5b114a94cc2feda0220ceda79921e33e3faef441d2122c18cb9bb78d31b65096

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
Size 12.6MB
Sample260708-vbge7sdz61
SHA256 5b114a94cc2feda0220ceda79921e33e3faef441d2122c18cb9bb78d31b65096
MD5 d07ece9c4dc0e9596993b9af3beecb3e
SHA1 0ffe3095989b9b05cc661ac9b669be099c82fd81
SHA512 e6c06db5ecfc1b6637109b2c388bd7231cdda9ff2ed8ee80a66af8371cf6cd64bf21cd52f1013e77356d36c352701894be9718c9457fc75184ce93b223aeac91
SSDEEP 196608:RCKh+xH8QepWB6lF6n2SceHU3bnpD/B16FWOaHCtExqmXGJ5ZF4uIsctsT6p:we+xH8QzBmwn2SOpXtrHCtJ9rUuIsEs
TLSH
T193D612573B9484ABC5073172D905E3A15679FDDC192AA10B31B43F2FEC362D19D3BA22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5124	elevation_service.exe
2440	elevation_service.exe
2064	maintenanceservice.exe
4684	OSE.EXE
3840	PerceptionSimulationService.exe
3152	perfhost.exe
2928	ReFsDedupSvc.exe
5788	SensorDataService.exe
1820	ssh-agent.exe
3216	AgentService.exe
5888	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/5744-5-0x0000000000400000-0x00000000010AC000-memory.dmp	autoit_exe
behavioral2/memory/5744-137-0x0000000000400000-0x00000000010AC000-memory.dmp	autoit_exe
behavioral2/memory/5744-367-0x0000000000400000-0x00000000010AC000-memory.dmp	autoit_exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ded9b3f9ce3e03f1.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d7d54eb2f90edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ce20cb4f90edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005f1ef6f4f90edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000084cf3df5f90edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5124	elevation_service.exe
5124	elevation_service.exe
5124	elevation_service.exe
5124	elevation_service.exe
5124	elevation_service.exe
5124	elevation_service.exe
5124	elevation_service.exe
2440	elevation_service.exe
2440	elevation_service.exe
2440	elevation_service.exe
2440	elevation_service.exe
2440	elevation_service.exe
2440	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5744	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5744	2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
Token: SeBackupPrivilege	2928	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2928	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2928	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2928	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2928	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2928	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2928	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2928	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2928	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2928	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	3216	AgentService.exe
Token: 33	5888	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5888	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5888	SearchIndexer.exe
Token: SeDebugPrivilege	5124	elevation_service.exe
Token: SeDebugPrivilege	2440	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5888 wrote to memory of 1504	5888	SearchIndexer.exe	99
PID 5888 wrote to memory of 2368	5888	SearchIndexer.exe	100
PID 5888 wrote to memory of 5904	5888	SearchIndexer.exe	101
PID 5888 wrote to memory of 1940	5888	SearchIndexer.exe	102
PID 5888 wrote to memory of 256	5888	SearchIndexer.exe	104
PID 5888 wrote to memory of 5584	5888	SearchIndexer.exe	105
PID 5888 wrote to memory of 208	5888	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_d07ece9c4dc0e9596993b9af3beecb3e_agent-tesla_amadey_darkgate_elex_hawkeye_maze_remcos_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5744

