29aada7d55a8c88c6ff02cb4a282ef26382b2f1f1a51a66456263401b0ca56bb

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 21:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
Size 1.8MB
Sample260629-1cdzcsfx4y
SHA256 29aada7d55a8c88c6ff02cb4a282ef26382b2f1f1a51a66456263401b0ca56bb
MD5 7da5abf44897508faa3cca889146577a
SHA1 bd7488981e2ff61b8cec6df80532406b9c8c273f
SHA512 f1a63bdd10327d523c0d4a90e822804114126eaee7d545587f3b4edfeee0632b110ac909f3a2a958d369fc55ec3b0396f901a65b1dc9d82e7b1a84910eeacab3
SSDEEP 24576:qKOWhEXwOWtskVf7L3GfSb/YaMCazmfsWEGIwmJd2pUt9UwSezotjnQ/tbw/2Mk4:lE7rlP2sSIwoiUDFNotjQ/lFTjN4
TLSH
T1AB85CF91FBC7C2F2E14711B42C77A73E5D3A6698132486CBE3942D194B207C1AE7D39A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6096	elevation_service.exe
6100	elevation_service.exe
2172	maintenanceservice.exe
6512	OSE.EXE
4600	PerceptionSimulationService.exe
5344	perfhost.exe
6336	ReFsDedupSvc.exe
4792	SensorDataService.exe
4900	ssh-agent.exe
5292	AgentService.exe
2376	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\24300ed7c8b6c6e4.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b23dd0bb0e08dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f2750d7a0e08dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000e42d37a0e08dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000066fec0790e08dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
6096	elevation_service.exe
6096	elevation_service.exe
6096	elevation_service.exe
6096	elevation_service.exe
6096	elevation_service.exe
6096	elevation_service.exe
6096	elevation_service.exe
6100	elevation_service.exe
6100	elevation_service.exe
6100	elevation_service.exe
6100	elevation_service.exe
6100	elevation_service.exe
6100	elevation_service.exe
6100	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5616	2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
Token: SeBackupPrivilege	6336	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6336	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6336	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6336	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6336	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6336	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6336	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6336	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6336	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6336	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5292	AgentService.exe
Token: 33	2376	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2376	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2376	SearchIndexer.exe
Token: SeDebugPrivilege	6096	elevation_service.exe
Token: SeDebugPrivilege	6100	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2900	2376	SearchIndexer.exe	99
PID 2376 wrote to memory of 1396	2376	SearchIndexer.exe	100
PID 2376 wrote to memory of 5132	2376	SearchIndexer.exe	101
PID 2376 wrote to memory of 1800	2376	SearchIndexer.exe	102
PID 2376 wrote to memory of 6940	2376	SearchIndexer.exe	103
PID 2376 wrote to memory of 480	2376	SearchIndexer.exe	104
PID 2376 wrote to memory of 6492	2376	SearchIndexer.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-25_7da5abf44897508faa3cca889146577a_darkgate_elex_glassworm_remcos_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5616

