6f4508485f58cb12c549291e59e82f135280669ef108e9b0cf846ed4673cfab2

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/04/2026, 13:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe
Size 1.2MB
Sample260417-q2rlmsaw4x
SHA256 6f4508485f58cb12c549291e59e82f135280669ef108e9b0cf846ed4673cfab2
MD5 19b6f7575afcf7904d809cd8b9e4893f
SHA1 aa53000eaa46df9f9c9579ee84adb6253fcf6f75
SHA512 86932825128751d57b7486e5fddb26c9464997005d159b70a8395083a36074092c86424fec908a240aca8adb90d345c032985cadd9de776adaad4226b1c2214a
SSDEEP 24576:KK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxC2:P2od+YBMF/XS/ezSC6vUzPvMC2
TLSH
T148554C6AF5B88272D072D07AC6D2EB1AE5723482533085CF434787692F177E6D53AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5036	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
5012	YZH.exe
3516	YZH.sys

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe"	YZH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe"	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe"	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\YZH = "C:\\Windows\\YZH.exe"	YZH.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	YZH.sys
File opened (read-only)	\??\B:	YZH.sys
File opened (read-only)	\??\A:	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened (read-only)	\??\B:	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5316-0-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/files/0x000d000000027002-6.dat	upx
behavioral2/files/0x001a00000002b3cf-15.dat	upx
behavioral2/memory/5012-20-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/5012-18-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/5036-17-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/5036-10-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/files/0x000200000002a1c6-37.dat	upx
behavioral2/files/0x000200000002a1c7-38.dat	upx
behavioral2/memory/3516-31-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/files/0x0001000000028dcb-43.dat	upx
behavioral2/memory/5316-40-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/files/0x000200000002a1c5-36.dat	upx
behavioral2/files/0x000200000002a1c2-35.dat	upx
behavioral2/files/0x0001000000029e0c-46.dat	upx
behavioral2/files/0x000100000002aa4f-55.dat	upx
behavioral2/files/0x000100000002aa65-54.dat	upx
behavioral2/files/0x000100000002aa57-59.dat	upx
behavioral2/files/0x0001000000028a1b-74.dat	upx
behavioral2/files/0x0001000000028a1a-73.dat	upx
behavioral2/files/0x0001000000028a19-71.dat	upx
behavioral2/files/0x0001000000028a21-82.dat	upx
behavioral2/files/0x0001000000028a29-95.dat	upx
behavioral2/files/0x0001000000028a2e-102.dat	upx
behavioral2/files/0x0001000000028a2c-101.dat	upx
behavioral2/files/0x0001000000028a2b-100.dat	upx
behavioral2/files/0x0001000000028a27-91.dat	upx
behavioral2/files/0x0001000000028a25-88.dat	upx
behavioral2/files/0x0001000000028a24-87.dat	upx
behavioral2/files/0x0001000000028a28-94.dat	upx
behavioral2/files/0x0001000000028a20-81.dat	upx
behavioral2/files/0x0001000000028a1f-80.dat	upx
behavioral2/files/0x0001000000028a18-70.dat	upx
behavioral2/files/0x0001000000028a17-69.dat	upx
behavioral2/files/0x000200000002866c-68.dat	upx
behavioral2/files/0x0001000000028a3e-119.dat	upx
behavioral2/files/0x0001000000028a43-128.dat	upx
behavioral2/files/0x0001000000028a42-127.dat	upx
behavioral2/files/0x0001000000028a44-130.dat	upx
behavioral2/files/0x0001000000028a41-125.dat	upx
behavioral2/files/0x0001000000028abe-151.dat	upx
behavioral2/files/0x0001000000028ada-159.dat	upx
behavioral2/files/0x0001000000028ad5-158.dat	upx
behavioral2/files/0x0001000000028c5a-169.dat	upx
behavioral2/files/0x0001000000028c42-171.dat	upx
behavioral2/files/0x0001000000028c84-177.dat	upx
behavioral2/files/0x0001000000028c3b-176.dat	upx
behavioral2/files/0x0001000000028cca-168.dat	upx
behavioral2/files/0x0001000000028abb-147.dat	upx
behavioral2/files/0x0001000000028ab4-146.dat	upx
behavioral2/files/0x0001000000028ab1-145.dat	upx
behavioral2/files/0x0001000000028aa9-144.dat	upx
behavioral2/files/0x0001000000028aa8-143.dat	upx
