0e2a2bebb4b29007d2ada509ed6b8c9395b69fe463150a859decd82ea9538c45

Analysis

max time kernel
147s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 17:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Size 3.9MB
Sample260730-wdm67sdb63
SHA256 0e2a2bebb4b29007d2ada509ed6b8c9395b69fe463150a859decd82ea9538c45
MD5 45ba85384f9b463163206f3f31bafb25
SHA1 94e63b6bb2e1b9ba939184c1b5fbaa13333245bc
SHA512 3b11b4800f7080e07ec0e3aa45fc9afc2096031f863455d23a0123e6acfea0dc33dc21401a3cca7083bf3c9b7d2417333dbe8cd00c8e72c4344661065d477377
SSDEEP 98304:G2Gg1Aif2JzyJ1B/ao2SW+Cc+8NiiXousfEkW54NQX:GM1IuLMmCc+8Nii4u8+54NQ
TLSH
T13B16AE11B5405266E11327701A3EFB79A27CA9B10BB1F0DFA2DC8F1D19776C28A3652F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 11 IoCs

pid	Process
2432	elevation_service.exe
3332	elevation_service.exe
3832	maintenanceservice.exe
5456	OSE.EXE
3012	PerceptionSimulationService.exe
4728	perfhost.exe
2636	ReFsDedupSvc.exe
5296	SensorDataService.exe
3468	ssh-agent.exe
1440	AgentService.exe
5084	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 49 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\F:	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\71d2abfc238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000092285ff4b20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fe6e1ffe4b20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a347ecfd4b20dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a84b0bff4b20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004616c4fd4b20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a33234f44b20dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b709a1f44b20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000591e72f44b20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
2432	elevation_service.exe
2432	elevation_service.exe
2432	elevation_service.exe
2432	elevation_service.exe
2432	elevation_service.exe
2432	elevation_service.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeRestorePrivilege	4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeBackupPrivilege	4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeBackupPrivilege	2636	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2636	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2636	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2636	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2636	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2636	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2636	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2636	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2636	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2636	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1440	AgentService.exe
Token: 33	5084	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5084	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5084	SearchIndexer.exe
Token: SeDebugPrivilege	4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
Token: SeDebugPrivilege	2432	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
4796	2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 3356	5084	SearchIndexer.exe	99
PID 5084 wrote to memory of 2916	5084	SearchIndexer.exe	100
PID 5084 wrote to memory of 5744	5084	SearchIndexer.exe	102
PID 5084 wrote to memory of 5060	5084	SearchIndexer.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_45ba85384f9b463163206f3f31bafb25_amadey_darkgate_elex_luca-stealer_njrat_smoke-loader.exe"
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4796

