object
PID:4984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Pre-OS Boot

T1542

Bootkit

T1542.003

System Binary Proxy Execution

T1218

Verclsid

T1218.012

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 12ebe2d13f4b9f7559700fbfc16ef3b94b357a1abb4bbdb862b13c2a59603a80
MD5 6063065691db5220e751d7ebae2eb0ff
SHA1 8a62dcedfc914ec4bd5acc9bfcbdc0b80af63ae8
SHA512 323f497ea9a7c53da8044f2d6db15f79c9ddfab08afeea1fcfb50d7088698c8d12dc8b2325923d5fed9075830d44f162e50a01fe86485f2caf82976774b3c4cf
SSDEEP 49152:7b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnh+tgauhwbR3P8wT8:J3q6mjBRgaPJ
TLSH
T149D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 9bfe1c0e07fdbd71040215c2709d76990df2d20912c2f5c166677ed3901945bd
MD5 e11b0d09d3259e7622cc6c1492632cee
SHA1 f4b0ef28c79a9622f6b16ee7e26f1b5efd652007
SHA512 b685d1ac58ad1579ca9750548ade3d8c4d9a7802cb1295cd32c1bb0390b9e251a2c6d3458d62d319e33a28d0c8d844691d564cc7a3dd76eea5e67c938121845a
SSDEEP 24576:8XYfDtczA6+4ZAgayjhwbmY3MaReFeDvSP3b:7tcn+tgauhwbR3P8wT8
TLSH
T1FE75F128B3D408F9DD67823CC9A28511E673BC9547A0E78B03E4AA655F337D84E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 8cc9b062d44b05a9ed492c8f300708620a6d89f757141c9433111521d9ed5f7f
MD5 4ac53c8e549114837d535c37d1c57229
SHA1 d9f10e8160bc8931a7704497f2e2dacbbf58525c
SHA512 de81341e7b1e86d6f5fdcf729f6315500a5a0b5f644dc4235ab48b4b2d450992155f070a8ebea13500dd130aba0459fb8f2c99141d720ab4edd2c834488092be
SSDEEP 24576:w0Le5ji0hmxSrMZ+4ZAgayjhwbmY3MaReFeDvSP3b:wPji0Aos+tgauhwbR3P8wT8
TLSH
T1DC95AE15F6788335D073C0B9C5D2A69AED7134821B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 550f2c42402c3bad1478d8eae7ce5f4035ddb620605b42713d1ec4ad4ff7acb0
MD5 53c31a915ea440ac851d909238e9f48b
SHA1 104497953a681d95a38075d2dd3f8e76062f2dbf
SHA512 3eedba34ae2000f31788c52865f1ec726cc271d89529bb496af58bc3e88aeca21dd82fddf45db0d1d5cfce016f13cb2b3a1598ecb1cdf9a5c53aebac049e2b35
SSDEEP 24576:4a7/ezSC6vUyD/aqgrvWj6q8wyu3+4ZAgayjhwbmY3MaReFeDvSP3b://ezSC6vUzPv+Hjy4+tgauhwbR3P8wT8
TLSH
T196756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 020b039a2642f0b81573b860ff60030404e83b01dc2b1d946bb789b055cf2e4e
MD5 4fc3de224d01ba5d61bed7f4f11473b8
SHA1 575152787c5dc036e4a2dd342a8dd8a73ab7d5ba
SHA512 1f4d44cfcf0c27957724ffd98048b64e67dfd212ecb25ce4f9eee5f359995c2e15896fa87da2fa13aea5ef9b21dd875e7b6fc3d0c10b64de34cbc5fadea56647
SSDEEP 24576:qVbqPb88hv/l+BO+4ZAgayjhwbmY3MaReFeDvSP3b:qVO88hXl+M+tgauhwbR3P8wT8
TLSH
T12F559E66F5748331D073C0BAC5D29A9AEE3234425B318ACB1246D76C2E77BE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 1873d6cbb9c3c6eca529c8347365ca6b6ec3e00a41fd0040f1b3663f51d62c57
MD5 d602952ceed3be2e13194e412ba94fb7
SHA1 54a8ffb6c21b8a2632ab29c8d4f8ac0ef838652d
SHA512 cc389e332925d159d4661f2db23ee502c04656b1c5be6248252b5e8db00554327b9081616a1f4794aacd34c8d9b856ca50e5b7eaea70aefba297a99d06a6ef3f
SSDEEP 12288:dq8eH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:dqd+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T19A552381D34C98CAC77B0B308BBA09607699AFC51E86A504E4C97BD9CCF0DADC6B5395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 e87d56026d51b941796dcc7c580e11c8f689fd657e668b0ff9d7fb686ec62692
MD5 8c3bd77449899a156098407340bf936b
SHA1 d89751566e1ef52526523732e1804b7c8f1e9c5e
SHA512 7278693064fa9ab8b483d86a3c4e2681631065d11c05bd13ba5069a65e8e7db2a4aebbca8c00de4f5a5dfef1f019d7332811b3dc4b80786695de8b84f1af656b
SSDEEP 12288:9eBNUbTVO86UPeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bw:9JIUm+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1B075CF3BEE28FCD2C27E4DB85B918600A76278704F52A3CBD165830EDE235E54E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c1ce694f33ca10c57a1917257a516b18c54fa2699c526a814f4a3e0f1f5ca9fa
MD5 c1192fd87e9b42c7a35d8259b68587f4
SHA1 8c535ce48f56f27a949837d3d2868723e69b9a02
SHA512 6448f9e424dc8605595cccf8e5b2355404c74c62522cba185bf4810d87a410a7fbb9e01f1ddee6d989392fd9ee7dc21a0441867732227bdbe4153dd2bc51f65e
SSDEEP 49152:MQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THO:MQvGAdlCEL8c/WRNw5C6gaPJ
TLSH
T124266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 aae752f6cb0c623bb1885ac2fa889ddbe93ebb1b744d1379cc421b75a7934cfe
MD5 510f2d3a8ecc35f7b60a6549cfe6f96d
SHA1 4866953f81c17616bc683b0c2ab4e08684c50e48
SHA512 67f9ed198aa3491d1d998d00b3405f9d3df8ff32ec740542d9cd3464b8dbf1801cb33741fca52f4d1a9b0ba208f5a20cc2c79a4e5af8242ac0d6d441e1770505
SSDEEP 24576:EuewsAj8+4ZAgayjhwbmY3MaReFeDvSP3b:Hlj8+tgauhwbR3P8wT8
