b8a2694480baf7f22695e7ae6ab2af8a9b81884c6c51cb9ef5cad5dcb3c28be1

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
Size 2.0MB
Sample260722-vxseladp3z
SHA256 b8a2694480baf7f22695e7ae6ab2af8a9b81884c6c51cb9ef5cad5dcb3c28be1
MD5 9bcc3650bc6cbd739ec610d665729606
SHA1 6e5e49712938047191a6aeac06cddb885faeaa47
SHA512 7e5d7aed3890c3c80485377321d96ed8cd962fdd290e9eacc0d1cf7add3294a7f05eb1469b4a67306c49b7173484cb6a8d2aea820b3521efdb4e1e00413bcc5e
SSDEEP 49152:bVxeyk+tWoS/0PUa6xDm40bk+BiTwXFw0h61tySHD:BxFx4oSML40bkOn61tySHD
TLSH
T1A9A5AE033283C075DC6211B08869DFAB86ADB8345B6148DB67D06E6ED8F22D15E35B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
44	3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 16 IoCs

pid	Process
5428	elevation_service.exe
5092	elevation_service.exe
1344	maintenanceservice.exe
5872	OSE.EXE
3304	PerceptionSimulationService.exe
4492	perfhost.exe
616	ReFsDedupSvc.exe
3308	SensorDataService.exe
6068	ssh-agent.exe
5660	AgentService.exe
5948	SearchIndexer.exe
3804	installer.exe
4700	installer.exe
5488	servicehost.exe
4460	ServiceHost.exe
5000	UIHost.exe

Loads dropped DLL 9 IoCs

pid	Process
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
4700	installer.exe
4460	ServiceHost.exe
4460	ServiceHost.exe
4460	ServiceHost.exe
4460	ServiceHost.exe
4460	ServiceHost.exe
5000	UIHost.exe
5000	UIHost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d85eb970e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File created	C:\Program Files\McAfee\Temp2420486724\jslang\wa-res-install-pt-BR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\checkmark-green.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-sr-Latn-CS.js	installer.exe
File created	C:\Program Files\McAfee\Webadvisor\Analytics\Scripts\csp_client.js	ServiceHost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
File created	C:\Program Files\McAfee\Temp2420486724\wa_logo2.png	installer.exe
File created	C:\Program Files\McAfee\Temp2420486724\wssdep.cab	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\auto_restart\auto-install-progress-fullscreen-ui.css	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-el-GR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\logic\smart_toasting\smart_toast_config_selector.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-sr-Latn-CS.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-fr-FR.js	installer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-es-MX.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\nps\laptop_open.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-es-ES.js	installer.exe
File created	C:\Program Files\McAfee\Temp2420486724\poppins-regular.ttf	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\logic\providers\bing.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ss-toast-variants-rebranding.html	installer.exe
File created	C:\Program Files\McAfee\Webadvisor\Analytics\Scripts\transport_aws_apigateway_v1.js	ServiceHost.exe
File created	C:\Program Files\McAfee\Temp2420486724\icon_failed.png	installer.exe
File created	C:\Program Files\McAfee\Temp2420486724\jslang\eula-es-MX.txt	installer.exe
File created	C:\Program Files\McAfee\Temp2420486724\jslang\eula-tr-TR.txt	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ext-install-toast.css	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\builtin\wa-ui-checklist.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\webadvisor.mcafee.firefox.extension.json	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\uimanager.dll	installer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-malicious-webpage-toast-hu-HU.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-it-IT.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-es-ES.js	installer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File created	C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\analyticscontextconfig.luc	installer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
File created	C:\Program Files\McAfee\Temp2420486724\jslang\eula-nl-NL.txt	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\x64\wssdep.dll	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\inst-top.gif	installer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File created	C:\Program Files\McAfee\Temp2420486724\mfw-webadvisor.cab	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-pl-PL.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-it-IT.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\externalutilityfunction.luc	installer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File created	C:\Program Files\McAfee\Temp2420486724\jslang\wa-res-shared-da-DK.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\core\json.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\toggle_off.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\ux-pref-red-progress.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\aj_toasts\wa-aj-toast-toggle.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-fr-FR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\smarttoasting.luc	installer.exe
File created	C:\Program Files\McAfee\Temp2420486724\jslang\eula-pl-PL.txt	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\core\postinit.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-es-MX.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-hu-HU.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-ja-JP.js	installer.exe
File created	C:\Program Files\McAfee\Webadvisor\Analytics\Scripts\config_manager.js	ServiceHost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\nps\info-16.png	installer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	ServiceHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	ServiceHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000acc1adbbfe19dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	ServiceHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	ServiceHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002aa009bcfe19dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007ea1b1bdfe19dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	ServiceHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e0c84bbbfe19dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\ = "McAfee SiteAdvisor MISP Integration"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\ = "McAfee SiteAdvisor MISP Integration"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ = "C:\\Program Files\\McAfee\\WebAdvisor\\x64\\WSSDep.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ = "C:\\Program Files\\McAfee\\WebAdvisor\\win32\\WSSDep.dll"	installer.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
4460	ServiceHost.exe
4460	ServiceHost.exe
4460	ServiceHost.exe
4460	ServiceHost.exe
4460	ServiceHost.exe
4460	ServiceHost.exe
4460	ServiceHost.exe
4460	ServiceHost.exe
4460	ServiceHost.exe
4460	ServiceHost.exe
4460	ServiceHost.exe
4460	ServiceHost.exe
4460	ServiceHost.exe
4460	ServiceHost.exe
4460	ServiceHost.exe
4460	ServiceHost.exe
4460	ServiceHost.exe
4460	ServiceHost.exe
4460	ServiceHost.exe
4460	ServiceHost.exe
4460	ServiceHost.exe
4460	ServiceHost.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
Token: SeBackupPrivilege	616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	616	ReFsDedupSvc.exe
Token: SeBackupPrivilege	616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	616	ReFsDedupSvc.exe
Token: SeBackupPrivilege	616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	616	ReFsDedupSvc.exe
Token: SeBackupPrivilege	616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	616	ReFsDedupSvc.exe
Token: SeBackupPrivilege	616	ReFsDedupSvc.exe
Token: SeRestorePrivilege	616	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5660	AgentService.exe
Token: 33	5948	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5948	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5948	SearchIndexer.exe
Token: SeDebugPrivilege	3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	5428	elevation_service.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5948 wrote to memory of 6008	5948	SearchIndexer.exe	100
PID 5948 wrote to memory of 1904	5948	SearchIndexer.exe	101
PID 5948 wrote to memory of 5116	5948	SearchIndexer.exe	102
PID 5948 wrote to memory of 5368	5948	SearchIndexer.exe	103
PID 3012 wrote to memory of 3804	3012	2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe	105
PID 3804 wrote to memory of 4700	3804	installer.exe	106
PID 4460 wrote to memory of 5000	4460	ServiceHost.exe	110
PID 5948 wrote to memory of 952	5948	SearchIndexer.exe	112
PID 5948 wrote to memory of 5596	5948	SearchIndexer.exe	113
PID 5948 wrote to memory of 5384	5948	SearchIndexer.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_9bcc3650bc6cbd739ec610d665729606_amadey_darkgate_elex_hijackloader_luca-stealer_lynx_njrat.exe"
1⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Users\Admin\AppData\Local\Temp\installer.exe
  "C:\Users\Admin\AppData\Local\Temp\\installer.exe" /s /upgrade
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Program Files\McAfee\Temp2420486724\installer.exe
    "C:\Program Files\McAfee\Temp2420486724\installer.exe" /s /upgrade
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Modifies registry class
    PID:4700

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5092

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1344

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5872

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3304

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4492

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:616

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3308

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6068

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5660

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5948
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6008
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1904
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5116
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5368
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:952
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5596
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3004 3012 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5384

C:\Program Files\McAfee\WebAdvisor\servicehost.exe
"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"
1⤵
- Executes dropped EXE
PID:5488