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2432

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3332

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3832

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5456

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3012

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4728

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2636

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5296

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3468

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1440

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3356
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2916
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2868 1768 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5744
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2896 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 676bd28e70becea93cff4ed8ca8dbb3e80ea56231b198be73a528621b480ee69
MD5 1157825c18d096b6d2405913099964a9
SHA1 f022e2a260c37194fedbe7ee106f7b65db6b63cf
SHA512 b53e1983b647ffe6a2f43c23b6a6c17ec7b2e2ed4fcbe4ed0dfb3061c5a5cd299504179cc0db94f8b53309739f9c4574fd7c0d4f2297c71d6bf062935915cbee
SSDEEP 49152:Hb+632BuPkFKRrdE6ohrstBhuXjfS4LWxnkEkoiZqDfEFiJJ854TJQE0:13q60jB9ousfEkW54NQX
TLSH
T159D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 826KB
SHA256 7133963e21a796e8d78cf1aaa16dd72dba15097d832fc748fffa759918bc6d85
MD5 074acf7322b9900b0fca6be1c56c3361
SHA1 f1ec6d6a20df2036e0d514324415a70db52b999f
SHA512 bdb09295f68aeadf86965ff7296127df29780b4540f465cd7e6936d6e23c1bb99deaf495792d693a80b6640c23c4e8cd0cf3eb9c094b2d5652f444c828d9d856
SSDEEP 24576:FXYfDtczAfEk962hZqDfX0Fiz9DV854P7JQEtK:QtcKEkoiZqDfEFiJJ854TJQE0
TLSH
T15005F12863D408F9ED67823CC8A28512EA727C5547A0F79B03E4952A5F337D85E3EF52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 6a3de11def9bcb1efc14067f7175afb733527ff7d7de571f4762186fcb581819
MD5 178e6079038729a745169d2a0005e836
SHA1 db0f4970f6acc578ee6c277a127084f8306d77ac
SHA512 eb2a625aa43fa93030ff166eba147f0b0cd241b4b8527747936fded93daa88037be3ade77190789347679d91e59e729cbc0b9433e885f74f306084c752d0ed8f
SSDEEP 24576:n0Le5ji0hmxNrMsEk962hZqDfX0Fiz9DV854P7JQEtK:nPji0A7hEkoiZqDfEFiJJ854TJQE0
TLSH
T1AB35AE16F5748371D073C0B9C5D2A69AED7130861B308ACB4286D77C7E67BE68A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 1e85bbb89ed136a3273f5fad906ac46a427d482dd2b4cc41973e289e000ad45a
MD5 d3ac9cec5eb7d8444ec5acacd3e90c8b
SHA1 c0856dc77829852f6a62d004acbfd907e03be9c1
SHA512 dbc701c89f18d8e796c9863ac69797f41f975bbb6f31ca31d06f78eb0555495215d21913c4de9ed98ed628609ec7fd0b4d859b805b3e23e300533487af4ced2a
SSDEEP 24576:ma7/ezSC6vUyD/aqgrvWr6q8wyuaEk962hZqDfX0Fiz9DV854P7JQEtK:x/ezSC6vUzPviHjylEkoiZqDfEFiJJ8j
TLSH
T16C755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4f48b2511fef0cc714b00254644fdedbddd0b7ded5036cceb730ce633ac4458b
MD5 af7721f9b05d8067628f2534b1ca8aa9
SHA1 92f098291c324b5fec5b77c86d51de287ae2cc27
SHA512 b98fe681d42447571407331ccc63476c7d64654a44b1a82456753dd2a8eda710498d4d6146de194d257a8e572997bc1e877e6aff464eaa691897ecb0de7e83f1
SSDEEP 24576:9VbqPb88hv/l+b7Ek962hZqDfX0Fiz9DV854P7JQEtK:9VO88hXl+XEkoiZqDfEFiJJ854TJQE0
TLSH
T1C4559E65F5748331D073C0BAC4D3AA9AEE3234425B318ACB1246D76C2E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 582KB
SHA256 14fed9a56ca6a9a5ac867dde648eac29098544d0bbb38e5b9c2bd597750ab31d
MD5 a5e0345c104c6f6c72ea6c753a772ad8
SHA1 ec92be503fb58f1197f6067cf1c0b66a4ef1eeda
SHA512 130295f6501d92bf4fa8662301f7c63ef919b365a8fc54517cde8ae898ebc87c7c31c58daf927a5dece8a728ab0ce0253c47d687bb8b6097efba2eb5b67af915
SSDEEP 12288:ujoDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:ujoEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1BAC42341454428F5EE730634E4A7A4E769B87C999FD0B9274B81F24F803EB21DD2EE1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 840KB
SHA256 e2427e0289595a4913feec8a70b3e8105245120da7bd03554ac3e7663bcf4c5a
MD5 69db20eff15d8972a606caad96b7bc0f
SHA1 2085891d1c3a9456bd95649f87ecbef1aaf09e13
SHA512 486b25123e704a0d178461987c723d6d8635d9252f3932e0b6a1dea0838e44632de13f9d66d26cad25bc6f1dca725aa03d0b17cd87e0715a3bcd1e444415a91e
SSDEEP 24576:sJIUDEk962hZqDfX0Fiz9DV854P7JQEtK:sJIUDEkoiZqDfEFiJJ854TJQE0
TLSH
T10405CF3BAE28FCE2C67A4D785691C240E77278704F51A3CBD165C20EDE236E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 8d1fd3a6585e698f7a324115f652c32ef088ca5a1aa14060044ecff7e46d65d1
MD5 c23f9c69caa54d67e0172c73d1ad74b4
SHA1 439ffe0bbed459e3bd182bd841dcdfcc1814e932
SHA512 9b53493317376576ba4c7c3b2fea04dbfe8a2d0019f3738f12ecdece5dab1c34573b6bebe3cc6d12fb8fcb22b140d13c4b1b69fe824137a4f6c51f1f2e2cbb54
SSDEEP 98304:PQvGAdlCEL8c/RRNw5CYousfEkW54NQX:IvyEYc/R3w8zu8+54NQ
TLSH
T1DA266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 910KB
SHA256 a1218cfe3c317bc20556156b0f4720c61884b91a0901371257582c2f99ff5f48
MD5 d2b49f108f448884235b7950ada77773
SHA1 9fa04072868a9719aa303669252ad6dafa4e6d64