behavioral2/files/0x0001000000028a40-124.dat	upx
behavioral2/files/0x0001000000028a3d-118.dat	upx
behavioral2/memory/5036-179-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/5012-180-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/5012-181-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/3516-182-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/5012-184-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/5012-187-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/5012-190-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/5012-193-0x0000000000400000-0x000000000043F000-memory.dmp	upx
behavioral2/memory/5012-196-0x0000000000400000-0x000000000043F000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\dotnet\dotnet.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	YZH.sys
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	YZH.sys
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	YZH.sys
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	YZH.sys
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	YZH.sys
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	YZH.sys
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\7-Zip\7z.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	YZH.sys
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	YZH.sys
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	YZH.sys
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	YZH.sys
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	YZH.sys
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	YZH.sys
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	YZH.sys
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	YZH.sys
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	YZH.sys
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\YZH.exe	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe
File created	C:\Windows\YZH.sys	YZH.exe
File opened for modification	C:\Windows\YZH.sys	YZH.exe
File created	C:\Windows\YZH.exe	YZH.exe
File created	C:\Windows\YZH.tmp	YZH.sys
File opened for modification	C:\Windows\YZH.tmp	YZH.sys

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YZH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YZH.sys

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5316	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe
5316	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe
5012	YZH.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5012	YZH.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5316 wrote to memory of 5036	5316	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe	79
PID 5316 wrote to memory of 5012	5316	2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe	80
PID 5012 wrote to memory of 3516	5012	YZH.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5316
- C:\Users\Admin\AppData\Local\Temp\2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
  C:\Users\Admin\AppData\Local\Temp\2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys /zhj
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:5036
- C:\Windows\YZH.exe
  C:\Windows\YZH.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\YZH.sys
    C:\Windows\YZH.sys /zhj
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 aa653a0e5f3b99a39c3b95064c1d99c6b9b6f135abdd44a63e7282cd987c5873
MD5 a6ee2ffb5e7a413b3fcb43c99daa3427
SHA1 9667b0b8275eed55e7643e4a7573a2240fca42f6
SHA512 9a0b83f0176cd73875d0605c5dd26e9806406c785c02e3a0f731a6cff5697b4e7bcc25cc8a319976a388544275f585b23a5b164d2fdf325e2268d79dca8f2dc5
SSDEEP 49152:d2od+YBMF/XS/ezSC6vUzPvMCCPji0Aj2:d2oNBMhXWezSC6v2XMCIjoK
TLSH
T183854C66F6788372D072D0BAC5D2A75AE9723482573089CB4386C76C2F277E6C53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 2.2MB
SHA256 161bb9c883ad289b8ebe3afe05dae8d2c528357422c023d9124ce57bdc785b73
MD5 6106fb6299e427716eeadb15722e14fa
SHA1 580df06f2487ab92bd9debd8e146253a9ee648da
SHA512 e6dcf3b796a4ce6ba210266c975a8aae3577ca97c5d0c17526a861d6003ea85af8f602805614ce698bfa9f81e4411fce790f231029f7e0cbfe8b0e4c8ffaa8aa