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5124

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2440

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2064

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4684

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3840

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3152

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2928

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5788

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1820

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3216

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5888
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1504
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-515251955-468707340-1782030364-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-515251955-468707340-1782030364-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2368
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 956 2928 2932 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5904
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 956 2908 2916 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1940
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:256
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 956 2908 2916 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5584
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 956 2928 2932 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 f43db80ddbf9c8be5e8e245d1782707cb421bb24366907251a0921f431d9ab26
MD5 53ec757f426defb42865d01ef143ef44
SHA1 870ebe366000a1561b8b71249202b1974c9357bf
SHA512 56af7b359c975d234675dbfa918308ec2bac427789da83dfa9b0419551a67962842a8a65ebea1cc2a2bf1eada642a832e26b32199cdaf2218c27973229218f96
SSDEEP 49152:ib+632BuPkFKRrdE6ohdstBhuXjfS4LWxnEb5+Pl6bJTIZ5jdgp4:E3q6mjBrslgJTIZ5Bgp
TLSH
T1B3D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 26fadb966082600a9e3692f77d6519cdd17750de0de3d88eb412b968e00bf727
MD5 98107c93afbba83197a862b8bcbca030
SHA1 860098ef4c3133c85fc0033bef292357793f7d59
SHA512 ba30c49edab4dd3d3c6e2080957ac721a894762e4fead0458d436c5e76e2cf8229423b8bd595ff9f74ab5555754dc561e5f027136503a99dad40ec523ea378b6
SSDEEP 24576:xXYfDtczA0mb57GBiOl6a8JTth/RWZvR6wQQ92pN3x:Utcib5+Pl6bJTIZ5jdgpf
TLSH
T19C85F11967E504F9EC67823DC8E2C611EA73B85587A0E7DB03B499265F233C86D3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 4b184a0bef3da216371e29501cd425e6927196a1c4d8504348ee427bfa31c84a
MD5 a07c4b7cb1412de55d3e464bb30533e5
SHA1 15453044b54e51225e4b2b843c960867551292e5
SHA512 78841ab070c05936d249a79a11cc004afbb73f6a43be096f7cf9e06473c9c02f661f86c064a389acf0266e1199bc0b09e93115dbb4983430d737c289dcb0fb73
SSDEEP 24576:j0Le5ji0hmxyrMRmb57GBiOl6a8JTth/RWZvR6wQQ92pN3w:jPji0AI9b5+Pl6bJTIZ5jdgpG
TLSH
T1CB95AE16F6748335D073C0B9C5D2A68AED7230825B308ACB4296D77C7E67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1167262fa7bc39b23cad0fe889c96d1550e543d787d29e5bb1f950433b6bbd4d
MD5 9eaf631e5250291032e068db80ab9241
SHA1 75049ddd21d8ce383acd369359d302a80938490e
SHA512 82e23ad4def895cee88ed3525210441cfd1652751b4907b1a51bee52a2fdf65ac7658155b6ffef543ef89a23bf4a0e0bc9a680d6d8f403aa0617d8b6a45fc38a
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWj6q8wyubmb57GBiOl6a8JTth/RWZvR6wQQ92pN3/:W/ezSC6vUzPv+Hjy5b5+Pl6bJTIZ5jdQ
TLSH
T10E756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9c9f04e19f5da3d2abf283ecc6ae62bbbc64c52173de054ef572448e441a8126
MD5 5bbdd4acefec78b655fd0250f9072189
SHA1 0916a27c878c9ac65d244aeca7acec11952b32dc
SHA512 9b8c1cb15d47b8ac0ed0ce95e3d154a46b6a2a4f372a8b274968607f9f22e76ad648444ffbb4bd931d5c1ee887005c73f19735d48b2f7734a580539b2446614d
SSDEEP 24576:tVbqPb88hv/l+BQmb57GBiOl6a8JTth/RWZvR6wQQ92pN3v:tVO88hXl+db5+Pl6bJTIZ5jdgpt
TLSH
T1CA559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 63b8686dd6095ebefc66f644641589488fd42b6ba99a160e4465f3293e9b62a2
MD5 200e670c8a40f4e73644782ea42bfd3a
SHA1 cf570c58bd13eb9faca38ec312b132124617d4b4
SHA512 fa55c1191b73ff359170e773a037a04d48d3424090029d8a73df45184bbcdab67a4e210519f7c1c209b75396914667f63d96a4c67bdf8c7effc55e1f9a77f5bb
SSDEEP 24576:+FNmb57GBiOl6a8JTth/RWZvR6wQQ92pN3O:Zb5+Pl6bJTIZ5jdgpk
TLSH
T1626523434A6A30C5E5AB1739E9CDDF00F879EF55CD866BB6C579282BF034349B85220B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 a90cb64a2c286c19937885a561e31214a56ccb388899fb11ef23c60dd2f395c8
MD5 c7ceb242d796480810eb3fdec17ddab3
SHA1 9fa7154a9d74132996e70a6ae24caa6383d96616
SHA512 523376507e85397ae0d301dc6bb86292ea7015f1614a8fad37526a57a004b3dc8859a755c0e28dc51cc88789258f66c53224962e321667d18c9f6a0519ed5173
SSDEEP 24576:rJIUYmb57GBiOl6a8JTth/RWZvR6wQQ92pN35:rJIUPb5+Pl6bJTIZ5jdgp/
TLSH
T14985CF2BEE28FCD2C27A8D799A91C700E77278308F52A3CBD175820EDE235D55D7A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 fe13ba206a208344fb628b4388a7317fc9d5c92b23c3871368ba8aacc8f86c70
MD5 ee76165d11a7e213e453082d3687fbda
SHA1 786df796a39c15270b269a4be4b7e6de9232339f
SHA512 5c1e04d412c53b5fdeb95ca5738a24ae013d07db339510e4e6fa2da93daceda6b743138a328bf1a0d8c537fa8dda3e3e765eb3adb6cefa782ca7350b5aa026dc
SSDEEP 49152:PQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THC:PQvGAdlCEL8c/WRNw5CIslgJTIZ5Bgp
