92b2ca4e8b49abe88b250b1bb4d7abb2d7da2805ed62d968b1756aa58f4865f5

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 11:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
Size 10.7MB
Sample260716-nzwfpscs2k
SHA256 92b2ca4e8b49abe88b250b1bb4d7abb2d7da2805ed62d968b1756aa58f4865f5
MD5 4f864cfa381ba840d2e74f80146fea1c
SHA1 330e0e455bfdcf2317bea47710e08f1b0ee4287d
SHA512 13cb8aa5a6b947ba551df7b53c172f933562e2fd0d2a7ab6048c34c4ba796a11386ebcccf758a33ef5d71da0cf51e5879e4fa49a3068a580f277c41831615103
SSDEEP 24576:ohzZgUEYO7aANd4dojKzqSI8CEsH7YoG8nQ/tbw/2Mkjy6Fr7g0os:igsUad8KueHsHxG8Q/lFTjN4
TLSH
T15CB6164075EF9320F1AFDA3398B9EE504A79BE152635A1CF91B138F90B712504DA873E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3212	elevation_service.exe
4380	elevation_service.exe
3208	maintenanceservice.exe
5952	OSE.EXE
3304	PerceptionSimulationService.exe
3200	perfhost.exe
2264	ReFsDedupSvc.exe
1208	SensorDataService.exe
5276	ssh-agent.exe
5732	AgentService.exe
3944	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3f82d9e283806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6e7e95e1915dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000da90d5d1915dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003589525c1915dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000691045d1915dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e6a6855c1915dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
3212	elevation_service.exe
3212	elevation_service.exe
3212	elevation_service.exe
3212	elevation_service.exe
3212	elevation_service.exe
3212	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
Token: SeAssignPrimaryTokenPrivilege	5732	AgentService.exe
Token: 33	3944	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3944	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3944	SearchIndexer.exe
Token: SeBackupPrivilege	2264	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2264	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2264	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2264	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2264	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2264	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2264	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2264	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2264	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2264	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
Token: SeDebugPrivilege	3212	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
4576	2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 4212	3944	SearchIndexer.exe	99
PID 3944 wrote to memory of 3516	3944	SearchIndexer.exe	100
PID 3944 wrote to memory of 6044	3944	SearchIndexer.exe	101
PID 3944 wrote to memory of 4240	3944	SearchIndexer.exe	102
PID 3944 wrote to memory of 3848	3944	SearchIndexer.exe	104
PID 3944 wrote to memory of 1756	3944	SearchIndexer.exe	105
PID 3944 wrote to memory of 4176	3944	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-16_4f864cfa381ba840d2e74f80146fea1c_darkgate_elex_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4576