SSDEEP 49152:B2od+YBMF/XS/ezSC6vUzPvMCF/ezSC6vUzPvMHjyq:B2oNBMhXWezSC6v2XMCNezSC6v2XMHz
TLSH
T18AB51966F5788333D0B2D0BAC5D2AA5AFA723482573089CB4347876C2E277E6C536735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.9MB
SHA256 01b80632c53dda2333a3cf3019b3de91682a566d17b7869d4f1061a0500cd769
MD5 06226aa7bd70715302f9743c4b4ba107
SHA1 d8f302ea398bb439425765966e2c305730892e7b
SHA512 c01be8d6c59f5ecf6225afc4d26e3b704926b681922de32655d7145b9473eb38b13c9c005bf0afc718f32f0e188cbb16682b9476c4c738a8b0f7fdee5c529115
SSDEEP 49152:B2od+YBMF/XS/ezSC6vUzPvMCCVO88hXl+M:B2oNBMhXWezSC6v2XMCl/h1+M
TLSH
T1E6954C6AF5748232D072D0BAC5D2AB5AEA723442573089CB4347C76C2F277E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.3MB
SHA256 2a11af7b67a6e41062db263de493f3a4472b4365f597931cd4483bd34bff496b
MD5 02960e78ab13f5b0d40c09311d751255
SHA1 abcd6eeb6e972cb4cf7b8961d0ed5ad9d04b8b83
SHA512 e0fdd99233a6f4f9c2ef6ea0baca25f734fb5de5e216adcc5469ac0f8c27516d9bd14540fc721f0381676a10244bddbda756f0c896f6e51182fa22faf4bbb49c
SSDEEP 24576:fK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCMan:i2od+YBMF/XS/ezSC6vUzPvMCv
TLSH
T102555C6AF5B88272D072D07AC6D2EB1AE5723482533085CF434787692F177E6D53AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 1.3MB
SHA256 14596e74ba814430b7780f1d1e43eb78a2897671e749f72dee6df503cc0df42b
MD5 38a1d3bcc1caf61931b222a79e41545f
SHA1 3ccfb58117c015967954496ede594108b02a4404
SHA512 a66f957252e9111bd456e5accab3cdaade33057b3e93d3865a2d79c82ccb30a170bf3b26c0d393c4305187eddcfc8402f4851ba419c543256c28d0f25a31e94c
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCn/:d2od+YBMF/XS/ezSC6vUzPvMCn/
TLSH
T18A554C6AF6B88232D072D07AC6D2E71AE5723482533085CF434787692F177E6D53AB36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 8b31a08341faee8bdd53aea7a0648bba9cf1da7856ef268c4c9f5e0f13c109bd
MD5 92e7e72a3b0ae45014b650dea42cf0ba
SHA1 f25e356bb4cefac56690e59022bb1e22af013916
SHA512 85c0bcc3c1b63a1b96cac990addf563f75e3692db49db883d96d158fe7fe0d56227bbbf24091427c3bec91340d3e083596aad0c139455ba91df94b5ba7cf1680
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCIZu3:d2od+YBMF/XS/ezSC6vUzPvMCJ
TLSH
T198654D6AF6B88272D072D07AC5D2EB1AE6723482533085CF434787692F177E6D93A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 3.0MB
SHA256 c0ca706d033de0fe3791418404285b61777643eb7c5bb7658390d413e1cdcde3
MD5 1d9bff71a05ac590112b3384e72bcd28
SHA1 d9b3664259c3059c2f68e84c9401287d8f9714d1
SHA512 b646c00df6c7cf9914caab8e4d736c846086ffd8a4eaa3a85b2a501d0724f7c0fa2582b7180598d7c24c6493b94d6837689274ac378cefa2f9a667ab528bfb08
SSDEEP 49152:ww2od+YBMF/XS/ezSC6vUzPvMCp68Qg55nhoeWu7PNU3/I:ww2oNBMhXWezSC6v2XMC3thHRc/I
TLSH
T1ECE55C37B1F601A5D06DD076CB869721D5E27C628FB0D7CB424273191F73AE0A63A72A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.9MB
SHA256 6662e2835e7a2c61f51092be4e6115a7206304ac8edbb62c3b91f8a1d330d768
MD5 bfd2b3d932401a125ffdd42cabb01217
SHA1 1cd485dd80f768de1e8c967b787087cf83c4f52a
SHA512 de2aba05c88e8a7d78353ed68d8f6b129411a17f45c67f39b3941086914a18d661f9fb6c66fe79631ce3aae39f030e207f57fc8913cfd631c455c080155632a8
SSDEEP 49152:d2od+YBMF/XS/ezSC6vUzPvMCU1hpsNoJpF1A6GU44CwH7R4xa:d2oNBMhXWezSC6v2XMCUmifP5Rf
TLSH
T1B9E57C27F2A841F5D06AD079C792A626EA727C42073096CF0781B7591F37BE49B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.7MB
SHA256 9472c6f063c0f082450b2c53e8b5548be3924ad798607b52d8700ba410ce83f3
MD5 94047ca3eb502817ee600e3e9d549658
SHA1 027133b5e2037b4fe583b63fd6e3b5160bac2cf4
SHA512 670c13a48bce4faa5ca03391a30910578cc0c4660454040aa213591ead7541e7255c7f5af5e9cb4e1fd073847dc94417e26fa78cf73102080361f6cf7bffbce0
SSDEEP 49152:d2od+YBMF/XS/ezSC6vUzPvMCXhtSn8EApI0fig1giDn0AP5wy:d2oNBMhXWezSC6v2XMCGX2iwphr
TLSH
T117D58C27F2A841B5D07AD079C7829626E9727C4207309ADF0742B7691F37BE49B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.3MB
SHA256 9463020415dbdaeec109ca6d7bf91ab713c0d92a7a0d2cddc9679bf4cb9cd72e
MD5 e3c703714a13145fd04f7f3370843aff
SHA1 c1c5eb8d9712d8a9afd6bb017f95824ca1738c16