TLSH
T11D266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 fffca67ddcc7c1b0d8bf377e741adbd30c8ec269668966abc00f51791c1d704b
MD5 8708b3c382219c5c78c553e0e9982f65
SHA1 bdd5f83d466f9e830e651621a063415eab58cefc
SHA512 0eb4bf71c2f437c042913a85190f2eff0c7654ff873ddc8f9f5d34b18a7d5e3a7ccffae97a896cbee961427a61400484464b1272be5e8ab810e282be0b1c8ad1
SSDEEP 24576:aOewsAjimb57GBiOl6a8JTth/RWZvR6wQQ92pN3z:5ljtb5+Pl6bJTIZ5jdgph
TLSH
T1DE85E031FE75E036C2BB0DB65B65C706647DBA208F511AC3E3B84D9E99302C22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 57ea31e9df8d0597d62018948a98908d02c82991e41bd020008b9e638823e496
MD5 8ad42bddab8c25d9b2f769b7e21ea97c
SHA1 4fe54203ce8e38a6866aef61dd3d3b30b27ecd71
SHA512 91d6e120951e5a737624f613883370cbc1adf8511c795f261ae5f92719743c691efc885514e810d939d2d2e4e80f4dd3978919914e7136e91a382a4a85366339
SSDEEP 196608:AUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHhsT6p:AUEtQevvqc2W1cpV20I32hs
TLSH
T197474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 676a4a0b651851de65155bd99f246b228dfd528ca7bb481487ce5a0bd01e68a2
MD5 030d6bf595b91e6e9277a0aabd10942e
SHA1 00514ad631000e414e4e3a30494966fa5a2a1a54
SHA512 a079e8090f22aaf002b8a4fb39e7ff6c9e14312f86281d384e8be57f7198bb97659913995575a8301fc5b71946f38a304c9595cddf37260aec4b7d1e9b3d8a3e
SSDEEP 49152:RCbRquA/m2yL5zQfFiV+XenmE3/zNb5+Pl6bJTIZ5jdgpS:eoqtVjnm0slgJTIZ5Bgp
TLSH
T145D58D0976B8C1E4D1F6C77886A2C647F37178158B31A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fffc55d5aa4d94acc983a0596242cfc5db348c468d8194a2a81d87b2cdf3b46a
MD5 039f8bd733386f75a18e1ba69f318985
SHA1 2ab88d1c090c8fbb5aa11ada11389f8b8a46dd4a
SHA512 ccbd037d766f0a6e034d1c57035a3fc6ef486a1004b56cc6f0ca4a7c0fc792dbda62644d66efdf02c202252bce74f0b07f046df41fbce8fb665306eb46d3f868
SSDEEP 24576:xAhGL6IFoiwtA5l7S53vmb57GBiOl6a8JTth/RWZvR6wQQ92pN35:xAM5Foiq5+b5+Pl6bJTIZ5jdgpf
TLSH
T180359D81EBF955D4F5B3AB7899B68570EA76BCA65E31C20F1160C11F1E33A40AD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 9f9f9fe390c041d634b3ddd1b3b14800608520415ecbb23e71e08ac7583c2f18
MD5 e843ee734eef0b6f3a9fc47526b17221
SHA1 0664bd3515d9a38ce37eef925a99a40b519845ae
SHA512 8ed47f381f2e4e78b34d02fc55640bad716a332fc102cf1ea880fb6f8a4db7dbf06aa6db3c7b603b48ae3a43c29e631205b6f1c787ff1f5090a50e76df9bceda
SSDEEP 24576:7wuGOWWmb57GBiOl6a8JTth/RWZvR6wQQ92pN3I:7wNOab5+Pl6bJTIZ5jdgpy
TLSH
T14B75F14666A51CF9E9A78239C587C632F7B2BC022A21DB1F4770C65BAF333517D2A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 edcbe5a3aa2f2871fc697a940b7f2269abe88d8afe3aefef87e553e556eb75cc
MD5 921b439b2368d4f01b58c7ca1c310403
SHA1 ade310e06460e6ae7ee5dac9e913035e1a5cec64
SHA512 b91a78200774f0558e904ce59480b44cebb37fb83019d26814c4b5210cda08e9a9c29e27bce10d22a78c4e2dc8679d4ab5bfb0f1f9280584960214e37dec5089
SSDEEP 24576:nZu5mb57GBiOl6a8JTth/RWZvR6wQQ92pN3o:tb5+Pl6bJTIZ5jdgpi
TLSH
T16165128627A830F9E0A7523DCCE58B01F772B8529B7653DF4674056AAF32BC52D36312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d53226b910d1ffe0327959df338988ffb900c5bd02f23140173e638b9dd700c3
MD5 ed64a52d0faae6d5cb70b883ec5499a5
SHA1 721dcfedb8795ce093433a486641281f9ca02a66
SHA512 6a9664f349c7dd752e9d717c77cdf76707d95a490ca6f8ad28190ab4f59e4945840991814e66db962da349e6e2dff82120cc85ea57d7194f0a88113e5f6bf687
SSDEEP 98304:8QRQyi36YOcPDLvw2gAf+PN3/slgJTIZ5Bgp:jQyiKanX+PNvsT6p
TLSH
T181666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9c3d25a0787882e82badbae3bb50a84d70bd511a9d85e53ba76277a5a68d5cd2
MD5 5a456e12033dc5798843b67fb81cd0ea
SHA1 6a1f85a535ba36b4474f04a9d4ac1ef3fefbe923
SHA512 1bb9cf897048b0aef19853689f0087cbc05ecea01ffc1d88000ce12403d55a952f64b9bc8c60fe1972cbed42838b480b4ed955f3193bdd94c80c51720c952768
SSDEEP 98304:SQRQyi36YOcPDLvw2gAf+PN3/slgJTIZ5Bgp:JQyiKanX+PNvsT6p
TLSH
T13B666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8dccce419adc91f48c72bbc4cd49850d4155c1693a4052255deaf948ee252472
MD5 63b5c24e6c6366eca4912adcc82c52ac
SHA1 849a5ecd5a23ce16e6b2bc66d738c3f9b0254591
SHA512 2f5590d241774bb59c9b21f927b63e5e68751a64581eed18559a623f848d4d356a75d76bb927299ebc12cf4b0ac0a4fa5b8d908c708ced0f5100daf13523ec9d
SSDEEP 49152:p68Qg55nhkeWu7PNU3/9b5+Pl6bJTIZ5jdgpc:3thTRc/pslgJTIZ5Bgp
TLSH
T15BB55A33B2F60099C44DE1769F4A872196E27C71CFE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b9a7342c5eb310565b73572296943e095a76c427623c665e038db6c23bfc3193
MD5 79553386b00a5b06c7b50f667ed50c42
SHA1 08785bf5dc22ab8e28f8fabb7807c73c94699090
SHA512 d76c45af0641af7e7397c2c1626de1f43bdfcb9262bf6183ab99178c7a6e569e4028ea60cf547ee479197db78b068965c6865096688db812be2cc1f24e15a0a2
SSDEEP 98304:Vy5112gYy5azzVvU69nLKnhZeslgJTIZ5Bgp:4LIHRWh8sT6p
TLSH
T172167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 442cbaf0de165a0ca94570295224863f59eb13aab79b7f289f0f1663424c5152
MD5 36517e5122e43a3cda1498479d709fbb
SHA1 88e4601e08e78c088569e1e5c049499943adf752
SHA512 9c279a8d2edbb4f06ad6f0872fd1cf3512f5f151c610f5b3dd2c1fb3836991f9cd8854f8b3603110ef73442ee87cd70672494b6aa05625a042ad309624aac341
SSDEEP 49152:4B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glTb5+Pl6bJTIZ5jdgpg:Su6JmIxd2dXslgJTIZ5Bgp
TLSH