TLSH
T17885E031FA74E436C27B0DB21B36C712246CBE604F511AC3E3E89E9D99706D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a076d6e5bd919523ea0e7fba50d2f001f8eec16bb4e08a1c021c29229efa0085
MD5 dc38c7d52fe60a8b3427d40d3115ee4d
SHA1 316b0f84c29b2946bc1882b8d39904c99c01f575
SHA512 9c80def0d97f93bf8bc325d9c83e29e7c3cb3901fddec4f389f95f2cc806da5b7b5b4bf23f00e74121752fb4a9d8e774294e81dccd63bf794769d202193efb11
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHgax:xUEtQevvqc2W1cpV20I32j
TLSH
T170474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 432151ce0c7e851e88f2e4aef2b1741585709c735fa36801e503c1e989735aee
MD5 56dc0a662fe7ae8253ac66b99e41238a
SHA1 b5d89fdb5552d462059c469f5c23b2db06e0b31b
SHA512 e7f6de14025b5b692705afdeeb85d280c6422be60fcca8b7cc3040003c44226a3c4ff6cf47c79e3e90d715945acb6bf70acc6adefed543ea2be0b64b0c26774b
SSDEEP 49152:pCbRquA/m2yL5zQfFiV+XenmE3/zc+tgauhwbR3P8wT8:moqtVjnmGgaPJ
TLSH
T157D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 7eec043b54085f4ad35a332432ae197080919fb857904a080bedfc15eafde4d5
MD5 4ca2a281f42251ebe36e6855e538f491
SHA1 dd91708a5157949ceb8dfb44576639cc9f035ed2
SHA512 51724dec0d47ec6f3fd9a4e5ef66b51aa1b40c7b13f48684932a29b54f8e3bbd387d13789747f2d9ddf7ea45f21332309d1eeed6126245f0746879ca29c010e2
SSDEEP 24576:LAhGL6IFoiwtA5l7S53T+4ZAgayjhwbmY3MaReFeDvSP3b:LAM5Foiq5D+tgauhwbR3P8wT8
TLSH
T12E359D80E7F955D4F5B3AAB899B68570EA76BCA65E31C20F2150D21F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 3506f520ef00b50781cba1c28cd01045b2183b3c25aedf184c9f23fb2d0f6e81
MD5 f79180b9bc9591469250ed34eced597b
SHA1 6c73ab35b64ea9db8530445236924d63bfcfc440
SHA512 95c171e216e74f5f508967e080afae8d02ba8eb2c3adecc048de8bb726d1402e77ba4755540f9361819854ce541250456057a029ccaf87865b1fe852dfd66124
SSDEEP 24576:zwutOWY+4ZAgayjhwbmY3MaReFeDvSP3b:zwmOv+tgauhwbR3P8wT8
TLSH
T14575F14573A80CF9E9674238C6978532F7F2BC422A21DB1F57A0C75B5F33661AD29B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 523a31b51052a1bddbe99d54fbb0f6e6531f137424f1f414e76e01b2f68c2b5c
MD5 3c696a7f9379a55738576ed827674031
SHA1 359d6b2294cc94a4414418467f8ea0bdb7e30f90
SHA512 50686af6a0913687da581a431b26e4072182f96cfec3b19b19acfa29e517ed89fe0248a658aa71ecebd9e0ef73bf0a020d1a1b2dcdd937ac30cdd308aa2eedd7
SSDEEP 12288:t+Z1IyBeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:4Zux+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1F0651285339860F9D1A7033CCAF60A00E7B1BC922B7293CF9594679A5F72ED54E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 ca5209990bc2c1472c96a1fb59e03a674de8d6c6bf643062c9cc9bd1f63f5457
MD5 fe187222994881b2a00628d4178c79f5
SHA1 1770fdd26fa41f5632651623e7dac3ff8015a7db
SHA512 c05f1a6453776321054b596e2b76d8cf42b026fe0507338717910a167b7485eb169e50557b042f3ef8a829dea48da977f7f6d3986de0c0b850892b2cd517aff0
SSDEEP 49152:kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23US:7QRQyi36YOcPDLvw2gAf+PN3VgaPJ
TLSH
T189667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 4ac86eba58afba1c83f7333a59c77a2a9083ec97d0f5666718df1d446602e54e
MD5 280f3c7b19c80ceaace11888fad10c46
SHA1 2e9182a0b4a5b49ed9e0466d574769fc40b5c9b8
SHA512 be06993359cbf0a4bd38268b84643a911911652874a57c043dfd32356161c6584eb90fb98954b13ddca92aca00355d305e9ef76f59b581ecc086046caaaf8981
SSDEEP 49152:bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23US:KQRQyi36YOcPDLvw2gAf+PN3VgaPJ
TLSH
T146667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8d77bc44a0953a6ce9ee513a4b0eed9988cf74c60a56c62542dcb2b401010e64
MD5 ab9e6cd8cedfbbc475767dce84daff5c
SHA1 0e2b597b7e574eb0c21d91142e1a4a0db0b31c05
SHA512 0e8b928ee105b377223575efafc844a43d85f8b46b5cb8f8e33926fc29be2a05be79737e6c28368ddb765116bdbbe8adcd2cdf6b198a01588190932dee05daf9
SSDEEP 49152:X68Qg55nhkeWu7PNU3/s+tgauhwbR3P8wT8:BthTRc//gaPJ
TLSH
T1A1B54933B2F60099C44DE1769F4A873196D27C758FE0E3DB8545720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9036824b81202aeec30296206b044d73b4efdef5c88f70901a82d3a7a1710556
MD5 0e9d5fd245f674b8f7768ff42b843ef9
SHA1 46a5030981322537cdd57e4da27ba3a26f63ebee
SHA512 6c6710fe02145bc5bf00f1ca5833ad7c975b08a6b45b1d8bb17734c7762ccbab319929a02f859508252950aacc43bf62ee189e3b2e6fc5aa86c6b915f522ef2e
SSDEEP 49152:c3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99k:Zy5112gYy5azzVvU69nLKnhZQgaPJ
TLSH
T113167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 16a978b7238af6459a7ee950bc7c1a14debc4f1c0dd65929872f7baa0f07f82e
MD5 f98bfe4fb0a0bad0f055d105cf48342f