SHA512 7eed07f7c6989d13c3b3b497b719715451a6a4ad67b174d84107d3a71d3ba335d4ada29d2de091b206f7104346c536ec3baab3a8ad68fc632fea1f2fb75c895d
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCHf:d2od+YBMF/XS/ezSC6vUzPvMC/
TLSH
T1B5554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.3MB
SHA256 904f79ad3f695d2f3394d7b444601c331ba32adbc5fcda86196723820b2296a0
MD5 43844df7cb3a22fd611d9fe53ccd578f
SHA1 3ecbf942eacdf6c628808cfc7eb497fc1108e6b6
SHA512 e9a22b8e83ea59863327d06c55ccda04e0f87206ba89a873f1ddafdbff133e6949c072e3a95c1d4b7cd0275714201cbf42cd6147b219ed3f5457e3e8cbb82cd9
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCVR:d2od+YBMF/XS/ezSC6vUzPvMC3
TLSH
T1F7554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.3MB
SHA256 d89f892cbd60206dac3bf5a4cbe6afabb4ae5b6e4b9855a9b5f2f36e5f5ec417
MD5 17b25c43cda1685b159970d0bb509c3e
SHA1 4916f9b70b4aa073726d3fd42ca6582924de4458
SHA512 2e65a7e6f8d15f2c4274b576bb285611a3687729a16fc038c7b2591b5f96e92843e7054677b29c8ccbb714e8d84beee8b39c8f620ddcfdbef3abe45ca085d3d2
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxC/k:d2od+YBMF/XS/ezSC6vUzPvMCM
TLSH
T1AB554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 a3eaefd72d33965bdc3f7837d2246ae90a63d06537492ac85e42e6eea684f5e0
MD5 f6c0149f85cebe267c46b9e1bb5bbd1b
SHA1 a7a20725c27225446415d3508079ffffff67d1fd
SHA512 30dd31342e13a8e3a0c10395506e08f3b780dbbc065c57ffcd0a4c9d49777266dc235cb92230c9ac863944ffb32bd2b73b3a0ccde1169ea0a449c2c9636be539
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxC9:d2od+YBMF/XS/ezSC6vUzPvMC9
TLSH
T15B555C6AF6B88272D072D07AC6D2EB1AE5723482533085CF434787692F177E6D53AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.3MB
SHA256 5a074a8af823cec03a709f8ee3190b26407e4eb1695462f2ea09c024f1e0ee97
MD5 2fce795fe86f999f250a2e092618120c
SHA1 bb0cdd6fbf8ba9f7ee4ba1c7fc65eba0ec794d43
SHA512 71f18555d2f023a646b5779e57480c8fd56b4e3c3112e673ef7c17482bd4ed99cdf2a9e08fcfc3ef45ea25c74ea1d8b6dae04d6d8ab1ab337dc562715abc56f3
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCGJ:d2od+YBMF/XS/ezSC6vUzPvMCo
TLSH
T1E3554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.3MB
SHA256 a60864475045a8d6802bf21f4fb749e320c24719ca0b1118c6aafb8cfc89a69b
MD5 4eab6ecc1a3ced945558ad47c2ce2333
SHA1 dfdfb95574c6c344e1131b9ceee19b591ce65b33
SHA512 d629723df07194aa1d6f70ea7d3a1514e7fb2cef92d33d37e0eedde4d29bb6affcfdb741508993c90b50c17c9733ea77f77a405c9b8cda769cebfd70c407a00f
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCxl:d2od+YBMF/XS/ezSC6vUzPvMCb
TLSH
T1E0554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.3MB
SHA256 1d90455cf2905ad659ce88963324931658e00919bee91f67b1c19b2ed6cb7d9f
MD5 0c200b7d04a01dcdb0f46ac759d76a1b
SHA1 4074220e36399b18119000c198535193a4194e07
SHA512 a5bfc375158f9f69e302127cd70c6726d2a759b0ab49b899d1bbd527a48fee18b923dd7db7fc4bf7d4016e3df29fe1b464bfb500f92ca44ee40a9ed1bc909044
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCZj:d2od+YBMF/XS/ezSC6vUzPvMCx
TLSH
T1EC554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787692F177E6D53AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 9dfc80f651e276174cab0733cf1e0cdf21bb7bb529156c62c340ed2050bfd44b
MD5 8ae2b9e0de4f50b396b7d3fd6a6822b5
SHA1 5365eac73eaedf4ea196e4ddd7e3aecc8f6aa759
SHA512 5e1e40cfb2d38513a012cf992722e06d2d390bee2c10a8de80e4f7de3258c15869befd93f4119a49b72b292bef2fa0bf6c75838b6595e1c59875d488c40217c4
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCkzyf:d2od+YBMF/XS/ezSC6vUzPvMCkk
TLSH
T194656D6AF6B84172D072D07AC5D2AB1AE6723483533089CF434787692F177E6D93AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.3MB
SHA256 ca1eb4b887daca81c7e4fc8194c1e6c6aead6d49f9fd376bdb0c083edaa92a30
MD5 0398be6d9c0a250ccb63b5cffb85d030
SHA1 7dc3ee7a0766afe53dcae6c98496615430eae075
SHA512 513cbbe5795362c5d7a73eb220b388a79f865d94072c6b78a4b76740b9551a592de4b31923ef769de2f7aaed01bc424bf105eebb6737a80af7dd34eb3a1d1f8e
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCbQ:d2od+YBMF/XS/ezSC6vUzPvMCs
TLSH
T17E554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 9b53ea72e31a11d9ed4b1db0cf71e991293b8d599b8381f7fc88819793983734