T1B8D59D13F1DA01E8D06ED178974A9233F962BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d7a3e5c840d6f16df8711dba84294646fa20347a358445a0699a1731290f21b6
MD5 a56141d687fbf81430131ad30e1d81bb
SHA1 17cc5b41796ac15c84612e557c9195377e5288de
SHA512 fb4b8922dc41dd7be6083a88ada0de9cac146f481b788edf2ce38b1ddebeed92f1e6942b7d868f3fe6df35eefdd625378bb5a5fafcc9d24f2f783251dcfcda89
SSDEEP 49152:Y1hpsNoJpF1A67U44CwH7R4xvb5+Pl6bJTIZ5jdgpJ:YmifPqR0slgJTIZ5Bgp
TLSH
T106B5BE13F2D900E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 13c15b0729ca4f694d43ad768d0ce63266ea89ba8d15b4008a5e66e68f88f2df
MD5 254b891315e212816d418ba841630c16
SHA1 93678185cb50eab30e338fad45f514c1bc7554de
SHA512 9cbdd94bf1f5c4cda29a0e9bd06cc2ea300239b9c5e25c60f892b939100050af5b33688fa68c8aaa6a7ae2b6e3e1ad34c3673206089e07f92d4a489649d6c465
SSDEEP 49152:dSuZQIY0Be2KkRVtOnks6NMHq0b5+Pl6bJTIZ5jdgpY:z5dKqi61islgJTIZ5Bgp
TLSH
T144C5AE03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 30f3500e793d487e80ab1bb20e37e4a2b67c45d9a8d6e519365b235f2c1ddd5d
MD5 a586daae055afc646c97464b298ab72c
SHA1 9de15e3d1b60477c90364e776e6e3585b0ed4692
SHA512 b328fff1ec11a49cdb620419f6a03aa2969ed44705e85f4e1abc584288ca9cb9aa54ed5ad508c23e02b7d611ed7482f64f28cdefbabf6a2827aecff4fc5ab1c3
SSDEEP 49152:EhtSn8EApI0figjgiDn0AP5wDb5+Pl6bJTIZ5jdgpC:FX2iWphQslgJTIZ5Bgp
TLSH
T1F795BE13F2D900E8D05ED178C7468632E962BC164B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 2e673cdcb9648af5f12cd8bfda4844dd62ce6961045449d076fb0375b44fa6af
MD5 e63e2854b98901b61f22850dcd9ac6c4
SHA1 4b5482ca139062abc248c5c90c8b983b69fc367d
SHA512 6f93b79c4c335dac9d64709132aaf041e2e6bd6fd2591e85b4020c07e1aa5895a50c42ed7f5a5500da1911bd9a2452aa972fa01b976fa6ae983be1411d970dfa
SSDEEP 24576:O1mb57GBiOl6a8JTth/RWZvR6wQQ92pN3j:jb5+Pl6bJTIZ5jdgph
TLSH
T10B6523824D6B20CAE09B5779D9C9DB00F87DAF96DE8727B6C67D0427F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 68b5af58765768e80191e59dcadf644c4fbe4db73cb30c745dfb032f9c94567e
MD5 174e7d56284cdb6c096e78bb4e30d6fd
SHA1 44a5cace3efa1fea6d4a3277583ef28df4445d25
SHA512 a8ebb7e71db85ce01c621b0bbc9057b7b7a8ef215440ef653e7883b6254f3a4bfbfeab990593ac8bf9747dbc817e522e9436324149748a6dceef167c0d88d37b
SSDEEP 24576:VOmb57GBiOl6a8JTth/RWZvR6wQQ92pN3I:Hb5+Pl6bJTIZ5jdgpq
TLSH
T10B6523824E6B20CAE05B5779D9C9DB00F879AF57DE8727B6C67D0827F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 98e34d0d8a7fd6c5d8e873103e094c06a5924f89c0c9691897c6286ca9ce4707
MD5 e19549897f253ca526e9a76efd9431a2
SHA1 0ad5e9f00d6724604417103cdf6610f4487f858e
SHA512 df235875e86954f926733e51efc5afea41e6c834c27a7d3772df128ed1ac5d752b1cce64bfb65e1c7714f1c0ea6cade5bf5848182bf79c0550f82ee1855bee39
SSDEEP 24576:Zgmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Q:Rb5+Pl6bJTIZ5jdgpK
TLSH
T1016523824E6B20CAE09B5779D9C9DB00F879AF97DD8727B6C57D042BF130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 8ff41c2df9cd8f5793edab608fcc018a84461810b61655c371465a0b14123dad
MD5 bfc519c16e9db4eb06f7f02d163c6b93
SHA1 dd371807782d8ec2858a90a575e7a73a397c013e
SHA512 93fa0e4639b025d07ceec677dafa816e05281f37670044404b214a43c36b337372e2504e5048153b8c8f0cdb34607a1baba34b1a990a3b15846e4494fd6fe4ea
SSDEEP 24576:0mb57GBiOl6a8JTth/RWZvR6wQQ92pN3I:Db5+Pl6bJTIZ5jdgpG
TLSH
T1536523424B6A20C5E4A79339C9D5D700F4B9BE96DF5267FFC675082BA9313883C3174A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 68fe33aed4261d68987597af634da5972266449ee352af246f54bee3284422d7
MD5 013a8329d61f2b071a3467aea79cbd90
SHA1 0f9e688f3d36807c416da8419f8a6d84fba683f8
SHA512 638544795618e3471a34980e7ccfbb09bcae8bbd4fd5715a49c5f4d0627c3ba3df26d55821f16392727ed8a4b3f7fc4fd787303d97a76faa0ce2a58774692b4d
SSDEEP 24576:Jnmb57GBiOl6a8JTth/RWZvR6wQQ92pN3q:sb5+Pl6bJTIZ5jdgpM
TLSH
T1766523824D6B20CAE09B5779D9C9DB00F879AF97DE8727B6C57D042BF130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 78a6c57e1e27418db922dced778402b23d909e345c47e0b14aea1503dfca3b9b
MD5 e8a8f6ad263a516c7c1b8b2c4faff73c
SHA1 82964851c7c6da2f8117b8a5803af2760066b3dc
SHA512 5a07ec251c9f5176abb95fa34acafb955ec7ea5014de91005211b295416841fe796091654bdb1ee50f08a47e650043cfe46a0c8c22cfc236ff1aea420dce302b
SSDEEP 24576:2qmb57GBiOl6a8JTth/RWZvR6wQQ92pN36:Eb5+Pl6bJTIZ5jdgp4
TLSH
T1DC6523824E6B20CAE05B5779D9C9DB00F879AF97DE8727B6C67D0427F130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 e49f66c130de7158dcab49cde66cc0753f80e40b5537b8481d804af551445aca
MD5 1ab94b11ce76c90d1b31fb8ae39f6909
SHA1 8d1c8a67567ee785ae587114e24becc9446daebe
SHA512 28e09ecb25fd33395a620e8f395df03007fa5870fa5c05e0af49cda4ebc0ea5ccd80e341889dfe0c2077aed8e9bf621b994d2e4f49fd8f57a5b5cf5cc35648b8
SSDEEP 24576:7mmb57GBiOl6a8JTth/RWZvR6wQQ92pN3B:1b5+Pl6bJTIZ5jdgpj
TLSH
T14E6523428E6B20CAE05B5779D9C9DB00F879BF97DD8627B6C67D0827F134389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 d9a7b3a6482373ed37162d2197f7ada0470fed0b760482170a8bb5c8bc438855
MD5 454411c1226fdb1edb076a9e1e8f2e2e
SHA1 3a8aebcb4222a00b1c730e0f541adb3c4b5e822d
SHA512 c95af1610394a3056989cb95aa84bfcbd583fb03263b5b7e5c1fd0c8ae4f2ed5883a9ad2818a33c7d05200203714901d572b159ef8028883ffd22c3081683634
SSDEEP 24576:aZMazFVSOumb57GBiOl6a8JTth/RWZvR6wQQ92pN3E:aZMazfFb5+Pl6bJTIZ5jdgp+
TLSH