C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe
"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Program Files\McAfee\WebAdvisor\UIHost.exe
  "C:\Program Files\McAfee\WebAdvisor\UIHost.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8d705c1222bc816e3b7a152088ed4c21b86c7dcbf0ce494d7ff5747ce3d2c6d2
MD5 0a6398a42a98b73236ce2fc33472596e
SHA1 bd38bfa5a9119c2ba13848daeab31a859e1d8c77
SHA512 eef3032d0831bb80fd49a1fa48fc08b68c2e3758b5f08ad0e894da2be59f4200436f49ebc3fc8c6074aad871216baa0b984f424f393da9d538b58da192ecf34f
SSDEEP 49152:5b+632BuPkFKRrdE6ohdstBhuXjfS4LWxn+61tySHD:P3q6mjB961tySHD
TLSH
T14ED59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 6b0a49e72ef9d526efb19567a69a6af2a0a96362d7cbea973b63f8d57aa5f26c
MD5 91a59ceaa89342bb71328c5eb7277ffc
SHA1 cd513ba2cdbcf6aa9e02f915f356855f0655c892
SHA512 ec30f6e3776915b4a9139f2b5a3beb083ffef53e4ea7f3a53986d85fd8bb98609d1eca17eed2271dd9afaa6496267c0b42ca970479b58d81317d7742fa6778c9
SSDEEP 12288:l1XLsswWkxy2lRq2czAJ/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:rXYfDtczA1H6LRgy7iBY5/ryIDxXv
TLSH
T12275F128B3E508FDDD678238C8A28551E672BC5547A0E78B03F4A9295F337C85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 46d116310f9100f2c19a969f1af68e9a76c6306fecf0b8f48c6a6bed85291afc
MD5 3afc5133371dadd1e94a5eb9dce6e085
SHA1 c84107ec5bf4c7300445718889509b5dc0b9b85e
SHA512 c09acc640ef66b8eb83c71c8853a721c49b8c17dd2269929e53d02cfcfe7a56a42e018d352daf510281919e7293bc4facc4e7f97705490b7a08a52b7c5d349b7
SSDEEP 12288:ymw5HEjsChNEBFgl0WDm+Cm/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:rwuROWTH6LRgy7iBY5/ryIDxXv
TLSH
T11565E14676E90CF9EA664238C5978175F7F2BC122A21D71F13A0C65B6F33351AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5719bcade19ebcb2901ac6366b1fcf6265d2356fa867ea908036ad6b139f81ba
MD5 461983957ff93c76a4a8bf895be85242
SHA1 765a08c1eb16a57560d6ae967dc2d1332ed35fe7
SHA512 17b769b188a508e662e5b3cd0180e314e3ea0ba03fcd496a3d41217f73e0c9245c6b4a4a43f1e52ef8c2d2abc15cf56f18a3d08a05f9c27e8092ba25e4673945
SSDEEP 49152:pB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl561tySHD:/u6JmIxd2d561tySHD
TLSH
T112D59D13F1DA01E8D06ED478974A9232FA62BC490B35B6DF0A9073552E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

analyticsmanager.cab

Path C:\Program Files\McAfee\Temp2420486724\analyticsmanager.cab
Size 2.9MB
SHA256 04655cf1093c3fb93d67cc21d55bfedd12e9545947116e0636b688c00e2db8b2
MD5 0e7e50df7e6d56051ef7f2ce64f69150
SHA1 dc270cea69a86caa855cc5a4e750e3d15a45b4b7
SHA512 4f911fa777982ad9f4a1aedc17f9ed9536b73ec23b155827f1a2e4269d89e255fabbd196fa4ceb0a01d889cb991dc4a2646f02818c1ca8871605c5529a4612ee
SSDEEP 49152:eYW1g20MljEXll135qNnMHBttoj3GdVIdp/hOMRmAsv2TXYJWrPBUAQ29u6XK9hy:hW1g2XxEVl1piMHyj3GduxOMRmAsObY6
TLSH
T168D5332B30420855EFA44FFBB95DA0914D25B00750388F3CBB4BE6268A1AF71DEAD795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

analyticstelemetry.cab

Path C:\Program Files\McAfee\Temp2420486724\analyticstelemetry.cab
Size 68KB
SHA256 bb4ef3b73def145e2db57bba3c760bc9d129d45f20cddf173768bced0a2128d3
MD5 62049dd5a5d469fb12a943192528d54d
SHA1 0e5bb9376d13e402b547ba0eb472ab3d3b7ec934
SHA512 b942742c6d9db0220b73a87c8ef17d5e62aa1756326063c5cd6f7d18b4b6c9cdf02d124d5c52f1889800b726408a3e56652d91d08c2f0aec6463fd3f659d5904
SSDEEP 1536:m48sR1uTytjnlQbBWiLkRCQuhepRXlA43WWaMQxx+/h14X7aE:eSkojlQdWWKcON/3WScxyr4X9
TLSH
T1F363E1635A24A802EA43FD2EB9F319B7533DAA9155D4D44182A8CC0F57E53823DDE6CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browserhost.cab

Path C:\Program Files\McAfee\Temp2420486724\browserhost.cab
Size 2.1MB
SHA256 18f7fd14cd54022d2cf93b35ddb7bb80ae8b1b9d1112ac0209c18bf5c836d505
MD5 bfad28bcc941a24cd8490c0082b47b0f
SHA1 5c5ee89fc308bf5a5bcf12fdcdc29e2681795780
SHA512 195368a0f2a8bb03409c3af23e79168afe29067902ac823d6b722c034a9ecb0ade822e9e1b51b79c33edb60514ade333e7498d798eb22685d7eaf73e940d7553
SSDEEP 49152:Q+NKku3AGsHOVmrJf3dg7NGhngh1WwFuMnC4E4/R02wnqUbwm:Q+vPx3K7NkIGj4FR02wnqad
TLSH
T1B4A533F268434B8846087A2195CE42572CB0C79590AAE1036DC95C7FF52EBA6F7E7CF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

browserplugin.cab

Path C:\Program Files\McAfee\Temp2420486724\browserplugin.cab
Size 4.8MB
SHA256 086e66a24ebe7cdb72000cb5ccabe2b013c1bb58492da7c394f332402343ada9
MD5 ad56bd033c0c0c0cc28bcbbd4d8e9e2b
SHA1 75f98913e245c1e95f82715ad941e29ef90aa6fb
SHA512 2adf9e39a95df7dd6e2c9068405968deeefc9493c52197cf5c11b6c69a1fa7375d0998b9d97b8eeed70f0ae4a4c0b57de3779506cc5029d6217403f2c1076316
SSDEEP 98304:+hPDSay70AR7YlRF1JxJmNASEkYQZrctPk7bkAvAcRKEpY:+hbSanvRF1rsN0kYQKs7bVvFwEpY
TLSH
T10A3633FF80032146FB10EAF3BFE4BA2F4144271F648159D152ED7725A6AFA6606E8D48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ds_invoker.cab

Path C:\Program Files\McAfee\Temp2420486724\ds_invoker.cab
Size 4.0MB
SHA256 96ed39fcb00b5c9e9534cacadd63718c669ef63f55c88dc2f7e58fc288cbdbe9
MD5 8dc7776ae20bbcd7240208be488fa573
SHA1 61fef763e0b5aa841b9f2384aedaebc75b87bea5
SHA512 bd415dceac0a867d033ae84184a5a750452ab11b56dbe388d53c755ec735d0cc4f25893280e92706390467e4b654c9d9ca29b4596c61afc70cdf52702579c3df
SSDEEP 98304:S26aNAKijPhn0Pc/KnJZJl5wKYF7gOefEL7ksKOSsNB7dZ:SuN9ijPSMKJIKw7lCY/v/
TLSH
T1A11633B419982D310C5A9E1AC3B0A6D01FB8E9A77DBFD413792B0A41E5457F0A193B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Program Files\McAfee\Temp2420486724\installer.exe
Size 2.8MB
SHA256 a69ad082ec8344bd645090021dde987f711d224e88394147abead2c07e7011ff
MD5 dd73eaadc686818bf4591f5eb6946962
SHA1 0f734fe7717be598ca3d66f4956ae13f4dc1ab1e
SHA512 e225603a829a331643a907f2b09e86d2897326cdb7bab2fe22bcfff5202b484aeeb59a669e8127322d86f0ecb4975f24df91b0d050d2e5791c82130fcf1c0891
SSDEEP 49152:nDyAgegOYKkfNOvn+X5Lj2KhOksL7lftYGAuZbS:nDy9FOYKe6n+X5LjdhkgJuZW
TLSH
T1E7D59E1B72BA40F6D876C074C942860BEBF2781543305BEF1790566A6FBBAE00D7E725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