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3212

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4380

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3208

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5952

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3304

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3200

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2264

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1208

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5276

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5732

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4212
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3516
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3012 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6044
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4240
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3848
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3012 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1756
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1688314e880ed7bf0a634e5d88c0c4b7a231171a66440d3d49d45c87174aa4e6
MD5 e0e1cb96e08f3fd5f01c13e3641fd9fa
SHA1 33b460779084083b6c0fd353056c69d94d78fae5
SHA512 43e9d6e55e9fd6632b39132b45712c9c57e804afbf1d8177193593966b6d165a8f37ae22e42fab5ba1dfd40d777665d8e9b41406ea78c27cd802aa73d76dd2b2
SSDEEP 49152:ib+632BuPkFKRrdE6ohmstBhuXjfS4LWxnUQ/lFTjN4:E3q6HjBYLm
TLSH
T199D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 912d56ba6b23f466bbfdea5f31a5f1d6ca595730f577df781fe56559eb3f711f
MD5 8a05fa06b4003f8f51b49e69a666ab37
SHA1 edc8dd0bbd8130bd8f715892848acca0c5d7e9e7
SHA512 59f85a4da480d7aea9b7161eb6f499eb80620c95fb643c31b11f8d6ad81221c5d69ebdabe360bec160b53c3aee523b1d537ebc1ac8cfc2e38cdaac2a133304d2
SSDEEP 12288:81XLsswWkxy2lRq2czA3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:KXYfDtczAXnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1EB65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 c3c37d19a5d0f9cbd47ceebea0407140255d857341e1a6f9ef8a4f0d1986daf3
MD5 10fd8a4af3cfe09156a83fbca49f8416
SHA1 1dd2e5a2c1f9c605a0b1d697482d9c8fa6c27a82
SHA512 e5a4de25bf1263de5e0930c5fd1d8f3269abc5572b8c6a47781a3e27435c3193dab408a1d1101a1e600944eef039f84d247b712204ade62f05cf0ba1a72040ed
SSDEEP 24576:o0Le5ji0hmxLrMMnQ/tbw/2Mkjy6Fr7g0oW:oPji0AlZQ/lFTjN4
TLSH
T152859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f60f60f64881353451546b3151e920f2041f394cf4da1d40f98f319a3f73d577
MD5 114e6487d85f692ace427523af72d5c2
SHA1 9b2ac84ba594302b24b71d45748717ee5fff7d92
SHA512 5812ac0390f64e0d35c88f2fb4b3f0ea2d89a20895168b7dde9f84964b946e6f742078a315e31c81e9d30bff6c55b7fde6c5dec2ef288e35ea162689c20baf9f
SSDEEP 24576:0a7/ezSC6vUyD/aqgrvWE6q8wyu6nQ/tbw/2Mkjy6Fr7g0ou:j/ezSC6vUzPvxHjytQ/lFTjN4
TLSH
T160755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 41a0b626384fbad10317044d2b5bd62bc43d508697fe663a8de67f677c2f5c2f
MD5 0022ade23976c8021cbe39d15c500e12
SHA1 198400d04882567eafbd7678785c76381732d63f
SHA512 4c1dd6d0de57fd17656ace0b9b2a9373b4a351b4affa092bbb6df6fbd18b876413fc857d1ead29e67641f984172450c49a8c192c21402a61e5814fafbfdf4b7a
SSDEEP 24576:aVbqPb88hv/l+6DnQ/tbw/2Mkjy6Fr7g0oY:aVO88hXl+AQ/lFTjN4
TLSH
T19B559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 1eb3835fc4273867e7b56c34f842834ab56c0bf14a20b6158a42d12bd830ce23
MD5 ca524d881585a7026ba5156f3ce288e9
SHA1 929816e76e52ae2f29f794a04089820639146fe7
SHA512 84525643e7b77a27e1041d527806a5096a3bd38cca979f5b8eae7a957f7e7bc0a92a39af8da680f4f14c07c1eb9bfc0ea1f068b0058406c91c9991885db3aaec
SSDEEP 12288:QzoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:QzonQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1675523796A24F897FF2B06B55C8284826B7B0EC1BFD4E74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 0a8b1568a48706c930711ca8ffb69ead5a884fc1413ebaf126696d7a23a0a6e9
MD5 871d898331da636afffa27d975246e73
SHA1 56f436adafe5e2070dd3d80ffc675d3b0447f76d
SHA512 9d6811b3244d1ad676e195a617f78957180a0f5ab22ff8d59c930b2251581162abe0da5bf288482ec07635f3953811ef83132423b30d7cc1d1301bb8d5c2e7ae
SSDEEP 12288:ceBNUbTVO86ULGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:cJIU7nQ/tbw/2Mkjy6Fr7g0o8
TLSH
T17775CF3BAE28FCD2C27E4DB85A918640D77278704F61A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c6f30f8529a6e5fcdebffd2926cdb66ccfdcc05efae4a29e8f8d072091ef26d1
MD5 7d29243e8a1fecd6e21affbf3636d94a
SHA1 a0d79ba92dd03c9f0231684c1c10021236ca2708
SHA512 a287e3e96af852fa2da3c98a089f255294130a72f7cd27eaffac82fb6a2788b9922b0e38dd503d128bba41521683175fbf05b749192585bff9f93678c02bf0ac