T1DB85F295B39018F8EC67823ECD958A05E5B27C5A4B60C65F43B836275F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 09ce448218c77d7e9c3b139e73e1ed82df9be23f0baf72e35ef81c72b17247a2
MD5 754af912e47799d05c059cf2011b930d
SHA1 583e1f986e4de3e723f4e640326c939e2c8c9b78
SHA512 515dc99df219ad208a46175a37f2e1053b9fa2d089c91aae535fcbce3f7cff1092e166ef2c451405742382175e405628c6911362d9a0b7b5c9cd607d34861645
SSDEEP 24576:9pmb57GBiOl6a8JTth/RWZvR6wQQ92pN3n:Wb5+Pl6bJTIZ5jdgpV
TLSH
T1A0652387496B20CAE09B5779D9C9DB00F87DAF97DD8727B6C57D082BF130789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 000c5d8d3c4039d77846f2eab7d0390fa82a6c3a15dbe2737b755bd856a9d583
MD5 375aa917bb67ee5929aaad2077097c2d
SHA1 2f7aa54d335d7a60e312c97bfdc3f865451b95a9
SHA512 f1da6fd95ab698f33317ce4a76e6af9d33e2bd8ec539fd84d6771d35213217a09770763793c24611be837db9240ab35d9f57502e50f09019e58991bec3a099e6
SSDEEP 24576:e9mb57GBiOl6a8JTth/RWZvR6wQQ92pN3D:Nb5+Pl6bJTIZ5jdgph
TLSH
T18A6523474A6B20CAE05B5779D9C9DB00F87DAF97DD8727B6C57D0827F130389385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 44d97053465fe5e9f130d9e07c2515147fb2a2ef1f188112834987a5cac436d3
MD5 c805f10f1effb0063f798cfc1e1a0824
SHA1 430999cbf519d80a89e7880b54cd8172061edb7d
SHA512 28b67edde42fa624dbd4653772396f3283f54b9c042fbf328f650dd92de3f87f54d0edbc3f832184a7c4b66971ec73513262a951b5c32ff8591a3a136b0bd6ea
SSDEEP 24576:8zySmb57GBiOl6a8JTth/RWZvR6wQQ92pN3G:86b5+Pl6bJTIZ5jdgpw
TLSH
T1CD75024767A630F9D0679238C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 fe9bf4110dd5e2c475e147c9b0b82f8c7a036ab9e8e9a294e01f82074ba6dd43
MD5 c625f672b1ec5e66cb1b9ac235e05958
SHA1 b6c8c04e5afc1e74efbcfaedcc2eaab1d0e193b1
SHA512 ed1650232846e60b0b8116b6ebca27e1dc0c666d96fe5d0b151279f0824cd25a969a83b15c388be70efa43e1ee4475a32203f73d03d1043c704320d7e9d9fc94
SSDEEP 24576:ipmb57GBiOl6a8JTth/RWZvR6wQQ92pN3S:Zb5+Pl6bJTIZ5jdgpk
TLSH
T13E652387496B20CAE09B5779D9C9DB00F87DAF97DD8727B6C57D082BF130789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 021cbb3b73306259b50de9d9d1e0d76fffe94cfeecf414e20ea167741bbb2069
MD5 bdd092890fa977f3853598da28992b67
SHA1 b98dbbe54744442c4c7d789aa50e009803b806b1
SHA512 b585f85878f974a5d89cb7ee5dcc20aa6655656b8864214e0b2a9beaa5faae65b9f633ab735f1d8c78ff3778bc04f8778a5fb42c2037f55dd52096ac3f7478ab
SSDEEP 24576:5pmb57GBiOl6a8JTth/RWZvR6wQQ92pN3y:6b5+Pl6bJTIZ5jdgpA
TLSH
T1BC652386496B20CAE09B5779D9C9DB00F87DAF97DD8727B6C57D082BF130789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 dcaae893108ca76465e60b48061eb93f12131ba68ca3ef1ad1eae747dd20eb20
MD5 50e8218546dc9dbcce3c5485863c9948
SHA1 7f8523635d1915f74916861d75802e170ccf2fdd
SHA512 02126efdc5ae7f28394fe35383109d3e55f587cad9c71e9949c28775a8140a677d53f64448a7e127919de6a09afcd443f45e46ebc76c8799e73844dbf709afe9
SSDEEP 24576:8zySmb57GBiOl6a8JTth/RWZvR6wQQ92pN3D:86b5+Pl6bJTIZ5jdgpR
TLSH
T1E775024767A630F9D0679238C8D65B01F776B8328B619BAF47B406376E333906D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 0d85658fa4a356ae534c4bb300e0c1252ee97c0b590981b1984823dc7827c64c
MD5 d473fe7a2577752fd6a94de76eaab4fe
SHA1 20809d493f630a73d4fdf92c3020174dd5f966fc
SHA512 7cc5f85fb38d53aace4f1fbe52527f971e12f63cb1599d2cf207e4289ebd04d277097d6d2bb2d20292b9305bb61c1b30916c251627bfa4b57f32509dc9eee70f
SSDEEP 24576:zT/aLl3z0zDwmb57GBiOl6a8JTth/RWZvR6wQQ92pN3Z:zTiLljSb5+Pl6bJTIZ5jdgpf
TLSH
T145850295B35018F8EC67823ECD958A05E5B27C5A4B60C65F03B8366B5F333912C3EB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 c13d24d219ee54c6ab3a36cf5f9e2e6dcfc1bb0c8953c130b0ae8b50dfc372fa
MD5 15c7f61a4a375f2f31b22ab46e075ca1
SHA1 28f5d53c91627c0f35399caa71c27f452d05fc27
SHA512 a0cf8aeb4916e5a6a6869652d8bfa8c0e2f959ec0226ccad8289aa616072dc5cf942b7f85044f4d32bb812ad5f9d588a17d337ae4d88806bcdf8e7a8a2c718ec
SSDEEP 24576:x3Ud9CHKy7GZcmb57GBiOl6a8JTth/RWZvR6wQQ92pN3l:hUd9CHKyaFb5+Pl6bJTIZ5jdgpr
TLSH
T17695CF90F3E410E8F0B79A35CDA68601D9B67C5A5B61DE8F03A8251A1F337D19D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 1dcf45edad3248463f8d5456646dbf1b21dd658bfbd0ad89ba0a0e091ada47b1
MD5 90bfff778f4eea15a4573893b0d67609
SHA1 1a7f4bf0576321d20c7b57be430c119bbc2a699d
SHA512 e131a477da8282ad6f1b6c8fada93a0a9f434fcbfb12ccc7551a5b0a053252050a854eb5d1baa91155d26032210c29b78108afb9e273a1dc8238877e012e7d62
SSDEEP 24576:eAmb57GBiOl6a8JTth/RWZvR6wQQ92pN37:4b5+Pl6bJTIZ5jdgpF
TLSH
T1E16523828D6B20CAE05B5779D9C9DB00F879AF97DD8727B6C67D042BF130789385224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 72ab03d22bef1d2d4d3d324ad6f8f35c97cd95ee57a241a69dbbea440e57fe70
MD5 81abf32af99d80013fb931e18eb04bb1
SHA1 846d1db8bc869975fc59f23317e376c072ab2dcf
SHA512 316bbbb59879d15c05d33c13ee50b0738109f879bfe7fb69bd1ee51f97095537dce6afeb9d3916ad66f0dac53e5436e8ec9d50f24a2ec33b1e80944ef6c3f008
SSDEEP 24576:Cymb57GBiOl6a8JTth/RWZvR6wQQ92pN36:ib5+Pl6bJTIZ5jdgps
TLSH
T1C76523824E6B20CAE05B5779D9C9DB00F879BF56DD8727B6C6BD0827F134789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 4ea383a1c2161c84db5c555e7c669f7e8c5bb9ed6e6c96502e25d6834961491b
MD5 2d2fdc242dffd13f83e8c7290133a368
SHA1 bb5bc0b817385a812de710716583551cafad7c90
SHA512 9980cb6c0659b8efdc4b79860efa21f94a2fab637f54e98e572fac8a3b04db47e1edb90d17cde82290f7f2f0c64654008990510a0e13e019fdc3a98f8c020d79
SSDEEP 24576:aTmb57GBiOl6a8JTth/RWZvR6wQQ92pN36:jb5+Pl6bJTIZ5jdgpM
