6bb06ea454eee78259c62ae55bd7947eb13c511130eb61466eaa1d02065b21d2

Analysis

max time kernel
150s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
Size 3.6MB
Sample261113-snretsw19q
SHA256 6bb06ea454eee78259c62ae55bd7947eb13c511130eb61466eaa1d02065b21d2
MD5 29fdceee7755ba481e6a8fe4e7784471
SHA1 e4c10cad409152ae637a5e1997a7722c11ff0962
SHA512 f485e495a8b3bf9c1a15cc9006a4c1e098c8cfb617a179f537e51acb89bec7154b9a22530c84ec5675d877172d6219d73c0a47c040756d9da34770e29988be0b
SSDEEP 98304:HnCG4h7FiRA7WkAbJbrCmIZDjNJpl90yryoBeVw:Ho7RWkwamIZDjNJjH6V
TLSH
T1D106BF21BDB18527C46303328D6EF67D316DBD742B3481C763CB3A5C29386E15A3A6A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4180	elevation_service.exe
2276	elevation_service.exe
5468	maintenanceservice.exe
4984	OSE.EXE
2724	PerceptionSimulationService.exe
2888	perfhost.exe
5344	ReFsDedupSvc.exe
4908	SensorDataService.exe
5568	ssh-agent.exe
5700	AgentService.exe
5776	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe

Drops file in System32 directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3185172e9600bb.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ea9e72488273dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000057f6cb038273dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000024900d058273dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000534d60a8273dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4180	elevation_service.exe
4180	elevation_service.exe
4180	elevation_service.exe
4180	elevation_service.exe
4180	elevation_service.exe
4180	elevation_service.exe
4180	elevation_service.exe
2276	elevation_service.exe
2276	elevation_service.exe
2276	elevation_service.exe
2276	elevation_service.exe
2276	elevation_service.exe
2276	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5388	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
Token: SeAssignPrimaryTokenPrivilege	5700	AgentService.exe
Token: SeBackupPrivilege	5344	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5344	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5344	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5344	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5344	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5344	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5344	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5344	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5344	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5344	ReFsDedupSvc.exe
Token: 33	5776	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5776	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5776	SearchIndexer.exe
Token: SeDebugPrivilege	4180	elevation_service.exe
Token: SeDebugPrivilege	2276	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5388	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
5388	2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5776 wrote to memory of 2768	5776	SearchIndexer.exe	100
PID 5776 wrote to memory of 3876	5776	SearchIndexer.exe	101
PID 5776 wrote to memory of 4336	5776	SearchIndexer.exe	102
PID 5776 wrote to memory of 4232	5776	SearchIndexer.exe	103
PID 5776 wrote to memory of 1756	5776	SearchIndexer.exe	105
PID 5776 wrote to memory of 4128	5776	SearchIndexer.exe	106
PID 5776 wrote to memory of 2572	5776	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-11_29fdceee7755ba481e6a8fe4e7784471_amadey_darkgate_elex_glassworm_luca-stealer_magniber_mes.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5388