SSDEEP 49152:tQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THb:tQvGAdlCEL8c/yRNw5CFLm
TLSH
T11F267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 b5f43ccba8dc6cab46a421033adabd10934a612b3148c8d4245adb7904b5191d
MD5 bb19cd5329c0856f4f4fabfdb5adca32
SHA1 349c5ac53bca2e23a9356a3958ab089c76ae79ab
SHA512 8d48bb5c224666ee91601d44b019ebd43c1d2519ebb3ac5fed696b719b506c26413157a22da0d7d01a865ae6c0cc1b8842b620c4e9a5219e8c303291bf2eabdc
SSDEEP 12288:VAwSfxL/2Dc39DLLmt0LDQewsAjZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgm:2QewsAjpnQ/tbw/2Mkjy6Fr7g0og
TLSH
T1F775E031FE74E436C77F0DB21B22C706583D6A604FA11AC3E3A85A9D59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 de1634edf26b95a0109d8a14742ca1e1594acb2b22e1e741e722596a6b260cb5
MD5 475b4a748222a65146a2bf579e18ef4e
SHA1 b7a24af1b6dec24c15fe64031e73fb6ee05222c5
SHA512 d976de30115291ecdd09e148130fa53e9ebd9ffb35e4931110c59070731cdd951c06a8fd5e1b6ad780cfe3a87f04caf280ed90b5d9455c1d7598158235837104
SSDEEP 196608:hUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH2L:hUEtQevvqc2W1cpV2EI32
TLSH
T11F474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6d3cbb8dfd84a675f5660a5cc925b6b4f49ad065ba0b152d1033c36004088351
MD5 8c8b877a6835387173c1e98dc2d5d172
SHA1 047c9ef4e7337b00730cbe1079c63a795d3d0624
SHA512 94494b0ac3b2969f95832d5ec843c87f122d24cd3700eb6a37c93eb1ccd4b536619d3606f38ac8a7c1d9b99b685fd532b3151303d51216f6f950d91bc80defbf
SSDEEP 49152:YCbRquA/m2yL5zQfFiV+XenmE3/zJQ/lFTjN4:RoqtVjnmpLm
TLSH
T143D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f728f8a7d644709c63e91674c376be50e7db4039681cddd6c8ddd763b27dc7e1
MD5 4a1062ac205b2b5011826be56d0d56fb
SHA1 1898d2bf3baa9d8f68d8e861425301d1cabffa57
SHA512 6529a65f3ee87cb098fed0dcf885bc44e05fd8c8b5a8388ceebc8d53e3906cfca10aa8f91206642e1c4fd4239e3a579bab0eabd8803cf5a7d8b4e404c0cb8f1e
SSDEEP 24576:JAhGLJIFoiwtA5l7S53unQ/tbw/2Mkjy6Fr7g0oo:JAMyFoiq5eQ/lFTjN4
TLSH
T1E035AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 565c2bc46cf2e2e21fdeb5c4389dc18eb8e8be2077d0a1cb77ce830c46cb3dc6
MD5 933502fcaf9a4a00381263008eec3c95
SHA1 3f07d557362d436f5d5eda759344053dc4f4e85e
SHA512 44559fc7c9ec983a74615c211fc187821c50e188e96d7b8c4b24e830bd54e2365878a8b339fc75ec69fcbdbc993625fd902d3ade8fb6bd570f366a5a94d739c8
SSDEEP 12288:dmw5HEjsChN2BFgl0WDm+CaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMO:YwuHOWNnQ/tbw/2Mkjy6Fr7g0on
TLSH
T1A465F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 c26cd2068d451b5eff8be359b4395626aae494278c2814607a28189a372ac903
MD5 74fdb77990d95ae668b2c4b54d9fa9d5
SHA1 08b3d117750d6d989f85c44557fb927a0ee8bb91
SHA512 1c0fc68849e4ef406b213ff26fcdfd0afaef896b8554fcc97d3a2cb308f721511e4695b8c982daa994ff144e48599ba8524276f498d82edf1d78eaf7715b9e9f
SSDEEP 12288:OXZ1IypGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:eZuknQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1E755126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 78a150c897e50939fe381f8236097f18747af8f688227467f0465245ae1d67be
MD5 33233641987c91eab240861df755a6c5
SHA1 67bfbc87f4b3bae926db0c714169023fc26bcff3
SHA512 d659969f53ac53ec61fb848dee125816d8694eb5585688ceda250b6811c37644a67c80153046983768eea9d0e81931b6dd3c176ea7f5ec6c8c21e23fe6930973
SSDEEP 49152:Nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uf:EQRQyi36YOcPQLvw2gAf+PN3ELm
TLSH
T153666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c084291b25471777fbf12d495108d849d7e765d6f4610758269ce69c62afa3ea
MD5 a9fec25d1a735f5a838bb254ceb504a2
SHA1 156c54fc611bcec36da2ea3ebac740dc25d1f5b8
SHA512 3b026207f860fe8f71fc17d1282ad490f6532aa6e6160c073abae83410b65da6d14dab208615b530fe1d21f153dd2b7bca582692db34aeda34757e794e88527c
SSDEEP 49152:rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Uf:6QRQyi36YOcPQLvw2gAf+PN3ELm
TLSH
T154666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 c284bad4ed78ad8265d085385089bc602e9000723d55cbcc3dd403627c5ee80e
MD5 6885278835a8c02028f219dd9cc51405
SHA1 a12129c0792e39aab8e67185f7ce2e26e4d5438c
SHA512 602bc4d4a9fe0d11c5f027a6be62c103cd5118af10396e721d30894aa6ce9efa4382a567a5211279a9e7c5c5786d1956471b16f86358543550b3eb2dc0d06bea
SSDEEP 24576:zwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0UnQ/tbw/2Mkjy6L:L68Qg55nhheWu7PNU3/ZQ/lFTjN4
TLSH
T11BB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0f395649334744199486dd60d841f0d0d94b0c155f2cf104a21d7076c0023500
MD5 1a4b251ab685109b1fb137271765a268
SHA1 e5884e6f3fdf1215c2d83b7ac5a2317d73c98c77
SHA512 a7f46af8b5f71453b575cce2f0b8aba8579ddf7e3ba5113f96ba6a53df78bbbc657a5eb4b4ef2ad0f7dcce0ee94e8dae5728c0208388c532f71fca868c84f18b
SSDEEP 49152:G3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99p:Xy5112gYy5azzVvL69nLKnhZLLm