l10n.cab

Path C:\Program Files\McAfee\Temp2420486724\l10n.cab
Size 226KB
SHA256 e7a23ebc564c9f1ace5529bf52610f21091b27f38f196ab620a243fb65175e62
MD5 a86789efdff4b2528b12813129fca3a0
SHA1 5a8949c6379f25a4e37c7222991e94a0eadb1332
SHA512 bd2d4d18202b87a12f4df4c95a33da96ebc708ba7e0c1ab28c9ca68d4ffaaa95ea705d7c006b5494442918bdec8a15d6d6632e4dfe7af4d5e5534bfcd3cc8d7b
SSDEEP 6144:Szb4Ouv2OdPvlj+5irEUkNMU0hKDfX9psnP4Y9rMfKgarMMW0Wb:Eb4d2OBEUk+XIfX9sPPW1
TLSH
T10C34CEE09E7E72EDE918E22F99204972E3379142CFD5EA83D31E428D290570E5D53B35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logicmodule.cab

Path C:\Program Files\McAfee\Temp2420486724\logicmodule.cab
Size 2.5MB
SHA256 b69fb8ee0cf3f251b2818a0d19f27276d0059aa6b69ec9ba3f64e6ac76565d67
MD5 01a3c8fc3bdde2fbc6892fad082e90dc
SHA1 4ff28fc06e318771f077f3be067bbc2773a3b4f8
SHA512 2c2cd94c11590f64ecbe0c2e4fe2b3740177ab5a3c848bd9bc5e8f649960dcc743f768affbbd772fe9066d2b4f4b7ab4789424efe4838f5874ef7f955a570afb
SSDEEP 49152:HEWz41MqO9jOQa0S9CiJdgA0pWn5Msmdex3uly6yjYvLQCy:HH4qOCFgCp4eEHjALBy
TLSH
T184C5339FBFADB5CA46D0C3C49193168D31A052978EFF4DD6AF207BA6E83A3400712597
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logicscripts.cab

Path C:\Program Files\McAfee\Temp2420486724\logicscripts.cab
Size 70KB
SHA256 19ace87578cabf9acfaca8c5012298a241b73947d0ecb55322909bb7abb9c780
MD5 c96203cade4eb6a64ec0dee27f8954f2
SHA1 e9cdc3fc650538a0f4b4f73beb2c0b92b3839de4
SHA512 5f231920be45b2cead7db557c3ad3099ed16807aabc6f7a523c17ef2fdc1dc5d6c0180c0d745390957dadfa3b3f91393acb5c404a2ffefccb4a6214fbb9a6d4e
SSDEEP 1536:YPu/wuuti5a7zlQnucaS9djm+k8BmWcwKsz5aD7ww:Ym/wxi50Z/cJW+pBmw8kw
TLSH
T1E963029317B8EC03AD43EC75B4915416E9BDA5D39CC420C6995A813C97A2BB13BAD0DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfw-mwb.cab

Path C:\Program Files\McAfee\Temp2420486724\mfw-mwb.cab
Size 20KB
SHA256 3e84b4348ecae9c1eb0c895dfe1307dd046341f5b1b24f6093dc7e6235451916
MD5 d6ea5677f4819fbec19444b0f360b237
SHA1 e4dfd78e4acff44634ca76802df7d8104eb46a5f
SHA512 47d2b7fa4cbba390ed8f2a823720c5db087df34f9060ab889f3332024ebce3aab23180354fac9faaf718db0fed92bba41851cc935b2f7972d583158a0afdcd69
SSDEEP 384:FFgnoO88aaZbJIz5KfKwM6ki29d1ikvZy8RbmL4nNyHgw3:FFgnoO88ZZbyz5Kf52PsA5ALL3
TLSH
T188929E6A4C685C83FF83AC34F0C49A269E7E60817CF4E0D7B195C61847A53A237DE28D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfw-nps.cab

Path C:\Program Files\McAfee\Temp2420486724\mfw-nps.cab
Size 22KB
SHA256 c0ef76178b0bd95a76cd75d24a5f8b4e24d176fb03f585390c47442770f06ddf
MD5 475ced9e7fc8e2acb4fd455ac97cae82
SHA1 4ddf710086bc13a88cfe804daa07435ba48e8482
SHA512 4f62586534f8e12d5775b772defdd908e8bebc0b5d4d441d21de181c3d05c4ebb8853016defd7072816befbdf786a896bf9dce6c25f34791359a92c8feed771a
SSDEEP 384:Z7xIfqjYnicStI1+fI88I+E4Lk84muIFBIJmb7vt+246ki29d1ikFo3hy8RbmL45:Z7xCkY7SG1SI885R1ey7vt+272PsP5AG
TLSH
T1D3A2BFA718682803FA1B6DB4F0D8852BED25EB869EF581C3B148C3560F6C3866BCD15D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfw-webadvisor.cab

Path C:\Program Files\McAfee\Temp2420486724\mfw-webadvisor.cab
Size 583KB
SHA256 dd2a590c843dfb6f6d70dbc849a2c61fcb7765b59a63cb3c4322c5ae638bbfcb
MD5 062504242f7ae2db5d2e9db857d0b111
SHA1 caa62bd117ffadbba505d81e9bcbbab8a0e72ec3
SHA512 0d36df35725f42504f96cbcb4052a03324d762cc608bf8b915aace4031c01ed56bd8054f927606b5cf86263074bf2a68c09ef7e0f13d9099b82b092d462c0337
SSDEEP 12288:8BGRewke6oEcoMZ+uMhV7mN1bG+vbj/kBSnZEb8mw3HhirpheRWa6Ur:80RewkR5ctM81bGYqb8N3HEZaV
TLSH
T1B2D42371EC539F4AE88FF838F4A98B28FB4A9C19341DD5D63751C6B86A0635029170EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfw.cab

Path C:\Program Files\McAfee\Temp2420486724\mfw.cab
Size 786KB
SHA256 2397623adf4c92fd90de9fa56193dded2e68e8c80db1f1698661defb2ace2565
MD5 a8b7ace6fa3cc80e1b92298f5c5dc0c9
SHA1 36a75c6069358c58cd9ac22d4692ef486d0870e9
SHA512 399bc9eee4bc58d19a721f65ee37c65bb1a922cad20242bb1a5cfa19a1c30060c331d5de5c1d01abea7dc999a93b2cbbf5ee53bff25fbf65a2eb61b96c7b266d
SSDEEP 12288:gXTximSxmsF2oOM6L7QlWWguTZagr5nH3VNwcmosZ7P0ab:gtxQ1/6QWKZayJT8PPb
TLSH
T10C05332ECD42C5A6E1B93624E0E44D08CA324DFF95FA01D6CDEB77BC18ADB326D81255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resourcedll.cab

Path C:\Program Files\McAfee\Temp2420486724\resourcedll.cab
Size 37KB
SHA256 ef2b9e94f27ebd7bb1812cc355c02980504a3e6ba78e17a571dd58d247d51e08
MD5 4ae75efd68a2d67fe30a40ec67c3692c
SHA1 6458afd14b9d1ce5c2d022e71eb1dc89eb6c0790
SHA512 4c52eb9169054929cb2cae66360444e879c8dfa9b8eb8faa302fc4771920ca545d3fc99cb7cca1d526050ce16325866d6c2134a54da292baacefa3aba8fa2c8a
SSDEEP 768:SEa0j6qqhiewzQzkj8manhnCG7ZrVE04TgHHWLmAzX2Ps3F5ALq+:SB0bqhie2ofhnC87E040H2LD73s
TLSH
T1AC03E0A7892458C6DE6FDDA4F0C858A70CB077C5B9E1C096B4A5C3206F893C63AC25DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servicehost.cab