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4180

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2276

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5468

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4984

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2724

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2888

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5344

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4908

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5568

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5700

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5776
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2768
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-696679853-3915825385-3233721679-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3876
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4336
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4232
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1756
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4128
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 aedf6fa699887e336f1e79f3a4f02134504fb4ad960facdc899814ac65f1519b
MD5 d9f330bb1154d7a4b8d5d7d6d7c4ab96
SHA1 19477276d4ad02e7a5f66a72dfac6c93a2d9abb4
SHA512 9cb190e6eba0119182f37569309205119a0f8dfb2c7fbfa17d8d673b0cacd147b700aca6fa57902eb562cb56e3d0f9683866f52f6a252d89ef0117ece620761e
SSDEEP 49152:gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnbkwduyrydeBebhws:K3q6HjB490yryoBeVw
TLSH
T109D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 ce449607d3ec61a3b151e386b730fa9bd7016f3577455d5504345701a066d5a5
MD5 e1e6ef5f41ce0434daa2be53c852025d
SHA1 52ae4468defa3e2a64475d601629ebf05ee92304
SHA512 89eb21558ef5cb55e9ea064e7b2d2c4858ae9b4d2c168a53ef38dbbc56dade3af4620ac47decc7cb79283b7dce1092b66622036a7b7c90026dc9f2ae49560dc1
SSDEEP 24576:gXYfDtczAskMP5N3ARyrZzSsXNbsdeBebhwc:XtcZkwduyrydeBebhwc
TLSH
T1AD05F12973D409F9ED6B813DC9A18502E633BCA14764E79B03E4A9261F332D85E3FB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 024f4a4a6c5ff28c4f9588c165a1fad7beb50ab0ff88cac72f96584ed28494e3
MD5 e1dc1194a33bd414a5d3b148b8400bd0
SHA1 26a9f8ef47cf1f1ef247006693fb8a4ec03463c8
SHA512 7184b041d183cb217e403d2da357ed1cbd7f65c63744cc07fee128cf4fbb2f6835c47f4413523d7355f3bc4db38f8d2f8db1105107616186852210b0399d3bf0
SSDEEP 24576:n0Le5ji0hmxirMzkMP5N3ARyrZzSsXNbsdeBebhwR:nPji0AcekwduyrydeBebhwR
TLSH
T1C7359E26F6748735D073C0B9C5D2A68AED71308257308ACB4286D77C7E67AE6863B731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b0fc722a503d42b06df38b4f7c33e7fb5eaea14784a89ff7e4c7698c46b2c98c
MD5 09b3a06ce26df5a214421ef2b8c3f7f7
SHA1 6826be4d98277cb604677785aaab29657c852d12
SHA512 1be9257cdcf70f4d8b843483dbb1085621d41d88c192af1618f79a0bc1ccfe58659a22487ce2cc695461ba996dc50207663fe2fb550fc17b1d2e5175b471f840
SSDEEP 24576:ha7/ezSC6vUyD/aqgrvWE6q8wyupkMP5N3ARyrZzSsXNbsdeBebhw/:g/ezSC6vUzPvxHjyykwduyrydeBebhw/
TLSH
T1D2755D15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 8d7ed5253a815efdb10863c2d3792b553ae9a69a58df8f877489b4f0187823c1
MD5 448669a54fedf22a0bad2229279407d0
SHA1 5bb3f7013574095e1558c1270bfc50f63c7a65ec
SHA512 67f0f3cade608356f0e580d305eb237bf41a15c4f691c5a08c43edc3504872114d60b0e84dd026ab9a225f25dd84341dab49e436ceffb71099bb69ab939c38a7
SSDEEP 24576:lVbqPb88hv/l+6IkMP5N3ARyrZzSsXNbsdeBebhwr:lVO88hXl+3kwduyrydeBebhwr
TLSH
T173559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 34a3d9a447895e4c9a5b3174c2e3810c7894dc82511fd1525587ac25989a5997
MD5 e16ef8f7566bf96f74af05bf165cf9d6
SHA1 110e6260f6833a5811d336ccd0e0bf8710b2acfa
SHA512 b31576cc0d488e7edb3373d3d56bfa571a23a2aec86932ef9e23e5aee7e280e421f50b0d373bcb46348982c60a021cfaaeeef65d70b6da63887fec85f3b580e4
SSDEEP 12288:1RfRgpMDrvBNGopBRwAIXVRyD3PZaoSTgXa4bpigIeBeb+5atOXl:1RfkMP5N3ARyrZzSsXNbsdeBebhw
TLSH
T1EFC42323A7DCAB02EFBE503601DCEC4214518DF2A5684E5F62DAB63A503C49EED27713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 ba5b96208f49df779f6822b4bed7ced17d74f632b2e636fe1186b8fc420bb0a1
MD5 ae09d713814307a06bd9250b95c5fb74
SHA1 e46d419c339958e69bad0b0615e62da10ffca49e
SHA512 1b95e9d90db9aa44f673e8452642520c686cfc27c142910e449d9c3b3701ab6226e4df04ebe6c687a38057584133b7ab8481b2c0f5600f36558fb33e65cf686e
SSDEEP 12288:ZeBNUbTVO86UgRgpMDrvBNGopBRwAIXVRyD3PZaoSTgXa4bpigIeBeb+5atOXl8:ZJIUgkMP5N3ARyrZzSsXNbsdeBebhwu
TLSH
T17205CF3BEE28FCD2C67E8C795691C600977278704B22A3CBD165C20EDE235E55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 244baf79b6fdb86d6f2f249da7c33790daaa20029cc21f8475ce63543c24bda7
MD5 3a6a6733682bd84d531a44df82c4ed70
SHA1 5295fe3aea63d25fae4dd1ed927003028432fb37
SHA512 4f72d436474b505c23f2ddf0ee3ea7ac49bb417c5bf8c6cc48450590a136b3fef8b5c6e03be79a0e29c758f31cace58bbb8b2a054fc33b4cc10e23451ba308d6