TLSH
T1BF167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c7723a538e5a286f76d82f31770f3493009f0b0f0d62798210bd56b848437ffd
MD5 4743b8dd921b4ca92b46d24806e55cb6
SHA1 53fa326fc371ee0aa25c9ea8cd97754a4abffc88
SHA512 07293b31c983c5129defb448650e37095b4b81f4b27f334fc7194ab3d2995f676149a31bd4020d2c27e68eb7972b75762f12d000e436a2bfed09eec2cc04b39f
SSDEEP 49152:2B+taZ3usBWOBr4tEGT0bqx0z+n217aau1glHQ/lFTjN4:Eu6JmVxd2dsLm
TLSH
T1BCD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 45ecbc4a27b607807838579014f7866f03c1d89cd94d4cfdca95553d4b6dccc1
MD5 92cf525885ec924c4b9c6ed335aaea16
SHA1 ddec41604e7c671cd7b36ca1752fb688b414c7c5
SHA512 8c33a2dbd6715ff611a29a45478824773947aea70f4f34161467a785ee245cd4a831e2852edf5191a38295e86d43e509c74f9301297a4b8bb7f90462a1b265cf
SSDEEP 49152:b1hpsNoJpF1A6UU44CwH7R4xbQ/lFTjN4:bmifPbRpLm
TLSH
T129B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f737e108e28fa2c419af0c125a3d36539c3add9136b7154e59b28b1c71d0412f
MD5 2a5cdd2d111a542b9ed0af2d34916dbd
SHA1 4e7c5cea60d8ac7bdff0577315dcae8320b37a7e
SHA512 562dadc1a3cdee900f99128a59d3dce38cb363abe9a98561565ce82c3529b7f0eb8039501b56b350006f807373bb3bbc7b12026da9d526846561ad6a75cb7047
SSDEEP 49152:rSuZQIY0Be2KRRVtOnks6NMHqkQ/lFTjN4:55dKTi61XLm
TLSH
T1AAC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 750ca48723b7c28446dcf86dcd2d3905ef41edaee144586f2132b2746a250dc4
MD5 f826b9bbddb5f1fdffa802e86c637759
SHA1 2d43385017259adb7e01832dc204bd4cafd8560d
SHA512 c893f4c8112da55f9bf73a8b0ea9c1c7d6a8ff35496d07be96c9e47f44db7191d1db89ba456fbd6e98d3666a93552a1ce24da5f3b1c1173080f23e2c48bd31db
SSDEEP 49152:YhtSn8EApI0figngiDn0AP5wXQ/lFTjN4:JX2iyphdLm
TLSH
T1A295BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 6f1ac07595e9f94772388ff14b391904577a490761ac244806658a254a7c4a7e
MD5 d416b368f0bfcd962a7ebe7b2edbaa0a
SHA1 f80ca09d314fb38878ea43cdcf64335d5f1c2dd1
SHA512 a55fcb0252e6d2f670231e3296908d7449cfb989cfd66f57656cac0e65968cc6550715ec1d224b89df711187b34278210af3a0477939bb623e45db5baecc9a31
SSDEEP 12288:hgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:hAnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1DE5523697965F98BFB1706F18C828182A73B0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 6bdc421e1ede36fe1822c5a1deeb218cc788c678ca89f41f9242b50a9c50a869
MD5 2269fbe33fe1ef20b5a55505e64c0822
SHA1 c4fae6b851267961311f40b7316eb75cdd7cc4b3
SHA512 5df231063436e01bdf09d4dd55e867ad986fad66bfd020561f4feedf0768b2f0a2536a270dd3e4fb377cffab3f5d7544bb8dc579e7b8630c986ac42615a21141
SSDEEP 12288:j1GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:jVnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T15C5523697965F98BFB1706F14C828182973B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 e23b4e5e6afc68832c8ebc186c28037c68076800cdfd0a4188248c0f59bce3ac
MD5 6b7012c5df66a7788951f63fd02fc635
SHA1 42e0db030befafff9b80486879c182e96d39ad58
SHA512 f291870d1b42887a89ef6983e99d7d10d5cc8b0c9ecea70be03d7783a1e477c6a90aee1432e918a0edfb5e25539938a2e69654989834589f2a76e91167d7cca0
SSDEEP 12288:CDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:CznQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1CF5523697965F98BFB1706F14C8281829B3B0EC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 bf9f5cf058d1801efc74b3d5cc2ed854a301bbabe219873ead297c4ad10289e6
MD5 62d270e2f6e2d430694797d17446ed0f
SHA1 9235de58407f05bba3e6a138634faf1af42205aa
SHA512 23d2a3f4c82415d346d89c3187c1e383a3dcc36d7ff73641e8c57f7dc55f87bcc0898c28636831d4181c4bff2a27514d27b6ee3b7137a2b05c73deb6541fc678
SSDEEP 12288:EVOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:fnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1485523693A69F4C7F92742B4CC928142E77B3DC5BBB1A3CF6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 8d3527d1a9986f7054b83f7750fb7388a92d35ba9decaaa55d3881a9a9412f0f
MD5 fb3a0dd1e8f8a4b507ea33f47d92c5b8
SHA1 1fc86d4173f3c616321baf0a22491d0055a8b56a
SHA512 e7e0668868b3bdec490a47e98a5e1e80666a68dcae61d3d337bf33cabf37f95c54cd3cae1877c8d4bbb703e3a066544e77d6e40c0b7a0a66b9e48ab9f1515d2f
SSDEEP 12288:jWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:j2nQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1915523697965F98BFB1706F14C8281829B3B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a124cb47e4655af1f067fc813a637d23d76f564018b29c07af055874263a532f
MD5 fa1722eafb33a24043a6a25a18b940ea
SHA1 4e33854f2c8bbfd61c18cfc920e9877caa4c84fe
SHA512 76f97585278adb2e7573dbf06e579faca3af5c1c26641c0952299d2b1c3108bcbf493485d35bfa5e8f24b70f250b721d5490affb30df1898ceab33ca1e03027a