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6096

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6100

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2172

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6512

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4600

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5344

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6336

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4792

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4900

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5292

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2581000985-3042091657-4068028891-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2581000985-3042091657-4068028891-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2900
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1396
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2832 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5132
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1800
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6940
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2832 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:480
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:6492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8f7d1963b65f8a1e7baacd7c1c7f7d43723facc4af3348e7ef3db0e9e6506fc1
MD5 5d33e050d93b75f970c752ff21580466
SHA1 10ac415a59d1900a3f1bd24bbbbf43cba535262d
SHA512 c8c24f2ee943d08c6a89f2a649c0a1f845f41f9b4b6eb44cb9bb0552e5fa513dc203e546a577b3142ba3f35a590e7ef7d9c52cee9164e832cde5da626807eca1
SSDEEP 49152:4b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnWQ/lFTjN4:S3q6HjBaLm
TLSH
T138D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 c0381483abad2f30cb45213b3fbd9365ec8134a8444296e41c7d22e55993aed7
MD5 4d1ee058476572e6ba02946e6e381f76
SHA1 bf8a12f3ad20a3cc23151704aeed84a226f8c6f3
SHA512 cdd1dcffe9809b7d378707998eff3f60551a47e580e4baacab5b98942219701e242704049456778c89f215d46cc3ccf9ee97b61c479c13d806d51f436f52e25f
SSDEEP 12288:Y1XLsswWkxy2lRq2czAxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:eXYfDtczABnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T14065F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 93b4d0feafe10350f45f9a277dbdd1bbd1b5fbaac81c1ab161e3d4ca2d9ca8f5
MD5 63130c058356a33de07b3eaa7a144d08
SHA1 1ee667b2ce514725f0d0f2bad5af2734f257d695
SHA512 1e2f27d867654fc181c977587569fcd5c860c471b82a92f46fef3e3a12caa3db7b58b1812073b453dbe2bec05f2b5b6965adfb1b0726e9beb83857e3b42f0dbb
SSDEEP 24576:o0Le5ji0hmxLrMOnQ/tbw/2Mkjy6Fr7g0ob:oPji0AlbQ/lFTjN4
TLSH
T1CA859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 07195ad3f3655e539321897c2d00203822f3a26902bb5e18bc0b4800765ee82f
MD5 f87754311cb856f86505bd933b86e3c8
SHA1 c865898177efff1b9250d8e1d58f72f8dbefe75a
SHA512 5397706f1f75f61791a36c69aa46661aa0ba53a33a8f13d9612967ca5b003842e7d8f05768d93c91182863ef3a856cbc538e5c3f0ed43bde54797613fbbca031
SSDEEP 24576:na7/ezSC6vUyD/aqgrvWE6q8wyuknQ/tbw/2Mkjy6Fr7g0oJ:q/ezSC6vUzPvxHjynQ/lFTjN4
TLSH
T1A1755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 95783ff346fca99a318394015ea568d0fc66eb5dd2b457b67bddc44958319adf
MD5 cdc6f5c13bd4b2d7b64bc080d2af872a
SHA1 596f13791f36192776ee674e8c6d7edb5e44a436
SHA512 80970805cfb7dcfa1eac7ad5767241a48b1799c5c69c996ba898b369ec234e4c3fc4afb52442dacc21078a5774450ee1e9dd32c32ae97abdfcae3d2b211f259d
SSDEEP 24576:rVbqPb88hv/l+6FnQ/tbw/2Mkjy6Fr7g0oc:rVO88hXl+6Q/lFTjN4
TLSH
T18F559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 8468657384ed14b31636ba0bfd36a71800c548da61750c73d52c7f9e2dcef587
MD5 aaba143b02e3c1991da625fd1bc7c74d
SHA1 c7b1d80bf82417ddda55c8654ec1a865702c8316
SHA512 fade7ddec9a3d1da928df4c869e8900ac8285ce1378c53dbc8ea8dfed3f0e75e67899574fbc2fcfe300df8f8d755685b5f710cacd91b4ef95647c3f658a2ef91
SSDEEP 12288:IzCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:IzCnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1D55523696A24F887FF2B06B15CC384826B7B0EC1BFD4A74E6B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 27c14944433cbf1b656d7c42033a28fb6bb8a929e2d2afb29dde2bab5b01a666
MD5 44f3a6d153818697fa1f19225afa2020
SHA1 29f45bbddc428ba4616370a317997a31e3df0240
SHA512 4fa61ba59cf7e89d6321e4b4722c20a55add6b6fec6cea6d3e565e21204176959afb0e4f62d9d21b2539fe532153923492b6b3ec79b9c416b1e9dce9b31bca9a
SSDEEP 12288:7eBNUbTVO86U9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:7JIUdnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T13275CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 085d6f8d5b594cf00b4716ab6292418996960c393aacb417f0f0c11fda717317
MD5 cf86dc127aba9779b9f56c800107426c
SHA1 8c7fe8f0ff45c31ab935e14b883fb19b5dce5b6f
SHA512 ca4299d3799b85ed8fe55cfd400d060a0136c0896c0307148c300c27197df9158a952e6c848b4e9c282fae50c9baf4655d1a25262d0991cf38cba6bdc8af0f17
