d7fd420a7eadb3f28e4d17ece3bf63ecb8b976099accfb278fb28e0dcfe234c2

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 09:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
Size 2.0MB
Sample260723-kyd89aah82
SHA256 d7fd420a7eadb3f28e4d17ece3bf63ecb8b976099accfb278fb28e0dcfe234c2
MD5 ff75590930badae7234bd6e123fa7195
SHA1 9a264c5de94a62e9446d77219235a7c3349726b2
SHA512 c356df95321a4471ab086df788b8185c7e87c72946cc89d566f966800370269a21a15cb92837c0129d4e5e401a83e1c58f672cd7769247b4af7512fd3db00eba
SSDEEP 49152:fyM3bF/EQ5P52LDJKIIM6VBTs78+oCrMtziCxi5UfqkdirbGbc:fy6FsQZELDJZuVBT2XrMtbi5UfNc
TLSH
T16FA5235576D084B1F6B3193265F89BB11F7CBD610EA15ACF03602A1D0FB45E2E239B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4896	elevation_service.exe
5244	elevation_service.exe
2656	maintenanceservice.exe
2452	OSE.EXE
3140	PerceptionSimulationService.exe
5052	perfhost.exe
2008	ReFsDedupSvc.exe
2144	SensorDataService.exe
4972	ssh-agent.exe
4516	AgentService.exe
2624	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\c980776a5387db0e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Temp\EU1515.tmp\msedgeupdateres_sr-Latn-RS.dll	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1515.tmp\EdgeUpdate.dat	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1515.tmp\msedgeupdateres_eu.dll	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1515.tmp\msedgeupdateres_hi.dll	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1515.tmp\msedgeupdateres_hu.dll	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1515.tmp\msedgeupdateres_cy.dll	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1515.tmp\msedgeupdateres_ga.dll	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1515.tmp\msedgeupdateres_ne.dll	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\java.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1515.tmp\msedgeupdateres_ca-Es-VALENCIA.dll	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1515.tmp\msedgeupdateres_vi.dll	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1515.tmp\MicrosoftEdgeUpdateBroker.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1515.tmp\msedgeupdateres_iw.dll	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\javaws.exe	elevation_service.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1515.tmp\msedgeupdateres_tt.dll	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d47b1506821add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e87288bd811add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000045bbdd05821add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f31a1bc811add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4896	elevation_service.exe
4896	elevation_service.exe
4896	elevation_service.exe
4896	elevation_service.exe
4896	elevation_service.exe
4896	elevation_service.exe
4896	elevation_service.exe
5244	elevation_service.exe
5244	elevation_service.exe
5244	elevation_service.exe
5244	elevation_service.exe
5244	elevation_service.exe
5244	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4680	2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
Token: SeBackupPrivilege	2008	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2008	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2008	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2008	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2008	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2008	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2008	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2008	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2008	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2008	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4516	AgentService.exe
Token: 33	2624	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2624	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2624	SearchIndexer.exe
Token: SeDebugPrivilege	4896	elevation_service.exe
Token: SeDebugPrivilege	5244	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 5008	2624	SearchIndexer.exe	100
PID 2624 wrote to memory of 4780	2624	SearchIndexer.exe	101
PID 2624 wrote to memory of 2256	2624	SearchIndexer.exe	102
PID 2624 wrote to memory of 3832	2624	SearchIndexer.exe	103
PID 2624 wrote to memory of 4360	2624	SearchIndexer.exe	105
PID 2624 wrote to memory of 3136	2624	SearchIndexer.exe	106
PID 2624 wrote to memory of 4236	2624	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_ff75590930badae7234bd6e123fa7195_amadey_darkgate_elex_hellokitty_luca-stealer_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4680