SSDEEP 12288:vRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:vhnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T14C5523697964F98BFB1706F14C828182A73F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b9c95567fc2a2a83090743e326fbfd4a5f8ce350ec1bf8022a85df650d07f33f
MD5 f5647ffffb3608d63c29142aff082028
SHA1 855b7e1d611c967556cacf1e5644140e164cbe80
SHA512 c6a37db0b43303dfe4b18b8a2865dcea7817c847cc0316f4a7b633fc0feab6779e19dd20b4147455de75cac14105bb741392dc16c4bfb0f20c698aedc5e18214
SSDEEP 12288:XdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:X9nQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1195523797964F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 109b889ebc0c679d148a3b90405e6f4fc979bc827abe80eb620c93cfcbc18f8b
MD5 268f114ff31735f10d6d73527d0f3f88
SHA1 a8ac774d632189eb61444defecdf16cde7e1b170
SHA512 80e973fd580cb04dc52f0c08db34013ff0801203efebe00d0442f1b408467cdc61da913370d98bdd77a3d0499710f1f12043edf72f1a9e202768b79387a326cc
SSDEEP 12288:riZwbDzzFEoS2cPvyVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:WZM3zFVSO1nQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1687501A5B39058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 4ee86ac478330629fa8908b3ab0289351ff3ad606a6fab24889381b00dbfe9ae
MD5 a65733e599f01e2e9fa5327c9ec3a3cd
SHA1 567f87096c9818e502004a78085e71de064ded28
SHA512 934ff0eaa3219f50af119a4a95b88301d2f967875736308e398c0b6411ba10eb01d87ea9a51b40d2bedfaffb1ca4bf071864f7651228d8a46e3e07b31547d04e
SSDEEP 12288:YUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:Y0nQ/tbw/2Mkjy6Fr7g0ou
TLSH
T19C5523697965F88BFB1706F5488281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 f46be45ab489fb7bc82b0d08ca0dd8621d02f5882480787553da691ca118aa29
MD5 ff3530257d678b2bb21b2ed42cf687bf
SHA1 b2112f8e777869905fc0718012c12ff6197fba56
SHA512 1395e01b8ac71e7907644df55dd0802a6e093c87c81c4115d1692f9e12b0fe4c38354cd99e33bde9731a1ea2c59b0a3bff4538c1a42a82ec38d025b839753089
SSDEEP 12288:F4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:F4nQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T12C5523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 af104f28cd41968cbf7402d2a79823cc2b3906395e661ec7864dd5335d216072
MD5 06bef9eae11e8ec07f3f759f45b3a906
SHA1 f123fbaa53338258470b13505f63b3c402345f34
SHA512 10efd337e3f30f2793da835501ef95fa046d33fc9416c4a56382e820d329cf5d3e02b5ac47a5d324a52115a4374de567c39cddf6fe78ff227f56af0213137af4
SSDEEP 12288:6yPz5L8pGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:nzy5nQ/tbw/2Mkjy6Fr7g0o6
TLSH
T16D65021773A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 61373e2ad8c42a12df8936710bf1f20aa8f5e8d62a5dfdb05fec41de245eedb2
MD5 aec56b40a6309e98ea873f9f6a4c146b
SHA1 51965ce86db5ded2e8ec720cb83093536ebd288e
SHA512 51b849c31082167f9e03c1ed1ba2e6af8d4718e5b7aa56cb33414a68ba260fba47109537dc1717d2d3dd9016132d5aff2432693ac7522d36f3101636de12bd54
SSDEEP 12288:0UGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:00nQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1215523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 ce135e44608f61bec947c282cd3180d0dd32d21b7f7ef6847dc54b8084898029
MD5 43667beb5262079c841863d148556d21
SHA1 196fdcc50a24afe0546ee0727ac41f4f5cf9d69b
SHA512 ebbe11da53b43ab3c4977486e6022cd08c28065c08b191d8cc6965e3bec840147677ae6fe45eda3a69ab090fdcb96baf32291bb06ca673cb8a4d4e2aee755feb
SSDEEP 12288:pUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:p0nQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1A35523697964F98BFB1706F54C8281869B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 cb7dbc82ab2dd60934fbbe03918da8fce344dfd875efc3d5f30a918226a2a271
MD5 c5d21b5fb471588334fe77f91fd31ba7
SHA1 ab760a5017145d1bd545d83ed04cc9718325d40c
SHA512 501ee903b93fab5706e2cba35968b0c31477e634319cefcf8d9157533c4949fbcc235a0de0d3df97db34d98b64a5776a08fef07d79fb15393c80b32301a1cf91
SSDEEP 12288:CyPz5L8pGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:fzy5nQ/tbw/2Mkjy6Fr7g0or
TLSH
T11865021B77A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 c291af003de3c03bea89a02a14660b6939f8ba0d62f11b4203b19d6968ac1322
MD5 61642bbab7de1d3f7d5187495c149de7
SHA1 b867818c51abecc812262787f73ac43ec67ede9c
SHA512 80a05a8ff5b66e0d997985574ef56439297b0b114f1454dde34c681610cb6ade2729eaf44c46528ea2cc5757fd8a904dcaca4ce76984cbfefd55145d55b0b652
SSDEEP 24576:eT0aLl3z0zDjnQ/tbw/2Mkjy6Fr7g0oL:eTDLlj6Q/lFTjN4
TLSH
T1957501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 09ff8b9bc634e27f6f743d4e4065abd4b639a3b3adb53ce281fcc7946cb7edbb
MD5 67d8198d706f09dcaa8ff0cc65d57284
SHA1 a7b3d91ba9143ccd51b691705d25bf1c2660667c
SHA512 abb09e67aa29d115a9bf8d97ddecf00229febb3391e022e728c698b98fff5e1099857dbcdec156813631a8a2e1f8fde176f3d114ec5f9ef416a42da77940a8ed