Path C:\Program Files\McAfee\Temp2420486724\servicehost.cab
Size 319KB
SHA256 84fc1c9a8d28beebf196ddc69150e071eea7e89b4d95e4868532427f5f111a54
MD5 4a096448b0a2f8dbfa1ea2f6a037b65e
SHA1 df0d54664111893110a38cc5de8ffbf749a15db2
SHA512 2f45aad19f682576c488c6429cac043fb938a5969a1c3ad5d322d093fdfc988a81523d82388adcf9ddb4625303e2cea0fbbe2f6a109cebbdb5de8cf24db0d8d1
SSDEEP 6144:VHeuF526YvPDrg9uuC1dZsASmkS8Zi5x4Bpt/ZM8Svu:JCd/vkmOZC4Bb
TLSH
T17064233D93A8F0460D0BECD5E1B5E2D32F313AE6CEC5218B5544D7A146823B697E83DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settingmanager.cab

Path C:\Program Files\McAfee\Temp2420486724\settingmanager.cab
Size 808KB
SHA256 1c437ca8f3e161ce4c37cd3527ab800cf0f64bbf24411a20f093fd574d4696a1
MD5 93504d331dca04d6d25f33d49e363963
SHA1 9489810f420d54a40e4f9f4bac83b5b340bedebe
SHA512 6a16c97d2d91c3736988be3482bf81197dec9e2f044604e6d680189bf5da72c2c2d94b3c7336089afc26a0091ccc5602d41ad504b45905e0a2046e1c51d5678c
SSDEEP 24576:BZns3M9xLR9HdIwu3mZWyQP0+oNsiUgUsAjZvtimgxpk:BkM9xrHyw6aKyvJAZtimgxa
TLSH
T134052356BEF4504DDE3069F7F1F47E8DB66217B68D2404A2928B863C3EF820E2095D97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

taskmanager.cab

Path C:\Program Files\McAfee\Temp2420486724\taskmanager.cab
Size 3.8MB
SHA256 c551948588057e20c015def1fb6aed211826095eea8676a6ec19f0803d950b7c
MD5 392ecdb06e9c73f5834d85fa53c5d0ba
SHA1 37eabe22044cbfc658924af1a745c2c9314d58c0
SHA512 e1f68fe5c47ed075bbfedf588eb44d2f4a1f985b49ff05f936950e791843c8fa72e4f08dcdc1bb290be39fa922110b802bc80b51b35fa881f7f04c7a0eff5b1f
SSDEEP 98304:Rpx08sXRzH6l7xktErFGqm1FndsdOjxadYTX6ahGEG:L4SlxGRuOjaGX6SGEG
TLSH
T1E41633F412CFC8CBC84ABD6B26AB2304F96350720515968B55A9D37D9D2FBA72F80335
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uihost.cab

Path C:\Program Files\McAfee\Temp2420486724\uihost.cab
Size 387KB
SHA256 bd43fe23541219eba6b1c8398153542da1ced88123c293d3ab646528145a0068
MD5 7652a06217810831c3bfdd4d5e2fba24
SHA1 d327ba22a7f2cd26c29789e955143d630396c355
SHA512 220a11cc46cf8fe75b3b674fa25c9ebd6fac70f7fe7d9304d7d707ba99790836c1a377b21d5079c8011d64221b03e7cf092239ec4690c4b7beb475a3e81c616a
SSDEEP 12288:M6s+M3hvNgUB0LYHG+VWJGuMhbVHMW26ZwcoxNn:Bs+IVYLYHG+oJGuMhCqmxNn
TLSH
T1988423496C0FCDB7BAC996B224F6A5735BB065D2588089F755E1233C8770B422FE630A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uimanager.cab

Path C:\Program Files\McAfee\Temp2420486724\uimanager.cab
Size 4.9MB
SHA256 cd67bf2e662631c8a26cc155b317a3f3990dbe5aaa1cedafedd08455b70abe81
MD5 9be10152b56998ad27c2a264ac4bd630
SHA1 1d9be5182152a2cb418e3c6d914e826d49a0a57c
SHA512 bb9427d77dfa2f893e01ef64d56af8081300bfacaf0e8cc359e5dcaf71c493cd0a5c49c853b8cba72ee77b5ac05b9180c23ec5e05e10a2e34445a2cdfae7fc75
SSDEEP 98304:PTOqa4zGzTGdWD2rM0nqGVvt58SlSau278/ZgcrBZ9UO/owuqjHQ6WL3PwZDlPc+:PTOq1z6IWDKnq4NXuMpFxkjw6SeD166
TLSH
T11F363355EC21FA27D582D172C9AEFD73BDACC37C093812FD3E9A014522A62C9642774B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstaller.cab

Path C:\Program Files\McAfee\Temp2420486724\uninstaller.cab
Size 1.0MB
SHA256 125484be657b2bd68dc659e1e529e957a703afd6583faa87fbc65c6385cb5bfa
MD5 c4faf352c1a4dd27d16b31c4284cff43
SHA1 e336b85477c528e79dad9d23aa91a3d5ef36c370
SHA512 058a88b6a50bfab3d8d5ec49aab40b88c29bf417728ae7106595a4070ac2476449cdf0176a00a490649627892296e844aeca4cbed30137dca5539d114fb35490
SSDEEP 24576:ScaBuZsZyS3RJJe2bWhQXe3ZZCSQbjc+44AbrDaBLlsvrCDE2:SiZc3Ra2bWhQXe36SooSWGXsTCDE2
TLSH
T1523533BECD658ACED69A0702D774F581E4A2D671FEB744A14203E1AD052FB92F8F3181
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.cab

Path C:\Program Files\McAfee\Temp2420486724\updater.cab
Size 989KB
SHA256 5e860c4243aea7b52111cf434a91c7a4ad61acd044cc020d318a960ba5a11202
MD5 bf44305375d9afbd27b3b4e039f0712a
SHA1 6cfe7df75b43aaff6d65e151dbfd0f1f2765761f
SHA512 910539bfd0ceec24a7183305fafb2e7ad81ef5ec4a9bc6c4a4cfad5bad8cabc323c0658165d869461982bec200bf5e2081ae6c31beb7e6419e406084908dece7
SSDEEP 24576:0Ti0URG+oKCGoxOUTLe4JqhxMhlULhUFkEOgHQOefcM:0+VU+oxOUG4whIlUNUFkEOgdy
TLSH
T1BC2533B58DD66FCF628AEF02415A0D7D3808DF4CBA42C2810FE9A19DC75ED9E9D088D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webadvisor.cab

Path C:\Program Files\McAfee\Temp2420486724\webadvisor.cab
Size 11KB
SHA256 e632c23068fd6ce0f8b9b26f898b8d54efbb3a3b31ae3975b4cde120feecd567
MD5 2d2d1733e5f48e86fabd553db7a9c20e
SHA1 3ecc49d435fc8a5351176e34160eed1c997923fd
SHA512 5d16f3e4bff71709746ef8ad22122cf9a78f163ab903b056641d90c0b34c5b496782cf7ed07c41828f099d48f053514571e7a78b4212be39a9415eae28979b22
SSDEEP 192:v5uqMdj6kSDnicM9Lx76iiX0ime5mfULc8pq8RuwdmL4pUQrNyS7SSn:vJMV6ki29d1ikje5msy8RbmL4nNySWSn
TLSH
T19B425AB748684843FE83DC35F0C09927AD75AAC56DF9D0C3A11AC2594B943823BDD6AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wssdep.cab

Path C:\Program Files\McAfee\Temp2420486724\wssdep.cab
Size 573KB
SHA256 2bf87bb4746b03181b9b644a059929741f0f4d4fd782875e14b18799d39b1a13
MD5 12718c157d48666616fe88ac63565615
SHA1 050052338c819f2d2dcb4d4956911d07772c01a0
SHA512 66c7017ed4a8938a8857b62db17c700299b7d4386d757517b930250a27ee4e709a3a222ae5f139169da9ffafc3e8773cb65febafafbab7dfb3d65487bc91a420
SSDEEP 12288:vSawysG0Jh41WuuBxnT7O0XQYRqjra9gro/6OGcWj9GlaRYi4M:Fhw4WNvtXQXXAgroCO2nY+
TLSH
T1DFC423812DC06B4A94EE7BA3A442BF4C5F82E1A763D81780A49C55D078EDA075FFF1C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AnalyticsManager.dll