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4896

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5244

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2656

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2452

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3140

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5052

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2008

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2144

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4972

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4516

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5008
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4780
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2256
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3832
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4360
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3016 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3136
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b4f4ab364b71c013fce8949663bfaae113d2f97b1f1df2ee31f16575b49e2e8a
MD5 9f58e41dcb10b8a8d481fe9c20087a46
SHA1 0e218108b1d9d4fb86383c2d4bc762ca29082736
SHA512 c1620311492a9b05ac25a0fa80ad5a364ed8b050eb5b8ec7caf2a7308b454564ce43b04f03cf0c4f4e1893a8be1b95b198b7dc8dc8be5358a161ecbc46bba3e1
SSDEEP 49152:3b+632BuPkFKRrdE6ohQstBhuXjfS4LWxnJ5UfqkdirbGbc:l3q6tjBK5UfNc
TLSH
T102D59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 6bb58953d6d40f614d794407b6ef4eb0ab4ddae5fd617c9a690b7c832e7874fa
MD5 5fbbb863d72c1a83b2c8a76afdfd759e
SHA1 eb27172383dae088a0d62efd98baae451b314af1
SHA512 816732abbc7996c78d8b734e2c628ff460ebb2b447ba38c936a55dd0f8d384ff78d307404266c6a3cabffe49906b9022b31cadbc8f2ccbc05f75cebe0b96d640
SSDEEP 24576:wXYfDtczAOt5wXWotDWi//dirlvZGMApYSRiO:HtcD5UfqkdirbGbc
TLSH
T1AB850128B7D508F9ED67813DC8A28501EB3378914790E7DF03A4AA251F772D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 547d28d3b1e0bddd72c02a837f65848b29ca32e4b790c597b4c192100154d4d6
MD5 c18b1a113a30a05fe4c5e8db3b1b915c
SHA1 df6eb7de1153e17ebb17874d587fa2780763b575
SHA512 46b47c5b067db7528efb0f4dde1f491f311c65ab0effb5b99092df92f7418f78a444e1ec203de788ed24d3a0c80176613d6e922ca098bece1b09170eefc687cd
SSDEEP 24576:i0Le5ji0hmxMrMbt5wXWotDWi//dirlvZGMApYSRiO:iPji0AGE5UfqkdirbGbc
TLSH
T1C5A59E16F6748771D073C0B9C5D2A68AEE7230825B308ACB4285D77C7F676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 faaf4ae46a03da9bfa57f584600464faa54815b2b470e060c96e18c14c4cee64
MD5 61f014686281c301f83d2f00583f2f96
SHA1 9d933c135bc25ea3e6fdfe57cdc063cf8458b81b
SHA512 dd11bc030af26500f9365b4b67520884961f85fac3fd6338b9c9b635a2d529ff36607e3dd0fd98988641c3b2ae61df8cce7d89cc2cd4c9b28fa79456ff0da853
SSDEEP 24576:sa7/ezSC6vUyDZaqgrvWx6q8wyuFt5wXWotDWi//dirlvZGMApYSRiO:L/ezSC6vURPvMHjy45UfqkdirbGbc
TLSH
T1BB756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 25ce35b9f0c5d72ec78c67df2274229602421ed2c2fa37354082f3c80a47038d
MD5 3573274c8bdde4f9822bb8ee2f7406f9
SHA1 9167a639f5cd3abc0186a10f892b587d70ab1fcb
SHA512 4bc1345b8c7b570b0503ac795dd7b6b801928e47a9f89969eed2a838bdf3812f08aadf0d3d5baedece505a954883ba70cc89064b6e8f1c109065825ed8794c7a
SSDEEP 24576:JVbqPb88hv/lV7qt5wXWotDWi//dirlvZGMApYSRiO:JVO88hXlVG5UfqkdirbGbc
TLSH
T15D559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 5cdafac0175d8e3b51dfbce52b6bc48f4022c43c4d7cfdfccf98bcabf5ca38c2
MD5 3389d5e149ccdd74fa991e66da7c7ea7
SHA1 34e153f99d978c04129a66319460449f0f9823ac
SHA512 f86c49d2eb03aabc61bdb69b142ae3878a10a349a8c51dea4917d56d4e5083c97287ffb12b2a1f098edecc59cd5f2b2a201ecdac4f545fff6d851f612226da5e
SSDEEP 12288:SU3YbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:SU3t5wXWotDWi//dirlvZGMApYSRiO
TLSH
T10965234ADF5568F7FB5B4532B06D4E46AB227EC088C1866E49203B6817FD1F4E13236B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 6c79ca7b7400bba480b402d7a95f98a86ca5f46c5e3358d90a76a10a4716f0ae
MD5 f96d6850705b85c501a289cedcf5f2ca
SHA1 fb6557983041d14c3d1c11c1f43f09a3e683d4c6
SHA512 e468fac852ae352e67ad6d5ea665c134b4a428fe7e1549e43ce95472e15f491a14facb1da13eb01cc14e77cf9467c98fcfaf70a452f40dfc71ce534e6fdf7205
SSDEEP 24576:LJIUit5wXWotDWi//dirlvZGMApYSRiO:LJIUy5UfqkdirbGbc
TLSH
T10885CF3BEE28FCE2C27A8D7956918600E77278704F5293CBD164830EDE275E05E7AD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6b0dcd16175faf9170fe48610aa09c84c008efd98041daf06514c54f5ce1021a
MD5 0bde36982bf17ed3f4b008dc19b28218
SHA1 96113721f1aa9ea8d908a1817ffba3b0a7526431
SHA512 703e3ec394416560988f572244c360edf369a1d355dddfb2c128a96d3959f5cf9ab8d922969056b619e5318d9bf4994498b863ee6e09892a1b402b5a9e20592d
SSDEEP 49152:LQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THe:LQvGAdlCEL8c/pRNw5Cj5UfNc
TLSH
T161266D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 aa0b371e8874b74bb0f6d66617380284f58dc0cbb118240ccc927a22027aba64
MD5 229eca4d6b7f04ca8dd56088dc38b8e2
SHA1 c6f9f5d87909d3b1571a5a46090717d7ba3cd521
SHA512 b1489567c48d1f31fb70f5d0e3bf05d64b3b71d4ecd3aa557ae658ceff248988d5830c42f13f68b212e10dc96f9eb3a6996c86cfbe6811e6fe22d4576d56850f
SSDEEP 24576:DmewsAjMt5wXWotDWi//dirlvZGMApYSRiO:alj05UfqkdirbGbc
TLSH
T13785E031FE74E436C27B0DB22B36C706583D7A604B911AC3E3A85E9D59742D26336B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b8a6c7c9f1ece06124c8383b2de97c493b19cc49ba47fe5ff754705d546dc89b
MD5 95c7abd011b61b1299a484d8d8ae5aef
SHA1 cdc8da03010654c577f025f1ebc8031882de8c1e
SHA512 3454d7d5f52b3188c4ae81ee401a439d82e48d27391a8330cf2e4c590d27b54ab5702c663268131fad33e489bac8d6b1b83e46dfbf286233a09708aa6d2382f8