SHA512 55ca5ecb522f83ffdc16ae76c3ca867fa4422c0216f9c55c70fb0ddd37e614ee0f5533ee6f3aa0c01734ca408bef9e4b97dfcde4eb3f8358b71be70386b30d11
SSDEEP 24576:aSewsAjxEk962hZqDfX0Fiz9DV854P7JQEtK:VljxEkoiZqDfEFiJJ854TJQE0
TLSH
T18B15E031FA74E436C67B0DB21B36C716187C79204F9129C3E3E89A9E59342D2277AE17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 41feb5d4ff16c759bd967e1fbe17c7e8a76f8cff183f234e036375ff4ec5277c
MD5 e494f46aff66791ad2f351113af4bd70
SHA1 709713b03f7713266bd86ebc712234051d307fa5
SHA512 60739a71e1088d6f70657c8f96428008bb45d98ae3e53b3ffc75493fb2dfa6d4dd8e1e9fa7f59507b3e562d10717e5711bb738301f3ea18545e9c51d5e195e12
SSDEEP 196608:/UEtQeTbvf2zlO12sJTv6Ja1cpVLyRIldPlbuJHQu8+54NQ:/UEtQevvqc2W1cpV2RI32z8y4W
TLSH
T1A9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d011b50db7b52f6cd607690709c4058fb2b7fab5a37eab5c1221a8476606cf27
MD5 2f9a2732180d0a0ffae889fd0eca7603
SHA1 1883ccd13bbf31fd0af267a32b2b81d6b960bd8f
SHA512 a263874ce223789bbc895405e4c8075567f3e5baf5943c3154debf34d27f852afa9ae9dec0e3957caa7b68255ef67d3b7ba42e24ea7c5cd0f09483040c9a3227
SSDEEP 49152:9CbRquA/m2yL5zQfFiV+XenmE3/zREkoiZqDfEFiJJ854TJQE0:6oqtVjnmcousfEkW54NQX
TLSH
T155D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 11101eb6126eccb5607320f24f253d9e468fcbc6a89d90455169614eb735e9bf
MD5 fbb49b2b1ed5fbe8600f9ceaa9bb543f
SHA1 6d92cfdf54502e4550321eabbd26f6a775b03a6e
SHA512 21822ed41e4ffcc5dd4da9459750fe06d76714f81a71768b4e48374b33d7525cfe5a94363fdb0a54810a1fdb18a618ac5589fa853363ca0884e1bd1629c97ff2
SSDEEP 24576:eAhGL2IFoiwtA5l7S53eEk962hZqDfX0Fiz9DV854P7JQEtK:eAM1Foiq5OEkoiZqDfEFiJJ854TJQE0
TLSH
T19435AD80E7F955D4F5B3AA7899B69171EA76BCAA5E30D20F2250D10F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 805KB
SHA256 b9168d043fd7073cf728e4f0b0743dc2b0fa28dc0fd6282cc50ccac0edeba29e
MD5 9bb84de4c11562f27dedefc7798fd556
SHA1 de6f3a6fc6943aa368c0fe332b04da582d2e7698
SHA512 b2d8afcc74bbc1590e5235e7abe1cd2c3e29dc583d673ed7c5168ffb7f81bf5c000c8e688a9042716fbaa1b4992b9888605dce21e2432f340f6b9f798c95d9ae
SSDEEP 24576:3wuXOWFEk962hZqDfX0Fiz9DV854P7JQEtK:3wsOiEkoiZqDfEFiJJ854TJQE0
TLSH
T11B05F04666A41CF9E9674238C597C136F7F2BC062A61DB1F07A0C65B5F37321AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 656KB
SHA256 d455f5c30e26d7552574e73d47333d1dde7b576c39428fc7e97c3e80885d54d0
MD5 4083f73fe2be69b3b861964492ab24b0
SHA1 5c9b3262936d1509ed6c73fb9186f2b76df37c46
SHA512 af9d53b5bb79b1604bfe374f61b75e1cb2302f50a9ce9edb6c4cc8a2d5cb1395654b64716e82c89f18e753658bb03cac477adea6c4cb87f62f342dc14daaa47c
SSDEEP 12288:I/Z1IyBDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:sZu0Ek962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T135E4124522D434F9E9A30238D8E29586E7B078566BB193CF0750925E1F37FD25E3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 82a2fbc4d8c448e3232d5c46167163c4d346a5d507e91d0b976e39d46e4c6093
MD5 ef6d2a686ef49c4d06d8015536188637
SHA1 66072340e12f75ef27174926a0d9e5c67ad6d386
SHA512 039d7fe905edd46cbfa8015dc4250abf35198ccbbf264e19528f0001e8a2ca2731dba95553323c8e3bc90e0d28f55deee09f0f80cae827e967f94f893b1d5049
SSDEEP 98304:uQRQyi36YOcPhLvw2gAf+PN3pousfEkW54NQX:1QyiKahX+PNeu8+54NQ
TLSH
T108667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 3e85942b6cdb7c05daff59d86b879bcc1d64bcdddab55d5a767bf9f60305ba73
MD5 23b78e797687f90f053084658a915426
SHA1 6e25c042135a27b9cde22a66294ba2ea820c6139
SHA512 b795908ded448bb7bafa3c45f0b4787208b674ff0853b54c4089f991476459132fcb6e8497e591141b2d15f95dea1719c3e3a0d813e2498d912436a81dd8eccc
SSDEEP 98304:jQRQyi36YOcPhLvw2gAf+PN3pousfEkW54NQX:yQyiKahX+PNeu8+54NQ
TLSH
T175667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 35e9adc15e2a0e804e6ba888d55b5c79cb07b9e13b6db7ca682387289433b148
MD5 29374fd395753b170b293883ba40b175
SHA1 fdc137d5094753315257632a1979c0cbab1ebd19
SHA512 735dc57f60709becac38efdc7927792245996888f55a1917957a006abe6f6e249b76e79f41832783f20ef0bc6e30878d1f6bac7f1f3115818fa77c07dee98a89
SSDEEP 49152:E68Qg55nhceWu7PNU3/hEkoiZqDfEFiJJ854TJQE0:uthLRc/XousfEkW54NQX
TLSH
T13CB55A33B2F200A9C44DE1769F46973196E17C758FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 cbe8445b09aa277eb2cf253b95200aa12aa0f2d014301ad0d1ad113698e2be41
MD5 22dac9ab0784ef55adca901bba903cd3
SHA1 44bc592ce4009c1be0f98b2d363d31e308b73bf6
SHA512 aa2d0d1569474183ff12b42cc173219137d556fc5cb22e4b4e330feab238ab7a380bcb9baad452212433037d177ba877f4cda75a90ebd074d6ade6bd0362171b
SSDEEP 98304:Ly5112gYy5azzVva69nLKnhZ6ousfEkW54NQX:mLIHjWhnu8+54NQ
TLSH
T186167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b6ee8f66f63074bc26a2aa93815e2ca0f5f4fd78319ace5a76c2d6eb2f66d245
MD5 d94e2d9661e5d16dd2da54b86b8d1e8a
SHA1 47621f704011cffe254182bfa78cdc8b93f73b55
SHA512 eca83a5ff93162b1a316b13505dcdf473eb045fcaa58138c1d27e77afca82980820015dae93536b7fa6289fe9e7ad14b6fd708d2fd62c7f2d1346292b6ce1658
SSDEEP 49152:nB+taZ3usBWOBr4tEG20bqx0z+n217aau1glPEkoiZqDfEFiJJ854TJQE0:pu6JmUxd2dRousfEkW54NQX
TLSH