SSDEEP 49152:OQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH1:OQvGAdlCEL8c/yRNw5CnLm
TLSH
T146267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 d9ef90e5c3acb04c8bbacf631bc82917b85a9f71b849c09fe434f4f600af9145
MD5 44d0d4807d1540db47fb26b8cdac2cfc
SHA1 2582cb0b6ea499fcc0b6520c0f5068bdd910124d
SHA512 eeec45ac207069d27c9048e917fa592dd8c5b683f0c0a547478791dc4161880fe999c1628b5ecb8ab7c5fccd4c72d5826bf6a8ecfb52cad5db479e6bef15288c
SSDEEP 12288:AAwSfxL/2Dc39DLLmt0LDQewsAj7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgJ:VQewsAjrnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T18375E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1d92a30a75413915b47d93a96ca86efc606104515f4f1aecb0f18f5c8b720870
MD5 fd817e0bf6a9fee59e545769cc29c2ca
SHA1 9f2eadb066ef138a567559d1a2369b83ae5b1eb2
SHA512 4957e3b44ed776cb92e602e6643a608e4741e5c7fd25d4d8538d1efa44c7366451741f08060bfe1b06d8d650875712fdc4648ec1a7e42800b089ce35779158a0
SSDEEP 196608:NUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH4L:NUEtQevvqc2W1cpV2EI32
TLSH
T108474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6a62a1c6083a50e124a31c654dad3a2e947dec9542f1d27998317a5bb3b59c69
MD5 94f77511c36359ba43093b62de604569
SHA1 3fd1a29f76f205e37bf1147b3d32e8a6de039033
SHA512 d9fb61626e94defb51f165a66df25c1490f6d30eee206b7df329f59f17b66efaeeacd20408a011a88b6db6f0a88e21a081f8540baeb3241f3267b5597e57df0f
SSDEEP 49152:mCbRquA/m2yL5zQfFiV+XenmE3/zLQ/lFTjN4:LoqtVjnmjLm
TLSH
T1AAD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 71342aaa2d8dabafa3813a67db9b8d6aca7b30e9ec48c24bd605835cd16c712b
MD5 f7cf30996eb95e0a0134026907c1e9e0
SHA1 55cffd807023df375e390067a08899c4664ba9c3
SHA512 b7136e01df3d507b6b64c0cb254c1f2c7ce35f0289bef487c84ccdc37039cbb5b0800af612ac9319e02254b2edb3ab6b22d7d4dc6f4431f52598cdbc456cbc57
SSDEEP 24576:RAhGLJIFoiwtA5l7S53wnQ/tbw/2Mkjy6Fr7g0o4:RAMyFoiq5gQ/lFTjN4
TLSH
T15B35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 cb6b05180474bf2a75b3d4c271ef8a080df60b6d96962ee3224f9b41f9dd024b
MD5 4b491fdf8e4192804d95d0d13ebf8acb
SHA1 08bbb87572d6ed87b20bd9b136a0581545a1c5e3
SHA512 a2c7cd550a3ebb658dfb47bc4285c9bd83d0400627a041dfe49866613ae01d88bda76bd2b77c794a2ebf53e35c357180104dbabae309e52451558b6b357a2777
SSDEEP 12288:Amw5HEjsChN2BFgl0WDm+CkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM4:dwuHOWHnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T13065F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 8f487ca9769d6c84d9a4abb37e43cade4986644ecc2302a744789eec94f7d075
MD5 7834768e56d6b3be07f7f0261f52f9ce
SHA1 bc676baa10a65432fffe6d9cc8e1b9adc75b360b
SHA512 3ca1b4ee7f971dc3a2cee23ee56b0962f32120d398113f4856c6af68adce5129b5f83817a9432888c679da1ecf5e359cf4eb110a00bccbb549a54c09078484b7
SSDEEP 12288:WXZ1IyLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:mZumnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1F555126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6889b055ba400a17ec6b692bb9d8dceea326a0157b9ad83b4370d4b51895c80c
MD5 7d2741c29add59f09b5f2538f5c89c66
SHA1 e15cdd779957840e53d10cc6295111595de67f27
SHA512 1c8bb418073c37218525869956aeb9acea30b3aee66c52db746a4ab691f1f3ec11118d1574cb052c36c6dc262423484eaf988ba5d14d81ba37352ad212cd6aec
SSDEEP 49152:oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UB:PQRQyi36YOcPQLvw2gAf+PN3OLm
TLSH
T1E9667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d45d8e9b4573c39f0d12537043350535e896d833c90d5464255a95961deaf177
MD5 e7690e8f16ac531d54562497f814b7ba
SHA1 87ed3882da6986d9eec16aef99c8913c983aedf7
SHA512 4a12dbc1bfe92deeaa891878cbc8b73918f87c2191809517a98ffd64afff3c1b7726f76fb9b608d575a929bd441032b661112975f2dd06f9466de05b1b7e802f
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UB:TQRQyi36YOcPQLvw2gAf+PN3OLm
TLSH
T1C3667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 b6275435c5e1d41e58eb6ffd908fc2082b40e17e0e888c856e5ab81a3b69d7d8
MD5 3ff262084fbff5653fa88032c48aa363
SHA1 7a76d4a778237b7c012b00af75c7141dd5303165
SHA512 8e0d6f35a076821f57e8b0a6382465df79eb00c7b5b336ebb74001b6e074206a23096d3a9f3c3a18bf31da1e692b4d90c537271d3c3933a9ee3f372518350c31
SSDEEP 24576:lwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0WnQ/tbw/2Mkjy6N:B68Qg55nhheWu7PNU3/bQ/lFTjN4
TLSH
T1C9B55A33B2F600A9C44DE1769F46872196D27C758FE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 246f07ab087f59d83e9404ba6a80beb3b05c234b61a10d0440585515e1bb048c
MD5 02d1db8ad539331d50d25100d9a40eac
SHA1 8d498d93dae2d7c9eadcfb3fde5c88293444e3ad
SHA512 e2b9951c4389447422278796ce3702e678745dd352082bad6038b6685e70abf48da1bc6fcfc55f5e864c8022276a8fd680d814112a134c58a5a9798ed480d7c4
SSDEEP 49152:I3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99j:ly5112gYy5azzVvL69nLKnhZNLm
TLSH
T1CC167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ae703ae6b44da1ea2f11351b2ea70e45dc5c39c4d0ae0c77fd128f3e2824dd12