MD5 a35f160405332e45b3c8724799388a96
SHA1 e52902b4831f3063fdb2595041651ca361c1a54d
SHA512 75fd2fba9b4df03fd960ece00717f3326e08d334bc0a4f1f61f4c9a4505426c8ce08891f58aa61213a8d81227ea1e0d0004512fa29f0d759356152c527c4f4af
SSDEEP 24576:uK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCTTWaLl3z0zDw:z2od+YBMF/XS/ezSC6vUzPvMCTT1Lljh
TLSH
T115757D6AF6B44172D472D07AC5D2EA1AE57234825330C5CF038787692F277E6D93AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 ace858d27fa04ed8fc6a79036ffbd11b1657311fcc5572b633eec628bc1c56d5
MD5 f399ff5201cd334cf600ce4ff99ed1a6
SHA1 13fde73d00ec3df6b0e05d54acc010dd69d8352d
SHA512 9d8dbdc9fd424af9676418914b9f106fff77ca8d8ce67d4a39947918257cd96f3ea2c3f2cd42a3a0571c3678c170cd4321570a60c12783092d1b52c1ff331879
SSDEEP 49152:z2od+YBMF/XS/ezSC6vUzPvMC/Td9CHKya2:z2oNBMhXWezSC6v2XMCbCq2
TLSH
T183857D65F6B84172E073D17AC5D2A616EA7238825730C9CF038687691F277E5C93AF32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.3MB
SHA256 ea983c318db44784d4b1ea8424dd664852529fde78b33649039073f7f5fbd9ee
MD5 43cdc1f84145534eaa73d2f648142ad3
SHA1 b7f95370f77061629eb01b57031d5c9d0905d1c1
SHA512 3cb4261b900ed6cac0c431023fd1b60977a67edb75265536731539f5a23626fd310753e086bce366f230410b3089ce7c30fd1fa8ba0e3042aeae04288261e404
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxC5U:d2od+YBMF/XS/ezSC6vUzPvMCC
TLSH
T1AC555C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.3MB
SHA256 ce035086ec21b612f022a86ca77341ee044faa4ba4e7df72e2c31e05f60c5972
MD5 30340bae5d15ef4652edb0bd9f4a42d0
SHA1 9a32502219e12ab730ab33c60ae3c3303e1e5786
SHA512 73e0eea34ee7f7644783ede4c48ab585e239fd279fef3ac6c895f0840fc1b0fc134e39cfa76b7c8fd56c7cbf70f16c0310bc3c587822405f461942ddb40ff881
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCyZ:d2od+YBMF/XS/ezSC6vUzPvMCc
TLSH
T128554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.3MB
SHA256 c81aefee8084410385e59829672eb01d8c5ddf0e667896f3147c0c181a21840f
MD5 93aae8209def6555a601e4c2cddb0637
SHA1 918dcb2e466099d017aa74c1dbe0832328416207
SHA512 058bfda41cc948ca12ee83ba5cbb4044bffeddd26d68b6c1320715619fcd840ef23b342082a7ef0c7b4be22e4e38f75c1c541dcca9c3d034b1f3b98f681c5728
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCFN:d2od+YBMF/XS/ezSC6vUzPvMC3
TLSH
T131554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.3MB
SHA256 5cbe65dc94cb66357ebb0665f10854d85a0e72859843520fc3278a257854c353
MD5 58e4c45a797a98e6822e36ad643c2434
SHA1 edd9678e29ba4c80cc54ed700a3fcb5688f7c04a
SHA512 1269e5da3d30c2da2f57d854630793f2f1709787ea53184bf6f742e958f6afeb6fec162f5621c46920f0b80482cf2319e47cfa6c791e5bd7691b381b9a04d1b5
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCoO:d2od+YBMF/XS/ezSC6vUzPvMCJ
TLSH
T18F554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.3MB
SHA256 6c5fa398835628328682836447de239e1afb09f6eacec9e7ad63a4c8ce938fb3
MD5 1708a920bd14af9aa7f9a623154378e4
SHA1 d07f1600a7b193a5d4ff6e6926b90382ece6d514
SHA512 4987a849dacdf908414f09d060d9547b90b4986b80570f98ecfcfb998509b1d09798daa7110b818409aea7f6daeb8aa6e1d0a346302c716fa90219b28bde30e1
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxC7o:d2od+YBMF/XS/ezSC6vUzPvMCM
TLSH
T10C554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.3MB
SHA256 1ae6fe2af3ff117145cf21856e2e83bedd2b9cd93bd5b6285cb59799bfdb2017
MD5 0cd105ee47daabbac170d98e8146ec90
SHA1 5b587631ae3895b26ce1db9dad7fc925ae7c6d8f
SHA512 3eeb06710dfdcf2c03a2216d751348787130cb7f8e202205503cd671c6678deafe41c39dfcd78087d4744d48463408558deef50f8e27340329a7bc9160f2744d
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCCn:d2od+YBMF/XS/ezSC6vUzPvMCk
TLSH
T132554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 1.3MB
SHA256 49b8db3629eee6ca6c5e21054abc62aa3f53af353b303bcca4cae97e8aa0b323
MD5 270e95a8ff164319917fb351f1c1f6ed
SHA1 d48b16f2db6cc63501c2f6e4e3734a8bf393a84a
SHA512 600883e9c75018da2e5535d1a2962f1b890d0aef0b7c633469cd9bc58084a07b20124847c6bc4a3a7e2feb4c8f948e3030377629d8a8013339e8887183e124b3
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCqa:d2od+YBMF/XS/ezSC6vUzPvMCV