T160D59D13F1DA01E8D06ED578974A9233F962BC490B34B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2e2e4f58b8215af89703c0009d69c510e74c26b79ec3891e2e8d469ac42cd144
MD5 6a3f1abcbbccae7892f8aafab1c21f48
SHA1 b658f8f20c8d438ef81d52cdf79658284c98cf80
SHA512 6f51393e9df6c3aae3d8deeca83230e63d260ae87ebb46433a51a1d7e7ab92680e4cb75fca9acbdfb099e5f921d8d3fba768e5da5828853381b5f4c745cb12b7
SSDEEP 49152:Z1hpsNoJpF1A6BU44CwH7R4xjEkoiZqDfEFiJJ854TJQE0:ZmifPkRcousfEkW54NQX
TLSH
T1E5B5AD13F29901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e03e251945938457890cbc32e8c7400fba7ef9250ce62fa664e3d10909c2809a
MD5 c6516f9e7eb53ae75adaa390fca660c7
SHA1 c6627dc0a72077e7d8e9a7e4d92416becd7f1484
SHA512 9682570b699670ea42a9a967b9ce7248623cc2c6a160d67cb4035992a046208c604d887fd6245fb0605ccf944094b1f477885c9b59877950f59d3b7146b3b44f
SSDEEP 49152:tSuZQIY0Be2KNRVtOnks6NMHq0EkoiZqDfEFiJJ854TJQE0:j5dKvi61GousfEkW54NQX
TLSH
T13DC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 bac694291df46a4adcdf833d1329542db83a4b9f3f61cab398141791fd60b0df
MD5 6f210d43184b4b18c152aa7abb23b60c
SHA1 bfb9cac16d3cf17f336c2638137f3118ddcd7200
SHA512 9f4babc89e73a59b523ad5027b2af45a01eb07d096d975946b76d82b763aa3d4b79c608d5d06f4318182db2180e7a39e2ea2a04788d5231beb6446d84651bcd2
SSDEEP 49152:MhtSn8EApI0figXgiDn0AP5wfEkoiZqDfEFiJJ854TJQE0:tX2iyphQousfEkW54NQX
TLSH
T13095BE13F2D900E8D05ED178C7568632E962BC160B34BAEF0A90B7561E7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 581KB
SHA256 b03c6559107d00faca3b71a70fd1097696030c9c0dd91f421d2591b378f75256
MD5 86b74494e8145142770acce5934190c9
SHA1 ebe42a613b42e6067f3c372d903bb6360787b89a
SHA512 a24b29a916f41de5df5c933c381b093bdcac93995afeb15b627dcd7c0d117a624382d9c521bbee595b360c741c433ef945779be6ca20ce0dcbf5097778b9d582
SSDEEP 12288:gwDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:gwEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T18DC4234144562DF5ED220234D4A3A0E7A8B83C8EAFD1B52B5B81F10F917AF315D2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 581KB
SHA256 5078aca8d82dc6477645655993617f4c32745428f9b5ce24571f24fc2dd3feed
MD5 7955a025bb5e94440cb14d5db3eb2944
SHA1 c63ef0491df3e0b8dcac440d42613847bf2b135a
SHA512 33874482894357ffbe88ca6e3ea4df3fe5b6d0284892e3d28118e63f46408f381bd2e1a091518b79f1753a1fda1aa2ff00b3a34a961fe7a7e71b93aeba3bfa03
SSDEEP 12288:O9DIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:O9Ek962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1E4C4234044561DF5EE220234D5A3A0E7A8783C8EAFD1B52B5B81F10F917AF315E1EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 581KB
SHA256 8d4f0fd6458d2dc15c88c4c43125a9825cdb67d647df903a3bffc8f5c4a280c4
MD5 02f5635e39bf7f068106867c5f4252b6
SHA1 86c8ee8c8cf13430f77a2c7071f25f8b779cb0c8
SHA512 130502132ffd03b7418dd0cc0446cdb4c235c5596aedcff99c279e6153260f926a727f93b3084faeb44b81b1d8664a4ef142386f94fb54f336f4a7e94b9e907a
SSDEEP 12288:SrDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:SrEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1E5C4234044561DF5ED220234D563A0E7A8B83C8EAFD1B52B5B81F10F917AF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 601KB
SHA256 c27ef2885f211850a274def20308e0ea288fc5b9dc556a3c9fdf5d88c3ce2910
MD5 c9ea4d38bfb29ee61dcdc5a776693ff4
SHA1 2ad16cfc8afba71ac003f39a4cf5f4c47883bbb1
SHA512 cfc8e881a73f159c2704a60df380f263ad355e051d84cd7a08f5e83e8d6983549ed56bd7fd023c2481252039207b85236ad849dcacb4805e2efb20092778ae89
SSDEEP 12288:4V+DIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:7Ek962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T188D42341069618E5DC734334C4B390E7F5B87C9AAFA1BA6F9B40A10F4A76B205D3DF1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 581KB
SHA256 4e22c8f3eda4c781508b520ac4fd0bf6ac8e527ddf987d3da092ad8f84f4c46e
MD5 f4f4922145a4d7d264a92721bc05cf00
SHA1 827cee29e73460d6d92f04e0c782eecefd82279d
SHA512 71080bc53d54354df47a195afda3d15d070d343716cb5820d551ab89c2f1b0f809f2557c50cd7b72578cd013ee4a1a953b951b41fb86122d1c888501767ac747
SSDEEP 12288:t2DIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:t2Ek962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T11EC42340445629F5ED220234D563A0E7A8B83C8EAFD1B52B5B81F10F917AF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 581KB
SHA256 9e6f918d6f84788f869b5d2e5760cf31609bd9023515c5ee29b5aa15c1d1d4fe
MD5 854107544dad6e663fbc7f362869e008
SHA1 da376947c497e3f04283d048440a0967124e04c5
SHA512 c1536444f772013c11945f71e0e169629504cdab5f258b5c30c91b8ec592b85e4908a1c754d492201d0e516440109896b9a085ea6c6e02aef1ca5400b2dd38db
SSDEEP 12288:qZDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:qZEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1C4C42340445619F5EE230234D563A0E7A8783C8EAFD1B52B5B81F10F927AF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 581KB
SHA256 73a1069d0b958c94a557c70fc3f9e7318202a314a22afb1387c349c83e388504
MD5 4bded62f6f33625e1b42dcb3ac2727e5
SHA1 9e1958eade35b3add41d86dcba77bae366b9a497
SHA512 de9f410d5d0643ee7f097f237909e6ab1d8d7f7daece184c0c2394c5dd251f059c1f98ba6ca3cf725b3cc119596a40c8f68a21961f925dbb4cec3e7ece300dc1