SSDEEP 24576:031d9CHKy7GZvnQ/tbw/2Mkjy6Fr7g0oW:+1d9CHKyaxQ/lFTjN4
TLSH
T18085CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 e268a240499effaf0c471f16a93d31440e5df5a08a2739241bb4613362c21a98
MD5 daec20d1fb0bc8bdcd9af9bc4932d0c1
SHA1 9e6f2feef634629245d2aef83ff286dc80e2e059
SHA512 74badd0305296941d1eb7c032feca602aadfe5a710266a7e901c637ee40dbb8647164447644348467b7f35223b889b8ab954d3eaf18a036ccba14fc12d859864
SSDEEP 12288:2jGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:2TnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T13A5523697965F98BFB1706F14C8281829B3B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 900190c46c92bd0eb8e5bb428ed46f89618592b4a6ac30eeb5ebee1e11722f8e
MD5 1714ccaf9a96af9d364349b58e2890b8
SHA1 50f61525a9e9a7d5adbb0c7581e2127d7fa960dd
SHA512 d7a87091ad4e8a7e4024f205013c0fd1696111ceb914f42a26b84aff99dfd03bf877e9606d7e4ce361ca1acdde445723c236cbe15a3c074165629189f2b7838f
SSDEEP 12288:lJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:lZnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1D95523797964F99BFA1B06F14C838182AB3B0EC6BFD1938F7B481129967D39406C67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 94d6a914fb9a3959670332b2ebdfacdec7fd4b711cdf226163a3e44c223e0b8f
MD5 6a8f0a3264b6f0c5fb8e4c7a544de26a
SHA1 83f5d3661df73a8cde9ca46472f14436f8cb8d1f
SHA512 86d268af4436f813c4cedc122db9d4bf51725e0e70ac27e480091cc5edb8791ac66fab303c64580575b3bfbd4e11db036cd0c25151aa98c43f0877cc304fbd20
SSDEEP 12288:5iGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:5inQ/tbw/2Mkjy6Fr7g0oE
TLSH
T10A5523697964F88BFB1706F54C8281829B3F0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 2c7710dba7c426da0c82a1d976dabc094d79075ead74ac3dbcba5121424a4c0c
MD5 3f3edb2a63f9225e583ab939fd8090c1
SHA1 83a74c834255dbf17197f24f34312f195359f0e7
SHA512 baf6a1f5a2533f6a8a5695db900436906a7c488afa5485def110b99703b254147f640b6d2bb8d81655b829e627c3c934f4656ac2db36f56fdc5e40ca4f16f765
SSDEEP 12288:CUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:C0nQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1C95523697965F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 5950df604ca2014eb7e65f7bc2e464127e486e29726aacf7b2fddf0ddf2c5770
MD5 ffe669b346090ffb8e582097508c9614
SHA1 ca5647d24268039febd805dbe3edc66af4efc869
SHA512 6b96a69067e67f723808503c27383a417f9478c3d7793061bacd9e03dd378ebc89ffe9d2ac8311980477e30f0f36b9e62c724130ac55e320faa4aca350af4055
SSDEEP 12288:FjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:FTnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1685523697925F98BFB1706F14C828182977B0EC6BFD1A38F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 4aada7a2fb908ff2731fe36a4534b8e804fbda548aff9434419aedc967887ed1
MD5 441392868f139e2abe84388b4394a551
SHA1 f890283f85686e1ba5331de27137cf1c667c63ca
SHA512 b604193eb644217334bd913394248f69ccab3fb05982e7f85c3f35fb5959384ca611299c12b0510c69b1ce569d651f051a20e683b345e0eba4db6f635e883d84
SSDEEP 12288:U8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:U8nQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1A55523697964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 f5d4d0f96d0d64dbd5e00e505ac69e145a2ff307f8b20bdc207c4b446b836a92
MD5 ef2411f511c0772a7780eded7b34b21a
SHA1 0f149185d235ba19d23907a77a4772e361e1d8e6
SHA512 304be26ab1e226e62a7bfdcf1c4c22d9192044f10839cf2f0f6943921f4064f4099a33b293b4bf039c489bc5e6f9a0c5de7bf1d3be0e457b7fd1217d2daeaacc
SSDEEP 12288:AWGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:A2nQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1D35523697965F98BFB1706F14C8381829B3B0DC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 15c1ff68b1a3330dbb1a5128efdc702c850d33999b23f666597bcf1fed2938d9
MD5 b6960f1b6dc813c7adfbab71bc692762
SHA1 d547b02553876d0a69f730374fcc0be7da9c3e54
SHA512 69133720de3e99188d18c12b7669d0156dbf5f6deb731d38a1d183524e688b59094788461092bff42a2eb9f1a56cfd4c2dd04a6898040f12facd35e991a9d932
SSDEEP 24576:Wfwv/k9RX6wkyAIInQ/tbw/2Mkjy6Fr7g0oq:tMnYIIQ/lFTjN4
TLSH
T17985DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d6418aedbf15ae19e16030dd73080dc94c9748a2c7e669ef65b9ac87a59f9abe
MD5 233a61e8353ff1ce267b2b4b8b9b5491
SHA1 89a90c1855ee5b41a12eee980483f493ee00fe25
SHA512 3a9fa4bcdda97a85065b90c1d80ca5918af378fe95a4639708498a81c0ff3afc02b224bc7326a04a0f5e9e73ac38fe0226606e701432bfdac8fcd963c4397e83
SSDEEP 49152:oYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK03Q/lFTjN4:2ySzPkLm
TLSH
T154066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 752359e35c9ef8997dfbe9a55190b3e95daf8019bb530f456fefe053e62a1fe2
MD5 63db48199e8ebc2ea6a62439b32c9aa9
SHA1 da0bb059d8a19d88fd3301917162d2289221aaf1