SSDEEP 196608:BUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHWoN:BUEtQevvqc2W1cpV29I321N
TLSH
T180474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f9b472e5d8f378060002e447f646ee51c02af9be806cb2e9ac18bcd8dadb0811
MD5 807009c7751d8a3f0e233bd0881fa4b5
SHA1 0eb09a933be93e8d802e3c5e6541469a3ea7501f
SHA512 b12e2583df9b395de18eeb5bdf50b92e910520da6178504ef4f8dce1ebc7133055c11543000339f68135d0588f875cc0340a6fc4c0a25548ac803c43b2cc6ea4
SSDEEP 49152:RCbRquA/m2yL5zTfFiV+XenmE3/zU5UfqkdirbGbc:eoquVjnmH5UfNc
TLSH
T1A7D58D0976B8C1E4D1F6C77886A2CA47F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e359bcf466add8e2ff493949b04275556753a3b7962083850c1991b82c1f6d9c
MD5 2f93139daf8513087de14f7f07bc2f88
SHA1 898222516b5c963fc6db0a1dd6e6e70cbbbfe46d
SHA512 262b4dbf3c594a3b099a564b26fe854814c6c5db4c8abcace38962f4d6eb1491a660b22618e1eb8222b58870f67c3c86dd21d922958f85268b980ec414dd14ff
SSDEEP 24576:WAhGLmIFoiwtA5l7S53pt5wXWotDWi//dirlvZGMApYSRiO:WAM1Foiq535UfqkdirbGbc
TLSH
T19735AE80EBF955D4F5B3AA78A9B68570EA76BCA55E31C20F1160D21F0E33A50DD24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 fd906822a15faf93a294988fd3af35c4d43357d5764149a382764c7bdc296269
MD5 6dce150977444b7d30d8a26ba8a55c7e
SHA1 cb3f7dd583408de09c854522d1f1cd870dd3729f
SHA512 2478587fe137171c4fd636eeeddf1db04b28f0296ec5da67f7a9fcd6528619da9dabdac47f0e25b315be5c5e8fdd6662c1be7b08a5890524bf79a7d7d3087ac2
SSDEEP 24576:7wu1OWAt5wXWotDWi//dirlvZGMApYSRiO:7w6Or5UfqkdirbGbc
TLSH
T10985F14A77A41CF9E9678239C55BC536F7B2BC012A21C71F0760C75B6F37261AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 6329bbfb6e4ade5d893ddc27b4b75d866416b78beef23c4ef219fdd2800f7f5b
MD5 d852409abe3542f7014ccd332d3ed3ff
SHA1 ba20592abda57464a892f0a2a4ed8d58297f2b33
SHA512 e21b3afac5eb330d348bbd249130e2b7ad1a24788e9567bccd42f0405ba360962509f1d70d7d41141dfc4a9d383f7ead9a31d5083e3cf6165b5eb4ea63eb66dd
SSDEEP 12288:9tZ1IycYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:XZuTt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1EF75128A37E430F6E167423DE8E94A05E7727892576283CF062027691FBB6D1AD35733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 61f338f64e3c2707dfb917257f7feb768ae5be2d625463d0ee2f2ddb23692e12
MD5 e98aee099d77e407f6a6b1f7febe4dee
SHA1 5e9f8fb7f0a15f625b08026806dcbf32f774baec
SHA512 20d56ab5bbdcb5a35dfb400e84b1d08f48219bdc4834dcc4ba63cdf1b166a0677ef3326e2f720092708d73703e6e87752a1d8544227f7125376bf9a491c07ff0
SSDEEP 49152:5j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Uy:AQRQyi36YOcPuLvw2gAf+PN3W5UfNc
TLSH
T1FD667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 845233d16bec534f79396edecf439d93cf9bf94fe92f5ddf787c61267b1c347d
MD5 6a44527c0e3a85dd88d990c5e645df1a
SHA1 3a470e438044400f47a0bc64dbaab677d0ba8c50
SHA512 f711b2ba5689ae0588016111986b1352ab63b4ad4c1e736c0d287580afee52404cad91190a5bfe83bef3871ef92d1ce2e431683fd42f5bc7e9762e3cb487d3b7
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeaAaLSF259ruMHwpXMi4FqJLd23Uy:5QRQyi36YOcPuLvw2gAf+PN3W5UfNc
TLSH
T10B667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 8d2da0ae30d1d01f2bc88320391d0f103b06299db56a525a506f864b2a77b8c5
MD5 a436308ec9f15238ca7a4135d8145992
SHA1 1793faa1e43489a3aed5fe78d767bebcd479a7a1
SHA512 48522245d62023114476430d274e53e1598fc1ac21d097cf0a1052a295a88e31bd1135ec41809d0964d60f11e7a674ffba9277baf04f9bc73f3ff043060097a5
SSDEEP 49152:H68Qg55nhxeWu7PNU3/E5UfqkdirbGbc:xthGRc/E5UfNc
TLSH
T195B55A33B2F600A9C44DD1769F4A872196D27C718FE1E3DB8511721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 32065783ce95d6a71e7fe31fef18ab816f75a4e3f80c5886ce8b0e166e69e692
MD5 6717712363f480596dd546b3e2f53fd3
SHA1 286b389a6fe13aebbde2a979b95ab8dd7c31a915
SHA512 b0fa6fbae61c6dfeac3e487a3031241555124dc6280b54eaf721c0451ad5b9f8cfb27b1172b654dba961e159ea1babef82f35610667091521b2dcc3db8a84d1e
SSDEEP 49152:z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99E:my5112gYy5azzVvD69nLKnhZd5UfNc
TLSH
T159167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 14fe6a900c47dc2699a708dc332d6cddcbe57a2551a5ac81c03b0602441555ba
MD5 6449fce8837e45681551a5688d7caf1f
SHA1 aa98ca9c6db9b2d6fb9fbdb5609376f7fc7faff7
SHA512 d2ad7a722a137ebf1ee6485c6903e63bbcb734fbd1ea0a87f815a207a5dd737231ff1166219b9166e01f485a2d283af992f31282540a0a3b908f541ae327f9b2
SSDEEP 49152:HB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glO5UfqkdirbGbc:Ju6JmQxd2dO5UfNc
TLSH
T14CD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 e9ee011f1c2bd5efd4051c9f3286cb3dc9a27b03f854d406e85685703074ee94
MD5 657a9e6c5e20f51361b34c04349ad71a
SHA1 3ce91ee5f105346b50ca5fafb976c48b815e889d
SHA512 7a8826a2ae814bef1758ed286908d8222fb6e97db1ce739088795c77f325ecb091d5d1f23f2a22acab48559cae09e60c29c19ef137bc6baba96aae78b132f582
SSDEEP 49152:b1hpsNoJpF1A6yU44CwH7R4xS5UfqkdirbGbc:bmifPVRH5UfNc
TLSH
T156B5BE13F2D900E8D05EC17887569632EA62BC460B34B6DF0A90B7961F7BBE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2f7dd9883571570e91b39e6d50149ebede852f208a344d41db958ad7bed246b5
MD5 110824d28498acb819c85aa074a51812
SHA1 a69e922f78f5200af4db71e725a6e5f1b29a0d3c
SHA512 24fd5474a553c53f1d062664c900f38eb84c8412af0b5bafc0c7d67c8d8f7e461bc86d1b1bac59a090d145b54236f97bd6ad0c177df1bf174843be9d8df3d778
SSDEEP 49152:qSuZQIY0Be2KIRVtOnks6NMHq55UfqkdirbGbc:05dKOi6155UfNc
TLSH
T101C5BF03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 e497d6f361fec69242711291fcafda355fc98bf6e85d7b954c0dcf6822c51834
MD5 9c8b8dcc9eb30e959fa0030804593c76
SHA1 0dc0f7c706e8ac5dec34704b0578761fe2283e53
SHA512 c7d7fa6910bf73c60e1de8c65ac6f796ab61b8b61ca020fcb8996d3dda0f283f1b26a083751b9280782f0cecdb7e066b15f894526137a755dfed11315e98ba39