SSDEEP 12288:01DIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:01Ek962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1F8C4234044561DF5EE230234D563A0E7A8B83C8EAFD1B52B6B81E10F927AF315D1EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 841KB
SHA256 c24e2fce772ed19dbc4858c050c445ac2ab2b340d0d95b412dd9c889296d3cbd
MD5 a47db2d9ccad3275c9eb0d291fc4c834
SHA1 4d2f1b1e6a74a5b1d9dd359b3654170e3c8914d4
SHA512 7109bed4ef4322658184f58f7a32a42797a16e44e186d6b62abb8d47d15ca9e0fd446686ed3c50e38a22043df7fa8beb3eda6132dbe8a153bf06226f9a57c471
SSDEEP 24576:LZMMzFVSOdEk962hZqDfX0Fiz9DV854P7JQEtK:LZMMzfpEkoiZqDfEFiJJ854TJQE0
TLSH
T1AC05F195B3901CF4EC63423EC9668956D6B17C5A0BA0C61F03A4322B5F377A11D3EF5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 581KB
SHA256 da2b87fddf54ef6897923038f6b614b8f097033b14261dd2cad0ac0b52a09081
MD5 52c650b7d644eeaf03b81afa470aac36
SHA1 40cb0706f499103ab00be7634e32dae32e06f5d9
SHA512 008ebbaa42b9e6aa11d72db45a967e933b588d3fd599072291a0783be6d0f73e2f0452acf688bcea73db3b8719e144f0df8b5dbb48920124abe1cc47f1847b0f
SSDEEP 12288:sEDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:sEEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T175C4234144562DF5ED220234D563A0E7A8BC3C8EAFD1B52B9B81E10F913AF315D1EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 581KB
SHA256 515100ad771feaaf903d625ea6c9a1ebd2a2c145fa03b2186b0de809d48caafd
MD5 a7a71fc05e37c47c126c2875ce194629
SHA1 74d7aca52b47d43da25a10968af8bdbccf994d27
SHA512 9272e8be82e033470b09eddfad6f97e345adb5070c0b1370c031d58fa9f95bd11b02b0270fa53b74e0167abf1f7c38d29f5824fa3717bbb0a98c4a9b3de6ff21
SSDEEP 12288:+4DIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:+4Ek962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T160C4234144561DF5EE220234D5A3A0E7A87C3C8EAFD1B52B5B81E10F923AF315E1EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 717KB
SHA256 6adee8136046fc5b9cb4e1b9a58552c93d33b349acc7bef5672a9d56074923dc
MD5 2f746948e76bb045618497f4d472457d
SHA1 00574d0e477f11bded0a7dff3327cf7719a6fb24
SHA512 4d3884cfeee5fd6d769986eac99cd0393a83c9362d1cc4a13516335cd972fcb3fbd60ef4faef1f5d1b0b8b7e296b429c4823c4fd3de64e24676ab0c35f596e20
SSDEEP 12288:oyPz5L8BDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:pzyBEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1AAF4020762A130F9D5334238C8A31952F77578764B609AAF17A0527B2F377A19E3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 581KB
SHA256 3a922a2530e455560d972885a3f263bd43c8682c40f5da394be0ea78b4cfea15
MD5 db0be068183ef38fa1306eae5013b600
SHA1 82cf698bcc1899a8b626b6bb03803b046aa9c18d
SHA512 e0c559ffd91e4a06f6ef3f9534abc48005b52a90a3d24e4221288d8f1a3e369c64dcc96f40b1aae9e800bacee46a761195c401a8694beece3037356a53dca802
SSDEEP 12288:qEDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:qEEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T13AC4234144562DF5ED220234D563A0E7A87C3C8EAFD1B52B9B81E10F913AF315D2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 581KB
SHA256 991b0743430cf3ff44a817136b7c3fa5cce6273f7a3c5bb517ec778d198a2967
MD5 88e5f873ee55655664046f38e36d3549
SHA1 9292e2557bdb2af9e901e3e09fac1e4bb298183e
SHA512 4c32da4e57cd069c622dd96cfabc07625f7586684822f6133b7ae23c69530eb6656103a06ec54f3ae0b4bc2eaa91b8e621fb860a04d2190198ad45a257f80aba
SSDEEP 12288:TEDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:TEEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T137C4234144562DF5ED220234D563A0E7A87C3C8EAFD1B52B9B81E10F913AF315D2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 717KB
SHA256 3b0d41c8ef394a7766de09bc816c0f30a5ea3f25188312fb93f595b7f82aa52c
MD5 181e24c7b2824d2eb66c8b322ef0a96d
SHA1 8f17d79c775bb3c893e561f312211270d257a020
SHA512 991816cfa043569d384a654fe3798c1000fe3cc5e7a0e1c58a8ea08103a2d68437e9f65de017202be59b24c03bf58a628781f1321664a38d8328000cb68f5a70
SSDEEP 12288:ZyPz5L8BDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:YzyBEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T13DF4020762A130F9D5334238C8A31952F77578764B609AAF17A0527B2F377A19E3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 841KB
SHA256 bd96c9a729fe3e37cf8f584d6d7e2f48bf9833d030a5d76da622af5be79c7a50
MD5 8f360658e32e1e9f8900b9185715df0e
SHA1 ad159805d7d36e63c345673e9bad4b2484c5d4ff
SHA512 d9a8f1a2b42dfb705b1b64934ea29e16cb7197dcd6ade43e0272cf3f15a08100cebe21d93b9cd2817c49cdfb2b443819121bf2f0c531b9f84a10a9bce1d63e19
SSDEEP 24576:vT9aLl3z0zDbEk962hZqDfX0Fiz9DV854P7JQEtK:vTQLljaEkoiZqDfEFiJJ854TJQE0
TLSH
T19305F194B3901CF8EC63423EC8668956D6B17C5A0BA0C61F03A4366B5F377611D3EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1020KB
SHA256 5703145ccc2a579eba6a4bcda5a7994c78e0cd7e9bb3af50ee0d554f1459b51e
MD5 4acaf0c1cb5618ed5593104ba3fc40c4
SHA1 915b141563c0028f3991a94a67cb86aa5e9a0334
SHA512 57ea1c9ba2f0a1cdb82ce757f5af60fa9f3bad1b4406ef5aaddeefab15264638528783b637c6c318bb7ee9076e9a25636c0fef5f791e1e0c2ba28ee521ced8f5
SSDEEP 24576:/3td9CHKy7GZHEk962hZqDfX0Fiz9DV854P7JQEtK:Ptd9CHKyapEkoiZqDfEFiJJ854TJQE0