Path C:\Program Files\McAfee\WebAdvisor\AnalyticsManager.dll
Size 9.2MB
SHA256 98499019a7ed3fa8ab016b7ed2ac1a4dcb7016345e9fbbb1b4711f54fef7a4a6
MD5 6ef833ed885796660d5c2ae79bb27ad6
SHA1 94f567697c28d15c6cc8c93e96dcb8ae6d8b335b
SHA512 e6a68949b410b8b1a2be8d7e94a4b56b631c45a8aa40ae75de90eab1d3ecf685d61c00e74390c7d3ec0922bbb56f48fd7af67ffe27fa98836af4d50f0f1c7492
SSDEEP 98304:/gOMGBsfBeHxM4ACMjDgg006YY1fL3I02K/nAKD/:/gOMGqQRnACMj85fsC/A
TLSH
T1ABA67D43F6BA00E4D8FAC1388A676127FAB17C55473097EB0694966A1F33BF0A63D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dataConfig.cab

Path C:\Program Files\McAfee\WebAdvisor\Analytics\dataConfig.cab
Size 80KB
SHA256 97222f121e384e0224e4cfcdd3174ad58af17e08d57025d88ca638b65bed72f5
MD5 65a5df132da1f7d3a607323a21f6dd35
SHA1 2cd3c265bdc9926c8e530378cc2a74b8c0b2b4f1
SHA512 ee60aa8326335b5c32594c087150577744c09baf789fb137ef9e47c17c3d372ca630a2ef726b1c586e5809ef6a27e3a7d602bf5b0fd2546b6b8ea682efa227cc
SSDEEP 1536:Rvhgkw9rdJqN0WLH5LiM+2q1/e7Ldmak5hfNGKB4Bk3ilpTEuFaW:Rv2kY/qjT5Lx+2q1Glma6hfWpTEu4W
TLSH
T17E8302E09A844406CF25CDF9F0DBBCAB5C7CD2551CF790C3616EAA96910E3906F892DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogicModule.dll

Path C:\Program Files\McAfee\WebAdvisor\LogicModule.dll
Size 7.8MB
SHA256 cabc223eb3ae67483f29ee9e4036a2b18d75385f08343133caef60d6aedc5dcc
MD5 a3de9a4dccfad2d28db60ac5d33ddb24
SHA1 c09289d67095d2a00f666b3dd049b7f7deb628d3
SHA512 7e2fa22ccb69cf0bbf314c95da5c2f244296b4a28cf95d93176cac30875201952f00891db7ec1e9747a0bcc8ff2b25d8c9fadba678f963be12bc176b2a72e3d6
SSDEEP 98304:aDfsFJIGZy+hxeg0GLDXq9nPnt9I9HwfSD5wgKab9kjU6uhflY1:aDfsz7/YGLDXEI9QfgKghb9dhq
TLSH
T1A5866C47F6B610E4D8FAC1388A136127FAB1B8498734A7D747945A2A0F73BF0A53E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resource.dll

Path C:\Program Files\McAfee\WebAdvisor\Resource.dll
Size 26KB
SHA256 20ac89183b0f7dedadb1b8cad194b14e0e83e000e9a6aa6a62899cf1011563fd
MD5 bd61995c72ef7ec35eb1e19695b62651
SHA1 a689fc9bdf86461c2a7984eb1552ee0d417f85e7
SHA512 27c4cd4fc01af2d046c8cf88366d08668952fa556dbe00b075321a09345156dfedb14be5c238ddc87c03224ca1f9dc3f6f766424ea15a247ab00bec65153bf8a
SSDEEP 384:9BhBf/W58RrB3M65lWHqXPDpraC6ki29d1ikkzy8RbmL4nNypUW+:bBr3M65jw2Ps95ALp+
TLSH
T110C2C516E6ED9593F5B36D3462F050912E77B8863DB4825E8D408A2D7AB0740CFE473A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SettingManager.dll

Path C:\Program Files\McAfee\WebAdvisor\SettingManager.dll
Size 1.9MB
SHA256 e1eb2c4caa97da914adc7ecd22ff17ea9230f76667cb9ccdb68d05ba1f2b4707
MD5 5e111de491d40ed20513b018e0d37d20
SHA1 301361cb25c334836c99aa78d581fb1ad2643a3b
SHA512 0726cc1cf74fcaa9ab9dcb8a90d72fcc339a2232b47d30b3b019872ea03550770390bf8319554ce967471d7139808e18ffb66b2bcfcaad1ef037045e52f48c63
SSDEEP 49152:VXYHo1JGxEy33ca2MEP+sZY1M5lw/eo/AvNHJ:fJGxEy3MXxHwWpp
TLSH
T161957D1BA3AA80B8DD66D2B8C9538917EBB2B445476057DB02E0469D2FB77F0063D33D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TaskManager.dll

Path C:\Program Files\McAfee\WebAdvisor\TaskManager.dll
Size 7.3MB
SHA256 f784a24456521a960f90d3fe93793ef91f8248b2b60aa708dfd6de9563987344
MD5 ea28bdcef62f6714427c45a2039caf94
SHA1 0e5e8516497ebf98dc6f00b4c8e4e3ba85258a34
SHA512 5ec02e25b1d0eff295ccceb8738aedcedb3412e40ff1d113b0d1ef413f6022e283361c7d5e2303a831f17b05e3189d4c03a4d4405d0a79e0ebf917a031d288a8
SSDEEP 98304:gcoDvNXMcsNqlSb+TnBO8/OUEM2hn8c35n7i9/LAQt:gcoDvNXMcsNqla+bhERV8i5wLAI
TLSH
T177766C03F6BA50E5C8FBC1388A536123FAB1B8598330A7D746945A6A0F73BF0A53D754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UIHost.exe

Path C:\Program Files\McAfee\WebAdvisor\UIHost.exe
Size 1.1MB
SHA256 a1f08272e1d4cb7cfb9025f99064971ca86cd38a0b74303f222c7250512dc3ba
MD5 051fbdb9f360316a9ea1677c21b7195b
SHA1 79b72bdff85ea9cea77a233481eaf5fde0f6fd00
SHA512 7e9290257d804b85c7a2dc54cbad8016e2fc8fc1278c7b730d90140ec53f3b4d9c1d50accdab4e1596e84002dbd2c0d97eb7fd90b8c1a7bbf8dbe6922d6b96e8
SSDEEP 12288:wyYZT+g15nV+lK19oe9H6TcAsEcvzYIQbxft4HJ/3+f4:LYh9Vrjx6TcADKX8Jg31
TLSH
T13F356C1BE69FC0F5DC76C1B4C9928516EAB2B40983205ADB02A095992FFB5F04E3D73D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AnalyticsEventsConfig.luc

Path C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\AnalyticsEventsConfig.luc
Size 12KB
SHA256 dd5967a65aba7668d3d2abc40bab63468aa29503566fb5d32000284b014e9d12
MD5 2ef1fe182fcb21792fd114d2a6a34a15
SHA1 62800d9265608f59cf0abb8a218a6b9a371d8db4
SHA512 7194fb70b4068932140d0c5a65350360652308206ec73e208bf388233f58832bf3e768bf641d1ea7ca245ce45b3ac6fc3fc6c3688b9a29564a37851eae245c87
SSDEEP 384:pn543s80c6iEp3ySgqucppXvC5uWl+/Jkg:pH80c6iEtuc6kJkg
TLSH
T13A4293AA5F7E6A6DFFBFC29D5AF406E409300985B0D005F687AD8D6401C36644FAA70F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AnalyticsTelemetryHandler.luc

Path C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\AnalyticsTelemetryHandler.luc
Size 2KB
SHA256 10ce6ced1d8f8587e32d385966389306fbffdc90147e8fb0cbac7a6d986c2d51
MD5 b2364210cf311dbb1a76735c1b32f1c8
SHA1 d6a68653e877cf139ad8de9f91d65273ec3b7516
SHA512 8b148734d527938371baf8fed7856676304dfa6bb6eb90f0c8813c5cca21a9fbfbd9b367d2a24b48d1768be840753bf5e97bc7ac7bae427a69bae9f4fa2fd012
TLSH
T115415349BA4C54855537539F6BA2DF04E7B4DF9DB302C1A290827FBE8055124FAC3265
MD5 SHA1 SHA512 TLSH