SSDEEP 49152:VQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THJ:VQvGAdlCEL8c/yRNw5C590yryoBeVw
TLSH
T127266C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 155bd3a8fd52db77dabcb7315022cfd7a1918ff998f2b02c0a5632998bf9bda6
MD5 6f55364a6552c8e03f353501a3ec08e6
SHA1 1af0a2431f069629669e63e76a8dcaaca3301fda
SHA512 cd60130890752712c89e51fe0c4f5cac917025273f861c5ffcd1c596fea36a3b34628e58f316a480c11808830173c356ca7bea9c5b6cd843f823c92af330e7e7
SSDEEP 24576:odewsAjukMP5N3ARyrZzSsXNbsdeBebhw:oljukwduyrydeBebhw
TLSH
T13415E031FEB4E432C7BF0DB21B25D706142DA9604B611AC3E3E89E9E59342D22777A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 27f1f92a9a410be2f337c7a8f74e69fb2e1b86d4851087090aeb42aebb024335
MD5 025203654606dff8394e5ff2b174640d
SHA1 8c4974f484fe0cb9e47b5b8c9ab56749eae5979d
SHA512 c2d92a3aa746fcae95f076e511b5312a9fc2ce4297994bb0bbcc84d15f9d5db4697e232abd2153b3c5e7f6f01872d0e2a6ef37aac7fcfa64b557a3843c5df298
SSDEEP 196608:VUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHWH6V:VUEtQevvqc2W1cpV2EI32W
TLSH
T195474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 4ff86a590cbbc4d4f81ffff50d8a154355e45993943f17a37252073d8d048fdf
MD5 4bf28e6e03e2941a5d3fd6aa1ad03dcc
SHA1 ceabb0d4fd487c5a08b887c5f5b76950444151da
SHA512 1fea2647043aebb4c2d7be21a27b97812f54bfc2150e3f9c2a5cdf0c7c2969227e7563a3d3cc59d4d6864de4919962cc95bb9309fc4831b66ca9980bf9b1a1f8
SSDEEP 49152:yCbRquA/m2yL5zQfFiV+XenmE3/zOkwduyrydeBebhwr:XoqtVjnmd90yryoBeVw
TLSH
T1AAD58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 425e11591896e6e3a8b1829d05dd69afa4925ebcf2276ad943e309e196a44d0a
MD5 369742caddbd5b8ec21520c5e6f98385
SHA1 ef3aa54c1006a0edad7f0447ae2b3f7533d68a33
SHA512 1d2197d178424c8fcefc78396a48a6b0f24c5dd7a1efffa533cc5df30ce48ef1598c23763fad045caeb99fd9426b52b91f62db94047308e7d664b33051ca57a4
SSDEEP 24576:fAhGLJIFoiwtA5l7S539kMP5N3ARyrZzSsXNbsdeBebhwI:fAMyFoiq5tkwduyrydeBebhwI
TLSH
T16C35AD81E7F955D4F5B3AA7899B68571EA72BCA65E30C20F2160D21F0E33E409D25B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 cdabd95b18ade04cc816f5af6547c1999acb926a70b2a85de55439912cf9c0fe
MD5 4806c48569306103df631016bc46a106
SHA1 0c11c27ae37351a19af82f7782e4222c057c0776
SHA512 e362db59eb6d2c42868bce8fad660c2b60a92847cb04d9097c37122d4cdabf9b86dc705512d6bfa5b8f122554b6b92a0a85237af8937399341f169cee25c86cf
SSDEEP 24576:7wuoOWSkMP5N3ARyrZzSsXNbsdeBebhwH:7wDOhkwduyrydeBebhwH
TLSH
T12805F14673E81CF9E96781398597C532F7B2BC522A25CB1F13A0C61B5F37261AD2E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 fdf7cde1974836aefa38444ed39e0009144486033beef14a4e56043b2ec289ec
MD5 19d4e3a65e8df0b619780d48bccf3bbb
SHA1 9e8ddf0272e4dc74d8e9839343567ff0f7210efd
SHA512 947920bb8ef41fdaeaa2badb67bd59c91b4732f3fe6ed140eff2263cb120538f0cc654f5a9539dbeac4db23dea74e28c269c4c41e09c9bf6879827bdea048791
SSDEEP 12288:fBZ1Iy+RgpMDrvBNGopBRwAIXVRyD3PZaoSTgXa4bpigIeBeb+5atOXle:pZurkMP5N3ARyrZzSsXNbsdeBebhww
TLSH
T1FDE4121733D872F6DAAB513989E49902D3727CF2233543CF1265622A1F369CA5D3B322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 c2cfad8dc4989ec115c5eeb3aad8f7a102373d10432b7b9405e0e74751bc2fe6
MD5 58fad52b1027290c8c0ff31bd61f0ec5
SHA1 41a72a444dced3535627fd6ceebc6d0aa81f7227
SHA512 880eedc97423def5fd4b579447d3cc1195e93fcfd877d94f9b80db30bff581c66ff9aa16d6f8d1db3ea912fc358b0b66484fde74fa55e84906ffe704127fbdeb
SSDEEP 98304:OQRQyi36YOcPQLvw2gAf+PN3E90yryoBeVw:VQyiKayX+PN0H6V
TLSH
T1F8667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 706033272cb9ae77fccbfc9a82db8475c9ffdd9e9c5d51ad60062dcca7e2d69e
MD5 997e4b3cb9d2ae1595eab899e7701795
SHA1 a5c199d1986fe1cb6e4e51459936611caae01223
SHA512 06a9fd70e3f2cdc25d88d703492cc94da4e6a75b6867c3f5702d7a2a5913844bfead911bbcf823bfddf0fe5023feb100108acab1985310e3fc32b238835f14e4
SSDEEP 98304:VQRQyi36YOcPQLvw2gAf+PN3E90yryoBeVw:sQyiKayX+PN0H6V
TLSH
T131667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 629bf2a1dffdc7dfc377943bf2c46a7433fec56262557242a63d67cffa43b33c
MD5 7a6d167e9d3be7a8e11abea03702ed5b
SHA1 3f498c7a486309f34de1a5bd452e15bd87845e1a
SHA512 19be7e4520847d2dad6e1710d4c6542e64d48400de5b34ec152c1f8bffcf955b926f5aa0a7cccc6bff4be333f3d3079d361d183f75fb89333515d87dcc3f13cf
SSDEEP 49152:X68Qg55nhheWu7PNU3/ekwduyrydeBebhwP:BthWRc/e90yryoBeVw
TLSH
T177B55A33B2F60099C44DE1769F4A872196D27C71CFE0E3DB8551721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 14a4a9bdb7f3e427c37009218f5d59614be6bd2056403a11eab4ac6e0bc902bb
MD5 38c29a4ae93768d9af6359439ce81420
SHA1 243c222a5f427f3994e57402193b327c72b9a163
SHA512 ef46f206140a72ba34e4512f0a096106af7e083ee5a68ff101ba38e297b55dd2085d46a3ae00a2a04a8816d1fa480102250ec448b832bd376ae0bee743b90770
SSDEEP 98304:Vy5112gYy5azzVvL69nLKnhZf90yryoBeVw:4LIHmWhFH6V
TLSH
T145168B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2a1c809d66824e1ec9e596be59113af8b4d396f10f35b6d562cd432228a8059f
MD5 b44c11e9116891da54c28e8380b992db
SHA1 188050dc4e679f894e8a72a5b42251c9621b8307