TLSH
T1F325CF90F3E414E8F0B38A35C9765512DAB67C5A1B61DE8F03A4661A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 581KB
SHA256 b0374f6b12c04690fb510361a40b7974e5932e261373a645c3d502003cceacb5
MD5 f18c649297cbbdc4108c01bb5c4d9a8e
SHA1 3ec2f18dd4b591de2b61d932bd1e6d52f250825f
SHA512 340a11d172f72b3a7973aa6a2b9a9422d790646ad0c05f3050391998ccd972b8d853ce8caad66133d109e830973328b1145247483be4200202ccf07fdb9742b4
SSDEEP 12288:GLDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:GLEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1C5C4234044562DF5ED220234D463A0E7A8B83C8EAFD1B52B5B81F10F917AF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 581KB
SHA256 3f326bb0c516a798996bbc49b4880c557f32cfd46e5d3c44f69d95a0abbf7547
MD5 74dfea7af47352b89295373b888a5f94
SHA1 486a66eb30e4d4b0bf013e62dbf986886a65c4fc
SHA512 805128f74000dde8e57132d126a1c451e0980804f0e71bb4ab543e62a643611df60cd9e38bab9be50ec8ddd908040c31fa0b1ed8f70a45c1d2f1650d39c806cb
SSDEEP 12288:ahDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:ahEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1DCC4234044561DF5ED220274D4A390E7A8B83C8EAFD1B92B5B81E10F827EF315D2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 581KB
SHA256 e8eaebc2989a8121c922f3ee1e89f8bfa07fc40177336a70a5f26611f36dbbc5
MD5 4bb64032825bcbbee797b6abf924e226
SHA1 46c03cbbf6b0880a0fe089ede117475fca2b3883
SHA512 e7ac716fab6e50640ec1dad2e99319a59abc7db936c9f02d487cf19b8e0874372eaec402c35bfbe6cee72280294af965e58f230a6645ff2617935649e15d424f
SSDEEP 12288:YSDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:YSEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T184C4234044561DF5ED220234D563A0E7A8B83C8EAFD1B52B9B81E10F917EF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 581KB
SHA256 a3d5c517e4ca4619c5229a443c1d6b77d96691f1b62716fd85ea80e3e5c10add
MD5 c1c64adaa75655c144f5b13a0cd02634
SHA1 4ee0ebfecfd35ef617eae4597d52b3f83d7ecbbd
SHA512 5f1b2bf5fa9ac1e3f3a7b06b654d99d7dea0b58e6b67ef3b5e7dce7e9e2dc235c9dbf88e160949d290545e0c4b358fa8d6ca27626b988c4aff08eaa1723eae6a
SSDEEP 12288:3EDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:3EEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T113C4234044561DF5EE220234D563A0E7A8B83C8EAFD1B52B9B85E10F913EF315D2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 581KB
SHA256 e2976eb150f4a66a99d22fd78a14a03e292cd588073407026d5408ad17e95f29
MD5 88a6c4dab48c057b52b75638af54b166
SHA1 a74b043b8b79c6ee182ba16a777e7eb1402cde05
SHA512 55214dd481a1a7a874ed3994cdc631a344c131c2a2c58108c484b99be2432edad129d7d8260e053f9eb64d8d12d95061c6b2479447a705f07ae7b09d4cecdabb
SSDEEP 12288:NLDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:NLEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T1F3C4234044562DF5ED220234D563A0E7A8B83C8EAFD1B52B5B81F10F917AF315E2EE5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 581KB
SHA256 35b6a2edf50876137bc30027bb6badf0628660858bc91358b932d284c325ef50
MD5 5cf1c2aa0be4fd37a0d61f4a61f14121
SHA1 289fdcdb49d65d816e314da5c90bc3d586adb100
SHA512 cadea64bfb2c738bcb77f5af26c792e37d3a4b3d3657ca4b249118540cb2e801233a761b11e93dbf932418c9dfd03e66dde35b679945e123c9895a19985b0fbb
SSDEEP 12288:2cDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:2cEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T19DC4234044561DF5DE220274D5A3A0E7A8BC3C8EAFD1B52B5B81E10F923AF325D1EE1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 fc7583f68222323e6178bcce16fe48667062001c6ba7d2a6d762630347e305c5
MD5 adf5c50d3128fbebfeeed5a1de8e6677
SHA1 0ed429ea94b23103614c737e6718a4b02c2d194a
SHA512 cc04db1e0baedc9065593588c800686d9241afac12d5c5e236a14f2a87752662317ab2305547227ca996ea8bfe368e2b2973faea425207e4ea6007b0be694a31
SSDEEP 24576:Mfwvok9RX6wkyAIIEk962hZqDfX0Fiz9DV854P7JQEtK:cMnYIIEkoiZqDfEFiJJ854TJQE0
TLSH
T1BE35DF29EBD808E5E177923CD9B3460AF6B178591B31C6CF029A536E0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8ae06803ede6c55edf3e13f0dc2030fc2bf8264b3fd16456abf8125420b36339
MD5 07c747cc6a279d5e4216fe3aa36ec9ae
SHA1 ab271369bdd32dc2c3e6c712e79daa82a6a79e33
SHA512 4871bc966b3079528365d6838b24efa05a78ddc98b0c789cfee7d1254c7264421961f944385a749b376d3d8f902a7777442ed2e6ef73170fa732ada54e4e7b1a
SSDEEP 49152:cYvONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0/EkoiZqDfEFik:0ySzPJousfEkW54NQX
TLSH
T16C066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c3a5372637199f3996f09926cb7f506549e5d292134c367bf2ef5b5ad7b214a4
MD5 1dda31e89220b93de0c259017e24897b
SHA1 3ecb4ede8c31ae1e3ecf242dfcf38c2cbe7b9244
SHA512 88a9f25b4a61c99ab0444c9b11c4974329e496cf4d5027cdf52dbb196421717e99fa8c9c584f3b318e3ccb4b7e4660af62c80ace6bd4673411b63344429d2fd2
SSDEEP 24576:W47Jb1aQZR4LfOrIhnjFN8rnDHU2+fF/AYtEk962hZqDfX0Fiz9DV854P7JQEtK:W47JUQj4irIhCnDHUPfF/PEkoiZqDfEd
TLSH
T19F65AD1DA3EC01E5E1BA827885154A5AEA71782E1F31DACF12B0837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 700KB
SHA256 320ff972bc0e25b820ceee5d7b65fb159a4d7bf145297addf644a06505e1aa82