Submit Download

class.luc

Path C:\Program Files\McAfee\WebAdvisor\mfw\core\class.luc
Size 656B
SHA256 43e0afc5513d8b318eb9313b70eab9112147c74faa84b7c76fa037e6d135b07a
MD5 8e7fee8e1137c8bab8aa73db7a8d7660
SHA1 a5b503193294b5fafa2294e7eaff31eacea3a6dd
SHA512 c797a79853b1dbc41e5131f54ec23e2b27d17b81cbd0a0948e89494d1cf81aab7a1cbb6aa0b012c64dbe9f6f883da03f0d54f116a52068f59a88298fecc7fee4
TLSH
T1D1F0D3AE12DC7153641EC511059B9D1056A0DD164B16533F5753D15DFE26A082B0BBCA
MD5 SHA1 SHA512 TLSH

Submit Download

dkjson.luc

Path C:\Program Files\McAfee\WebAdvisor\mfw\core\dkjson.luc
Size 9KB
SHA256 7dab0ce4b47294055643b76c87ff0c74a8c40a61b319a018c5b1667f8f017c49
MD5 4eb4a0e143d64b4909851157d62f2665
SHA1 fd55d5ed1b3aaf473e83c005f1346c493a67ed4d
SHA512 53690c88deb3ef1461127b026fd670c0dfdc54413a66da2bb9be5b07de866e0e8552db63a3ac6da9249d00decc9b046d6d16b6dd5db90a736af44dee0d322fa3
SSDEEP 192:jWXBkgh/3g7O7qaNfEyc80vDGwVd4Wog1DYEZpQ7+hC+Tf8IkZ0JmRy:ckgBGO7q8RcTvf7xNZUqB
TLSH
T19C22FA1F92CC1B57753ED03A9A32CF34A6905C1EFF124F4B612A96B2F55220C9B8638C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logger.luc

Path C:\Program Files\McAfee\WebAdvisor\mfw\core\logger.luc
Size 699B
SHA256 dc0f8ee4238c9a3344579dbc30fe74f9c27ef76e21763459e73822ca838283ef
MD5 dfb3d0bd4bf5ef35d7239f8597074ea4
SHA1 bc2afc092a43aa9a84e02a661feb6daac7de55e0
SHA512 380fc6c03d4558d5c3e96fe5f2ba866a6de4a2e918b6bcdaa5b3b25fb41ae4222c9565c2159b184661c72f6cd5a0588e6172b3e984c686620961f104089e3843
TLSH
T10C01700626FB245FD126E3878824BBDA6D70B85673118B1E85057BF606446D0EEE72EC
MD5 SHA1 SHA512 TLSH

Submit Download

servicehost.exe

Path C:\Program Files\McAfee\WebAdvisor\servicehost.exe
Size 868KB
SHA256 adf4ba73c2788a3592338403762858a358f13f9f2368f8188842cd31728bff89
MD5 2de0e5622c4cabe125697fc3a40aff3d
SHA1 a26a1685405ccb8ad974e5d7a6d6ad4fbe1fa8ae
SHA512 431efece95fb63a6f70159b120b76e4cea7e386f04dd19405e88776fa2e2df9f2b3cf226c8ca69d4c20ca6eec3d326fc5b46c1395e42d459de79519ddb83fc1d
SSDEEP 12288:gASdW7dPBRNxeH/PVxNM6I+1JrMkW0beQ02s6pSm:g/EfRNm1xNMV+L61Q0W
TLSH
T11A158D2EA79C42FDD071D2B9C6425502FB72B80A536166CB47A049A93F7B6E04F7E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wssdep.dll

Path C:\Program Files\McAfee\WebAdvisor\x64\wssdep.dll
Size 785KB
SHA256 972a92ed0f69c1a5d9540fb86b013c593866a5ccbd65b30dfdd27d01785875a4
MD5 198724a808127e3ca5786bdc29851cb6
SHA1 d81389ddee652a995e8567190ae68677afa2c2f6
SHA512 a7b58696932dbf0f301b8e63fe65207cb5acc46a45dc08b69d08e7ffa71ea2322be13bb3ccf836d122615e2bf7c098e21b9642fbc3ca42105911c5a0c6eb7f69
SSDEEP 12288:NSMUeSJFVwoykQGh5YHWSGBjfWeVoNEOPgdISQ:NSbRJFBykQ8YHWvFWeVKEOPg4
TLSH
T19F056C1A7BAC41B5E1B7C17AC9578A1AF7B278151B319BCF0260826E1F377E50E3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt
Size 1KB
SHA256 f2560dc123c90128fa5238bfc6bcb649cd4a0099b3a72409add3b698a047bf8b
MD5 a0ccbf350e8638fde66398fd8d6e9c0a
SHA1 5ec751ec836d581e13723e0cc22b0f69a6c840b7
SHA512 dbe61434e53e08912ce492d9d47200f5ef6da63d11028c043ce53c4c90f279e40594240a6ccc6c1c5cc4eddffe7d84efacb57790bde329b33ec93b68c10dc73d
TLSH
T16F21AB857EACE67DB9E1C87499F4447C4A394708BDCFAF50A27C01C880869EFD4B86B4
MD5 SHA1 SHA512 TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\ServiceHost.exe\log_00200057003F001D0006.txt
Size 298B
SHA256 c44cce1a80c39725884bb5ce7f392498dad363405f2c899900ff32f1ae59a897
MD5 47d8e80025c3bef100c50d2c06842cd0
SHA1 a90facad14563490224cd504990d3cac3ed813b6
SHA512 75353bf68c5ee1975690006e5112bb8009409422f6511b64c9e96da09196429b3e68c32ee77f3f16234310c5775a7de73d3693702d6d1c2879db8be4d59abd51
TLSH
T153E086E037ECD2D9207290B293E951738F7C4200A38CA77D255C551541CD82E52FB591
MD5 SHA1 SHA512 TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt
Size 3KB
SHA256 c8c6a01fa6a1e86c806ae9a9a02e29af3f0a3ad10c151ed4f7d5713214a27d82
MD5 579d4e46454bd6f2fb6eb1dfcdbc4881
SHA1 b181add65b7765237e0951851cd8bde21d6f797a
SHA512 736eb9934a1cdb48bf63ad76e1dd59c8f3ca76ad50f16c7008ba2627d3e58bf757973c5eb2ee1eabb9ef20a959e3194e97f388358c1e0e913d3cb52560f28c45
TLSH
T1008109893EBC897CBBE1CC70A9E9447C297D4710AD8FAF50B97C41C88195AEED0746E1
MD5 SHA1 SHA512 TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt
Size 4KB
SHA256 617a3333536b48d5455636a1f13a5b89786c9aac681655eac764f707d50fb766
MD5 0594e11da040b1be6b751fddde1e1fd2
SHA1 7626e31424ac6f639a4536b34070b2baa4a705db
SHA512 9714a0bf59cf7a0465df999ade0c216007a2819f26d4e7e61ac08d2831e9b5f6cb8346362a1f8764d9d5d9dcccc06a8a2571eb9f9f95f6da2c4f938db6b6707e
SSDEEP 24:3F0FDFAVeZSFILXF8F9VifF1F1FJV3qFoFDnFwgVxTqFmFZXFKVHESFVFEFVVvth:8LrOkPMR9w
TLSH
T107910A893EBC89BCBBE1CC7099E9447C297D4710AD8FAF50B97C41C84195AEED0746E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\UIManager.dll\log_00200057003F001D0006.txt
Size 1KB
SHA256 61ea0a5ce5c45aa85cef0534d3fc8ece16a10b8b9f0f09d996977d58d875a0ae
MD5 0b5f9665e372f87e59afb974a0ea2843
SHA1 c17bd41a49d163832fa39583701d180a570ef247
SHA512 e1fa2ab9914cd4be940b87d07a8cf640a7019d75b39724c05492888e69eed6e5f15f57a2bcda84e304773434108e4561f27ec2229ecbedb225c680bc0c25af1c
TLSH
T1042146C57EBCC57E79B2C8B0A1F8807C0E3A8754AE8F9F64A17D01CC81849AF95F9194
MD5 SHA1 SHA512 TLSH

