b2148aff8d86bb9eaec1a8378c8072bd51ea6f72be42ece53dd4bcac32f6acee

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 15:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
Size 4.2MB
Sample260731-sgwe7scd65
SHA256 b2148aff8d86bb9eaec1a8378c8072bd51ea6f72be42ece53dd4bcac32f6acee
MD5 02245555ed55d993cc1fb18de9ff9c0b
SHA1 82057e24551a0455c2a64faffc7e44ef76c72092
SHA512 1966737554c49c8d6b3a3dbdd692e85efbcc189ad4ea75f852b72ff22a928e63c2bf80f10d0fc9fb289d9c06c7fd21dd46e9d49c097111da423b4e4b83db1fe0
SSDEEP 49152:Kevd0EkD/ID87+hf3bFOshy9ECwwDpo5luG2H2d5yFP1ixAUF50u/zvs+8d7K6nJ:30Ei0xTQWj
TLSH
T13A168D9263C6606AC11690B7D9507A347FDA583CBB06DEF210992A3F34F3E60B339759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1836	elevation_service.exe
3856	elevation_service.exe
4752	maintenanceservice.exe
3324	OSE.EXE
1400	PerceptionSimulationService.exe
5512	perfhost.exe
5188	ReFsDedupSvc.exe
2160	SensorDataService.exe
4452	ssh-agent.exe
1760	AgentService.exe
2176	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b6d060d75387db0e.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113265\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008d110a54fe20dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd269254fe20dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000333ef195fe20dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006c8d9555fe20dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000002703d454fe20dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e175e454fe20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000a96a353fe20dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000049446357fe20dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1836	elevation_service.exe
1836	elevation_service.exe
1836	elevation_service.exe
1836	elevation_service.exe
1836	elevation_service.exe
1836	elevation_service.exe
1836	elevation_service.exe
3856	elevation_service.exe
3856	elevation_service.exe
3856	elevation_service.exe
3856	elevation_service.exe
3856	elevation_service.exe
3856	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2076	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
Token: SeBackupPrivilege	5188	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5188	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5188	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5188	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5188	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5188	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5188	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5188	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5188	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5188	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1760	AgentService.exe
Token: 33	2176	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2176	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2176	SearchIndexer.exe
Token: SeDebugPrivilege	1836	elevation_service.exe
Token: SeDebugPrivilege	3856	elevation_service.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2076	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
2076	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
2076	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
2076	2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 6136	2176	SearchIndexer.exe	100
PID 2176 wrote to memory of 3488	2176	SearchIndexer.exe	101
PID 2176 wrote to memory of 588	2176	SearchIndexer.exe	102
PID 2176 wrote to memory of 724	2176	SearchIndexer.exe	103
PID 2176 wrote to memory of 2600	2176	SearchIndexer.exe	105
PID 2176 wrote to memory of 1724	2176	SearchIndexer.exe	106
PID 2176 wrote to memory of 3100	2176	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_02245555ed55d993cc1fb18de9ff9c0b_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2076