TLSH
T1BE554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 1.3MB
SHA256 332d90299e5e0569fc2f5b4177b8dd4bd38199a8e078187b944289d51db1ea18
MD5 b6f313fa056cb78ae4aa337cd216163c
SHA1 478b17c5e4e5ab3ec9f76c53b022bcd991c0fde0
SHA512 1c7ad4a39917f85ac3d199f52236e920b03a048dc6277cef9fd40c6e0a51093eeac240cc0e196fa786f40da39e502db7dfebe33475c4aafaf48ece93c4795d31
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxC73:d2od+YBMF/XS/ezSC6vUzPvMC7
TLSH
T186554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 1.3MB
SHA256 ce0710d1e787572bfbf1efaaa9d5b1a45c9b4d2d73db6e8c89f3d6139f908958
MD5 96c236ebffff6593842625ac10466b5c
SHA1 b246fb4f8ea9e8033f98e217046a8061daeff9d8
SHA512 f6f2e3eb59abe6ca4c4e89ab9f1847efae7fd681314154b818ee77b83432cc6c2527ddb3da38377615d740ec3deae55ec183e0ba2fdfec55d907bae9fe8ffa9d
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCpw:d2od+YBMF/XS/ezSC6vUzPvMCK
TLSH
T13D554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 1.3MB
SHA256 9f2b82d4b0007688055ba691d00e016f539ec9bad1f6f66c63ee3dc1f377fdbd
MD5 c2f647d5e18bac877a8f78515e560c97
SHA1 014c31ddeb177c70cfa0fa38c786718f4892a95d
SHA512 d19f72cba7604d5ccbaee6b3dd557903f1d5378c54ee977d803516ad02d2c56e140f7ce858e09d33d8be08115c75325f23e6e6b2d231dcc07b422193533365e9
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCLQ:d2od+YBMF/XS/ezSC6vUzPvMCU
TLSH
T123554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 1.3MB
SHA256 d66c44a04f128eab8e32d999dceac5b783bb7d35a276ee4b397eba3e4e0c954a
MD5 833557a430e54391da695806e531f50e
SHA1 1677148b5a53209c4a13dc973e45209b25e3b2f2
SHA512 b8ed59e5ae95d667198a43322b331cbff02fd013b4e1af0a77361f6d1c993a4e89e775381ba3d79cc184dfa3770f85d46052a73450e3ec6abb392f61d0f83fd4
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCwq:d2od+YBMF/XS/ezSC6vUzPvMCx
TLSH
T108554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 1.3MB
SHA256 e7e2c31fed7f5ee50ab58ab3d6dc2ba581cd5919ff0ba629bf2851f9832d7b90
MD5 744a5ac406e44a9bf653f42430bf12fb
SHA1 c8b129b8c6a8b5131c08e5c297f393165a52270e
SHA512 b77a7cd50c6b567e176ed63e7feadea590ddc393d99779f154d4d00dc287115f5ece75421f873965cff42451e31a35ce5a30f1c86c8c5bc98d1b330144ac86a4
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCII:d2od+YBMF/XS/ezSC6vUzPvMCx
TLSH
T163554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 1.3MB
SHA256 ff88d1a7489a3a94418a4f4a2ec7479f9e245c0449d1614e9c0eb7b8ce49f2d8
MD5 9e61ebf7a43d946c0c72e51e6e6a7d99
SHA1 14228033e346390af14361021e999ae8f37808fe
SHA512 7eb57ea174f4c77186cf08d35c1062aec3d7e2867bc28341e45e0fca1e75e6e0197f7f6aea9231f0afe5e06c1167fba52083d00e1e79f9103633a46780e13768
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCBr:d2od+YBMF/XS/ezSC6vUzPvMCd
TLSH
T1BA554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
Size 1.5MB
SHA256 3ea66cbbab8dd259eb972be8dd94df7432fc6c12de557d6fb99c737fda4c1565
MD5 21ee6a008afc7b266733366bb97c57ac
SHA1 24f4305d03a6bec1aba5a4fc7be3202546d07f24
SHA512 182b9d4a09128ba1e5cb8492bf5b10dd600b160cc2b9eb6fe73268afca8188a8855bd8f4ab871be438e1e18322246a53eddc429bbf7fee7268a6de92f80eb07b
SSDEEP 24576:uK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCJTWaLl3z0zDH:z2od+YBMF/XS/ezSC6vUzPvMCJT1Llju
TLSH
T13E757D6AF6B44172D472D07AC5D2EA1AE57234825330C5CF038787692F277E6D93AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
Size 1.7MB
SHA256 b8c2f9ba2afab03f7738fe1915496bbb49bd8a20ee5d553258a61742de437542
MD5 82a94f37e2e1fe1933f2bdf504207c07
SHA1 5a45e2363f88c644a23c8bcfaa527d6070b609fc
SHA512 3e5e426dd31edcffbd32f3f4ac1ed503a2cb6178bd146b69ca5e04fcfa7775e9e1e012366e40778ccfbe751136a1bf76480131bebc140918d6172900ba479041
SSDEEP 49152:z2od+YBMF/XS/ezSC6vUzPvMCYTd9CHKyav:z2oNBMhXWezSC6v2XMCeCqv
TLSH
T1B3857D65F6B84172E073D17AC5D2A616EA7238825730C9CF038687691F277E5C93AF32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
Size 1.3MB
SHA256 a9a56010d01410051fbc924f5998177e89697bd71f4ad642756c7bc5b5214d03
MD5 be9653953cfae1c7e7b27c12234010f3
SHA1 116075e7b5d739cc44f9fcb03bb7cc841a653a76