Submit Download

log_00200057003F001D0006.txt

Path C:\ProgramData\McAfee\WebAdvisor\servicehost.exe\log_00200057003F001D0006.txt
Size 4KB
SHA256 e6c19c5ae29463a6863ffc89e0f61b7376edda708714568685554823e95c6a5d
MD5 82fd4465eaa7c955bdfc99f4571675ca
SHA1 dc34f12ca0299b19f3c06b78d975ac22f4dfe450
SHA512 512f9d6e83ee0fb152dc7100e7798337cd3538182f0390f030ee9b35727719c53baf780453182f7bd4c1847c9e0d6b013d04ab73f75b9727c54cb5abf88653ca
SSDEEP 48:OrzL7won6L8SILSSG7L86J78L1S/LVjLjTSHLTtGLTWS0Lc8LAAS3TL9AML0SCLy:yccGOGs6/wftCXBXd3l11y0/
TLSH
T18B911AE6375BA46D7023C171F2F0C2BA77B59084574E6EB5212C051D8295F7B72FB980
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1020KB
SHA256 2b65142ed773704149b1da26790f1018d6863ed0c509b829088f02ddbb3ebf0e
MD5 1754134b5c89f7cb76a8b60ead2467c3
SHA1 ad6931bb91ad1caebb74b4e57cf797e43de4b3f9
SHA512 71de0f07f5bab4a5b7ea0edb23c62f902ee9e24ca50dfce46fd15603019caffe54616c5162097a4b9a57befd30514f4bd017755bbaa05410be9dfb70ca279709
SSDEEP 12288:nkMO+JU3fFqv5MzS+lSAsF0Z+7pYE5J0yBFAuOZ25eU:nkp+UPht60ZOY8JZBFAuc2IU
TLSH
T16E253950766AD75FC5AD44321E33D2CCAB707D01EE05AB0372C8972FC576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 1e1d9713f44179f7eb729073bdbcc7b7a4ac078bf99e92ce72cae5c21e3fc8a6
MD5 8a531118a3680a2181ac6b208f281997
SHA1 048b427594dd74e5216132c461aa3f3542f023a1
SHA512 e241ca204a6a0cac7cc50e7007930f1115fbbfc0afc50db93e174cad3f1a161318b24ac76eb001be03240291fc0c37b05ffa2c9d07679925ebdfe2e92d0b293f
SSDEEP 24576:N1a3fYUiuoa86f+u+nVSv+WaAabWsFu+SC9fhc8pay:N1a3fYUiuoa86f+u+nVSv+WaAabWsFua
TLSH
T12E55C781A437A38FD1F66131072A6B4CA764EC0773096F266388553EDC1BB66A0BD3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Users\Admin\AppData\Local\Temp\installer.exe
Size 34.1MB
SHA256 d5aaf5a6a43ae3c15470c90aff6df1ea26fb79ef27f4ccc8f5eb7f70b4810dd1
MD5 75834080d08377d1b6579d46cc95f18a
SHA1 a7eb2c467fa8d3c027ddae8cc407414f9348b4f8
SHA512 37c8fef1650622798dec4519f2412ca470975e6c5e534d1ba486ed14118038ff7470b225d69f527202c3f807e1112c4af6311b0b35b0040707ee11c99a6da279
SSDEEP 786432:Ek8S7ddfgrBCVE9R2SYh6AGoZOtKK2pphDdZ1IfeDyI2Pu:AmdCEVEjQzG85Z31aeDylP
TLSH
T1DB7733AEF596C5AFD4498E35D5146308E770BC3703328FC7B384A3676E7BA9009BA641
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mwa11AA.tmp

Path C:\Users\Admin\AppData\Local\Temp\mwa11AA.tmp
Size 135KB
SHA256 926061fc6a92079aa227cc2e426bd5b2130501422a95e6a8984f15f05dee2e70
MD5 32528f494643e0e05625d5a5b8e61263
SHA1 701eb330c5f29b2178c6196404f3bc53e297987e
SHA512 80979203400fde66bc2f5567c2cc5a60448b8336dca93b8ef7d2d77033a063a9c581b9acdb99f81c1affae5fe159f2b4bc74b842104ffbb05172cb4656ab561b
SSDEEP 3072:ppIo/Z/nT74FOGNcO7/exDn/1ISZ3kHoh3I42H01Vqx:ppb7tpssD/1IQ332H2Vqx
TLSH
T1FFD38D01B090C072E5BE19390864DF725B7EB874DF906DCB63A50B7A9E703C19E35A7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mwaFDBF.tmp

Path C:\Users\Admin\AppData\Local\Temp\mwaFDBF.tmp
Size 173KB
SHA256 6dd62d41da015e4a1486a8866fcb28ac1209a552be8313dbd63e821cb46811c8
MD5 6e7f3a7401c7da1e60f5df4531738ab4
SHA1 fc6305ca9ae4023d45ca8d7e67304f59a8ed2aa7
SHA512 4f6984e41b17bfe78a8d27c6fae33b3a2f7d8db3479f73ce3a1d42782db7ee029bc44b77cdc3ebe0d046e72a613ccfe406748878d5002e947cfce266cf90af41
SSDEEP 3072:1WKqE1/0WjsAGX5Gn39yf19led13p9tyDTQrf:1J1MWoAGJqe1neftyP4f
TLSH
T15C045C1BB7A400BBE577D27888930A06F777781107609B9F03A4477A5F27790AE3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 27ab01b7527c8c4ae77a45b4b539f7201cb571f368fb1006ae78177694be7318
MD5 66138ee47fa30a2127cb9b23add522d2
SHA1 e45719514c64c5e38a731c051fe767cc50c072d1
SHA512 3e05a31983b8e06e754625fe11fb258836efdfa00f9b55bd44ff82a889b20d605a387253fae3f9d8fa3664049857bef2c558362f24c0005ab8b9c18850c3442b
SSDEEP 12288:CF7o/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:+QH6LRgy7iBY5/ryIDxXv
TLSH
T185552325B5EE06DFDA79063084C942E4228CBF699F5045C3B1A9766DFD71EC4CE2FA02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4c04db63dfe8b929223d5fb757a07c4300ff32f3d93e88de5475243a7b5c363c
MD5 e216f58bead63363d7068ddabb989bb5
SHA1 cf83d163c9e630d8051f3a25522053bd2ee6e699
SHA512 98551bdfdcc95d7c3203da3944a55516b26c7059c9cc0d24a972393610e95ad26157cd94c3564534037a09588957e34da9b62b90f10738aac23b4a18f6dd654b
SSDEEP 24576:ogb6bmBIi49WNNFpg1rSvFv7bYWH6LRgy7iBY5/ryIDxXv:ogb4mBIBhGF761tySHD
TLSH
T10E659E1E22EC02F5E1F9D2B8CDAA4417D6B278161731D2CF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 e31716ca2e62db37d8e9fbf08c4f436a3ada3690a0213866c0b97a44178a9b41
MD5 4bbeeed5047557d39fd948b99c100b2d
SHA1 25475d3553cf4310833965bb7ff8c017edf5999c
SHA512 a6d0c95f091ee0ed675593f613256bfc30da771fb3e9743e8735c56475c8f67081912aff71c313cda2b56e7a615f8279693d0d6c028b68df40b11960eb58c2a9
SSDEEP 24576:EG88u8FpJqH1vzria7/m7H6LRgy7iBY5/ryIDxXv:37ZFPqVya7/I61tySHD
TLSH
T10885F165B6E102F5D47BD138898646A3F6B1B8250360EBDF07A88B551F33AD44B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 693f3f91728f2396b48dc643fec8a4c58cf0308d82477a64ca12a280b3ad7ecf
MD5 8cf7de8f03bb47fc5e2b42c675a9cade
SHA1 6dfa153aaa292f451a41d9696ff8252ce5a06461
SHA512 8919ae02232a7851fe06d181868ea3d7921e49b68cd3db9bb5d6862f872f6c494d571bf90d7b5b72b45241141fa28f69f014e511e4fee0aae3ea4db26bd3f62f
SSDEEP 12288:3HvUrBFrEjwaQz/DH6bXRgy+iiBKH9Q33QVptb9yIljJ/dW4QqFvUu:3PUr+NQfH6LRgy7iBY5/ryIDxXv
TLSH
T12365E12F72ED18E9E67A913C85824759F371B862171192CF02E0917E5E73ED8AD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7cc0cbbafd95741b90a48d82ed2e7cc14a3d88535340a9d5e7ae5cfbb7aff602
MD5 7ec5e3dee1c6e53b6d08f2701d58e200
SHA1 f53b0d83e2cddd3e3f14a6a12c61ad77e7bc380f
SHA512 84955b9754a48fc64fe51ed1d57942eb105ea9683e82ddb69b8ffe062def202e69d5893431005f8b4f1ddce628264a0dbb36cc7a16f78a3456317ca86b9f4d4b
SSDEEP 49152:EBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjf61tySHD:nG05lO43by61tySHD
TLSH
T170D5CF6E62EC11F9D1BBC17CD9C6460BEBB23815033556CB02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b01c92d100789e024ee3ef99577aab6c9398429b51197fb1b53a2de4a783d70e
MD5 70e6883f5818912dd859df36248a0f41
SHA1 1550b01ac68b6cde315e69958beb1f69ecd17155
SHA512 2e8ac0470340fdc2d345113f63003badbae113b6d983d2b8b77dff53a4eff2a5fbf26ad53f6b2bee3956cb956546f7f92835c9357f9879b3442301e5f4e6f4de
SSDEEP 24576:8fa5POZ3dpyWVM50JicR2hG0lasx2+47eidnVH6LRgy7iBY5/ryIDxXv:ka5POZ3lJt2pasx2+mH61tySHD
TLSH
T1CF65BF5EA6FC01D5D5B9D17CC583461AF5B1342253329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 25a83f48869bf6ed234de0a6509c76eeb1f482f3c21ad43da1e0e7e3b09fb5bf
MD5 906fa49170bc8e1ecff93115ea803863
SHA1 8d495096093aeead493c49929890ecb5115e7615
SHA512 74f5d28ed0953f3f79c23a65313267086e3257dd06581602d3757fab788513ffa7e9114b2a54b0acd39aace99dd2f9a0309955ba9af8b193b7e7c75e43c94163
SSDEEP 24576:xNcwHdjbyQ4nLC18lb/EOjowL7FkzH6LRgy7iBY5/ryIDxXv:xNc/zEOVHFo61tySHD
TLSH
T155858C2623E901E4E1BBE1BE89779546FAB17865573086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/616-299-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/616-98-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/616-331-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/616-332-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/616-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1344-43-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/1344-49-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/1344-53-0x0000000001B80000-0x0000000001BE0000-memory.dmp