SHA512 ffc0bc84562d45c6ed33c414d561c324edc790d875e81d83ff6c9d125b32f1a51b26e171a302892cabe106dbbdb1a1d0ec4c760b88980545d1f2ebf8d48a61a2
SSDEEP 49152:FB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glckwduyrydeBebhwf:ru6JmVxd2dc90yryoBeVw
TLSH
T1B0D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6a122c4e6bd330669305dcd5b92d9303dff8c8ed5053f4eac12767f13725b07b
MD5 2690abe17003799b99feaa6d62aa799d
SHA1 0c91882e9187f8b50f0326741ec7ddabf8973752
SHA512 a7dc9e7a689e8e4aeeb04397bd4ecdb2334423c022a9f7b827a911f52b1284bc45b427179b0bbd51dca00aac271765cd18e37dc72a29d71eaf30ecd0f82c1273
SSDEEP 49152:q1hpsNoJpF1A6UU44CwH7R4xAkwduyrydeBebhws:qmifPbRd90yryoBeVw
TLSH
T102B5BE13F2D901E8D06DD17887569232EA62BC460B34B6DF0A90B7961F7BAE45F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f9ce52ebd6cf4c31e87048eeb6f680ed21f6376dafac3a5f897dc9607922a159
MD5 fe5997b1a3b05284227c831fa9f3e31b
SHA1 4fc42402a79b2cd9b816c8c919552d3b4d87ac41
SHA512 b04221670b2d3275adef0a8abb88a1f6eebc5c66bfbf7b36dc858bcbcf8db20ca0a8c1b5a83221b46c20108e8cd6bf0045fdd4658e54aa9971f3cef359829c18
SSDEEP 49152:zSuZQIY0Be2KRRVtOnks6NMHqrkwduyrydeBebhwB:x5dKTi61r90yryoBeVw
TLSH
T1AEC5BF03F2E941E8E0BEE67487659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e0871c903f8fb3452273670827e9039efb87b23b4b923fd005a93b979880428f
MD5 5e7a6575af0d76e90e37d176ab45be6e
SHA1 62488adad1590a2d0aae2ec73cad8624c3dcd489
SHA512 8ff392a9bc83ec2f27e9b1ffde7fbc4f9ac39a0bb0aa9d5955bd65bf6d7d779a72eee11732bd0f71bf10abb8168fb81dc1ba2b4ee352668c4ad89da6de2b2021
SSDEEP 49152:yhtSn8EApI0figngiDn0AP5wskwduyrydeBebhw4:zX2iyphB90yryoBeVw
TLSH
T16995BF13F2D901E8D05ED178C7468632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 b8f14e5dce72d8703011dab785e5b402834a122770d52bf4a2136889fdacf316
MD5 be42ccd510f6c2fde658bd6c67e3c01b
SHA1 a4d3d8d4b5bb1ea3382cb7625382de5a9fc684ed
SHA512 7913bfe258fd735e2e8a2be8f56d1d97a72352b4c00cac24a4bbe8c21e4d1363f1629eb22ca47f936245b39c471af3ae3624b878d938a2f31f84d39151f78ccb
SSDEEP 12288:h3RgpMDrvBNGopBRwAIXVRyD3PZaoSTgXa4bpigIeBeb+5atOXl5:h3kMP5N3ARyrZzSsXNbsdeBebhw7
TLSH
T119C42323B7DDEB07EE6D503201D8E94244118EF3B62946AF73DEB13A603C49E6D2B611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 d34fb0b640c5f0edc1e9ad3fb336d766f5632a766573090fc15ca63ff90a017d
MD5 480506401e5482c345bb6ccebbb35f55
SHA1 32be4e3d06b05f702071bb6ee2109527e3867875
SHA512 565ca379e6c32426a551df3a4d64fb8663c6c0341e79aafc1562388c9adcdddee37bf112290bf50436e4e3c86843ae32619979efeb51647c8e32b69867ba30e2
SSDEEP 12288:W6RgpMDrvBNGopBRwAIXVRyD3PZaoSTgXa4bpigIeBeb+5atOXlb:W6kMP5N3ARyrZzSsXNbsdeBebhwh
TLSH
T128C42323B7DDAB03EE6D503601D8E94244118EF3B6294A9F73DEF13A603C59E6D2B611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 585a8057cb60bacf20c9fc775f739e48ce1e56558166779feff1d738e9f6c952
MD5 a52049787f1dc47dd89c48721bef41ee
SHA1 982348b26a0f205ad0209595751dcb96a44dda3b
SHA512 a3d4e065f9f6c94de105243ade4e875237401ea39bb069b92c988e1aabeac7c82683b5cc043280d35b678cf8db37189e06592d43028e99e8ae227ddb90834baf
SSDEEP 12288:N4RgpMDrvBNGopBRwAIXVRyD3PZaoSTgXa4bpigIeBeb+5atOXlb:N4kMP5N3ARyrZzSsXNbsdeBebhwh
TLSH
T13FC42323B7DDAB03EE6D503601D8E94244118EF3B6294A9F73DEB13A603C49E6D2B651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 b68a393f43256bac71d909a24562b9f920eb13dd04a088c418740d7f945e0bd0
MD5 f46edcd7e253c319115f7453a0828c18
SHA1 e680d8d22440402ae4571cc21c0b5c5c92f5cc81
SHA512 c9c92283101a5c18a7d83e9501373be3ea840a6f985268b74e523072b4a85a38424ac59bae6131dacbe8d0803e4dd50f059b28fb901dc35662357051b23834f2
SSDEEP 12288:KVdRgpMDrvBNGopBRwAIXVRyD3PZaoSTgXa4bpigIeBeb+5atOXlc:KkMP5N3ARyrZzSsXNbsdeBebhwW
TLSH
T10ED4232373DD9782DD6ED03685A8D8029171BCF2A7354BEF6386762A04382DD6D3BB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 b63f02a68691c30c3abe741a6cd79a0f8d79bbf0626bd86fba534d98e715e7d6
MD5 1a07cf0b43d376e2dff105b12dfa40df
SHA1 fb26a8d62a582a03be21c2e3550a613514db6151
SHA512 ffb7dd628143fa24a5e6ba5a1779ff375d93164ad19bcc3051d9734030fe10cce08cf2d1b535c0f5736d14642c84957d8f0eddb72db859468c381efc869b147d
SSDEEP 12288:VlRgpMDrvBNGopBRwAIXVRyD3PZaoSTgXa4bpigIeBeb+5atOXlN:VlkMP5N3ARyrZzSsXNbsdeBebhwP
TLSH
T1FDC42323B7DDEB07EE6D503601D8E94244118EF3B6294A9F73DEB13A203C49E6D2B651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 d4ad3925697bac31bc95047d1bb831034cceb5987d024a24469d1046472df9fc
MD5 b2dcd5056db5ac8c601ee14c724ca1df
SHA1 7d6cf22bd7631453c3a71e0e35b916ddb4e20034
SHA512 ba028b8e2292d6d4f3128de58819053782b872b40c558bdca0a62c1491317d3b9cf584cd83a9ed8c179b31351c9725f67943fbe6c3b4e073d15c50d546cc06e5
SSDEEP 12288:EmRgpMDrvBNGopBRwAIXVRyD3PZaoSTgXa4bpigIeBeb+5atOXlz:EmkMP5N3ARyrZzSsXNbsdeBebhwp
TLSH
T113C42323B7DDAB03EE6D503601D8E94244118EF3B62946AF73DEF13A603C49E6D2B611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 1d85cfbc67e17d4e52b47e872f52881d028a1c91e1d1d086b183d068fc803938