MD5 9701906679834b85e29f50906b538267
SHA1 aa070002eb04f945708892b15ff01cc8967e99c4
SHA512 64ba269b1d55b50861a16633711d517197f9b8fe8f9cfa1d7cc3a43295b7dcbd4dc6477ba4af483e0526bef72a47efdf4320c5138fd5556ec90ef49fb600405f
SSDEEP 49152:iB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glxQ/lFTjN4:Qu6JmVxd2dWLm
TLSH
T15FD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b276511ace4d0c6b7e483bfe2600b0f66fe58132bce9672935726b1727fe87ba
MD5 7710c879f546cc7f0710bb02c3fb2cc1
SHA1 15718b52985cd75f64f35e60f8e51ad199588a14
SHA512 a906db85c04de668e985d809be56b712dc21e8b9af91b6cc47d75a82069053fa2fa3d095870f97d55c4475219753554a3bbab9b9c0edff23081089b69d426d2f
SSDEEP 49152:i1hpsNoJpF1A6UU44CwH7R4x9Q/lFTjN4:imifPbRjLm
TLSH
T1CEB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2f4435e09340b251ad6621c375800f5cc2b7cee98967750797b344b233c64243
MD5 f512814abf13e54be1eafab657c3d582
SHA1 535f5840e1775c9b2b6c9b24b1c346cc972b52bc
SHA512 edad203c734a79944cf9e55802dbc9ad6e0d6658007c947078492ce453ccdf29ee00cca94af7990eeff21786003fccd2d28645241bbba6b2d1e0513cf9088507
SSDEEP 49152:OSuZQIY0Be2KRRVtOnks6NMHqmQ/lFTjN4:A5dKTi61xLm
TLSH
T1A3C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2510111b4ba02a3aaffa59426b0213b2cc1bf36142e35d3ce1c6dd1c60d3e549
MD5 90f2e3829c167a0be74d7f2cc08ca172
SHA1 e834425fd00c4156abd0f530e6a4e1fd6431f86a
SHA512 1a5aacb375f59401488fda635e463fbea1bd4248caffd99fd0e87b49a515906ad4bfbaa9406eb7f9caeb577d7dc370414e207b95434dcc9fa401eb5f4b395619
SSDEEP 49152:WhtSn8EApI0figngiDn0AP5wBQ/lFTjN4:3X2iyphfLm
TLSH
T18C95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 3bb903e0685d1c09c8180d22b90959d57abb0bf2664ccc4723312f6217d15306
MD5 6a9d29f255a5218ceb944d501ed8bd0e
SHA1 5655fb3c06f9391f6b2de0fcaf89d0ff1be35ef2
SHA512 a47223ce26ed3394d5665dddac7824c24ad7de614cb8ae4c913ac34fa2be382573eb1a5293e611b6cb418549e7c3075c11103f3d18e833ecc5670074be0612cb
SSDEEP 12288:X6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:X6nQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1FE5523697965F98BFB1706F18C828182A73F0DC6BFD1A38F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 66fb20123e960e49faa2f6df29990e15d39e623c8bef682965432cac8c042ec9
MD5 d1825a03c86c718731010147cd2434ee
SHA1 13d16d03fc835365693378986b4adf9e4444b47a
SHA512 1e316a67ba21d7e155b5ee5539dbb50514ee444870a2c0f45a21a866d962f85ebcf452f8b843385bd2545c5ffd503d33f508d68f3d51984ba5557cd4bf1f060b
SSDEEP 12288:evGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:ePnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1EF5523797965F98BFB1706F14C8281829B3B0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 8b6153c94de01c97f4fd00b9ab1004516de61e43818959c2ad699c05d4d21628
MD5 f7c64b1a6955e2bcad7659a2bfffdf12
SHA1 22a68bae1258609441a40481beefbf7e242f47a8
SHA512 ee49042bb431ff46f82b28f79e79d10533d9c96d78edee6c5b4f7307aa6b76825c6d0c8ae7c4b6c5ade43f8f657d58a91240bd7b64b157dc56819c6ba709a184
SSDEEP 12288:AVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:A1nQ/tbw/2Mkjy6Fr7g0os
TLSH
T1805523687965F98BFB1706F14C838182AB3B0DC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 27d64a71a790a4f567db65d7b9a55d3bb720d8eef4c1dc6cdedb956333e9b9e1
MD5 98221a6f0029c21f31f20fd316ddbd42
SHA1 8cdff876d8ef2ead50c496ec30b837436f3bfa53
SHA512 1bcebb667cb4e170c23ce0e1f68dc0264a083d25fc0b549941aa4dd9e1a8ae2d0684be7e0d80fcbadb6f6d9982f08721d24b361187ddcb64aecb47e7db49f0f9
SSDEEP 12288:IVwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:VnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1C15523693A69F4C7F92742B4CC938142E77B3DC5BBB1A38F6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 cacf16a2df034b59d8720fb1032c7a0a52f60878a8a83acda246e7fb5295c405
MD5 21691f6c71459bc37bad44e5bb0ab024
SHA1 344d8270d611f6735e7909e06034d4596a011eeb
SHA512 f03e191305006cc4375e931b0462bdcf9eaacf1b04913ec82367fbddb7304a76cc054c78ed83c251b64b76720969675846be157906cf73729f402cec9140e1e1
SSDEEP 12288:yYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:yYnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1525523697965F98BFB1706F14C838182AB3B0EC6BFD1A38F77481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 8dc2d1e5fb205179ff48666d24d82484873be53d7f4b22c4c62bcab2fcae77ac
MD5 c4f828e928d0f933510ecdbfd85b96e8
SHA1 fa5784a06da339bd368dde83717e1eecf7403048
SHA512 506132e6ae89506010cb548172594a26f71ac490f47bc7626aaeb6d90293ca269c90325595195a26f2df5bd2a54f5302fd683103191f439478649b5472a19415
SSDEEP 12288:1zGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:1jnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1D55523797965F98BFB1706F14C828182A73B0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f58e2d738dc31d051dc45ad0a2b2b6c0846cf4eb64e8cf95a51f041809addedd
MD5 51e0049f0076ff32bbcd8eba0599e3c2
SHA1 7e28d424395b62e8e03e1eb1552b0b09ac262743