SSDEEP 49152:7htSn8EApI0figGgiDn0AP5w+5UfqkdirbGbc:aX2i/phL5UfNc
TLSH
T10D95BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 f98bfbefd7665a371ffe5fbde93bb91537b7b20442b101c1426d84206e8892fc
MD5 bba63a1788282bf25df4567d67b90084
SHA1 3eae4fd320cf78b778b6997dfe6a1a29d187f0fe
SHA512 d1419ba7ce22f00ed061d03ca4a33f3974a591afcedaa483de43c9c17daa358f80104f2498b55f66e3aadadcbed3d4679333c052e4311674a77eb238d9fa6f73
SSDEEP 12288:YvYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:Yvt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1776523499E9658F7F5078573F06D4E49EB227AC1D8C282AF4A2036241BFD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 5408f4c4acf791df2acd5aa5d15c6098fd7d66a655a8926aa15179e930d77114
MD5 f800734b41809acc6a8b06107ee78d63
SHA1 222b8f7a2cb3279068600c803658a81fcd6b39b4
SHA512 b4b87548ef0f0319fb3b2cfc9a81c9927bd85182e833338f9b56b4863b0a3318a956bc3d95f719b34cba7c01b605efc250dfbc5f406bc4cbe2324b4a0b91dfc8
SSDEEP 12288:woYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:wot5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1E9652349EE9658F7F5078573F06D4E49EB217AC1A8C282AF4A20362417FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 a6fb3d1a37f5b75c107889c02b230b69d44abd3fdead333a68d686b51844e2ba
MD5 82022a6b1cbdb159798e4cae34b7011b
SHA1 65118ccb8521ac8eff6570415fc66ace6aac9989
SHA512 f18eb2bc3867deca9fd4890f3e44f320c450240b65ab903bfb620b34dbe63a9c9e5d36f9397dbf3ee3178edfdc2027f704e0df3477e783196b58cc9eae34227c
SSDEEP 12288:saYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:sat5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1166523499E9658F7F5078573F06D4E45EB217AC1A8C282AF8A20362817FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 6855c0383b0ea45025de14017d3ae3573b2ee2000b6d47ee497c93c2a18cda0a
MD5 95b63c797ef494056b96318ce5388a47
SHA1 4c62832ac1ffc02a6cc514c389f2f9b9c1a6b14e
SHA512 b8a90db4f5fb65106f116c6360f6ea05a7daa083c649e84ab48e9a4da9318e2897ba05a1272d184b3b64bd86be590b6a65821e99b16bc8ac554919494b766456
SSDEEP 12288:gVJYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:St5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1BC6523456FA654F2F817C236E4694A05F7727DC0DA4283AF4A103A680FF92E4E531B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 56c83a514e1f87cdaf164468011e4d8b66dd09d21271a21a638ab8861e4c0e01
MD5 ecf2f87dc48e791151da220217e4122e
SHA1 bcf9162db59e95e56e8af769922be094520ba5b0
SHA512 5a48dc793068d0b23b44baea64a4f8c5eb8e178ed92b7e436460f653dc6d672df53c8d10e82f7c66eb04176bfb0d47144126baa444213e249d9578f841c720cb
SSDEEP 12288:bRYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:bRt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1D0652349EE9658F7F5074573F06D4E49EB217AC1A8C282AF4A20362417FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 aa02b77cf4287b8b3d36d2693423cb815c3ec69c2af2dcdcf6c13bb303017a7f
MD5 279c556e7e7b18575a6416ce6373af41
SHA1 56be87dd83da6b48d9412be071a7c9b96b46aa8d
SHA512 83df70dfc72cfc685b0168043e702138cd4021229430b052836533aa1add1100733dea68fb15cce51a9f766bd3239ba46eae4c994e54478bbf68e648df9f0acc
SSDEEP 12288:ykYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:ykt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1C9652349AE9658F7F5078573F06D4E49EB217AC1E8C282AF4A20362417FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 7bc1754bf459acd3a1c2db36196fef23a3539458a0523efd76925d1086cf52b5
MD5 47ec690a8261940ca91efe9582d3927f
SHA1 6fc3e3e701ee9ec9f2f9aa472220427a35bf1cad
SHA512 bd80f361ffffcd868ff9e7b92d09869f9376631c7a41b8c409a11d41f971a33c71055ef32b04ae63e16a03c5008708a5ee1bf6a7e0797cf2671acc31c51765da
SSDEEP 12288:4wYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:4wt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1AB652349DE9658F7F5078176B06D4E49EB217AC1D8C282AF8A20362427FD1B4A1317BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 3af3da238554bdb5271ce250d6e269645daf27d93256bfec34078a929b5d169e
MD5 c13dc44347a9dd26f3bb6dc967dfeb27
SHA1 7b79b58a4ba8bdec73264fefebc61417039f1ade
SHA512 31cb44aa6cfeb71bad89db51b36df450d13a8bbd6b4844529507bde600e5b2123c159a21355a88981a54ac8cd808d74519ddaa8f0c37a2c6adb42ee395c797ba
SSDEEP 24576:YZMLzFVSOIt5wXWotDWi//dirlvZGMApYSRiO:YZMLzf85UfqkdirbGbc
TLSH
T175850295B3901CF5EC67813EC8658D06D6B27C550BA0C61F03B4362A1F773A15D3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 f45d57f017778e9b9680d96155bc9a2cf46fda1ab511b7e51008d86f32107a7f
MD5 5375b59e796e536c83e522015c0fe338
SHA1 3061126159e8c8c4d8b6813d229b69777cc0371a
SHA512 cf39e4724dd0f984e00b6e90a9caef74f2e4d2465eb63a3b4e1d8b187c187209f2f98893ee19f46faa99c180f1c6c71a8979dae0ae54a1aab844bd369c45e760
SSDEEP 12288:QjYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:Qjt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T18B652349AE9658F7F5074536F05D4E45EF217AC1A8C282AF8A20362817FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 4733d38a12d743ef0d85bb4303745a81a1bf69f23c7ad8ea3c6857d33c42c4ab
MD5 2100a6224107194a6ca38d65dfde6855
SHA1 c8eb8b02b7741cdbde9fced69eaa436c80288f11
SHA512 8e79df0cc81d3397f02821162b1b4f302a14789ee49d7f486b88f15a27882651e4745d074b024f50a4a696f1c2d4f65c703a723a052797abb3c101d158bb8729
SSDEEP 12288:pHYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:pHt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T18065234AAE9658F7F5074136B05D4E49EF257BC1E8C282AF4A20362427FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 007d2b33b91141b2e2294675eb42ede2565bea4d67c0781e0c9434ef65fbd866
MD5 428194b656478937820b1503ab9828d5
SHA1 fa77afcc493f4a92056b7525011a383300284eee