MD5 9f37fccd68cb8c3a6c4c2e426af99f83
SHA1 b0f9befaf46eded9666dfa1b7c84b85e95085d09
SHA512 75e1bd8110911f1b99f9f44263c802b8188f380afd07ca6f18727de24464f07004e78828508b8e100f5eaefaf2cb65a432aab5f8b0e90ba2749a982747470434
SSDEEP 12288:kGsf0DIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:80Ek962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T196E4F109C29412E8C46E5235C7565682B7773C658BE1E3CB57C0F53E0F7AAA09DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 588KB
SHA256 bc41782d7d830f6681b7a26a9b57d64040dfeb15e633cb4c705c9a3c241b1126
MD5 3b472255c8f6921cf4d976481b877765
SHA1 23cb44e94b53f128e97832f0cfadfd4369d45e1c
SHA512 8ac89670e84bf13ca5a524d443ae10cce64768d053459299e9744e7bd6c6519c4f7e110fb7ce76ebc1e3df6b98dc214beafa1bba8fb9071e0a15cb6ea77dfecb
SSDEEP 12288:3M7MDIk1UuaRN2YvEPxZqDft90FizKMDV85E1hl5E6yOEqbJbfyHtREtKm:MMEk962hZqDfX0Fiz9DV854P7JQEtK
TLSH
T14AD4230141992DE5ED720230D06790B7797C7C999F80F49BAB41A24E913AFA19E3EF1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 4dabcf3c384df3b47aee94c975315b5ce377741d45c4a42be3fdcb5cb6abce5e
MD5 7b4aae35446104c0817fecff70542224
SHA1 620956b633e950a4977c53e6b98e4bf5b1654485
SHA512 69442e07922e1c5725d0525b32232312936eefbc0dab22748226f46c029efb51536413803b25e1aca932ec749eb3d4af69361b8347847c56b4f149ae18df9a7f
SSDEEP 24576:Bgb6bmBIi49WNNFpg1rSvFv7bYaEk962hZqDfX0Fiz9DV854P7JQEtK:Bgb4mBIBhGFtEkoiZqDfEFiJJ854TJQX
TLSH
T18165AE1E22EC02F5E0F6D2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 31559996bf8fb685dab9b12984f9ca9e95a44e091f4735d5bf7abdaf3c5f34c5
MD5 da7c6a539bf5f4d2882f5e22fb40a7a0
SHA1 0f5b1e328a92e231a18a76ec556b801053f04b9c
SHA512 f9a6ace4d5000d6bf3d3d87ad2dcd518521627aebe3327a14f2371e7219554b5644cb66bdaf8d9054f6860515d1e68b58ed56fb6206ca4bbdbad5d6a2eecc601
SSDEEP 24576:pG88u8FpJqH1Wzria7/mdEk962hZqDfX0Fiz9DV854P7JQEtK:87ZFPqVha7/yEkoiZqDfEFiJJ854TJQX
TLSH
T1A335F16566E101F0D877D138C98646A3F6B1B8250360FBDF07A88A561F23BE54B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 f61a072db9c97d0819bd975275e1a7ecd3816dd3c0c8dc967f3b5de1e76f9951
MD5 0e637d37ea184713a7aa6c303363a656
SHA1 f820db43ad3425ff2c27cf07f330ee81dd0e66f8
SHA512 b94381c52e4ce782b0595540497532f067aae48df3913e0c6b6de027e5e1c02a454ddd8280fe37612cb6db6b73e9d40cfe0fb9c9e3ac04f9c813a068533e36a0
SSDEEP 49152:9BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjZEkoiZqDfEFiJJ85V:GG05lO43bSousfEkW54NQX
TLSH
T1A0D5CF6A62EC11F9D1BBC17CD9C6460BEBB23815033556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7ac7a12441122376d39b96ad8c378fdeef3c78d545914102e39d9013affbc72f
MD5 0245646deaad1a59de49237f2628fef1
SHA1 d3b294823c21e649303ddcb67967b495a7d46f2c
SHA512 fd0529a1b30a56fe7e5a53fd8645f83ebea3397638563f7ccf7e3ec4d404b4cf2bfe83d700ae6d247e46b1466d232816c510f9165fdfae9ac295a221d70e2f2e
SSDEEP 24576:tfa5POZ3dpqWVM50JicR2hG0lasx2+47eidn/Ek962hZqDfX0Fiz9DV854P7JQE0:da5POZ39Jt2pasx2+mhEkoiZqDfEFiJC
TLSH
T14665BF5EA6FC01D5D5B9D17CC583861AF5B1342653319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f8af2368fada418f893258653d39bfdbc6a0be914472df6d9dc2a2f4499aa035
MD5 19e7915a12e08567fa1ba81a4f2888a9
SHA1 5a2f997f46291a5b72d1f0ee16de25115f6ebd28
SHA512 3436eed245d7f6d02a1dd64eb880c495b46d93d165dec12fb11e8cc7983ca222bb53726578f70ed629c7e574cee8b648dd553beac15de96c19e47eb3a4f696cf
SSDEEP 49152:QNc/zEOVHFSEkoiZqDfEFiJJ854TJQE0:pIAeousfEkW54NQX
TLSH
T1B6858B1622E901E4F5BBE1BE89779546FA71786917308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e5070bfbd448816e00f04c2ff019f934e308a3aa8ceed852dd92a805a777bacd
MD5 9340e97ba0da02e68ef78c7ab9e367f1
SHA1 f048799983ede716bf0634fc30961a5711651c38
SHA512 d7cf5fc0d82c402cc50c92cf6b50e71ea051a155e2227c271cd1c83dc2b4910d523111f8a38d51cb93bd2a470b0fac48ca7967e003abd1322584497e7fc3ccea
SSDEEP 24576:UtkNvNnaFeYhJNtmZBmTEk962hZqDfX0Fiz9DV854P7JQEtK:UtMwBtOmTEkoiZqDfEFiJJ854TJQE0
TLSH
T1D455AF6EA6B806E4D1FAC6B4CD238512FA727461073293CB5390C13F4E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 804KB
SHA256 289657fbbc3b6bd89c0ab636dcda842c2d5d28ffca79848b6c921d45455f484e
MD5 3151b2a4d97b64e2e70c412335b0674f
SHA1 d5695680566133aab1d929533402b7d8e8e70c29
SHA512 9558a8150ed2c2547d8b110a30446301b26e1b36c2140bf8059553e565213b9ae7f4bb87a159334c556b11d7de0a81782dc61d0e3b59ea1aae3bf13faaf38b3c
SSDEEP 24576:XPUr+NQpEk962hZqDfX0Fiz9DV854P7JQEtK:XJQpEkoiZqDfEFiJJ854TJQE0
TLSH
T1D505E11E22A91CE5E676A17CC582861AF77178621711E2CF02D0817E4F37EE8BD3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 964KB
SHA256 4e922b818f7f3eacaef7e63e4ae93273dfe1c30cda19a29aff6a175caf95ae36
MD5 0a12750604f6d6a75323f9bc23a702f8
SHA1 204feb218f97229ff9621667c88cc46269516638
SHA512 03a0865095b18134a1bbab8755067a75be33a2f92b2ce15e7d7cc415856fdf421120f4d898ec4d87107bd8a771622b0ab92f300aa6db6591dd6c1d1227564aba
SSDEEP 24576:dD3FHshBIYQgAQEk962hZqDfX0Fiz9DV854P7JQEtK:dDVHeBIAAQEkoiZqDfEFiJJ854TJQE0
TLSH
T1DF25E12DE69C04E4E57BC2BCD6638906E67138A9072265DB02D0C1BA5F6BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IndexerVolumeGuid