SHA512 b8e06148b6c8c58558c52cceef06b88967c06fa3af20bccffecee3698dc03390207fec1090582b026eef2ce1e8af21dbb6798c3043401b4bf7b17c647787cd01
SSDEEP 12288:fXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:f3nQ/tbw/2Mkjy6Fr7g0ot
TLSH
T15A5523797964F98BFB1706F14C8281829B3B0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 2723aec4503b768bbeb795cf5992f825a7b3ecc8a0cd1fcc5d833fece8a4f6ac
MD5 98964fe652aecb2ebc3ac406f64cafb9
SHA1 c5a5c4dac051316af28c455d237a025b9063f5dc
SHA512 aaf41312b1f27f087a3a03dd4a6c7b696c827588188f474e9a8c0e2b284f1276288473ddf46ef39e8fa4941208d7b03586dbcf115f864be66c7717f0c3ef10b8
SSDEEP 12288:7iZwbDzzFEoS2cPvyPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:mZM3zFVSOvnQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1197501A5B35058F9EC67827ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 56ea9e704fa61e705915e904593ae4c3228fbebe2b8ebdcba41e07ab80c7f374
MD5 c015f48fc6f5f56e55e39b71ea629407
SHA1 1318f03cc5faf42968c9785a200d913bb8ccb3bc
SHA512 c6940beccb11438fe38e65085d5f168c370e91444147a9587da2f643bc8a6a3b218c94dc4ab692fd643efa47811cd010b4b7d7f6c8693a4002946656f690b017
SSDEEP 12288:5WGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:52nQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1555523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 36d195020d3ad3ed9b8661c4076a0267d38df4dff869e79fbaa7134c4bd58b28
MD5 b4cceedd449f1dff470e006efaf052b1
SHA1 94514ac1602eb70a0860a9dd728de3eff111f0e2
SHA512 b50ca17cbfa8f4c1b3c97345edb498d2b99db1a9b08746482395c4d595dcf6d5b876970696784e7702bf3603889e8ff4b8b554e1a609d6ca30c885cee3bf5a0b
SSDEEP 12288:ASGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:ASnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T12F5523697965F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 0e10ece980f05ab632a61bb1338f4952f943650de6d3075c59202d125226046a
MD5 58411dfd2f006e880300d3ebf574f824
SHA1 b0141b67763510835aa4a84fddeba4cb6d328d3a
SHA512 df12c9ac4da99759d2d6f4dac4df2f33fb4616330141457c55645bcf44d643666fae3f626134d83c73e6a84a332f495d1b3b44364dd54fd408046f11725e079c
SSDEEP 12288:hyPz5L8LGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:wzy7nQ/tbw/2Mkjy6Fr7g0od
TLSH
T1DD65021773A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 bb384800a7795c129ce9480a56ab9b7ebe36405beb6572cfca7445c28167c768
MD5 0992ce436298166b111f3ed15469ad73
SHA1 726b5e714faee1aaa905238626a953db21020f4f
SHA512 6c1efaf9489098b0d4f8ca703605b7948cbecdb5a59cf4674a9d9b398badee2ac7daf2476df2b6d4bda955ded13759384d13967a264de8acc4f51ae34fb7f825
SSDEEP 12288:/WGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:/2nQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1135523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 b3c25393067574be2bf4f024d10b06a4a49693fe7e2d48a1cd645cd66c78542a
MD5 305ca28eda1ff2e19e80a49c9da36b24
SHA1 ffa32fa425a10a140ba5459093b3b5957c1d2a7c
SHA512 eae7502ae750abca67768a0894c2d68ed8b68797836a50d027f1dfb881a35a27eb70a65fdc99195f0ba77d0892708e7eb827ad94879cb2e4cc35161fa575015c
SSDEEP 12288:vWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:v2nQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1BD5523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 70bfc7729c227dbd42c061a95750470f47307e0a589f6f9db4f639aed842b41b
MD5 c0b98e3c5d4fcb793281bedac5569a50
SHA1 e443707a617f029b89110ec4e922553b0552057b
SHA512 975f08cd8ee031f7201ac6172b071b983b3396e76ebd125de33a5cde213434d753279d1bd1735b5dd6160c39deaf558e1154ce55aff4b80fd515bbbf0e98145f
SSDEEP 12288:9yPz5L8LGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:0zy7nQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1E765021777A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 adae43de255062730eb1710b5feacb3371d7d467f2c89ca8176dc24947855893
MD5 e2cdf8d071c35381a52a495e0ed4b580
SHA1 1f92410c86e58db719ee158a252139d75754ee11
SHA512 d6df339dea9da342f3b34afcc6cd41d6f3b14bad7d7da32f94e30108db12f153ff193ccacd97cb731e26f85eb9e8e21bd90cae4b9f762f7a1baf0dd5ddcd8cf7
SSDEEP 24576:CT0aLl3z0zDlnQ/tbw/2Mkjy6Fr7g0oK:CTDLljkQ/lFTjN4
TLSH
T1367501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 9d1ace17738f39374aa7861d62a4babb68315b578a99ae3de895cedfe1684bfa
MD5 6002920187d98c10d2778576dae00382
SHA1 d290008da2b696ee088b4475daa21b0cfbe03223
SHA512 1699a2caf779a15d6401b1e31ed772a07909e3b561dc482dbe9225593a2d23623b31b012f0f655b412f22eb41500eb7f7eeeab455d5c07a8dad0332328372423
SSDEEP 24576:J31d9CHKy7GZ5nQ/tbw/2Mkjy6Fr7g0oU:Z1d9CHKyazQ/lFTjN4
TLSH
T15085CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 e27a58ad11a0f9e23f3d1d0d9070db9281290b8b79d2dbaae05435e4987abfa1
MD5 eba36df2662b4b46c1628a471394fabe
SHA1 c731ae6036f6908efd7c4807e9ba010ea757908b
SHA512 46a6b3b682ad7e67fbe261b181c73961c8f1f6fc941920570ceaf0142aa0002741e0804c94c56332c91ae690b750208279aaad775d9268138efc92f4cfda16c9