TLSH
T178652382496B20CAE09B5739D9C9DB00F879BF97DD8727B6C57D082BF134789381224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 a570f61cae33f89e835c45dfe1e267ba3588427015237afe0de3b2d02d159554
MD5 3d315c6a74dab24668f60c478c53c5fa
SHA1 665ed87030588852f9ecc8a75dd4935effa98c12
SHA512 00cb2fa7d55c81d87fc5b8039d8526152dad23938186ec7c5e32748cea4f695c2f4f876b1edf62dd10e4f73fa3e06bf2dba4546fa481cb3c79db60456ae28d6c
SSDEEP 24576:epmb57GBiOl6a8JTth/RWZvR6wQQ92pN3o:9b5+Pl6bJTIZ5jdgpi
TLSH
T1A56523864D6B20CAE09B5779D9C9DB00F87DAF97DD8727B6C57D082BF130789381224A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 dbc53109540a6610f55b091681b3893431b229adc9cad481dea35d5adcb2bc12
MD5 5cf62711c70ab2c0bb4fcd3c7a4237c0
SHA1 f7f24bf927d12bceb7697ec7372f80a5bd6d632d
SHA512 03124f01273f2debce4c6e19e21af63a1c817fc7c676eea98d26bc23705b8291a80af27de6ab710ae58e61faa4b4b7532781c445dd67e33c905fc4e164384dd6
SSDEEP 24576:nAmb57GBiOl6a8JTth/RWZvR6wQQ92pN37:3b5+Pl6bJTIZ5jdgpl
TLSH
T1806523824D6B20CAE09B5779D9C9DB00F879AF97DD8727B6C67D042BF130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 a6e3c37111a752983480eddb520fb31078e97e8886cd6c7d73169ed20207ba81
MD5 e200300a3268ce7cdcaad1aa4ad9626e
SHA1 798dadd06108a28fc059bd09103d8a8fe4619c9a
SHA512 16722218a7e2687b0956848d8df6b100782d3d7adffaf417b085c590de2ba87a62e9c638bd79865035c7d7f525cc0635b0ae20530d60404a63fb58f7a75a861c
SSDEEP 24576:9hmb57GBiOl6a8JTth/RWZvR6wQQ92pN35:eb5+Pl6bJTIZ5jdgpP
TLSH
T1526523864D6B20CAE05B5779D9C9DB00F87DAF96DD8727B6C67D082BF130389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 f0b3f6ca9bad30e8fc5f4400faa2c0bd407ccbe867c7c26a4924ccdd354300ed
MD5 c24492b45f99e01120a6d30701945fcb
SHA1 13e0d513707b3f505db2e60a067d11583a4e37bf
SHA512 9db68565f3fa83e97d7b09b7a3eddb801cdc588c970951292840083a7321d2f0c30a681580908a4fce749a8fd27399af94ebb02670d7bf3a516bbe9c8d59c255
SSDEEP 24576:hnmb57GBiOl6a8JTth/RWZvR6wQQ92pN3v:0b5+Pl6bJTIZ5jdgp5
TLSH
T1546523824D6B20CAE05B5779D9C9DB00F879AF97DD8627B6C57D042BF130789385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 3989abfc1e3c1328a05dbc5bdf6ccf4e2b4e45e8c55a23946dd8893c329d134d
MD5 43bb42fa1152f2fc24755bc41221c540
SHA1 44fefbeb8207cfe2610b4baaececbb9ce6c76d70
SHA512 d47a48eeae84ca5b0f37e9586a375a64fb7596fe86f60ca35e7133636f9ad301a54c7e0379d4bca5554d1002d3c9a76997d7345536094fc9ea882ba53441fd9f
SSDEEP 24576:QImb57GBiOl6a8JTth/RWZvR6wQQ92pN3k:Kb5+Pl6bJTIZ5jdgpS
TLSH
T1E46523864D6B20CAE05B5779D9C9DB00F87DAF96DD8727B6C67D082BF130389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.4MB
SHA256 eb130c8b68234ceb0089fc0fb9063a13053b3afab00b2e1378f3cdfb6fd015bb
MD5 15e2fdc2c3f2c2dded357cbd074c7003
SHA1 ea983feac2b02acbb1bb2d7f33341d7ca767bc34
SHA512 452c801f042cfed28907d8b636aff9a00191c8ef62adba1ee733c5dc722941d20b12871589df29327ddf559d48bd6bba1d04e4471a6e3d36ef80d30105a69698
SSDEEP 24576:mnmb57GBiOl6a8JTth/RWZvR6wQQ92pN3R:bb5+Pl6bJTIZ5jdgp3
TLSH
T19D6523824D6B20CAE09B5779D9C9DB00F879AF97DD8727B6C57D042BF134389385224E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 53607a4f5125316b947355c2ffef7df4a19aee69d4d9510d23fd833097e2a2ca
MD5 da9736b03eed2642716de13072fad8bf
SHA1 e03425ad934b449355c3e699da41a789d803e8a0
SHA512 108898df9a2439f44663f7898ed8ef4591a214ea61e8be5e86b7f4051d8fa6410f1aff1b00b7e078dbab24c62a23c313757159d29a94695fb2d0ea311c72d0ae
SSDEEP 24576:Dfwvhk9RX6wkyAItmb57GBiOl6a8JTth/RWZvR6wQQ92pN3r:QMnYIwb5+Pl6bJTIZ5jdgpJ
TLSH
T16295CF29EBDC04D5E0B7923C99E7460AF6B178595B31C6CF02AA536E0E33ED46D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3449311a6cfd0e874f60c2b29ca2a2aee96fd7e3d5db3485f2cdb4a91c12ad51
MD5 3a9fcf0cdac7e04852b4fd5c68bbf359
SHA1 7a232a3dcdc769b052e9d90e3d623cf2d8de538a
SHA512 5eae70bfca338d46b19cd38b37675a41e7808fa991e134aa8064b87ff3e3186fdf3cf1db9c02d3f20c12936636bebb77bf0a38a6aaba90061876093095a940ef
SSDEEP 49152:1YOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0jb5+Pl6bJTIZn:kySzPfslgJTIZ5Bgp
TLSH
T18F066C96A16801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a4f7a2c258fabda08c35823544eabb859156eb2cbd470e3fea2d428c74561a19
MD5 788112f5308ce661d2dbe78cff614209
SHA1 8504e49cb4db7d91cd1164a00c84540c48a94e18
SHA512 321c2482db0f9979a4eee1da8fb3a07632ba7b398966c7405b266b75c5b17c643985ccff33661a0589811805d2b7021ebb397158f45f73293068af634b269ecf
SSDEEP 24576:T47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYemb57GBiOl6a8JTth/RWZvR6wQQ92n:T47JUQjqirIhCnDHUPfF/Tb5+Pl6bJTj
TLSH
T1B065AE1EA3EC01D5E1BA923885558A1AEA71782E5F32CACF1270437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 0728056a37118a6f7361d3a6f6170057d56a2d9ce3abc99f7f059a013fd0d9cb
MD5 2a6e512976dd83894ebe6d32e56f68b7
SHA1 04e3370874a20d023c4d1f6ba4aea4fa79050d57
SHA512 3794dbd3b6fb7db0cc451a5fdf197bdcdca3bd5750899ca248d1c817987ac9c807b6494f99a57dc67a9ea87b291d07b98525dbc6c0397117d4b219981a1c1421
SSDEEP 24576:q5mb57GBiOl6a8JTth/RWZvR6wQQ92pN3q:Rb5+Pl6bJTIZ5jdgp0
TLSH
T1D875F14AC29811D8D06F6279CB858A01F7377D658BE193DB86E0F43E1F366846DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 12KB
SHA256 77426298b7093306bbbfa22b9a31749b7d70858d97d39fa34c60d9e4f26320ab
MD5 68f73103d820cb5b137a61e525b7c5bc
SHA1 444f2d24022f63156bdf960ffdbeeb57c6fcf756