MD5 42b90e4922b6a37e7b7a92fd6311b5b5
SHA1 5ecc5dd2548c4cb00f14d964be4a3332a59ed85c
SHA512 e23cd872b0ed367120180100bb4afad39f5ab7986e6664d874bd240f57fb0531a7125ad452acd3c86bb72fe8c19d5168aac66d81108cdd2de7e65c5b9a226e08
SSDEEP 12288:ECRgpMDrvBNGopBRwAIXVRyD3PZaoSTgXa4bpigIeBeb+5atOXlL:ECkMP5N3ARyrZzSsXNbsdeBebhwR
TLSH
T130C42323B7DDAB07EE6D503602C8E94244118EF3B569469F73DEF13A603C4AE6D2B611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 a9eb94360ef7babad0d993cb50099527521bbf8ebd3fd57651fc25b4b7305730
MD5 18ca807f7b27d40dd2b972d52e7921ae
SHA1 9e17215b226369c0295c67527a978537dc86a9a4
SHA512 7c6ff48a722e88743c60dd5bdbba0e2608e21937a03ffff6aa267b90a86d70fbdb983b9cf80e3bc42e01f0aff6f4f1cf3ce9161422a13a7448eb5568d9aae726
SSDEEP 24576:3ZMSzFVSOakMP5N3ARyrZzSsXNbsdeBebhw1:3ZMSzf2kwduyrydeBebhw1
TLSH
T1350501A5B39019F4EC67813E89558906D6B27CA60B70C61F13E8362B1F333A11D3FB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 6330793295702989ff271a114d9b0caf03faa17b394f0907ee01eb729a7e4b6f
MD5 405ffffb482e8f84de020dc4a93f86c1
SHA1 d85b10a7202180d72a014d4d9dc06f0328cd9070
SHA512 bee5e9ab210aa00059881989d68cfc2aad9ef5bf868d994ebc44c05ee379ffc1eba3d0172061b92694996a4054e41b2cb116e9a83850e419e029ab8a9ac12d46
SSDEEP 12288:g7RgpMDrvBNGopBRwAIXVRyD3PZaoSTgXa4bpigIeBeb+5atOXlD:g7kMP5N3ARyrZzSsXNbsdeBebhwR
TLSH
T10DC42323B7DDAB07EE6D503602C8E94244118EF3B5294A9F73DFB13A603C49E6D2B651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 94bb37d69faf4172f1c1829ecf390ab8acb9eb21f1d3e82bc3ae50931d9e63f3
MD5 fa84de25a0b1ca29c54c5e3dbd69dcd2
SHA1 66ecae87ab668922364dac65a0e850ad31533e3f
SHA512 d2171c141673da829ad9340436f8234613d3f0cab9601d5d80171128702a88ebf040dd51db30633d94e502ac19b00937d5dfc425fa7145eb0c415e639eea3275
SSDEEP 12288:VvRgpMDrvBNGopBRwAIXVRyD3PZaoSTgXa4bpigIeBeb+5atOXlB:VvkMP5N3ARyrZzSsXNbsdeBebhw/
TLSH
T139C42323B7DDAB07EE6D503602D8E94244118EF3B529469F73DEF13A603C49E6D2B611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 27e2b71aad44c9de85d6ea109c43c705d7791e87a8380c09743dbf499c1287e8
MD5 9c6a60c253772b2a028ade6089a52be9
SHA1 46caf79fb008170b54474254589748fb80389cdf
SHA512 ea1a001eae2e1e8311576e0bebe7294c99e20bf3d90ee3189607aef3ddeb1b189dae19ee5ff183eb9bcbde9f65a254502c20a8cb7d0fbb87c4817e8d7d959128
SSDEEP 12288:TyPz5L8+RgpMDrvBNGopBRwAIXVRyD3PZaoSTgXa4bpigIeBeb+5atOXlR:ezy+kMP5N3ARyrZzSsXNbsdeBebhwf
TLSH
T174F4121373E531F9D97A913988915A02F372BC7247248AAF13A463362E376D55E3BB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 0cf7449d7d9b917181fa51cf7e5b3bc5dfe34e1c2717297618edb47f66e8be7d
MD5 62fc15afd8fa94b360719c9159806093
SHA1 384fe7f8384326f87e34b0e8e0483943c56b4033
SHA512 23817a4e41738f4858aeb9b534e5e80fa47f09f1ff2bf94ad495b92ecd4d5f678e906769606b649bfdbdb34473b7e7e6beb7866af1bad0a4b07d45239f02c324
SSDEEP 12288:T7RgpMDrvBNGopBRwAIXVRyD3PZaoSTgXa4bpigIeBeb+5atOXlo:T7kMP5N3ARyrZzSsXNbsdeBebhwe
TLSH
T119C42323B7DDAB07EE6D503602C8E94244118EF3B5694A9F73DFB13A603C49E6D2B611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 6905a1ad754537be45a7924bab1b427b6ce613638bbfa4f27e852db460ffb00b
MD5 ca9766b45e1799fe8e42c42024a0c126
SHA1 b946bb479e886ed45786ac451de3cdc1fb4c3aff
SHA512 ad533f80cc2066a06ef2715428f4765af68ec95a754e0ea3a0ba959b65e20db6f491eb350a046034d8dff6578676efc200187410f58914ebb728826f95da34c3
SSDEEP 12288:K7RgpMDrvBNGopBRwAIXVRyD3PZaoSTgXa4bpigIeBeb+5atOXlo:K7kMP5N3ARyrZzSsXNbsdeBebhwe
TLSH
T12AC42323B7DDAB07EE6D503602C8E94244118EF3B5694A9F73DFB13A603C49E6D2B611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 28db70410ea01dbf98e9ccc68ee6db9ef1c1176ef70bcb8c33ac594ef5f9b607
MD5 7fc4173e65bd7a7b40925110eddce702
SHA1 e6a6a1541ef92ff6b27df295e9b20543f3221207
SHA512 f31d452a55818edbfcb1c94547ecf56a948979db6fcc10e8dda2a47d0549b16512116522f85e9f51503224a9ae36fe08eda822084da13474349ac1f8fc532a7b
SSDEEP 12288:SyPz5L8+RgpMDrvBNGopBRwAIXVRyD3PZaoSTgXa4bpigIeBeb+5atOXlk:Pzy+kMP5N3ARyrZzSsXNbsdeBebhw2
TLSH
T18DF4121373E531F9D97A913988915A02F372BC7247248BAF13A463362E376D55E3BB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 cf689bc0954c1aea594f08498df823d8e7cbf8beaab93775d79a338679b0820c
MD5 345f4ba1ec8453e4b012020abb4e8955
SHA1 e7c1fb785892ffd7bc8cd9ec77dd33867d39fe3e
SHA512 303f93b5530337cf87c4aba5eb6af05e449b18e2b776fe6e303f4246c5a25a6f03822ced4591102b225ca2bf7bd544e4755856aad5b9a5176626de9cc94bdcb7
SSDEEP 24576:UTHaLl3z0zDokMP5N3ARyrZzSsXNbsdeBebhw5:UT6LljpkwduyrydeBebhw5
TLSH
T18B0501A5B39058F8EC67813E89558906D2B27CA60770CA5F13E8362B5F373A11C3FB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 f3352295d73bdd9311d68c4cbb759008a0f2a019a9013f9ee616de8eb7450b68
MD5 693d629d6b5224801b994dfdbc1e6462
SHA1 2b3c76f1b18e533cb9af86447d5c6febb89c7e7d
SHA512 a9dc2801d91888fbae68dd98048f7528576fc9be7dd3677df371b70a1094123c5424ffc6e951b706bd64795ebc3641ec936e37bfa156d4340caab359068e646e