SSDEEP 12288:n1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:nVnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T14A5523697965F98BFB1706F14C838182AB3B0DC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 2e219fb391610921e396ec86cef99cd4221078240f265b0378fdf6fdc428764e
MD5 acb532bf194328db7fd979f6929c1679
SHA1 18f3c796de343296a8a838dab83708fb9a102bfe
SHA512 50cddc8b18930e9c52bdbbe17ce100ce8a857e56228b63ba279604b2dd2a42ccdc65be9d6eb69e260f6a60ab6c90ad43f14f97651e55e8e9e2fe091f9e8993e3
SSDEEP 12288:TrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:TbnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1375523787964F99BFA1B06F14C838182AB3B0EC6BFD1938F7B481129967D39406D67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 7a39ab0664a18a03769ebea65a162c81b814060ab4ba18e68d8e4ae490cfab91
MD5 bc896a5ceb4ec5e0d78d1281a3709bf7
SHA1 ccd04be3b5f22d87d0cc683ecc2e45b3d80bfcec
SHA512 00b4e896db1e9f130888504409df8430580a048ea28cf73f2d7dee5d5421e0466faacc30ce876feb78e83ff782bc49b26b0f9194e39ce7ef9b80f8f5edf8905f
SSDEEP 12288:/MGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:/MnQ/tbw/2Mkjy6Fr7g0os
TLSH
T11D5523797964F98BFB1706F14C8281829B3B0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 9fc991c642dabe3356edbccbf5e8bfacff6d00688ddeecfc79174a0a5134a9c5
MD5 365829832e6956d1ca130636590ca83c
SHA1 0bf2a59a019fe3dc33d9685f2c3dbadd7781c652
SHA512 b9ebbb18beca7155a56e1bc41d90ff547521d8eeb2d49295b503aed52338d95ab6eda13c53d6759193a05698506c841dd3371e6186104327114eeb3633d668e7
SSDEEP 12288:uWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:u2nQ/tbw/2Mkjy6Fr7g0os
TLSH
T12E5523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 4b7002514b0d4283b703bc63cd900376e0b628d47d9baf3f8c43f3ff7f44a112
MD5 bac784c2699d355235789c198c810fad
SHA1 b07a0701bddbbf27c617f9e602d5198b9192df04
SHA512 7efb204648404bc321061e575c04519d3c43c9cb11c32511b6581aa7826b52309872e060a6b26112e34b4ef198f218c364b4fb41b1086d33e9dd25d35b7798fa
SSDEEP 12288:R1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:RVnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1335523697965F98BFA1706F14C838182AB3B0DC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 bb14db812cac9dad813c54adcd05a0b79411aabbdeeb2f37129c278bfde0cfd8
MD5 d2c937f9e0e3d0b6d13d64b53c497766
SHA1 e20f302bfb73e4ce701d9e20ce574a5eeea2924f
SHA512 89513acf0c443cdf87fbb4ae43a4b1b7608c69e5c0c99fb5b1b0383ae0a58da4931880f9739e9f42ee37d67a55030a0a865c3e738e2bf18e047c3b39f4b8b2e5
SSDEEP 12288:q+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:q+nQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1265523797964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 3de2f31761948482069a229bfef5a2e4fb32a4b25f1fc2dcf9f38ea425fbf0bc
MD5 9ddd5617519a98f11b60ad4190baa197
SHA1 5eacbaa0ca76c13db60e3744e7087acb2e5ec4b7
SHA512 90f77e9c9d64f77ec5444699d8158a90e0d6a045a7476d4d60e8d6a243ba33ecc2b6d65cbe89b62c133b3861d5c47dba60a076fbbc132ea50dc3245ab5dca115
SSDEEP 12288:DYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:DYnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T17B5523697965F98BFB1706F14C838182AB3B0DC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 962a69b1f3950cb882bce4d137eab8fabebed3cd2fdaa0b14b52164f2b27bc8e
MD5 50997b3ec5375cefd2c7567989de60b6
SHA1 0d417058b1443c04ea6d4ec306ab2e645e225f91
SHA512 5999fffa3db8e8fb1ec4692dc7ed7d65428407da8cbec182263f70fc4fc89901d8272a636dde9f77ce51a65b0397567b0771a6887394ea81ab4692dc4f56fe10
SSDEEP 12288:CNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:CtnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1FA5523797965F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 395070ae8ae394239cb3f49c3f1b00153ea6fe962cead91fca22bf9304fcf0ab
MD5 74b4e59dc375d1723d274d54c4b97598
SHA1 2ee0f602b1bc98e0b8a698385347bb6b1a9598a8
SHA512 e5af91e79f5a3718c57920b6f4aa8655c050f49f9afa76f9c5e80c456cbee8902b50c431dd48f43cf3bf32109cf21321c5f48d05ecba2ec37d7c632ac7e9cde6
SSDEEP 12288:eYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:eYnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1FF5523697965F98BFB1706F14C838182AB3B0DC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 58434320e3ebd98af4a3cbf5857a28f6af4539de25eb4887929faefae31b8ac5
MD5 36405149ea2c1f21c996e5906661b508
SHA1 cc572f3d965e4cd0ebd550d80026f107ec769557
SHA512 200f0d16b26b0e750f1cc0fc068b2a890e302c0c3bc720ea5bb68c186f3eb9618bc2bafef7959ebe97dc54347dba72a66e1febf3b3bfb2465845ce56d012dc67
SSDEEP 24576:6fwv/k9RX6wkyAIinQ/tbw/2Mkjy6Fr7g0oN:RMnYIiQ/lFTjN4
TLSH
T19085DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 a0ce28e383d95f519c5c35c2183b63f56a60a82abf96457ce8d0e76acd3796ec
MD5 6d3d164339a34742a21555920b74e928
SHA1 c747d60ad7abfae8b0dc6d7705202cfc80fd1961
SHA512 48e2df721212ea21dd1d52b2d0abec0d8c9d6e073f464d51b4aab08d3f2aad9ef9008b1a31fe85917ffc8003951a0dfeb449fc372f39f450334da3bbd52bb601