SHA512 bc4782b1a273c62689860ab92bd749c61980b9d6425b191744a3e7b3cf6a3d1a36f985e11f19b6fe557ac533b307dfe1cd44226c839c1de49d9674120006d264
SSDEEP 24576:i47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYFnQ/tbw/2Mkjy6Fr7g0ov:i47JUQj1irIhCnDHUPfF/HQ/lFTjN4
TLSH
T1D365AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 c5308cdc6fd820f21ebb9e70bf366ccd2d6409614e32947439da4175c8bdea0d
MD5 ee68a3c764b6cb3a22d2add4f16f4923
SHA1 8c38d60b54e60ab4a6f7813f306517ea782e43f7
SHA512 42d20ddc54cb1669bdb6f04e196df663950db94e9ad45d740787729a0025b4c4912ed6ccbf202e9084d9db8dff45d30d74523acc4e7f6028ae69973774de2b89
SSDEEP 12288:rssfEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:nknQ/tbw/2Mkjy6Fr7g0oN
TLSH
T12B65F119E29852E9D02E1275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 003521f85be5913be306b023a49d75a267c08aedface1173eb729fe7f611f364
MD5 17601101984f41221f2f71ce0d303dbe
SHA1 35d227aa60b61d0497b5d8fac8d36e74d48c5a43
SHA512 6fed680d52bcbd3817e82bd6be5adcf54a6dc303a465e15611ba59750c1be5d52c675990c569406f10f6196199e0f76d64c2f726ea62da80d6921174619906cf
SSDEEP 6144:qsBC2naI5k+R9ytMcbPotMxuFk0U3fUkZRI4FHUgakDbX0TG1gkzqoaRZdSOXlB+:vzqwU3f5FHUgTDbeGEoaRZdSOXlB/B+b
TLSH
T10A353810766AD75FC6AD40325E37C2CCAB707D41EE059B0772C8972FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 61351d945c1936ee1e987ed56b65c00002bdde9e2cc60bd60297338a143a8829
MD5 cff9c19ee58c06e9acbc91e953c90ab3
SHA1 34287179fe31304949d0526a23177b8fa01ff32e
SHA512 4325929af9821038452049491ce6dfa130633b9a23a87b08b096342dfb2ff9ea52eb6fcdcff9f06d3d56f39781b72de7d20883d6a17144a160b44fe69869cc73
SSDEEP 12288:ZwajCoasDWLEOVwz3jSgTGQ6aKddy6weYM4HMXQwWZ9iQhMthOVx35B6Y9:Z8SZJ
TLSH
T1F165D8815537A38FD1FA6072072A9B4CBB64EC06B7056F276388453AD82B725B0FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a29fb47cdda604cb7009d7a3f52a4179764ed91d14a685e318c6bbd54c4f3073
MD5 dada812bb99351c7fe944e6928fb3a13
SHA1 4e8c4994582ea4b5add6ca1d199c75941fd4ddec
SHA512 9ddd4f2d3c670eafe98eb1cccf75533b542b7e3045c733c7e923639e2b82b7afb25e10a99e0dff71ed79ef21b1b90183ef5460c8b5607006d5f13bebfc981a18
SSDEEP 12288:J67sGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:gsnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1855523796668F94BFA3B06B058828111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 259c23b02a8e2e4188c8d102a4c54458dd79eb6e1fc5f8598219af9cb1d4ab02
MD5 9b819290acb397b895802e89974ff595
SHA1 01b0ac9afcae604a8e27bc55d69c06267402f068
SHA512 4da78ef6c5c70700484d4772e76a67f8f9c13b9d66bf890f8e521b6e16bffcf2a504960fc4dc69f6dd09a7c125c6e5f276a3f2877a943d02ccecd05501dadeac
SSDEEP 24576:vgb6bmBIi49WNNFpg1rSvFv7bY6nQ/tbw/2Mkjy6Fr7g0or:vgb4mBIBhGFFQ/lFTjN4
TLSH
T15865AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 9acf6cae0daa5c81527536814e1067fc619a9df9daf9d7c5261f4f67f70ead77
MD5 9bcdedf41048cf23b194794e540ae00f
SHA1 e81192ba11f19a73e8891738abfc3948384f81d3
SHA512 1162977084f1d4fe50500e3b04a69072bcb1ad991e79b18284cd21e876a9322572e3f483d03ba21b535cbce474c9664881953c39917c184dd63ff884e50987fa
SSDEEP 24576:mG88u8FpJqH1Qzria7/m1nQ/tbw/2Mkjy6Fr7g0o1:t7ZFPqVva7/CQ/lFTjN4
TLSH
T13B85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 77718bd790d45112f92ecc8f3ae50ef8f49cf68d2eddf46adc114c65432ac559
MD5 98e93ad4c3f6d4fedcc1ad5451ed02f5
SHA1 ddcb4aa1aa3964b2bf14357728f2a5234be3f578
SHA512 a195ffa524654a2af2244dd886741ba417de117db4c8a89e11f657106da133ae88f4179f4002ee27b5697064128a50d7a57c5bb2fe45583f80e4f1f9584715be
SSDEEP 49152:oBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjhQ/lFTjN4:DG05lO43bjLm
TLSH
T16AD5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 97b3c013bd27fd4bdb7633159d6c00a6cc55d75d3bf100a31d22f419fb64c774
MD5 d79832705b3f4f344c59feea675a51a4
SHA1 ca161f03b691eea61b0854c6bf292d2f34610f70
SHA512 4aa2da494608d8733b255639d793c6bd24652d69ba8cb260e94f9c370bc859e8ff54a7a42e649d82d43d4243d345e0a7bab77ef351a65b6f60a7f94e4ab1ea31
SSDEEP 24576:jfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn3nQ/tbw/2Mkjy6Fr7g0o6:ba5POZ3+Jt2pasx2+mZQ/lFTjN4
TLSH
T14C65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 47bdb8513df16399be415a65da7a48f41a831e957be342cd2677153279025c7e
MD5 c1989f6e3375d5f5d71a3b86df1d3eb7
SHA1 83b4b406fc91bee4d8c4a92dbfcc483bb5b03e63
SHA512 16733dce274b58da2f396d9931525fcc003c2361237fda8419082efe5e9953195d41a7dac8a9388255a84cd847d4e1eba2db897039219872b7373460788d75eb
SSDEEP 24576:+NcwHdjbyQ4nLC18lb/EOjowL7FktnQ/tbw/2Mkjy6Fr7g0o5:+Nc/zEOVHFiQ/lFTjN4
TLSH
T1E6858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 062293189cc80b02b32500a28e6876de4cf282d8ced7da0f6e1561404016500e
MD5 aa668e6076b6d8899d72bafe19664d07