SHA1 b3d90fa6f72faa16a3737abf2220fcbb1de4f452
SHA512 51dfc4538a936017bd2055434e02fb4b905346e1da535fc1f24db1e31b78df2764f075834ada227616506e2b7ddfdfca312187799f957ae087868adb52281073
SSDEEP 49152:yB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glq+tgauhwbR3P8wT8:Au6JmIxd2ddgaPJ
TLSH
T17AD59D13F1DA01E8D06ED578874A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5e0a9d02313835852c712f0699c6c973ece66e6a86f704fde99e94fbcb92c06a
MD5 b1a5df8fc654ab1a892387e4ad661d92
SHA1 cacce79831d06d485a1087fc04dfec4179e5de3a
SHA512 3dabc823f0db0bdbf124a91ff7d210c9eef5150fd8e2366d3a181f9468cac1548d9a45c5c6a26ac3df4bb512a0a2a80fdeac033dd63d18519d895baa9645efde
SSDEEP 49152:x1hpsNoJpF1A67U44CwH7R4xG+tgauhwbR3P8wT8:xmifPqRGgaPJ
TLSH
T1B5B5BE13F2D800E8D06ED17887569632EA62BC460B35B6DF0A90B7961F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 45f72db1068144afc219f22ebaf7541cafe9404905eb4d62268efcad57aa70c4
MD5 f6d6062c839ad009872b6078ae46cfd2
SHA1 538c5e2a8067756d7e0980f586c372df7d76028d
SHA512 5cfa61e52f4b72791e77cff47b38b8e02f67a246652f23fa97ec1db6926a2aaf5b88d618ddb7f30ef55683a930be572b324c848f9daee2e2416651094060c707
SSDEEP 49152:9SuZQIY0Be2KkRVtOnks6NMHqx+tgauhwbR3P8wT8:T5dKqi61UgaPJ
TLSH
T15EC5BE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9d6501dd925fc7bb85c54bd250559248f9bd78bb19d123b6fb8684c322834641
MD5 bd617e7ff3bd0964a7c940d330cc749d
SHA1 f10f75817251e56b4ca004f6fe9451e2f7a99368
SHA512 cfb8c566a90a050b2b2fac8976c39b89224bb8abcbe1ff6fa68d40b0c4d29bbddaaa9d0430f5954e17f46264783d57db6b8b1a455dd31361626cbe30eca0143b
SSDEEP 49152:1htSn8EApI0figjgiDn0AP5w6+tgauhwbR3P8wT8:EX2iWphygaPJ
TLSH
T14095BE13F2D900E8D05ED178C7568632EA62BC160B35B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 52b9d265d94b7c4f071ea90cba801a8fe5aa8b801024ed3f377698c15b30df83
MD5 6ee0902f6e05f1ae4cc62483448dd1ba
SHA1 394c7d52f03aa5496ae31e20949e7ac32dcc30b0
SHA512 0607be427b3705609c9ba40e93b378393c3710a9557b90361d9ced617dea01b92be4040b058cee68dab428ffeec7714d6284a339f923ac98c8385993e7310f82
SSDEEP 12288:VUeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:V1+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T16D552380D24C88CEC52B0B748B6A0A607698BFC72E866144F5CD7795CDF0EED86B57D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 436aa1f520a154df99499f7c1b102f984b690a8ff8d1e4bccb07865e8b345a3b
MD5 00952941382e2fc03a4ab1626e39abd1
SHA1 3c2af83409e474a323dcece3ed6d53c82cad2832
SHA512 89fb8cf677431165d4c4bb56cd9abba3dfaa631ad43bf594956ce01d38659f43cbfb63b414e4290f0898a011316d1a731e0fcf6f562d22fe9f9783b29fb892b9
SSDEEP 12288:kFeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:kA+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1C5552380D24C88CEC52B07748B6A09607698BFC72E86A144F5CD7785CDF0EED86B57D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 9daf58685a931a55a89a377da6e277c3354bdafa13b7729d1c7266b028b6cbc4
MD5 acd4c429c31cd91312e80b40908112bf
SHA1 5b42cf5c27ca710b5c1b859ae872099127c25ebd
SHA512 c636a7d72cdd001d334f10cf6e2dd02d47011464acfed24492908dc17c97f86b1c00526cc31470eb750d5cbfaf2429295df41d52e7a3e0d2c74b6f480d551cc6
SSDEEP 12288:xHeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:x++4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T176552380D24C88CEC56B0B748B6A0A607698BFC72E866144F5CD7795CCF0EED86B57D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 c1cf544231f22bbc8adaa05156f10eacb6748060cc7358f1fbd61fbaa298d335
MD5 0f62ef6ff26f3d16d5529580dc051505
SHA1 036e4ce4aec30a25ac482076d595683c609b1e63
SHA512 b8b49bc894ed4af09770a9ee67edfc6211ea2573ccc7b8c34ff875a469dc3b9a10193ea281909f388eecefdf5312281243e8fe523a51c9b500f5a5e903416611
SSDEEP 12288:+VOeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:M+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T121652341A35C44CAC47B4774CB760520F3E9BED66F52A28FE6843B854DB0FE88A74B94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 442768ec1362f328c152cf5be518c6f5b465414be553ad1a3035ba8c304288b0
MD5 bdb5128d8495bfc33350349970d8227b
SHA1 988e5becb5cc40829bb0c6a3186184f5d7a7697c
SHA512 ca4a296f5ff285c2cd5358343f8f2e5f1bd5314ff4187dd85f77ae922f9c5cd8d9ff4887fda20bb1f513111f3182754bb3a18c358d1beaf69f25fd3365b37716
SSDEEP 24576:FfwvQk9RX6wkyAI9+4ZAgayjhwbmY3MaReFeDvSP3b:XMnYI9+tgauhwbR3P8wT8
TLSH
T14B95DF29EBDC44E5E1B7923C89B74606F6B178591B31C2CF129A53AD0E33ED45E3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 340c3fcd938f6aa95a47e652d31fcab2eb03a12cb8d5002a23896a508bd12b19