SSDEEP 49152:ZYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0hQ/lFTjN4:BySzPuLm
TLSH
T1C1066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 9dd0a8b08036a7b5a1828b90914264cf043f6cddac8d7acc19b0b6ab561e3b82
MD5 15a159a0dbf5eada0273c477279c0958
SHA1 24448919e6a339df382a26dfd3c84ea180a32e5e
SHA512 33182ab389b4d83126f6e7799a1f7ca201822f6df108b516c8d3d096282bdf33a97671a790e8df9081988822751fd088b1b7afe7d318326a19a98cff70b5cbd7
SSDEEP 24576:s47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY/nQ/tbw/2Mkjy6Fr7g0oO:s47JUQj1irIhCnDHUPfF/xQ/lFTjN4
TLSH
T1FB65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 352d51ddc895369ffe45fe45091ca646d5965a346560b81e38991127e2f6a2bb
MD5 d4b3f5a347c6720c43856bb55f8fb1f5
SHA1 60402c35ebda7a2d56a70341b1bcca7a79de5af6
SHA512 5e4ed5d15954fc9900ebaaf4b94cd12f6f9124181bd4f01afd799f18f7fee488ceec0cae2747ae78700f8160de5cf9a4336f1d7cbd61471e117edf219aab49bf
SSDEEP 12288:3ssfGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:7mnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T11B65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 864KB
SHA256 dccede923486ce7802c2848b532222320c52457b1e51ee8ca533e441fb1c2bab
MD5 aec036165185b45ebf20f12e71f3eed3
SHA1 ddb6737b2472daab6be48c99b98383040c11bf1b
SHA512 cc66709602b2f9a47093db0b09874eaa849055cbd70628879cf6e064ae0692b611fb51651c8e134d119e9a8f225e4f9377f8fe65e5ab00eb1c3c9b76b8c4d704
SSDEEP 6144:asBC2nabSkLHwfFg9dotMxQ5onU3fdkoonZ6D8KOoe77tCLBlblI8VAQZgEdUbYD:fQ66U3fm6yxCFqDY5rL1nAUVWC
TLSH
T12A151710B666D74FC66940321E73C5CCAB707D41EE44AB0372C89B3FD576A58BAF6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 fbd12d29bd8af332be3ec9a5899add109cd6b6a876ac27b95c670837a19cfad1
MD5 8ee6a2118df59f5ae93200561761bb7d
SHA1 8ed6d3d3eadbb5826634883e4ae8f365efb464e7
SHA512 3f592bbf19fff7c027aeda7bd86146d3b47a0cb0440876badada4b23a554c3c00ac2d00b3297bf3c645e67cfcac9915ee6394fca52d2076ea6744ef76339d019
SSDEEP 6144:x+t0JPFi3HrOALloxEoDlI34LQHLb72c9MtMxs9MtMxj3ilg76GEYzZtO+3/9I8g:x+tpZYquVzZo+3VI8yhdSC
TLSH
T16465C840D537A3CFD1FA2072072A5B8C6768EC47B7496F26B388453AD866B15B0B93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c2d9b5e4c11d3bc9e9046ec1af44861563e3e2ef9a54069577f6cf2ce5a85c13
MD5 be3cb03c3e781bc74249033ddb889cd3
SHA1 bb976586989f7bc4da0d31d9d538ddb981446d14
SHA512 758cdad4388955394cc8f2af4ab8403e824ee506e144b6ec27214c43e7fc1ee98dd4fd6e2e8885587608cb8690ee16ce150fb9a74faef6fdb4af67d81c5f47d0
SSDEEP 12288:s67uGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:HunQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1755523656668F94BFA3B06F048928111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 59e5fa53c86c17f73b87039b40660dbbbcc0fc01e684832c266b644bfa032f5b
MD5 cd754c06996618fceb5681a12cbca85c
SHA1 3bceffed638414cd81943cd6c1675d4f667fec9a
SHA512 cbb9d65db1204d1ccf104db0cbd28a67a0e89da72df61530911bb6e65b846867002c641ba3276514c385b3aa0bcbbdfc5f49d87b78663c9973be0f1ff12ccf32
SSDEEP 24576:Ogb6bmBIi49WNNFpg1rSvFv7bYknQ/tbw/2Mkjy6Fr7g0of:Ogb4mBIBhGF/Q/lFTjN4
TLSH
T18E65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 4c534d0c9e24295af7136d065d3f418887eb4876df69069b065ef753470ff371
MD5 cd82c8939d76ce03b981ff86f8408e40
SHA1 63904916814970dd07ec7bf4df12d9c3dfde6dca
SHA512 0a3caf65de510518bb9d89f4eed6ab002f40d51d21809311e53ed3508488d8c4453c3c879698ebdf12f259715fd1cf01eb1a0cbedf212b29290490bf799a2373
SSDEEP 24576:aG88u8FpJqH1Qzria7/mvnQ/tbw/2Mkjy6Fr7g0ou:h7ZFPqVva7/sQ/lFTjN4
TLSH
T19185F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ca0e037b75c24474ade23dea7b94938343760bc1931fe2131066bdb6a202130d
MD5 124dbdde03b30c76e8ab374a59c9c001
SHA1 13344f8f883ded340fbd9956be15745d7b321b33
SHA512 4f660f2563fcf30e3824d10c7213be697e5467ddebcfd1beba6c761d30a5eac37e86f89a0b1be0a11c809df1b8065d6bed624d30380efcf201777dec0aa24697
SSDEEP 49152:8BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjjQ/lFTjN4:fG05lO43bFLm
TLSH
T138D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 eea5c052f5eedcea528b138b6110b6e58a64715539cb3d6fb44f3e2aba679667
MD5 9fe14cbbe3336503b72a4f397cfcadb0
SHA1 a4fcf6970902049fbc2786435228c31666fad8cd
SHA512 d2a3230c85e9168fe3922706adf654224ba4564e26b11964bb5ae596bae3e3848f630dc0d296117db1b581b6fd1e23e8a0728e64cf47fbe994ea341db56b796e
SSDEEP 24576:cfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnhnQ/tbw/2Mkjy6Fr7g0oT:Ea5POZ3+Jt2pasx2+mbQ/lFTjN4
TLSH
T13565AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 56478a44b14e61c5205d6759755623d71a65eaf946dd4add676472d427759bf1
MD5 1bedc81e99c3cc28b7a55cbfefc29a63
SHA1 55f09ef3901bef16cdbe361eabbeac2d90aa9c63
SHA512 5d3ff6945b7cf67c4a54f402e3db035518bd5e8267ab7f5d10bfceb698450b5e82eab8df8ec9decd8d62a1b49c2b40a2c7e46191a0122178414f50764d1ee34f
SSDEEP 24576:5NcwHdjbyQ4nLC18lb/EOjowL7FknnQ/tbw/2Mkjy6Fr7g0oB:5Nc/zEOVHFMQ/lFTjN4
TLSH