SHA512 b605a2ee38159f968f53d6a566ed03ee9fb6ac4a4ff6447e6538da0ab63018f4e43d16d1498c7accc269fa5424a5bedc91f17c7ba480ea99e2685f06378b7327
SSDEEP 12288:EyPz5L8cYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:dzyct5wXWotDWi//dirlvZGMApYSRiO
TLSH
T17F75024777A530F9E1278239D8660E02F772787247508AAF476017762F7B2E09E3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 40b4641d844e2d634fdaf0699418d21b6659ed7b3cf8ce1101c05376ec4a0c92
MD5 18faf5f9f6b41c8517df09f298921396
SHA1 8045be9bfac37c8567e3ec2b228f4c7781881938
SHA512 065bba5671d7cf9fff60f546fa3833845b451cfd286845965880dc02d2b234707fe3eded09566c5b438703f289febec43a8e5e4905156b7d48eaf19e09afbd3a
SSDEEP 12288:zjYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:zjt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1EB65234ADE9658F7F5074536F06D4E45EF217AC1A8C282AF8A20362817FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 32984e1ff2743912309a681e897694105a0cbd0a010d46ca1da82172104cf365
MD5 4ec9d29288525183269c452074f9a058
SHA1 8fb8ef293f92862da2718b1c1ca8fa7967159779
SHA512 60bfcd701825e1dd95b7292619631fd0ca05a29390f8343f3c9bc13c0a950aa7b55510afac1f4f414d9714e0a1b1b6ebda836df651bbeb6ac039fe478545a536
SSDEEP 12288:gjYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:gjt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T16065234AAE9658F7F5074537B05D4E49EF217AC198C282AF8A20362817FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 0c82e63a4a25fa2123e674cb1d7bfa53ed8b6a479cce8b05bcf0482e76d2930d
MD5 ea12bb376c57f27b7525ddf439798db8
SHA1 3d32e58210fdfbac0b57ef87aa12326474d91fcf
SHA512 33aa5a80f5dfbaa83742191c8231038347dce8885e896da212d833120752746b2a0752aa2de1f1d34a0d59ddd4bb669314ac3b1cab5f3584a3e9bdf65a4f2de8
SSDEEP 12288:oyPz5L8cYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:pzyct5wXWotDWi//dirlvZGMApYSRiO
TLSH
T15475024777A530F9E1278239D8660E02F772787247508AAF476017762F7B2E09E3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 b376698ea4c038426ae35f1fb8b5a211ac1f11eabb395746d47fb208aad23a2f
MD5 9876f2149e54c6b312239c9f8dff2bad
SHA1 de4f9077fc47a9e620f9c0cd23b4a4112f14ba16
SHA512 b3a232d53e6d4d01a2f657712beb08aadfd61bc5e6d3b9ef704301c92448aa0a51a7e5fde3afa742942457f68a8d65eb54e8f6b06c7dcf711675627d37aaf67e
SSDEEP 24576:bTAaLl3z0zDKt5wXWotDWi//dirlvZGMApYSRiO:bTHLljz5UfqkdirbGbc
TLSH
T178850295B3901CF8EC67813EC8658906D6B27C560B60C61F03B4376A5F773A15C3EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 4a43181510720e5878528b1084e21ac7064090c3ac7be50d6790034be41421d8
MD5 05eebbdc49bbe790311cd24481f651f2
SHA1 a47f76bc34dda59dd53754a17f12a4e729552526
SHA512 01161d7fb2f246fb7d9584f35e7ce9ff67c5088195eaca8a93f334a8c2cdc601a8bfa036d3ce0358ccb6bdd16900e47ecfe41dfd7241a66e767e18c2c17785a1
SSDEEP 24576:T3Pd9CHKy7GZGt5wXWotDWi//dirlvZGMApYSRiO:zPd9CHKya85UfqkdirbGbc
TLSH
T17E95CF90F7E414E9F0B7CA35C9764502DAB67C9A5B61CA8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 88bc08bf5a8dccfba8e77de547a15d473f457dc8f4e64108c85621653fcfda48
MD5 4c391e71c4467b717b3f92a0f5e96c05
SHA1 2e8414429ba13e2719b6f3afda5c67909140350b
SHA512 5f01360230e5c15fde4fd2715611951c2b0a2860b14d3613b5dd3e6f6ddfe8da377e99df3d79cee086f4158ce6df8e37b541e069151011e38ffc4996ba8a63cc
SSDEEP 12288:I6YbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:I6t5wXWotDWi//dirlvZGMApYSRiO
TLSH
T198652349EE9658F7F5074573F06D4E45EB217AC1A8C282AF8A20362817FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 169549002317360c35f8390a31022998cd03485a4858dfa60c81ece54bcd96e0
MD5 7f95904949027dc0161fe86d4770d268
SHA1 57a5ffabb42ef9e72f1d17f5ca95f15a41f851e6
SHA512 4f34e0fe508e72e31d45ab45a4e7742b1ca4526ce5237f79b7ab4d5ad422ab8fd0c06344dc734636e9cbe8d826f6304821e43be191edaa6ad2131cf0fef5eeec
SSDEEP 12288:q8YbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:q8t5wXWotDWi//dirlvZGMApYSRiO
TLSH
T13B652349AEA658F7F50B8173B06D4F45EB217AC1D8C282AF4A60362417FD1B4E1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 c6035a389032013cbad6765ea583f4f8edbcca217eeff300a95ce7748fdf611a
MD5 e5ba3f95e26513c61b4fb46a31fa057a
SHA1 756f34572111f3c6a00a9a5961695d7e1bb28726
SHA512 a2e595840850872d8e13ebc2b908b454e1b2a2de57d620b2fb931781a05279ada68cd67f7c3a1a41dfeb8b178f7997ed69cdfbc0aa8356389ac23cb579b584e4
SSDEEP 12288:JNYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:JNt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1CB652349AE9658F7F5074537B05D4F45EF217AC1A8C282AF8A2036281BFD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 1fba84604e4704f56a53606f763e7ba7547313265ed4cd67cf2540d611141c2d
MD5 64e0b6accb7becdebbfff90562f56dca
SHA1 ad47250ba479602a26b6e351e954005a61252ad2
SHA512 de9c0d27401873c1e0038df85f085b24c78051519bbdc7ffbe3599e500de0f5c784a7f8f54f19cd5390233e43363df8a820e7a05e03ba78a051128e0225ab89c
SSDEEP 12288:ujYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:ujt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1FD652349EE9658F7F5074537B06D4E45EF217AC1A8C282AF8A20362817FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 941ca052d5f6fbfd82b188cad3ddf04bc3513b0024ee642774cf90eb541c9154
MD5 e7c079fbb06efdc302930eb982da1317
SHA1 1d6c63ef105bd1aa9a2d2ed09cb46240e33d566e
SHA512 3f636a37634816293e22d392054b7f893291fca01aff506a2af8d7f3b653d73d67d74af2e95943a34c992231f5334909a457fd51d161bcf3c61032fcb3e7d3a9
SSDEEP 12288:i6YbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:i6t5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1C8652349EE9658F7F5074537F06D4E45EB217AC1A8C282AF8A20362817FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 36eebd29c93850a376df1ee8372fdee9ce20d0e9329a9edb55530d1be8bf5222