Download

memory/1344-55-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1344-42-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3012-1-0x0000000000BF0000-0x0000000000C56000-memory.dmp

Download

memory/3012-7-0x0000000000BF0000-0x0000000000C56000-memory.dmp

Download

memory/3012-90-0x0000000000400000-0x0000000000612000-memory.dmp

Download

memory/3012-6-0x0000000000BF0000-0x0000000000C56000-memory.dmp

Download

memory/3012-0-0x0000000000400000-0x0000000000612000-memory.dmp

Download

memory/3012-1645-0x0000000000400000-0x0000000000612000-memory.dmp

Download

memory/3304-75-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3304-70-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3304-76-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Download

memory/3304-257-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/3308-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3308-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3308-316-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3308-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3308-110-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3308-104-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4492-80-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4492-284-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4492-81-0x0000000000910000-0x0000000000976000-memory.dmp

Download

memory/4492-86-0x0000000000910000-0x0000000000976000-memory.dmp

Download

memory/4700-501-0x00007FF728530000-0x00007FF728540000-memory.dmp

Download

memory/4700-546-0x00007FF728530000-0x00007FF728540000-memory.dmp

Download

memory/4700-518-0x00007FF728530000-0x00007FF728540000-memory.dmp

Download

memory/4700-510-0x00007FF728530000-0x00007FF728540000-memory.dmp

Download

memory/4700-523-0x00007FF728530000-0x00007FF728540000-memory.dmp

Download

memory/4700-511-0x00007FF728530000-0x00007FF728540000-memory.dmp

Download

memory/4700-520-0x00007FF728530000-0x00007FF728540000-memory.dmp

Download

memory/4700-508-0x00007FF728530000-0x00007FF728540000-memory.dmp

Download

memory/4700-516-0x00007FF728530000-0x00007FF728540000-memory.dmp

Download

memory/4700-514-0x00007FF728530000-0x00007FF728540000-memory.dmp

Download

memory/4700-505-0x00007FF728530000-0x00007FF728540000-memory.dmp

Download

memory/4700-500-0x00007FF728530000-0x00007FF728540000-memory.dmp

Download

memory/4700-502-0x00007FF728530000-0x00007FF728540000-memory.dmp

Download

memory/4700-503-0x00007FF728530000-0x00007FF728540000-memory.dmp

Download

memory/4700-529-0x00007FF728530000-0x00007FF728540000-memory.dmp

Download

memory/4700-522-0x00007FF728530000-0x00007FF728540000-memory.dmp

Download

memory/4700-534-0x00007FF728530000-0x00007FF728540000-memory.dmp

Download

memory/4700-545-0x00007FF728530000-0x00007FF728540000-memory.dmp

Download

memory/4700-544-0x00007FF728530000-0x00007FF728540000-memory.dmp

Download

memory/4700-543-0x00007FF728530000-0x00007FF728540000-memory.dmp

Download

memory/4700-542-0x00007FF728530000-0x00007FF728540000-memory.dmp

Download

memory/4700-541-0x00007FF728530000-0x00007FF728540000-memory.dmp

Download

memory/4700-547-0x00007FF728530000-0x00007FF728540000-memory.dmp

Download

memory/4700-536-0x00007FF728530000-0x00007FF728540000-memory.dmp

Download

memory/4700-540-0x00007FF728530000-0x00007FF728540000-memory.dmp

Download

memory/4700-551-0x00007FF75A930000-0x00007FF75A940000-memory.dmp

Download

memory/4700-539-0x00007FF728530000-0x00007FF728540000-memory.dmp

Download

memory/4700-564-0x00007FF7494C0000-0x00007FF7494D0000-memory.dmp

Download

memory/4700-557-0x00007FF76EFE0000-0x00007FF76EFF0000-memory.dmp

Download

memory/4700-538-0x00007FF728530000-0x00007FF728540000-memory.dmp

Download

memory/4700-537-0x00007FF728530000-0x00007FF728540000-memory.dmp

Download

memory/4700-595-0x00007FF76EFE0000-0x00007FF76EFF0000-memory.dmp

Download

memory/4700-613-0x00007FF767C40000-0x00007FF767C50000-memory.dmp

Download

memory/4700-616-0x00007FF76EFE0000-0x00007FF76EFF0000-memory.dmp

Download

memory/4700-624-0x00007FF76EFE0000-0x00007FF76EFF0000-memory.dmp

Download

memory/4700-604-0x00007FF76EFE0000-0x00007FF76EFF0000-memory.dmp

Download

memory/4700-593-0x00007FF76EFE0000-0x00007FF76EFF0000-memory.dmp

Download

memory/5092-30-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5092-32-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5092-129-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5092-37-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5092-38-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5428-115-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5428-24-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5428-18-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5428-25-0x0000000000D50000-0x0000000000DB0000-memory.dmp

Download

memory/5428-17-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5660-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5660-139-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/5660-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5660-131-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/5660-137-0x0000000000B20000-0x0000000000B80000-memory.dmp

Download

memory/5872-65-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/5872-58-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/5872-57-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5872-196-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/5948-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5948-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5948-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5948-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/6068-117-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/6068-118-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/6068-124-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/6068-315-0x0000000140000000-0x0000000140295000-memory.dmp

Download