SHA512 070f79233b922032298c4480fa6568f429fccc9b5ca3edf5d7d321766460d7c5019fc8756a7f12d2818cf09663520fbd1e98cd186629b14c0c6f6ce873c95f15
SSDEEP 12:KptNF9lWEEEEEEEfC5kEzBRMtrC0EEEC3UBEn8tJ15RvWvsMlE3UvS/0jkkXHWkk:KhUjICqW8sJLROs0skS/E2
TLSH
T1B642277DEF41AD41EAF29970C493EF950F22E818654593C3119621347D442C04D3DA28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 d9c85fdc126a15e967539a03d7a5cf161ceb9a8b82257fa3f94bebf765120a66
MD5 2e4e09d6829011c13df57a61d4170ed2
SHA1 2095bf69d2e5d626891cc29b0e59d7d1441d2bef
SHA512 9fcacf35f99757fbdad4db0d9429d073a7039ebd0e59fe6e7fca09e672a60272537714813e097d2bdae28d48b601b0aefde158f4d7c199ee66f41b2620af5a95
SSDEEP 24576:yxmb57GBiOl6a8JTth/RWZvR6wQQ92pN3q:yMb5+Pl6bJTIZ5jdgpg
TLSH
T1796522428A6A6086E4BB5778D8CDD710B83EBF65CF8566E7C569142BF1306C87C7230B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e491de7995b087693cdc4535c68089031ee385fabbd6920cffbd91ec4034ea6a
MD5 137e9a5667daf6d16cf78ebe8d8ef9e9
SHA1 8b349f4ea8a80b23b24225b43781d28d21aef522
SHA512 6a919d9ee4bf3e0225dafcff13726062d067636b2ef005acc347290919147a1edcc1981d28e221914657b3485fa8b1de8a781fb8dfb764f579f59023609b296c
SSDEEP 24576:Ugb6bmBIi49WNNFpg1rSvFv7bYbmb57GBiOl6a8JTth/RWZvR6wQQ92pN3E:Ugb4mBIBhGFBb5+Pl6bJTIZ5jdgpy
TLSH
T19A659E1E22EC02E5E0FAD2B8DDAA4417D6B278164731D2DF1151422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 d12f57433c60ae1640cf4788d3fc4c20a257d9864467b2a0df0c8767df8a911e
MD5 a1b3fdec8fd0dedfbd7addd1b3008b4f
SHA1 ae52b345041860697f5d3bb4f10d1b9465f345fe
SHA512 19713964449bfea915684b47640c61c2989ab63b9865e58f68612d664d068a2a651ecb50103f5f2fb5aaed7633b8976a24c014b0cd277a43cfc26b1149188fd3
SSDEEP 24576:UG88u8FpJqH1ozria7/mumb57GBiOl6a8JTth/RWZvR6wQQ92pN3i:n7ZFPqVXa7/Kb5+Pl6bJTIZ5jdgpw
TLSH
T1AA95F16567E101F0D47BD138C9868663F6B2B8250364EBEF07AC8A561F23BD51B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 480c7512af83181ebe41ab9ed00533b474fdedd01d898893767fb6aaa84600ed
MD5 e267dd29205c2961ce7470ac1f84f9c1
SHA1 4d03bb52f8a5684a55587eaa2ac85806cb263a2f
SHA512 345462f6a0015f795d4ed24766a0d8ee158f9b30c0ccb110c61d7dd75b0d0ffb08650739ce5d3f5c4ad3b0da529b42dc3d0dd42b142800d216e3cf9b153a5e35
SSDEEP 49152:CBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjVb5+Pl6bJTIZ5jdgK:NG05lO43bmslgJTIZ5Bgp
TLSH
T1ABD5C06E62EC11F9D0BBD17CD9C68A0BEBB23815032556CF02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ed0fb951077f05514d0c0aa4431102019a34f075f22972b52ed0d9d7fd323bee
MD5 80330e14cdd4f198717aa0b6531e6258
SHA1 0bd9a9d9e4467f6b728108ec05763ff359867ce6
SHA512 6465165cd4e75c3cfc426199ac5730847cbb56259970efc6c935c186f2999ab1efe46f49c377a1079c445882918247569a9e6af2d52d88e113eb8c7e6b872090
SSDEEP 24576:afa5POZ3dpyWVM50JicR2hG0lasx2+47eidnUmb57GBiOl6a8JTth/RWZvR6wQQ/:ya5POZ3lJt2pasx2+m9b5+Pl6bJTIZ5h
TLSH
T12F65AF5EA6FC01D5D5B9D17DC583861AF5B1342253329BCB022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9dfd41ba0225adb8ce6a5e6dd31f40c7de09708343aa7b07c5ad738b9fc87bf9
MD5 532221313556a51e11aee7e39594141a
SHA1 024b1ff1a5fbf3b375e90c10cb3dcadc3426eea7
SHA512 de28ff7cb51be51d21bc076a87f420ea9d44b1d872bb3bc1788a98da1792882fa0e3d74406b263ac06371f475772c530238b30a3953de527dd08e4c6882aff81
SSDEEP 24576:xNcwHdjbyQ4nLC18lb/EOjowL7Fk2mb57GBiOl6a8JTth/RWZvR6wQQ92pN3p:xNc/zEOVHFqb5+Pl6bJTIZ5jdgpP
TLSH
T110858C1623E901E4F1BBE1BE89679646FA717865573086CF0291811F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f85020ee37e13e0dfa1fefd93d21af040737cedb0f6b557e2ea720e54f470c58
MD5 ddf1fcea9678994922b2d993543f0c51
SHA1 9f14de21b89a1306484970bb61a0abb4f0613181
SHA512 c39860128fa1b115eec636ef8daf9a75258c78cf14df5626ce8ca8e11740e1ad34bee03ed076780697ef8041e198180f0a169e8cf5da08e1252efa08afc3a6ee
SSDEEP 24576:lzkNvNnaFeYhJNtmZBmImb57GBiOl6a8JTth/RWZvR6wQQ92pN3q:lzMwBtOm/b5+Pl6bJTIZ5jdgpA
TLSH
T19755AF6EAAB805E4D1FEC6B5CD238512FA727461073253CB8290C13F5E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 ac8c1e4517fb92902aac8e75668fc689e501e7f86e2e2ba2703c55cdc97371e2
MD5 6b0a6bcca26c984caafb6f08ef449e1f
SHA1 cbe54545bd118bfbb72098c9a2bc1ea0aae0ad2e
SHA512 61de92fcb1d139681dd97cf2cd353d5ff1d29fb9450099b29e0887b6b7c5d8926b0e15c9338befecc4bb89458612cd689cd0c6b300f5f398e350c7adf7bad102
SSDEEP 24576:LPUr+NQamb57GBiOl6a8JTth/RWZvR6wQQ92pN3t:LJQFb5+Pl6bJTIZ5jdgpP
TLSH
T16875E11F26AD18D5E67AA17DC9C68709F771B8624712A2DF02E0813E5F23ED87C3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 dc74fdb9f857c2d7e91315eedc8f0a9f368dbc31d71dbf0f296255e4abad58ad
MD5 e44fdeecfaefb509bf3d6a211a276da6
SHA1 baeff1bd0af905bc5c38ed8d2e8e4d74694e664f
SHA512 b568111a625dcbc232efdb2e7e7d15d06178aaa2f90c641639d5e4488f32afbb68b8d6896b0b8ddf14102a5024af1e1a757744997b95124cce6cd6a2fe5614ce
SSDEEP 24576:4D3FHshBIYQgAVmb57GBiOl6a8JTth/RWZvR6wQQ92pN3I:4DVHeBIAAYb5+Pl6bJTIZ5jdgpy
TLSH
T15D85E17ED65D00E4E47BD27CDA938A06F67138A9472266DB02D481BA5F2BED43D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1820-426-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/1820-181-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1820-175-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1820-173-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/2064-49-0x0000000001BD0000-0x0000000001C30000-memory.dmp