MD5 8349238343b630696fb05a0d4e7d2fa4
SHA1 a900b677b12b83b3390b1db38da3f9e3bf185377
SHA512 e865553407e5b020dc3626c15c67763ae61de961ef28415961c5802cfce1988b975e277f60d85c06d59d20da71e0b0d73a5cafa0cffc993c059cfa664f5e06da
SSDEEP 49152:PYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0a+tgauhwbR3P+:yySzP1gaPJ
TLSH
T121066C96A1A801D5C1B9C1B98F1BCC17FBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8feb6bcdc793f0251f57cd3a1ab50e41fd310e881304fbe1e156f2f78e96aaf4
MD5 c08f559a53d5d360884e0335db3f81d1
SHA1 c2926e091b98c4d07a5bc3e8c7cd211cc237ba8c
SHA512 6e83324591b7b220e05600473845c1fe3a8a5537099384fec4511d45898841ea59427fa1246682fbb9e2188947d178fbbd80221229b04f760037617e3ab8994c
SSDEEP 24576:m47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYw+4ZAgayjhwbmY3MaReFeDvSP3b:m47JUQjqirIhCnDHUPfF/q+tgauhwbRG
TLSH
T18065AE1DA3EC01D5E1BA827885154A5AEA71782E1F31CACF22B0937D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 87f6baadb0c0fac1ee0970d2305a8bfa287e67ea49f192397f1efc81a9eac864
MD5 285844897ff27adac3145891ad73496a
SHA1 ed457818337e08dbbbf8bf5490d4350f19e6bb70
SHA512 a7ccde9ef3704a949af218c387566316c2ce50cd01e7a54c5f5229e12f0dfbafa87d9051e3b5f68e697d2e9eeca8859c0b264a5817d1e4884d8c25d8551b06fe
SSDEEP 12288:rNsfAeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:Qx+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T1CA65F149D29801D8C06E1275CB564A40B3777C6597E2E3CBA6C0F67E0F71AD48EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 86e970e8ddcf15e5101b521987cb1605f2b0907634e95f2e7091d15dea1e9335
MD5 1bcdbb7aff1cc21dc1224328aaff238d
SHA1 02ce978f0dc6308e350f64ee035892511cebcfd4
SHA512 a3a8814416239b56a746d40f159265402db6ce88d25b352a22dd1ea918dd002882f7f28215615c37f6fdb37f5775b5b1a473b4f4cba144f1124d0dbb054d046e
SSDEEP 12288:GWIb9XFU3fDtmzl/nZzmWVB1LHjMmpdAwBJiLaRBA0Fih1wotsi:GWIxVUPDczFZzGmpdZYLaR6yiLJ/
TLSH
T17F4528017266DB4FC6A940322E33C5CCA7707D01EE45AF0773C98B3F9576659BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 317KB
SHA256 c69151c3c3933a730a67e2035dcfeda7e11a26781a8550f423564e9ec7822fbb
MD5 b3adca88ccc1bba86174b1da6130d3e6
SHA1 6df28511642363910bfac03588dbb32d68c51803
SHA512 e8dee55ad310c745e880fa8b79090b43a877b5cbf22187e772e618b53865a6d4120c513ef8229cd9269575112ba1676e5ca294302d55cf405958c0fdebafc597
SSDEEP 768:5J/T3+blToOlTPBlTz2+EQMxJSJ/TJlltblToOlTPBlTz2+EQMB/llH1kEblToOJ:51xMNMnnkttB0RnSMJi2
TLSH
T1FD646311B754F229C4B680779870D6A79B3DF023CF2243073BC91A99DCF32962A7AB55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0cb953c4-648d-4794-8925-16b4b549feca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0cb953c4-648d-4794-8925-16b4b549feca.tmp
Size 38KB
SHA256 47b9c7ac8d33f5791b40fd617aff21869b18ce685fa24e035d5a6373a6dbc88f
MD5 036c96bfcdeca9a6e28465b7f70d4023
SHA1 5373f17a494538832fd82faaedbb552e5be8c584
SHA512 e0937be5cf755cd68a08f5ff46d83b40ec919fe646430bf21d9e37dec07289b13a60b83534d0c18acbd1c9c539e80a6759175146790b23401d5d0f7e3c48e617
SSDEEP 768:zf/UxvxjgC+W329EsgZybNb8rBDOeRFZD1fTos7Rj6sMm:zyZj3+W329EPZSY1fT/R2sMm
TLSH
T1D703BF39B8E9AD334CF6E244724A7A83BFF414B399C9199849D85E0E0987BED1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6eddfc8a-676e-4a5e-bad8-8ff94bba78d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6eddfc8a-676e-4a5e-bad8-8ff94bba78d4.tmp
Size 38KB
SHA256 7df965f9987c9dd844e7cb3aaec28dd017b88ddac71eb9d3340e50dc73739d4a
MD5 a9869c9fc805c6ea60962d9faeba272e
SHA1 bc6ee5454cc2ad9210f8e6e8ad940b75c1c6a82d
SHA512 7d9538ae0323d439eb6a4024606addee7392d57b7a125f8ac0b96c68d4cee20deb83eacb4a26a8a51b1e30637ad378c9e9cc456325571920ceb724774ffb9010
SSDEEP 768:oE/UxvxjgC+k3bQdWgrybNb8rBEOeRFZD1fTos7RC6/+Pu:oxZj3+k3bQdtr3Y1fT/R1Ku
TLSH
T1BB03B039F8E8AD334CF6E244B24A7787BFF415B389C91D9849D95E0E098779D130781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9186d2ae-3bb9-4f21-bef5-575514b43c6f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9186d2ae-3bb9-4f21-bef5-575514b43c6f.tmp
Size 33KB
SHA256 bfe82bfdf47d4cb891db417c513b8d12bce5025b1a0d50b48a574e28c29ded50
MD5 959a873b7a3cb70ee39a02263f978df5
SHA1 2b7d356d98a56654c049f442a32ea33d0f73d1a5
SHA512 c5f8f68374edfb25c165368171dfc10ed099c139a329a014f0d708de23f0a534cdcba6aa214043594ab60d55a90443842b98a8e9410b20d2edd1065139c80aa3
SSDEEP 768:8zv32yEogZybNb8rBXOeRFZD1fTos7Rj6GJCbETD:8zv32yErZWY1fT/R2ICbE
TLSH
T1F3F29F35FCE49D334CEAE545B14A7A43BFF465B3E989198885D89F0E0487BAD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