Path F:\System Volume Information\IndexerVolumeGuid
Size 76B
SHA256 da46a11776bd90f8f1fdad1e0537db7df2f36492d9dd0389f85c00d5f8169f23
MD5 c844d46e095419aa351bc94896284423
SHA1 d101d220fef3b9f481de5ea321b952d033dcd30b
SHA512 f0917b85b73c91d0d6dd7a6f1473e47f897edcfc116d05ea9bf66a8a2052944bf5621b854f37e5bac30ae66b5d64703a931a110553b42e26a925ebb5fa37aa63
TLSH
T10DA0023D1D7E46737D34F4625BE49131B494920310005D7583C694418702C67B5D2D7C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1440-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1440-137-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1440-126-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1440-132-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1440-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2432-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2432-14-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2432-22-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2432-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2636-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2636-322-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2636-94-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2636-88-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2636-297-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2636-323-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3012-280-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3012-72-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/3012-66-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/3012-64-0x0000000140000000-0x00000001400CB000-memory.dmp

Download

memory/3332-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3332-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3332-33-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3332-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3332-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3468-120-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3468-114-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/3468-112-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3468-314-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/3832-38-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3832-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3832-50-0x0000000140000000-0x00000001400D5000-memory.dmp

Download

memory/3832-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4728-296-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4728-82-0x0000000000880000-0x00000000008E7000-memory.dmp

Download

memory/4728-76-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/4728-77-0x0000000000880000-0x00000000008E7000-memory.dmp

Download

memory/4796-0-0x0000000000400000-0x00000000007F4000-memory.dmp

Download

memory/4796-86-0x0000000000400000-0x00000000007F4000-memory.dmp

Download

memory/4796-1-0x00000000035A0000-0x0000000003607000-memory.dmp

Download

memory/4796-6-0x00000000035A0000-0x0000000003607000-memory.dmp

Download

memory/4796-8-0x00000000035A0000-0x0000000003607000-memory.dmp

Download

memory/5084-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5084-318-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5084-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5084-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5296-313-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5296-100-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5296-108-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5296-106-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5296-315-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5296-317-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5456-218-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5456-53-0x0000000140000000-0x00000001400CF000-memory.dmp

Download

memory/5456-54-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5456-60-0x0000000000880000-0x00000000008E0000-memory.dmp

Download