SHA1 286c148a44e5aef9ddadf5731db4ac63ab6118b6
SHA512 8f1d0246bcdb8afe6891906fa543be88261eaf0ecb8973cd5ab9e19bc606d35df6eb716ef35193582c93f24e0144ace70f57f7c4c127203369977f5ef252f208
SSDEEP 24576:v8kNvNnaFeYhJNtmZBmLnQ/tbw/2Mkjy6Fr7g0oK:v8MwBtOmLQ/lFTjN4
TLSH
T1DF55AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 b8523d49f6bc639986547158c592a4b3f97b4a1f9f91b6ab7f32c198877a8111
MD5 0067699a69fb02d19639827fe7025c99
SHA1 30a857286a80e060fbe1f4f79b1156f8fd1df277
SHA512 1c4c942a4cd8d008f21396fe99855c9e8f9b4f91a013e056b3c82ae0006eb11f5114a19803061401edd2b3f85ee6e5b80d1c3a7c00ec7473c87dd5537546a584
SSDEEP 12288:oHvUrBFrEjwaQhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:oPUr+NQxnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T18765E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 74eca9025f56eaf522ee80d79bcb7816b4809cfcc7af1be85acd6182a6e4e712
MD5 5f49c2d5d87427fd40a3a820203bacfc
SHA1 db3f372140d7002a9af3d9bcbe83bbcbffb7562c
SHA512 7e5ee1f388669198a0fc00eab22ceba872a60bf6b920d8fb91e8215dc1fef6c89f2074a1ac5a3eb75eb20f196a6b8abc3a84e14ff173a55942f93a8a1910892e
SSDEEP 24576:1D3FHshBIYQgAgnQ/tbw/2Mkjy6Fr7g0oq:1DVHeBIAAgQ/lFTjN4
TLSH
T19E75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1208-101-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1208-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1208-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1208-312-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1208-107-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1208-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2264-94-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2264-326-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/2264-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2264-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2264-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2264-88-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3200-294-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3200-83-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/3200-76-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/3200-82-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3208-39-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/3208-51-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3208-49-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/3208-45-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/3208-38-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3212-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3212-13-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3212-22-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3212-20-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3212-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3304-278-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3304-72-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3304-64-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3304-66-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3944-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3944-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3944-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3944-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4380-140-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4380-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4380-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4380-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4576-81-0x0000000000400000-0x0000000000EDA000-memory.dmp

Download

memory/4576-5-0x0000000000400000-0x0000000000EDA000-memory.dmp

Download

memory/4576-8-0x0000000002DC0000-0x0000000002E26000-memory.dmp

Download

memory/4576-0-0x0000000002DC0000-0x0000000002E26000-memory.dmp

Download

memory/5276-112-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5276-114-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5276-120-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/5276-311-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5732-136-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/5732-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5732-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5732-125-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/5732-131-0x00000000006F0000-0x0000000000750000-memory.dmp

Download

memory/5952-53-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5952-54-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/5952-60-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/5952-230-0x0000000140000000-0x000000014017A000-memory.dmp

Download