05582ff3-5496-4b49-a86b-da015fa720d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\05582ff3-5496-4b49-a86b-da015fa720d1.tmp
Size 13KB
SHA256 41d399e818770b715b4711ab25083d9c9e55b0f20c6e53fe5f2eb61e9c902de3
MD5 4e65c6b27347603fa70fb6b3ea54b6aa
SHA1 12a312065974ee90e12aacd46762618bd305fc72
SHA512 60be92544fe419fb3151ecb6672b54b6bdc9cd2fe97a16edfba7d27aecdf0f68f1605fb251e5816c4f935338c9e9cc05f1fda6f31a3b7d054f744f7138ee26cc
SSDEEP 192:sxRZRiC6/frsw9lZgJVGizoA8pOg/g6+WNDLQ/qXZSroUOkLbvDj64GGwNIgDVHJ:sxRZz6/frsw9LgTYb/5w/1xiX
TLSH
T1F652C916A968AE7B4CCBE519F659BF27D7F51422B0901F44A7FC891C01EB6DD6203C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e796711-2520-465f-9204-fb8112f3c395.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1e796711-2520-465f-9204-fb8112f3c395.tmp
Size 13KB
SHA256 8aefc67065d6700a63c37d86e4066261c4835b7f336f93a35dc20b2bbaeed726
MD5 20ab523d0258a41ad0f15368d1368034
SHA1 139adfa8cc87e8a0305ae09f7b070295fdd920a3
SHA512 c38f3dd0d6081749d08488c2b725a0312b1717ce9bea56e38cfc88e2487c8c247de282312af2648523384d554836049dcfe873970c220f4e39e972b18f732001
SSDEEP 192:sxRZRiC6/frswFlZgJVGizoA8pOg/g6+WNDLQ/qXZSroUOkLbvD3S4GGwNIgDXHJ:sxRZz6/frswFLgTYb/5w/11iV
TLSH
T12552D916A968AE7B4CCBE519F659BF17D7F51422A0D01F44A7FC891C01EB6DD6203C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