T18C858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f25bdeabd5205d81530c75cdced3e82f4f99060edfe7ac9c0fd09e133c1198e6
MD5 8af542fc0c3d047c1cabf2874b2b58ed
SHA1 97b5b48451684d25a3e6360f646e3ffb56c3ee1e
SHA512 63714b799914608da14ae453a44e23f57719ef70ee8823a121459714fbeca004305ef18ae163b41ff6675d6a32a5eceb790dc38fda77d66d19cc727e4483529b
SSDEEP 24576:I8kNvNnaFeYhJNtmZBmtnQ/tbw/2Mkjy6Fr7g0oH:I8MwBtOmtQ/lFTjN4
TLSH
T19055AF2EBAB846E4D1BEC6B4CD238512E6727451173293CF5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 7728bb1757ed5915d447e0b32399ba9eb9fabedafe7de6c927bef1f0ac017694
MD5 f2ad7250ba31458456ddd40209f79f29
SHA1 7b7e5e4f0b51bb7e06a31b657ea506fd3ca6f317
SHA512 b299030da8512172d879e6e33f8c11ffd0ec34984e2ca29a6220a50e7d1812a3d6ea1e5ee640e3d825ee0b63b641e2eaf2d806009d5b74f7dfba76965345f131
SSDEEP 12288:RHvUrBFrEjwaQDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:RPUr+NQznQ/tbw/2Mkjy6Fr7g0oK
TLSH
T15165E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 6d3a3ee267a9896150785685e23335bb172d1054a9d08e1ea11dfb8056becb28
MD5 8da3a511598661778ac032141fe59560
SHA1 1626c866b5fa8b5e22a02d70bc3a91193f2de6a2
SHA512 112858f1c8c16b080483cc6110269ee14ef908ce3f34bb9e8b61b9f427345d130db89d4b4988bfcda151a1b2005e764e247b6365165059fe3f4ed90057a68e72
SSDEEP 24576:sD3FHshBIYQgAanQ/tbw/2Mkjy6Fr7g0o6:sDVHeBIAAaQ/lFTjN4
TLSH
T1C275E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2172-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2172-40-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2172-41-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2172-54-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2172-47-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2376-369-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2376-145-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2376-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2376-144-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4600-66-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4600-68-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4600-308-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4600-74-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4792-103-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4792-109-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4792-367-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4792-365-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4792-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4900-115-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4900-122-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/4900-368-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5292-133-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5292-136-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5292-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5292-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5292-127-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5344-309-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/5344-78-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/5344-79-0x0000000000770000-0x00000000007D6000-memory.dmp

Download

memory/5344-84-0x0000000000770000-0x00000000007D6000-memory.dmp

Download

memory/5616-314-0x0000000000400000-0x00000000005CB000-memory.dmp

Download

memory/5616-88-0x0000000000400000-0x00000000005CB000-memory.dmp

Download

memory/5616-1-0x00000000024A0000-0x0000000002506000-memory.dmp

Download

memory/5616-10-0x00000000024A0000-0x0000000002506000-memory.dmp

Download

memory/5616-0-0x0000000000400000-0x00000000005CB000-memory.dmp

Download

memory/6096-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6096-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/6096-15-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6096-22-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6096-23-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6100-29-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6100-28-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6100-143-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/6100-37-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/6336-381-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/6336-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6336-96-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/6336-90-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/6336-382-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6336-311-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6512-62-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/6512-55-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/6512-56-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/6512-306-0x0000000140000000-0x000000014017A000-memory.dmp

Download