SHA512 5094d417700ee9d190907278b086a2de628bd7329eb9a1256d0dca15d97a1ef04e51c606665fc0c88ebb8777e6e82204a0b63a78894bfac4110e284eda59cc60
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCq3:d2od+YBMF/XS/ezSC6vUzPvMCq
TLSH
T19A554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jp2launcher.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
Size 1.4MB
SHA256 6e408c1f18220bbe12a951fa804f8685073ad06cf1330dbaf9fe60214a950105
MD5 6cda8bed1cfe660071762631c1f33fb4
SHA1 7986ad720d8f3ae081f84d145f9aaaeeb799d07f
SHA512 90d8bbf0bbb8c5f2f5b129adefcdd46fc90acc8f0ff47b2858f97ae63b7272bdd9e48c0b6a9b279a7b39dad433a56a44b9fe1e0170c86867ac5bded23f881c83
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCeHdfu:d2od+YBMF/XS/ezSC6vUzPvMCD
TLSH
T147655D66F6B84172E072D07AC5D2EA1AE6723483533089CF434787691F277E6D53AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
Size 1.3MB
SHA256 9aac35c38309857a4b83c2a94fa0b5f51a8a721f7235f1d252dc792d2974d1c1
MD5 e90e951494ffa856898ae7eb8137dc97
SHA1 fda124e786c23c18ad44287ea6bcf4bb7bf04990
SHA512 5c787263cd6adaa93472d945f35825878e405cbefd45bbdc75d7e93310aa3777a427cee61bfd8f6f93fbd9a60d9974bc75004683f4d435cc4f064a144c571b9d
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxC0X:d2od+YBMF/XS/ezSC6vUzPvMCE
TLSH
T1E9554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
Size 1.3MB
SHA256 6c1646afce1e70a6f04434eefd808bc3252df1c3464715a2addc5181db27ede2
MD5 dae6bc818b4f9569810ad7f6b7e6e01d
SHA1 255164077cfbf3a2774bb6fa19df0c91c82893fc
SHA512 ede052a7b48fc246002153e5e8141b13938c30df6c74596454d305b59cfdd851bbba55113f5e2df3e8232e322e2a8f8a8b4afe3bb4cf4ffeeb68f802f13c812f
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCxS:d2od+YBMF/XS/ezSC6vUzPvMCQ
TLSH
T12E554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
Size 1.3MB
SHA256 0cfbe8d3d1018e48a4b58db5225d1a2fe787a26acb453bb8c281727f23f069ec
MD5 7391af9d6c553978ffd8d25d147af670
SHA1 44d04e7075885946f60dd523ec34c61feb6f504d
SHA512 a22020c8ba4d60c4fd31be85b44a6a45ac7b37a7220ca060e4cc75761900a19cabf832badc96b9edbe61a3736b4bef910b7f2d4ea22c039f7fde5d061b2868ff
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCDI:d2od+YBMF/XS/ezSC6vUzPvMCU
TLSH
T101554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
Size 1.3MB
SHA256 809ecadf3d77f58b981915189b20e6ee1ea1e9b6c2cdfaf54a3f163699b65c47
MD5 f77a96aedd7cd15f492d4effb06d6ff5
SHA1 737648a9a0a00e3861fd481cdc58e612eb97edbd
SHA512 b3965e7f3e201d0f46b0ff62841d750edaf359c2fabd4671a036518521bc1873dee4e0096befec03fc29ce91a5a1fef6605e27a17f5cae5a9959d4ed8250827e
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxC6u:d2od+YBMF/XS/ezSC6vUzPvMCp
TLSH
T1B8554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
Size 1.5MB
SHA256 42960771662b8e59746439a9a0af46477798649cdb1fd2b9c27ca3106c116182
MD5 12a57bb2b1b38cd6684e92c0287cb6af
SHA1 934c95086054a5cda46239135d83b90c2c63a632
SHA512 21d77f9f6eee4a45b7a5a6a3cfee305a2ca257f499311e550eae3d5a6b064dbb1e1225c14e7d37a62f334f155eb2c20898ab58d86f2d981cea2d2bb596740474
SSDEEP 24576:uK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxC/TWaLl3z0zDX:z2od+YBMF/XS/ezSC6vUzPvMC/T1LljK
TLSH
T11D757D6AF6B44172D472D07AC5D2EA1AE57234825330C5CF038787692F277E6D93AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
Size 1.7MB
SHA256 b26a67d4f0241799eb8c6d1809c4f9f45722af9ab8e58c49c1cd3267ce777df6
MD5 b9016acda03712fd9e8af7ed1e9eacc6
SHA1 84177605884127ba602d6ebff6ef95770886af9b
SHA512 1500b203b82324ff1b45f74682b717b5a591398fdced9527c92049dd7935cac0be67cddf2728464935906605037907214636a59c8b5135ed0b793a7d7a74e035
SSDEEP 49152:z2od+YBMF/XS/ezSC6vUzPvMCQTd9CHKyaQ:z2oNBMhXWezSC6v2XMCWCqQ
TLSH
T1AF857D65F6B84172E073D17AC5D2A616EA7238825730C9CF038687691F277E5C93AF32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jre-1.8\bin\jjs.exe
Size 1.3MB
SHA256 f137f9220631ce2d6c77e56d80153f876d37a3266fcd28b9dd82730ea74836d6
MD5 e3eafbc9dc3042db675766090d8559a5
SHA1 03df31dceb8f1f4c6dfad7459fcd1299adcc3737
SHA512 c0429e3d2469a0cee33fe15321fc492a43ce2d8b564fb0bc1e8898fdb8e920f03078c4c4e3f2c16c94d9ab28e6fcee3f7c5c4651e590e6434a4b577cbe099982