292cffe2-07ec-4d6f-b431-fe9b50fbcc13.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\292cffe2-07ec-4d6f-b431-fe9b50fbcc13.tmp
Size 29KB
SHA256 70ce0c6973ee4879594d262f8187c4e09ec951dd76b04b6356ace537e0d4ebe4
MD5 26dadc9f0ed3fb34f46e5530569b9308
SHA1 d3aa13c4a4b91fdfae6c4420b656aee76ef435c4
SHA512 5ef3fa1d77fb1042be87ff9b007a2d29deb7ba48330580aa96915c0950332967a211adead0e31945588eb1613bca2dfa8be452cd734feb604bd68f189fcd7885
SSDEEP 768:SzYbkR7pLuLbxUWgasfA68F1+UoAYDCx9Tuqh0VfUC9xbog/OVY8w8WSPjroGqz3:SzYbkHEbxUWgasfA6u1jaT8wtSPQ/z3
TLSH
T1E5D2D97B640CCB7E4F804ADDEC1A7A9A6D6802CB96D8CD8047FE945C02C67EB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

51fb5538-42bc-4931-98e6-e4b91803d88b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\51fb5538-42bc-4931-98e6-e4b91803d88b.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005d
Size 92KB
SHA256 e8ba6dbfe1674e37d49c15ff69f239633bd0199ed689a64ab74988499122fca1
MD5 adbd75258da980f57858894cc5334d23
SHA1 11702cc430c861061fcd116e53735f60dca5778c
SHA512 35baafcd46c2a10e9d46d477da75485f0538296ba0ae70a4bca5967907e3fcf51666c0335e6421f3174d95a44e56e25a1c12e68f3e81f5298dab9a7d73e79740
SSDEEP 1536:5mIyd8ba1W/BAbaveqcAq8kXn6i0zfPLksVcpgUo4EgmugnF4+CfI5g+KU6QZClf:Xydcak8aveq/r5zfPHegUo4Eju+F4HfN
TLSH
T17293120D13758A6C574DF888C1AEA7AB24C3F7B77011C86E646633C6BE2C97C85E40A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 56c69d0cecaf4f92325b46caa53b2d9eb18828bfbd653a6f6cea83da341d747d
MD5 cc3e0092b9882b52fcc64759e5a692ce
SHA1 9189890ad7ce83641ba85a455499fee3c914cc98
SHA512 37f74dfcf120cd1eae8a637ce1c120ebf67fbb260aea64f2f262d44aa7b327acddc924d1ffb0556e5c973531d1a05bb5c86239c8419778ea112a2e98826552fa
TLSH
T14551C9047B44DA78EB78403B58D1D8C7B7724DFA81470C72021AE4EDA7AA3F679D06A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 01b72a62eff8745c2579f9f4c689e5222a22b236b11266ece11871bb5dddf766
MD5 520685dfb67cc090add59be7c7bc767c
SHA1 58af17bd7460b27b141db7c58a45df36a0987494
SHA512 97fe9052c5c427d128814a158f354b7f1f3b4163fd6d1f031b32d44b5df1a26dfe7ea3d11674f9e32f62e8f0244bcc3ffa83868d1fff57e03a15f0ccc6ff4433
TLSH
T1B041A3095B49C974DBA9003B44D0E4D7B7324EFD954B1C720269C8FD676ABF3B9D0298
MD5 SHA1 SHA512 TLSH

Submit Download

a15d4b95-eb48-42cc-8673-6509767d3105.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\a15d4b95-eb48-42cc-8673-6509767d3105.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.ccleaner.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

3aacf42f-feb6-4327-b867-8959ddea08f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3aacf42f-feb6-4327-b867-8959ddea08f9.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

9173792d-e98d-4d7e-9cc5-7fdc0fd71146.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9173792d-e98d-4d7e-9cc5-7fdc0fd71146.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

bd822e03-46a8-4834-b591-f1f80a049dd5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\bd822e03-46a8-4834-b591-f1f80a049dd5.tmp
Size 7KB
SHA256 0999dd619300ce825f39a6311d733a0b536b13a58ce6a6c2f4391adce2a1aefb
MD5 90a6f2066ffa4c6373b858f5525592b8
SHA1 2113e4d6115b8f0bb247d4a14e281685ce03c58a
SHA512 d981f7e3a549405fde6874d29df3c13c1c89434c4d67eb1e1d4a1c0b50eebc558736b49223f7d7926a35e38150c686445de59a1f2848ddd49e77a53e2e22306c
SSDEEP 192:DCIkHkukH23VaaZjhUgv7hGWlda1TNF/bLzfGaByhZXWuq/Zxm1Axl20FCiNT:DCILuN3VaaZbv9GWl0tNF/nD5ByfXWuy
TLSH
T1E0F178F787F5996DDF2153F0AA152E1FCE1A0824936C3C6A88D89F17A7E2470E140B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f865bd1c-294f-42f6-9b10-232bcf20e649.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f865bd1c-294f-42f6-9b10-232bcf20e649.tmp
Size 12KB
SHA256 ed2e247fbaee4d44203b6f69e353f82e3d84f750589fbcb30e695f45fd5f56a3
MD5 d48c598103bd6ede9ec1866f4a5b0a56
SHA1 babaa3175673485451e5dcb62856391cf40fa004
SHA512 0220a7fc9c3419c60d666e0f67ea9192439d4d81746e0794e43bc47899cbe3b1c4355885450cf60db6c5a6865131d41fbd0ae2e7a9d1320a9e58a0d5e3d8cf89
SSDEEP 192:sxRSRiC6/frsQK7xWGizoA8pOg/g6+WNDLQ/qXZSroUOkLbvD3S4GGwNIgVHJ:sxRSz6/frsQ6cYb/5w/11ib
TLSH
T16752D916AD6CAD3B4CCBE619FA59BB17D7F90422A0941F84A7FC891C01E76DD6207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab9bf282-eafa-46f1-b5a4-cdd79dd2cd29.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ab9bf282-eafa-46f1-b5a4-cdd79dd2cd29.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c4c2d58b-c909-4c2b-a308-39a61d96ed32.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c4c2d58b-c909-4c2b-a308-39a61d96ed32.tmp
Size 37KB
SHA256 6a7e580f7e44890868550d8b62b0ed1865d3e6dfb8b677d563acc74108273906
MD5 17ab891ef8ba878ad5fe743f574ca274
SHA1 c7981985cc41034ea76b4832b690c3b14c06c8b2
SHA512 5a4f0ae152123bd049b9595650ef1934d557af7739b04da268cd369e3d60f34071e469e2e399bec7fd217b5583aff1e117c7efe5ffb7d2c1ab05e2b3fa37bd21
SSDEEP 768:UYFB232qwgNEoglS8rBeOeRFZD1fTos7Rj6GJCbETD:UI232wErFY1fT/R2ICbE
TLSH
T1D2037D36FCE4DE279CE69785F2497A47AFE411B3C98899C8D9D89E0E00876ED130BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

01b842a3-d0f7-4648-9981-3dae45f0b267.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\01b842a3-d0f7-4648-9981-3dae45f0b267.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