MD5 0a84deb3c8e28be457bebaf89abec7f9
SHA1 929b0feab4c990906dfd73050fe62bc4e891b334
SHA512 864a044124b5ef300a23fe46ee0e793bd27c0885c92df4354c63aa39165b39b11874b49336f0415db97326e6c1a55aa32590517ceeea5a4340389ae3e3fb75a3
SSDEEP 12288:wLYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:wLt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T179652349AE9658F7F5078173F06D4E45EF217AC198C282AF8A20372817FD1B4A13176F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 6d4876909a5415d3b57bcf576054e642fbaa5fa9bc385a2dabffb6adf8129814
MD5 2af9488bf65607d34c44d62fec053de1
SHA1 6f1cfbefab85338e98022872d5d42698b075098d
SHA512 aaf883bc6b9f206f2b92248cfe74726749f120b01bd4491fb256407228854fad1254614e49411797f09809288fc7611e6e5be862d2368ac5f89e00893091ecd1
SSDEEP 12288:JRYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:JRt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T104652349EE9658F7F5074572F06D4E45EF217AC1A8C282AF8A20362417FD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.5MB
SHA256 48836a7e59d74dca60b91ba5ab17c02f73eab42522e5f7ec928316c0938787b0
MD5 6d5f900ab5b3e8260526166cccde4358
SHA1 8842ce98dec0879ddb79982987fc6ea951bb7c72
SHA512 d0490490ecb897e3502d570bf8e528e247de3bb906e2f71485c49bc03aa18d28859d9812c641f526f0b644f2ad2aa144aa884b8efbb2c11b9f41b70bb5557b0c
SSDEEP 12288:MyYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:Myt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T14C652349AE9658F7F5078173F05D4E45EF257AC1A8C282AF8A20372817FD1B4A13176F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.5MB
SHA256 35f3dbaf8cd0e8a8616e2009909d5dc4aaff3afe75c621ae09ee79e83b85c7dd
MD5 f03d8b3512ca094c320531b160db2b70
SHA1 784d49399bac045b02b6014ad8aea8e1c4c3ffac
SHA512 00f988ebd586fb8a1cfd9411595679df360c15a96c954782ebabd2ecb5be68c878c0e686bd49531539e7e1a3d046d254d69764b45e263f2549dee86ffda6e9ab
SSDEEP 12288:oRYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:oRt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T162652349AE9658F7F5074573F06D4E45EB217AC1A8C282AF8A2036241BFD1F4A1317AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 2f5d671b8e88f3b582e4062e3d9de463900f8018c775c599ff245c7d3d9b5ebc
MD5 18c3d190a43f51be109dfde8bbff9119
SHA1 d53ba2c3214244b857b08098523b71c4ca023f5b
SHA512 8e66f6818ee22ded4a5f76946e6ae13981df25bf25efa3e79403a9a82f838b442005214d52e2f1175d37ac1cc46197a7619b004a359985466737749b0e47b586
SSDEEP 24576:xfwvLk9RX6wkyAIXt5wXWotDWi//dirlvZGMApYSRiO:kMnYI95UfqkdirbGbc
TLSH
T17695DF29EBDC44E5E177823C99B7460AF6B178591B31C2CF029953AD0E37ED4AD3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d65bc2a7b6cdd37be0094c20d5be32b0bf5b38452672060d6d97b4040baab4ee
MD5 d2858bc313ceb2c5f3fdbaf1bd07ba00
SHA1 5c159bed3dd97a340bb9aea56ebaafdac1156a54
SHA512 26b5b5ac9a6dbd0c45b4b9187aa1f4b2a26f2988821e56f8f8f8b48d9b34c26cd1292e7e033b54b07315ed67faf16c7100c23d058e707a45cb2dbbc09a4d51bb
SSDEEP 49152:LYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0e5UfqkdirbGbc:VySzP25UfNc
TLSH
T13F067C96A1A801D5C1B9C1B98B0BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e8d8f996d8536cefefaa4e8c9df22863136a5a98b3feebe2aa1e87bf98a17fff
MD5 48acfc3febeb5e58c97524b03cd6b654
SHA1 d52ccf2b9cd3a958c40d20c6003f8c8b5414c7c2
SHA512 48b2aae61cff8765d8ec2f1f4775c0c6a9a19efc62e96dfee35759e39fa966cd701c316120ad056cd4a15d7eded84f466868378017b35612a9e966f50a6a38e5
SSDEEP 24576:M47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYYt5wXWotDWi//dirlvZGMApYSRiO:M47JUQjairIhCnDHUPfF/O5Ufqkdirbr
TLSH
T1DE65AE1EA3EC01E5E1BA827885154A1AEA71742E1F31CACF1270537D6F63ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 6a58cc1bd21bc519038bbf7fc8618560e1f02558f630b90579c999aeabd470f7
MD5 4ef15020bb46319754ea24c8fc451f68
SHA1 b426e2ec722406e803b9bac7e74e00fc2293b339
SHA512 bd7529c07c32cf90689f53b53ac5e93deacfc2806c8fe64870c03445034e641fa5a522d9e75bf805f813c168d000857f6a886b2a9f71444dc5cf680ed7f9c634
SSDEEP 12288:GasfTYbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:qTt5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1F775F00AD29801E9D06E5236D75A4A41F7337C6187E1C3CB46D0F53E1FBA290ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 1cab9d6f6c86ce738ec354352882ae4b5181a47f0a3733227c802ed5db2bad13
MD5 7396fd3ec06e1e419d81f0c768589b8f
SHA1 3bf0842c2eab997375c0d19e3c382843d7d43504
SHA512 79712121513a3386f85b8fdb52c33f09883abe936f31057c5fd7864be1341013cc993221087120112b0e601b380c8ff312578dac5f4d8c60653a1640eec33510
SSDEEP 12288:INuPjU3fvRE//TKE2f/kF0NNspOufQkBn1FbheoNdPK:INubUP2//mjf/Y0Ipxfl1FbhewPK
TLSH
T1934517407666D79FC6A940325E36D6CCA7707C01FE04AF0773C9873F8476669BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 11c0ef9a7730aac59e4a2646827e626bf3542b1fd74ec118736aad3384232c7d
MD5 2b8628639085aa67a2e84b1f2c1399c0
SHA1 d813d2fbbc8bb074718ed973d43444cadf0d1e43
SHA512 60885e76d4867f6b53c4fadd149f62a2eeba8806ad99f19f91b923d8f605bffac4d03d7d749768ad90ddad822ef141099a4ac06d338effad89fbbb4f95360028
SSDEEP 12288:IR3etNG9g2tLyGQQbHjr2Gak+Qa/4QvQKgmuRmo8iqAStQ:IR3ejUZpfda/4QvQKkmjLpQ
TLSH
T1E3553A41A5B7E35FC9AE9037423286CDAB746C06B7453F017344CA3C98679BEB5E2392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 879f2a032d2c17b07dbc350cc3e0f3cbedfd54146850c58124de556b482ce024
MD5 e6be623c7e11ff7c355af3a2893faa16
SHA1 39d256b23c2dd7c748c4f1b8cc9acaeec5085a0f
SHA512 30de4084c9c6e1fb95042d726ad29dc662df175f1ff37e139ec292085bd86319cd8b31f849532a64301168282f169ef7cf14b0bf9deccb0e5c527a578348f641
SSDEEP 12288:j+77YbevZ75gIspXWa7pnDr9si//E3KXS6FpG7lvbtNwM2OAwapmk/rRwZO:u7t5wXWotDWi//dirlvZGMApYSRiO
TLSH