Download

memory/2064-51-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/2064-38-0x0000000140000000-0x00000001401A8000-memory.dmp

Download

memory/2064-39-0x0000000001BD0000-0x0000000001C30000-memory.dmp

Download

memory/2064-45-0x0000000001BD0000-0x0000000001C30000-memory.dmp

Download

memory/2440-186-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2440-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2440-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2440-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2440-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2928-155-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2928-411-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2928-443-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2928-149-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2928-441-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2928-148-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3152-144-0x0000000000880000-0x00000000008E7000-memory.dmp

Download

memory/3152-343-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/3152-138-0x0000000000400000-0x000000000056A000-memory.dmp

Download

memory/3152-139-0x0000000000880000-0x00000000008E7000-memory.dmp

Download

memory/3216-187-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3216-194-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3216-188-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3216-201-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3216-199-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3840-127-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3840-133-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3840-125-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/3840-319-0x0000000140000000-0x000000014019E000-memory.dmp

Download

memory/4684-53-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/4684-54-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/4684-277-0x0000000140000000-0x00000001401A2000-memory.dmp

Download

memory/4684-60-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/5124-172-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5124-22-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5124-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5124-14-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5744-0-0x0000000003AB0000-0x0000000003B17000-memory.dmp

Download

memory/5744-137-0x0000000000400000-0x00000000010AC000-memory.dmp

Download

memory/5744-5-0x0000000000400000-0x00000000010AC000-memory.dmp

Download

memory/5744-6-0x0000000003AB0000-0x0000000003B17000-memory.dmp

Download

memory/5744-367-0x0000000000400000-0x00000000010AC000-memory.dmp

Download

memory/5744-7-0x0000000003AB0000-0x0000000003B17000-memory.dmp

Download

memory/5788-160-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5788-425-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5788-428-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5788-167-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5788-429-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5788-161-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5888-204-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5888-210-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5888-430-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5888-203-0x0000000140000000-0x0000000140172000-memory.dmp

Download