66e1de90-862a-4398-9cd9-79c75101e333.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\66e1de90-862a-4398-9cd9-79c75101e333.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

b8494a83-fda8-4c17-b17b-c085ae3fa5ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\b8494a83-fda8-4c17-b17b-c085ae3fa5ed.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

e12feac5-1cae-44be-bc71-c87fb08e0675.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e12feac5-1cae-44be-bc71-c87fb08e0675.tmp
Size 33KB
SHA256 314b1572a0bde421fd730f669bcadeeb47f1f9a12042b1006d958a4d72d26641
MD5 fd649ae253634c82043f309362b172d5
SHA1 b19d02ea12833000f7efd0f33a09ce7da513fd13
SHA512 a00195350a86e213c3c4eb47770001e0afb5a02c12cbfaac5041a5cbe7c557c0fe8143f0e4158ffb8dcb3bbb2222d3912827621baee4f95ae931baee118fe7a2
SSDEEP 768:zzv329EogZybNb8rBXOeRFZD1fTos7Rj6GJCbETD:zzv329ErZWY1fT/R2ICbE
TLSH
T1A7F29F35FCE49D334CEAE145B14A7A43BFF465B3E989198895D89F0E0487BAD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ff6d1dca-d7f1-4fd0-8975-6be731f8be71.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ff6d1dca-d7f1-4fd0-8975-6be731f8be71.tmp
Size 37KB
SHA256 154b2570cdb0c5abc589f0a836897c801a8b1b91782520cb21ba5d8695913e18
MD5 269449303c47078df9d553cd997714d0
SHA1 fa4fee18f30eb2e4111a38495c11d1e7e464b327
SHA512 afea7c3f38e670faae398c81dacec8bb19349fb5ae68a803ebba0b581ea3e5a32e64ca58bef2b71e2a76d033635f5cccfcac6b71e2f9cd04633115485782a9d4
SSDEEP 768:z/UxvxjgC+k3/KbybNb8rpOeRFZD1fTos7Rze/+Pu:GZj3+k3/iiY1fT/RiKu
TLSH
T11503C03AF8D46D338CF6E244720A764BBFF415B39AC91A9809EC2F0E158B79D1307856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5de32639-5bc9-4cbd-ab72-4f9448c5b581.tmp

Path C:\Users\Admin\AppData\Local\Temp\5de32639-5bc9-4cbd-ab72-4f9448c5b581.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

e580eb7e-8abd-4c13-8869-3511678ffb51.tmp

Path C:\Users\Admin\AppData\Local\Temp\e580eb7e-8abd-4c13-8869-3511678ffb51.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5784_163592287\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.3MB
SHA256 869c6c4561953da92c0fc4e8fd51ad14cfa61ddf680f4fb382c8e39627359f67
MD5 5f5d3f51ae541c8d5def436cfe68e465
SHA1 ce624db7dc18fc71309a6399e7f5433b32a156ae
SHA512 563925cb83ea07d61ce8890c431df8e0fbc9e52944bfef4047882150bf02a848369de6929aaf105139674ea3ee1c1f83ea5e875ffb46b72dcc0d2feca5730e8d
SSDEEP 12288:9o7IeH1uV4yczAM+GfacpSURvwbmY32vUM0JXIIeCnAA3DueSHRp3bMT:y5+4ZAgayjhwbmY3MaReFeDvSP3b
TLSH
T196652351D34C888AC57B0B708B6E4630365DBF961F41A1C7F48977C98CB0EE88EB5799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 3ff0e4159fa0daac0a5241573143b0049c95348963fdddf301d40bcca9429806
MD5 e6379fbb0f2ababfb3fedbacc4e25c9d
SHA1 eb624f1c49c54e7b985405c97aaeef262685232c
SHA512 2de33477707e3fc685c951ebf2b1178245c0ea5b25beeaea3e5f994f72dc66386a97680a2a50c6ee71515cfabddac063360d006ee63972a4857548af1e5fd887
SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bY3+4ZAgayjhwbmY3MaReFeDvSP3b:Qgb4mBIBhGFw+tgauhwbR3P8wT8
TLSH
T17865AE1E22EC02F5E0FAD2B8CDAA4417D6B278161732D2DF1151426D2F37EE89D39B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 55d3a3e411093f122da42f6a632ff07614511b5545307119910d74b9b8d01706
MD5 834491bf78fa28f3286b77f82c494de0
SHA1 c71f21da8e80442b071ffd98895ce3eeedbadf4b
SHA512 dfea40e7fbe7e45b9805c0d6b121c68030fd88f1c0b0d0908543f78b59f3a2e92f3448ce324f06a03ac82fc6e1cdf254250b9e074f24756a365254d00ccefe67
SSDEEP 24576:RG88u8FpJqH1zzria7/mg+4ZAgayjhwbmY3MaReFeDvSP3b:07ZFPqVGa7//+tgauhwbR3P8wT8
TLSH
T1BC950165B7E401F0D47BD1388A864663F6B1B8250364EBDF06AC8B511F33AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 425fa5fee95caf771ddf702b8c0adbd4269b99ba0b503550cc009bdaa163bc59
MD5 e6d3970d06e64ca0df4836d7849c9615
SHA1 fe32b944d43d93c2cddca0dfb92731cb22190071
SHA512 60be51ac4af27a08091291f71b7e9a7dae09e883d7097389ded7927bc8d4ca4af79d7237e7899ebf09eeddb64427e5c84c0349d8e88a63445cbf0afaca6b6757
SSDEEP 24576:BPUr+NQk+4ZAgayjhwbmY3MaReFeDvSP3b:BJQk+tgauhwbR3P8wT8
TLSH
T1BC75E11F62AC18E5E67AA17C8A864715F771BC621712D2CF02D0917E4E73EE8AD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b2b8d611b291c0e2017bae3fef95605ebf5cc4c7de8722039b61971275e8543a
MD5 bcd010a2f09171c81b1c0f94b751855b
SHA1 34bea61fad6910968b7c8928038f089057241a9c
SHA512 65ba77b1fccdf98242a7b51d4b1abea8f85672142b1beaaf77504d206b5103e9accf82f96c7258ae97087edefb71e86ba8b93a9481bc6861bf6b57058577db11
SSDEEP 49152:hBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjU+tgauhwbR3P8wT8:CG05lO43bogaPJ
TLSH
T17ED5C06A62EC11F9D1BBD17CCAC64A0BEBB23815033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 815cc4efc6733747a5b618e57890f12b2bd9d49711472bb946d8c85daa182c5e
MD5 4f35ac22f4370d9dc5d5f772cd79b8c5
SHA1 f3f4110af07ef878f7fcd4ec3c76913939a53d7a
SHA512 45233d8c13c4cd9f336f4c4ce6a26205eb713856ca27d96f2d3913faacb8bb4508645c67b8f1a30c20bd1261f46c0bfec0577664f2a8f0f2991684dc5e075890
SSDEEP 24576:Efa5POZ3dpyWVM50JicR2hG0lasx2+47eidna+4ZAgayjhwbmY3MaReFeDvSP3b:ca5POZ3lJt2pasx2+ms+tgauhwbR3P8z
TLSH
T1E265AF5EA6EC00D5D579D17DC6834616F5B1382253329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e2434648c38c3af238dfca88984775feeda6238e068cf223facb75f5aa29dbe4
MD5 565ac00cac4bb91fa6e4a8e7f28267dc
SHA1 891d1d0e794d9bd8f3a12144212117c3e764109a
SHA512 b9cf5245e7e0876e2c8443340dc8746e6ee31121091aff1ac3738c1226a6c337c5ef4cc801714a1a65cb952fa534c337c6b9104e3bd2ed71fe9c81cd4fb0c0cf
SSDEEP 24576:SNcwHdjbyQ4nLC18lb/EOjowL7Fk4+4ZAgayjhwbmY3MaReFeDvSP3b:SNc/zEOVHFf+tgauhwbR3P8wT8
TLSH
T1BD858C1623E901E4E1BBE1BE89779546FAB1786517308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_1728919560\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_1958298463\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5784_380048692\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d628b522b92d70bb83b2332f6ac0069301ab328e92353b794c082b18916170ba
MD5 71b1a9b8c6bf468b224bf0bf4c95cc34
SHA1 280336f0aeb33b24bf224dd03f19fd01018ea651
SHA512 710c303b38e5804a50d567ea426cd5b1dbb3cc595e1cc34325b8b4b623850361ce69c5f0d7483400e97e929ff5137baa667261b3ecaaa1b0e5bc7be39f9e7787
SSDEEP 24576:szkNvNnaFeYhJNtmZBm2+4ZAgayjhwbmY3MaReFeDvSP3b:szMwBtOm2+tgauhwbR3P8wT8
TLSH
T1C155AF6EB6B845E4D1FEC6B4CE238512E6727861073293CB9290C13E4E679D88D79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 a6e38d87aa684bef816f916c6f7c90133700a42058040638e7756662b48aa8b5
MD5 2e948ec71d0cbcb4d1b6b309a5edcbc8
SHA1 f1bedc8911de33c3799789b5a77bde331d0fb15a
SHA512 c5c8c127b365cd5dfafaf49035c4e9407de68c2093744f80d291fb3b1978993b44f3e74bbd1685ad965b07c2f990236f6acb69685ef9e4441848d882cef26dd7
SSDEEP 24576:TD3FHshBIYQgAV+4ZAgayjhwbmY3MaReFeDvSP3b:TDVHeBIAAV+tgauhwbR3P8wT8
TLSH
T13685E17DE69C04E4D57BC2BCCA634A02E77138A9032266CB12D491BA5F77EE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/896-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/896-133-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/896-127-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/896-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/896-139-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/1116-81-0x0000000000960000-0x00000000009C6000-memory.dmp