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCcA:d2od+YBMF/XS/ezSC6vUzPvMCv
TLSH
T198554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
Size 1.3MB
SHA256 6f6cc7ae29bfb9118f540574391981607ca65263b923206e1a6ea031a0de9708
MD5 f893bce0420db15d1e0c46c273dc69fb
SHA1 7c3d399d97034c45aa35a5d01e3aa7bb0fee709c
SHA512 bddeccb12452841495b4ce2df0adf15ab8d7f00e97aaf336f072dba47617b6d5f3f38c7085c7758a2052b2d54cf7d28b8ecfd078cf6f03e032bb94b4f2fda462
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCut:d2od+YBMF/XS/ezSC6vUzPvMCs
TLSH
T136554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jre-1.8\bin\klist.exe
Size 1.3MB
SHA256 a0ace086b2dafbc3a4d9d0164fc4f1cf458b1de33df69c18fafae75a95308198
MD5 537df40ded8957f8c3e13787ce381c4f
SHA1 97ebc4108aac8170bf1602f9a95b39097f745b94
SHA512 03d945649c130f08fc7e05a250bafd42ac2fe193f15f5102ff20192c02a63e2334ce4cd77171ea0715eaaacd49d58005f02a53bda91e2921ffd350a6d031c3e6
SSDEEP 24576:EK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxCLI:d2od+YBMF/XS/ezSC6vUzPvMCs
TLSH
T1D8554C6AF5B88272D072D07AC6D2EB1AE9723482533085CF434787682F177E6D53AB35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys

Path C:\Users\Admin\AppData\Local\Temp\2026-04-17_19b6f7575afcf7904d809cd8b9e4893f_amadey_cobalt-strike_darkgate_elex_hijackloader_luca-ste.sys
Size 2.5MB
SHA256 78539cf66441f06f58b293dfcaf67ac3a7198716b68953a3d3003958692faa38
MD5 05cfb2c1758c56abd1a8ce0407049652
SHA1 b7b49c67ba8a27d5d62aff9c6c02be6c63df1c3f
SHA512 a83172326eb153a98f574571a0b3ec0e51b9233361cf04c4fd11b1c8dc8abccff20c0e7c9646487ec2c660f66c1a6e32be0392f261b0dd39b42faffc551f2eb2
SSDEEP 49152:d2od+YBMF/XS/ezSC6vUzPvMCC2od+YBMF/XS/ezSC6vUzPvMCy:d2oNBMhXWezSC6v2XMCC2oNBMhXWezSN
TLSH
T180C54C6AF5B88272D072D07AC6D2EB1AE5723482533085CF434787692F177E6D53AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YZH.exe

Path C:\Windows\YZH.exe
Size 1.2MB
SHA256 6f4508485f58cb12c549291e59e82f135280669ef108e9b0cf846ed4673cfab2
MD5 19b6f7575afcf7904d809cd8b9e4893f
SHA1 aa53000eaa46df9f9c9579ee84adb6253fcf6f75
SHA512 86932825128751d57b7486e5fddb26c9464997005d159b70a8395083a36074092c86424fec908a240aca8adb90d345c032985cadd9de776adaad4226b1c2214a
SSDEEP 24576:KK2eTEe+YBMFNNXAia7/ezSC6vUyD/aqgrvWxC2:P2od+YBMF/XS/ezSC6vUzPvMC2
TLSH
T148554C6AF5B88272D072D07AC6D2EB1AE5723482533085CF434787692F177E6D53AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3516-31-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/3516-182-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5012-196-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5012-202-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5012-223-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5012-220-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5012-217-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5012-214-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5012-211-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5012-180-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5012-181-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5012-20-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5012-184-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5012-187-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5012-190-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5012-193-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5012-208-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5012-199-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5012-18-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5012-205-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5036-179-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5036-10-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5036-17-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5316-0-0x0000000000400000-0x000000000043F000-memory.dmp

Download

memory/5316-1-0x000000000043E000-0x000000000043F000-memory.dmp

Download

memory/5316-40-0x0000000000400000-0x000000000043F000-memory.dmp

Download