SSDEEP 24576:i37d9CHKy7GZkkMP5N3ARyrZzSsXNbsdeBebhw1:E7d9CHKya2kwduyrydeBebhw1
TLSH
T1F825DF90F3E815E4F4B79A3589754502DA767CAA1B31CE8F03A8661A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 985396523df9c6849164f22ad10dba5257a94ca37677ff586de4c62c233e9629
MD5 606e176a1c8842eb7690d88e967136f9
SHA1 de48a041606339957dbb96e5b9789068c005feb9
SHA512 753868edada391cae83638bc62d9fc0e4042bc833f5db0d6c641a6b9f6e03134b8ce2e9a98e0e75e20b682edb8246975c8f69f780565b9adef2a325bbfc908e3
SSDEEP 12288:SYRgpMDrvBNGopBRwAIXVRyD3PZaoSTgXa4bpigIeBeb+5atOXl7:SYkMP5N3ARyrZzSsXNbsdeBebhw9
TLSH
T1E0C42323B7DDEB07EE6D503601C8E94244118EF3B5294AAF73DEB13A203C49E6D2B651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 ff844c834087d9dd68f484eb57950e49f6854fe78b50be6fa9fbe56c89c9b3fb
MD5 e1ea3991fb9e3eb5b135a04c6cd54662
SHA1 71624092ef6815441b8c38942086e1a8e5e53f11
SHA512 372b50ddf200329519138fd50f50173367fb93f6b12f34ef31130152d13821bb37293adf8a8d83d0d0d7bac8896814210780ed1a3c9a045fba8c3c048888e76b
SSDEEP 12288:GeRgpMDrvBNGopBRwAIXVRyD3PZaoSTgXa4bpigIeBeb+5atOXlD:GekMP5N3ARyrZzSsXNbsdeBebhwl
TLSH
T13AC42323B7DDAB17EE6D507701D8E90244118EF3B5294AAF73DEB13A103C49E6D2B612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 87424c6665fe39817e7ccd935a5fec1b24d1aacf56314554b398153d219013ca
MD5 a7f540a03da7b65577b01b54fe8cd5f4
SHA1 c52a99de2bac1d16e1569494b418412e8c9e4820
SHA512 a64621395e6ef44aa4dc70fd8b251466f5c34396e6efb533e40dde1e6d40969c4e8499c1fc8343e80f77d99b11d2c960cb6786897bce2b0575778021107b0977
SSDEEP 12288:wRRgpMDrvBNGopBRwAIXVRyD3PZaoSTgXa4bpigIeBeb+5atOXl+:wRkMP5N3ARyrZzSsXNbsdeBebhwU
TLSH
T15BC42323B7DDAB07EE6D503602C8E94244118EF3B5694A9F73DFB13A603C49E6D2B611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 7a064aeaf2180b51c53c948cb21dfc80594f8d3aef4cea6b01b1bf66ea7da10a
MD5 71dd7c3d0349682bc0cb55aee1ba08b6
SHA1 dae70fc7d938715f6e6ed5180dff13355af07e91
SHA512 0f6f78ff071da95318dcb112e8261ca8fc5dc04060b8b9333bf90271fd4f9aff390b28a2438dcd744b555d6fe189df5edb0db3e930abb37e345ea55762ef809a
SSDEEP 12288:67RgpMDrvBNGopBRwAIXVRyD3PZaoSTgXa4bpigIeBeb+5atOXl+:67kMP5N3ARyrZzSsXNbsdeBebhwU
TLSH
T1D2C42323B7DDAB07EE6D503702C8E94244118EF3B5694A9F73DEB13A603C49E6D2B611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 ee486c464392fa37fc1fd00cf23e323e00df9d6e2c28f1b27e0477e672ea6ab0
MD5 6b4fcfb109abc12d4fb61de085c5d51c
SHA1 0d7d0ed0c1a494838aacebe16673b394a823178a
SHA512 0dcee333baf58e418094fe2e29cbff7a48000b9860cb959840e848b2430931bc8b3b446c0a89686181072ef9b2ae8181e0defb149e2f7655cfdd47b25713cae6
SSDEEP 12288:8YRgpMDrvBNGopBRwAIXVRyD3PZaoSTgXa4bpigIeBeb+5atOXlc:8YkMP5N3ARyrZzSsXNbsdeBebhw+
TLSH
T1BAC42323B7DDAB07EE6D503701C8E94244118EF3B5294A9F73DEB13A603C49E6D2B651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 45c8613b1897476ab013a8a094e9e2658163ae5758c93554fdb68b21c0fc1a9c
MD5 2e96d4c37aa6acedccacb8c1247e9f4e
SHA1 51b6f7f07f832ac02f0fe5c1fe19a3f560b16281
SHA512 66f95bc4c18d49d9b4198e78f2c3aba2f844ecd9e77a1a2c570fe436c41f800c1b08a66762b024adfe8bf6fe800cf596fbb165d31d4a761dd6b48ee03936df0f
SSDEEP 12288:VjRgpMDrvBNGopBRwAIXVRyD3PZaoSTgXa4bpigIeBeb+5atOXlQ:VjkMP5N3ARyrZzSsXNbsdeBebhwC
TLSH
T1BCC42323B6DDAB07DE6D507702C8D90244118EF3B569469F73DEB23A603C49E6D2B611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 581KB
SHA256 1e6b5705e6523b4ab5e13d55fe38217d670f48f386866c14feaecf3712138eec
MD5 5cf839e0835fe900ba97df8d321da76e
SHA1 b75121feff28e76a2e6790195ceb2f63efe0acaa
SHA512 38e30e6dc438c4ba93ed98b625c4cd6063ad7484c651f99175d6e548ba78fb18ca129cc46f7ceaf7827e0045ea57c201d5f38af56712f64040942e53eaa3b484
SSDEEP 12288:XlRgpMDrvBNGopBRwAIXVRyD3PZaoSTgXa4bpigIeBeb+5atOXlc:XlkMP5N3ARyrZzSsXNbsdeBebhw+
TLSH
T17AC42323B7DDEB07EE6D503601C8E94244118EF3B6294A9F73DEB13A603C49E6D2B651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 581KB
SHA256 0fe87126a228d8c9275d23c5405a6d774393408652a9b52fea8e1c1f99f70f43
MD5 677195c7abd0cc8b76aad6b675359d4f
SHA1 2089c9b003ba99e449636830d48d358559193fa7
SHA512 9e0e7860ad90151d9c88f2dd1f419dad40c656dbc196a41dcaaa2adfd66d9b8777e7b6a43cbb8dd195b32dc1d9ee14dab0634f2bbcbc925a8b743b1bedc343e9
SSDEEP 12288:RwRgpMDrvBNGopBRwAIXVRyD3PZaoSTgXa4bpigIeBeb+5atOXlr:RwkMP5N3ARyrZzSsXNbsdeBebhwd
TLSH
T131C42323B6DDAB07DE6D507702C8D90248118EF3B5694AAF73DFB23A503C49E6D2B611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 2a678a0eaf658ed68c77fa991d8fe5ffe10f34a46ca8400cb28cfaf4e4879dee
MD5 b56af73712c41ad0ee9f594be870c8cd
SHA1 fa62d524b688c4df09e85373268df47e16090b0c
SHA512 e23f8c4cb31b03140c3cbdb8b14e2971ad98a64d0465b6e27b9615e02e3e37811a4bc077ebf7d76881ddf78a1b03a12f7584cb8e39af3e1e40d2100d7989045a
SSDEEP 24576:dfwvok9RX6wkyAI/kMP5N3ARyrZzSsXNbsdeBebhwR:bMnYI/kwduyrydeBebhwR
TLSH
T1B535D029EBDC44E5E1B7913C89B7460AF2B178691B31C6CF029A536E0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a5dedad9b31d71a2945702a8fd3a34470d19998463450cda72a573f55df510b4