Download

memory/1116-75-0x0000000000400000-0x000000000055C000-memory.dmp

Download

memory/1116-76-0x0000000000960000-0x00000000009C6000-memory.dmp

Download

memory/1116-313-0x0000000000400000-0x000000000055C000-memory.dmp

Download

memory/1256-297-0x0000000140000000-0x0000000140194000-memory.dmp

Download

memory/1256-53-0x0000000000960000-0x00000000009C0000-memory.dmp

Download

memory/1256-52-0x0000000140000000-0x0000000140194000-memory.dmp

Download

memory/1256-59-0x0000000000960000-0x00000000009C0000-memory.dmp

Download

memory/1260-22-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/1260-125-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1260-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1260-14-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/1516-106-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1516-97-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1516-352-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1516-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1516-367-0x0000000001390000-0x0000000001633000-memory.dmp

Download

memory/1516-365-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1516-103-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2180-111-0x0000000140000000-0x0000000140203000-memory.dmp

Download

memory/2180-118-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2180-363-0x0000000140000000-0x0000000140203000-memory.dmp

Download

memory/2800-93-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2800-86-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2800-654-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2800-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2800-85-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2800-656-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3980-44-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3980-38-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3980-37-0x0000000140000000-0x000000014019A000-memory.dmp

Download

memory/3980-48-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3980-50-0x0000000140000000-0x000000014019A000-memory.dmp

Download

memory/4120-637-0x00000188DBB30000-0x00000188DBB77000-memory.dmp

Download

memory/4312-1-0x00000000028A0000-0x0000000002906000-memory.dmp

Download

memory/4312-105-0x0000000000400000-0x0000000000AC3000-memory.dmp

Download

memory/4312-0-0x0000000000400000-0x0000000000AC3000-memory.dmp

Download

memory/4312-6-0x00000000028A0000-0x0000000002906000-memory.dmp

Download

memory/4312-7-0x00000000028A0000-0x0000000002906000-memory.dmp

Download

memory/4576-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4576-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4576-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4576-383-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5240-312-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/5240-71-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/5240-65-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/5240-63-0x0000000140000000-0x0000000140190000-memory.dmp

Download

memory/5900-359-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5900-360-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5900-190-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5900-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5900-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5900-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download