T1696523569F999CF6F92B4131B06D8A05AB267AD08F80C1EF8910376817BD1E0ED3176F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 88c47932160cccb5aa4678982b253025c9665215168ad6eef42570ca6adaf5b4
MD5 6355f462eebea29829a28e70a2587a75
SHA1 79902491386758ab998caee635b136af89e78e01
SHA512 356d86ef5a00a5a4294fb31efcabe6247af78c2386245cb4a9133e14c54c34b63f200ee8ce4f60bd587554258c789c6555a47b0711b5fb4cb8089879fa6f94fe
SSDEEP 24576:8gb6bmBIi49WNNFpg1rSvFv7bYFt5wXWotDWi//dirlvZGMApYSRiO:8gb4mBIBhGFQ5UfqkdirbGbc
TLSH
T171659E1E22E802F5E0FAD2B8DDAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 6bc1342b09b79153d4b7f7bfa3816c0c80e94cb9316fc98b78eab29779d2a127
MD5 37ec8bed9afd62e51dc8555e5ef12b9b
SHA1 0b699776e3e9843d0ed633460d720248ca21de5a
SHA512 48357db08b4947206c73883a66f4b74e07384ab0aa7628b1ba2fc73162020d5f08c5e21d68dfbecd987e538ddaffda8c7a00a2b9ae8bbfd0a16bb1714357c0a0
SSDEEP 24576:aG88u8FpJqH1Zzria7/mIt5wXWotDWi//dirlvZGMApYSRiO:h7ZFPqVQa7/b5UfqkdirbGbc
TLSH
T13AA5F165B7E101F1D47BD13889864A63F6B2B8210360EBDF07A89B551F336E54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 60f8af593fe24817e8d5eb69568c34c94d461b742a882c79faa2264cc51c1dce
MD5 2e69be6194740bc72f86f71c38b1a6cd
SHA1 756518362a83b364da2cd770d73ca082e68c6d26
SHA512 8caa8f2393ad5a859a03b00bd0da3520bf3d97bab2d64bf25ab16274d1dd06260d9d92861a45e4df202f3454fc96c4e8f7bad0ea18b54c80877938203728b0b1
SSDEEP 49152:tBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjM5UfqkdirbGbc:2G05lO43bl5UfNc
TLSH
T195D5C06E62EC11F9D1BBC17CD9C64A0BEBB23415032556CF02A486A91F27FF4A57E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 cec432606b9ff8934f0c4a8730ac0dd2562b690c359af47f31a51d2c215992e7
MD5 4344ad69b72d542b72789a6173958671
SHA1 4cbb008b74bd3f40dcc9f0cd1dedb38e5eba3848
SHA512 64ba8c82d56de351438c40b90667075b845ce25185f9925685185a9ec57217bf976eed727f4b5eb3bff688e6b45bbdc841632708f086600553672e6dfe66352a
SSDEEP 24576:vfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnut5wXWotDWi//dirlvZGMApYSRiO:Xa5POZ3hJt2pasx2+mE5UfqkdirbGbc
TLSH
T11365AF5EA6F800D5E579D17DC5834A1AF5B1346153329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 55125afab9ea9ea9798eedb42403f7304318d2b7a8582534a46744da0a0b5481
MD5 e6a5fdcdfcfe0a9ece324fa1f2243cbf
SHA1 c95259bacb0dce70039a15a418d21ff48250f1d3
SHA512 b790dbd5a200d114dadc8dc0143ead8d34a8ffa8bbc9f31ea557d70892d869b44b87a09cfc3759a115d2553b0f33c0db3fdc29a3b3c1c1b5033c9a78f5a36e37
SSDEEP 24576:dNcwHdjbyQ4nLC18lb/EOjowL7Fkgt5wXWotDWi//dirlvZGMApYSRiO:dNc/zEOVHF75UfqkdirbGbc
TLSH
T122857B1623E901E4F5BBE1BE897B9946FA717865133086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 ef038d7490d260e1164ba93a14ae5828b565bec24c05638ee27710ac20d843a8
MD5 7db2e96e102566385d46e4c86d8c47ad
SHA1 1bfcee5bbce423987714a4b463dda4c257ddfdb3
SHA512 b9660f13d684b6740acf4dd52afa62a7b67287ff9c77de0b01ebe5558148f6cdc0bbd6d9b624e77c07b676c726e9cbadf0762a0b37c271753ae07bf493e2ccf7
SSDEEP 24576:W3kNvNnaFeYhJNtmZBmyt5wXWotDWi//dirlvZGMApYSRiO:W3MwBtOmi5UfqkdirbGbc
TLSH
T1BE55AF6EBAB845E4D1FEC6B5DD238512EA727461073293CF4290C13E0E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 10087b6856a26d768f141e35439637ba24466bbec764acf4c760e9de8a5117c7
MD5 a29c9ee963c6d5bdeab59e3d6a7faaf6
SHA1 4a0ebe07c4532aaf4c9a8ea67ed739890bc62526
SHA512 0674f968d122b532cfd283c9c536408358fa8c71c63a882aad052fb45fc2e49d427f6ec857f6ddbda54cf66397039f620fa9b6853482fbc7a26d4de8a0249f4b
SSDEEP 24576:hPUr+NQ0t5wXWotDWi//dirlvZGMApYSRiO:hJQ85UfqkdirbGbc
TLSH
T10685F11F66AD18E5E676D13D85868709F772B4620702D2CF02E0917E0F77AE8BD39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 80f0d3d311ea0840371894289924d82e4604a80cea8677c832c6a3ba12f4c550
MD5 154bd528e972b95ba4f6e4f1e01db7e5
SHA1 7b440cfad442514f5c33be66edfd0ce6653ed90e
SHA512 c3ec17540cac5de29e95ee0ccb74af03441c7bb903bd2e42c5e88124ad7a8e20c3012a97a43cd516075183f33f335c9d7cf21a9c466597519fad24953838d4d3
SSDEEP 24576:uD3FHshBIYQgAPt5wXWotDWi//dirlvZGMApYSRiO:uDVHeBIAAV5UfqkdirbGbc
TLSH
T11795E17DEB9C04E4E57BC1BCD6638A06E77138A9032256DB029091B91F6BEE47D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2008-181-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2008-473-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2008-182-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2008-188-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2008-443-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2008-475-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2144-460-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2144-459-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2144-457-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2144-201-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2144-194-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2144-195-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/2452-154-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/2452-161-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2452-155-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2452-323-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/2624-236-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2624-243-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2624-237-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2624-462-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2656-150-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/2656-140-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/2656-139-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/2656-146-0x0000000001B50000-0x0000000001BB0000-memory.dmp