MD5 eb44a6fa578f468c0a2391faef6074b4
SHA1 66008aee031a8252793fbc8045e821d2bbbc8d93
SHA512 fecaccd7871ce96a39d7f92ea4f5f8befb736951f523c8cda13941038a0c97b97c329ef44b241c58a26bc12f95f6eefe7c861b53b91503db7cb48aabf620ae08
SSDEEP 49152:FYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0MkwduyrydeBe9:FySzPk90yryoBeVw
TLSH
T1E3067C57A1A801D5C5B9C1B98B0BCC1BFA7134490335ABEB03E556935F6BAF0AE3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 96f98d4fce7116a663dbfd9bd61265a2d0ce1b91e091dcf1388717a9c854a36c
MD5 cad417a5815aca52fe19af238a6f6467
SHA1 356e4415ac02e360079ccb0512250ead17895618
SHA512 79762f371ad49f8ab92c76b9045fa89587c3ef363cfd41d8402fdc090441b6ae7823df297ef6d15aa96684db3c947971c72fe4d5ee9183b344900a04ee75575c
SSDEEP 24576:B47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYqkMP5N3ARyrZzSsXNbsdeBebhw/:B47JUQj1irIhCnDHUPfF/ckwduyrydet
TLSH
T13B65AE1EA3EC01D5E1BA927885154A1AEA71782E1F31CACF1270937D6F23ED45F36B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 626ddf848722d2a5deda9809b950c6506a902c60382d884a5495ab50684e3709
MD5 0942a1303b814e2ac26eadd3de7e7776
SHA1 4587452af8fde11aca093faa95d6483d37134c3d
SHA512 d174b9b20505606120e4cdeff44e4192c04f1512b36739ea52c0cad2d61dadae3c41ec215200916113f9fe8e4522f428c5585dd6c32631afd691ff7599bbd415
SSDEEP 12288:RNsfrRgpMDrvBNGopBRwAIXVRyD3PZaoSTgXa4bpigIeBeb+5atOXlT:WrkMP5N3ARyrZzSsXNbsdeBebhwN
TLSH
T13BE4F11AD29852D9C86E6136C7958A01B3237CB293E1D3CB63D0F53E1F396945DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 a53bea5344c7aff97d60334b53c1ef130a87c6e72ced3cd7a7e914aee49e6ceb
MD5 ebca7fce8a7448d5cf1530b9c356cb54
SHA1 e620f84132fd950b75b1db0ee1b2fd3582c723fa
SHA512 167833522d2c38ad55b6238bee43e17df2a8e620412ed78a3f383833a35ce811afe6f173e93c7d23f7ca4bfc43d618841de755bd517c82c37f6e6689f9cd3499
SSDEEP 12288:CM7TRgpMDrvBNGopBRwAIXVRyD3PZaoSTgXa4bpigIeBeb+5atOXl:/TkMP5N3ARyrZzSsXNbsdeBebhw
TLSH
T18BD42323A3DDAF07ED7D607101DCD50215129EF2AB2486DFB289B23A60389DD9D37712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 65813a148812f67dddf423b37a2c45312d8373ef23e80a89255cd8fe5c06d02b
MD5 eaf0e475d72c3f8f41efc69841446cc9
SHA1 b18a28f2db010d35869a402121fb0901ad8eacd3
SHA512 7a347632ea038d89095378e62aa85a53cd762d2cd4a9b99bc5668ed73377186a2f3cabf990218c436af98429cb6ae281f1f6fea3a0bce6049b51201e3f94b5c2
SSDEEP 24576:Wgb6bmBIi49WNNFpg1rSvFv7bYpkMP5N3ARyrZzSsXNbsdeBebhwA:Wgb4mBIBhGFqkwduyrydeBebhwA
TLSH
T1B065AF1E22EC02F5E4F9D2B88DAA4417D6B278161731D2DF1151423D2F3BEE89D3AB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 03a811e44d194be0acb26789d75e06df425b272fd1c3fdb9631d9b98f6a7a8f2
MD5 b3ca8f5bd231d96189cec3eaf9327046
SHA1 521483ede0ef5430eca01da7e16fa797e19748b4
SHA512 837374264ec7916e2bae25512101c767cfef2594bb473045f15a9daddae7e79e1607dc8941bf80314e1b1f1e7c5f96bdc308a6a445e8e9dd2a99b5967b5c8e5a
SSDEEP 24576:SG88u8FpJqH1bzria7/makMP5N3ARyrZzSsXNbsdeBebhwB:J7ZFPqVea7/xkwduyrydeBebhwB
TLSH
T1BB35F12577E502F1D87BD13889864653F6B2B8210364EBDF07A88A551F33AE54B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c9fdd8d5b58e38e62bff0d188d81a5d90ed465c610593f9f772471a8c47f3203
MD5 9568238a5b2c79cdc87e8b8854b3d52e
SHA1 b4002b86f407c22e65522d270c3b710de2461bc9
SHA512 a1cc06bb62d3615c2864feb5eff3ad4533998650d0a2e2cdc1dc63a5027cb8ac04d35066f7f952724374026a46ec6ebf16b5b693c9f9381dd3482e9a2e938509
SSDEEP 49152:CBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjmkwduyrydeBebhwV:NG05lO43bH90yryoBeVw
TLSH
T1FED5C06A62EC11F9D1BBD17CC9C64A0BEBB23825033556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 adb60b49010c29dca111171509c62d1ef2fd472118e2320d690b70c7e9f3d072
MD5 5e99e566d378fd52517ad2136194de14
SHA1 7996129994c9a1c3932a5724b2a249d1f995ad44
SHA512 73894dcba6012d80c01357851fe837e6746ffcbad96bf279c35b9d7f76e8ded203160071780909aa0c049046141064e300d0d0f29e472e9678c34531eb0ffb30
SSDEEP 24576:+fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnMkMP5N3ARyrZzSsXNbsdeBebhwz:ma5POZ3+Jt2pasx2+mekwduyrydeBebS
TLSH
T1FF65BF5EA6FC01D5D5B9D17DC583860AE5B1346253319BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e9bba449cac42b4967701cbc9e3dafa7cbf59fdbafc336517fc557aae7c18f56
MD5 ba21e0e64f5e26c73919a374d140f0c6
SHA1 b1d1b64e706281aaa3d4e925ea1a1300b122e28f
SHA512 d791d66da46edf0ccd3f22c1748561d869c856347bbd4554b78691eb3c00b21f4628a57af101b6c7985791b0e6a40e67286fbf570fc13f5dab470a8e034c1d98
SSDEEP 24576:0NcwHdjbyQ4nLC18lb/EOjowL7FkykMP5N3ARyrZzSsXNbsdeBebhw3:0Nc/zEOVHFRkwduyrydeBebhw3
TLSH
T13E857B2623E901E4F5BBE1BE89679546FA71786513308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 626763bcaead61217d555f76a8588c14e3f5d7204101651209e766616fbc22e2
MD5 1eac1ba5667fe504412e45df10fc5e25
SHA1 8a53ba2107c0b20e7f69839fe4594a28f4530ab9
SHA512 54e6348345d7f93bd3706b4ea31dc34b5a4287ebdc34d0793a9fa9eb833dde8c7b9d1dc31f0666bb7da4026eafe95d292c61be7222f17bdc01af4c2c6a0f69d0
SSDEEP 24576:b8kNvNnaFeYhJNtmZBmwkMP5N3ARyrZzSsXNbsdeBebhwk:b8MwBtOmwkwduyrydeBebhwk
TLSH
T12155AF2EB6F846E4D1FEC6B58D238512E6727861173293CB5290C13F0E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 6b7762747621f10a73060807574d20a4f13cfaafe1ac93955b748d9b677dd5e3
MD5 b963af8e7c87579f2e58aa7910b5928a
SHA1 0e4d575c68146f02521e25b147123cd2d4268d0c
SHA512 f882987b9c9aedbf006e4b5fc19bd0b42edee4c3242821b8d4ba519f53baf3745080c8486418e521f704bdc8a473b5dec8bc9f86898b2b5aa456555bdb29ab36
SSDEEP 24576:vPUr+NQ2kMP5N3ARyrZzSsXNbsdeBebhwS:vJQ2kwduyrydeBebhwS
TLSH
T12805E12F22EC1CE5EA7AE17D85858609E771B872171192CF02D1917E4A37DE8BD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 4b64590d3354c0043bfde5306f13c3519688c9fb8aa4c614f2c80cc76c7703aa
MD5 ff0b06b613a5f1230b794d58bc26f1ba
SHA1 202cf5f6ea39815a3bbe8315eb44aef11fb53c2f
SHA512 37a98b6bc0be4185a37105256396491e17c3615e002aaf5502d9f141764dfa475d0fadfe79b5f91e550bee2090fdc475246c5d1770ef099be22f4d67fa3d7a81
SSDEEP 24576:VD3FHshBIYQgAXkMP5N3ARyrZzSsXNbsdeBebhwv:VDVHeBIAAXkwduyrydeBebhwv
TLSH
T14B25E13EE69C04E4E97AD17C86538A06E67138B9032156CB12D4D1BA1F7BEE47D3AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2276-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2276-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2276-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2276-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2276-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2724-293-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2724-64-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/2724-66-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2724-72-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/2888-308-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/2888-82-0x00000000006A0000-0x0000000000706000-memory.dmp

Download

memory/2888-77-0x00000000006A0000-0x0000000000706000-memory.dmp

Download

memory/2888-76-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4180-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4180-13-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4180-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4180-20-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4180-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4908-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4908-107-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4908-101-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4908-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4908-312-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4908-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4984-276-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4984-60-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4984-53-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/4984-54-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5344-94-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5344-93-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5344-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5344-87-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5344-385-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5344-384-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5388-2-0x0000000002590000-0x00000000025F6000-memory.dmp

Download

memory/5388-86-0x0000000000400000-0x00000000007F1000-memory.dmp

Download

memory/5388-0-0x0000000000400000-0x00000000007F1000-memory.dmp

Download

memory/5388-321-0x0000000000400000-0x00000000007F1000-memory.dmp

Download

memory/5388-8-0x0000000002590000-0x00000000025F6000-memory.dmp

Download

memory/5468-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5468-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5468-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5468-51-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/5468-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5568-114-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/5568-311-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5568-120-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/5568-112-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5700-126-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5700-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5700-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5700-137-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5700-132-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5776-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5776-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5776-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5776-315-0x0000000002FB0000-0x000000000324E000-memory.dmp

Download

memory/5776-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download