Download

memory/2656-152-0x0000000140000000-0x00000001401B8000-memory.dmp

Download

memory/3140-357-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/3140-167-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3140-173-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/3140-165-0x0000000140000000-0x00000001401AD000-memory.dmp

Download

memory/4516-220-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4516-226-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4516-233-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4516-231-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4516-219-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4680-0-0x0000000000400000-0x0000000000612000-memory.dmp

Download

memory/4680-6-0x0000000000AF0000-0x0000000000B57000-memory.dmp

Download

memory/4680-365-0x0000000000400000-0x0000000000612000-memory.dmp

Download

memory/4680-2-0x0000000000AF0000-0x0000000000B57000-memory.dmp

Download

memory/4680-7-0x0000000000AF0000-0x0000000000B57000-memory.dmp

Download

memory/4680-180-0x0000000000400000-0x0000000000612000-memory.dmp

Download

memory/4896-193-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4896-13-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4896-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4896-22-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4972-461-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4972-206-0x0000000140000000-0x0000000140221000-memory.dmp

Download

memory/4972-208-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4972-214-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/5052-427-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/5052-177-0x0000000000400000-0x000000000057A000-memory.dmp

Download

memory/5244-235-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5244-72-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5244-128-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5244-136-0x00000000007E0000-0x0000000000840000-memory.dmp

Download