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3856

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4752

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3324

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1400

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5512

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5188

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2160

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4452

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1760

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6136
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3488
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2900 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:588
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2940 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:724
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2600
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2904 2900 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1724
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2928 2940 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ccc721811a66fcf463998e160da28cfb912a7e16f3231d6dfbe8de3c6f7d9b0b
MD5 13a8889bf70a937f46564cfc88fc2d5b
SHA1 87a3c83a38210125326c1765e311395eb6d0a9c3
SHA512 c27d4c75946b3f80ee6daa8abf8231129ccc8ce53d3fc903ad14ab09a44271e0305fe06e10b5fad59b9ea9c347014de68823796c8debc09c3271fbd1042654eb
SSDEEP 49152:Mb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnY95MdTAcQQfjP+:23q6HjBd0xTQWj
TLSH
T1D2D58D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 1febd82e13e28db20b974eb6dc72f77196468980d6d464676fe891285219b34b
MD5 995ebba7fb39d2e88f12bf3fd33e6243
SHA1 79d481c03f2e3809f667ec81d9dbd98a20d039d4
SHA512 5d57b0827d457049a02a0222a0459dd203f0603bee961436793fa5348e2e8d08767841a1ca1cea59a2265ad8eac72484fe16344c8d50a70fb89afb02b8d417e8
SSDEEP 24576:kXYfDtczADN94AMdTEvcQFuOjOP95Xdt5c:Dtc+95MdTAcQQfjP+
TLSH
T1F665F12877D908F9ED678278CCA18511EA33BC514760E78B03E48A6A1F337D49E7EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 fbab7df083dc5687d366bf6f720969bdd66746c06fee712c63f0ec2f52a5913a
MD5 23b7adf07fa159579ce4a6dd76fe4df0
SHA1 975e336937c6801f973a2ccff8b5bbda77ee1cfd
SHA512 018effdf337caebc096c1800c803ca3b7778fbdb50124b5d1328ce18c0a206ad5e2ec8651440b85e2be5a6cafdf948a7e5025875cf3ce86f89f3bdf8225157a2
SSDEEP 24576:t0Le5ji0hmxirMgN94AMdTEvcQFuOjOP95Xdt5c:tPji0Acb95MdTAcQQfjP+
TLSH
T1E5859E15F6788335D073C0B9C5D2A69EED7230825B308ACB4286D77C6E67AE6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 25721dd1ca51eba62407500652eb359289b1015012dac21708d9aa6b87d6285b
MD5 760ad710717ba4cc38c7eba42741ddf0
SHA1 47cbeb0497f0ee1ff47d9c6bc847fd245334c40e
SHA512 f63d691b6f3a0989b381d57235bee020391e04d0df8dfa6915afcd8561729449fbaefa22249e0b537332002e600e3274c36a9a1b8ef91436a4fda147ac3feaec
SSDEEP 24576:za7/ezSC6vUyD/aqgrvWE6q8wyumN94AMdTEvcQFuOjOP95Xdt5c:e/ezSC6vUzPvxHjyf95MdTAcQQfjP+
TLSH
T18A755C25F5788323D0B2D0BAC5D6AA99FE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e7f6c1b5d2096c29bef35b5277dd13d1bc7bf274dbffcbe426ba780a735246a7
MD5 5159b24868f2037cf1cc5fbbde6376b1
SHA1 c6d508556937fb2e6810e316d42b82f72f7439e6
SHA512 94723f585bee3300da7766fb0374304c34a3373e4c5e7967940df238d2df07555a9ac033953388f74dcb42b49a28635c5703dda086446cb1893bd3a9112abd38
SSDEEP 24576:VVbqPb88hv/l+6nN94AMdTEvcQFuOjOP95Xdt5c:VVO88hXl+E95MdTAcQQfjP+
TLSH
T11D559E66F6748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 35ed24fce7ca31f67b5d8d180178d1243be61506fbc58f6c0d62e387b3dbc068
MD5 77b0f2f17fb5549c2189cb565f05af5f
SHA1 45f593a4e3e5228ed42f03f3ea8b536e63847f35
SHA512 6f94dcfb9c0d70e80005de92223a10f9a61a5e4601141ba7a13c7892194b06522d4a7afcd9cb2d9905a447bb10d37cfa9b50b91335abdcbdb8219bfe7f760964
SSDEEP 12288:PRUqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:PRUN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T18B4523643F8D90BBF3DB1A705CF881686C0A9F518E41964F57D35FAE89389C2D6E102E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 04f69d2aa034d30f3c71ea20044825d2fbc5c40788e2e2bb14a83634f635f63a
MD5 f5677d4aebbb0ec33c68639b71f62fa0
SHA1 f4a7f766de98e3153a46ec4a6c73281e24ee3f63
SHA512 0ff3c2b6cfbb268eb3447e5ea4b460a566b0d611ec65b28485c3fc9b3cda045f0c96f8436b7527dcab05934cab2cab55a4d3171ecb7712f9305d7c730fda1c03
SSDEEP 12288:NeBNUbTVO86UPqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:NJIUPN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T12865CF3BAE28FCE2C27A5DB85A91C240E77278704F52A3CBD165830EDE235D15EB5C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 712e0c788d9c81bb7279a1dde2619a7842ca9f353fd8a0a9e30e36769ab5552e
MD5 219dac1d466983264cec0adba9442e45
SHA1 8f0f0a766e327a4761c50212bbed482ef40ffc94
SHA512 8bcd2ef607ea58041970a42748b133a6cd7b7891ff28f2562be3c643b68ab54a85ddd8b9a96c632a552928112745357ce81aa0c0db9062db35c5afd04ab97274
SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THv:gQvGAdlCEL8c/yRNw5Ce0xTQWj
TLSH
T13B266C656BF880F5E0A7E174897AC5B2F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 cc9ae966e31b0e6e1baa2ec96824dffe8cac4b13f1ed5dd014af13484d7c460d
MD5 3e6df2d0bac817c1432a3a961dd3123f
SHA1 0d8f4d044acde5c009452e57e7173cca466745f5
SHA512 e35a7cc478b3c65d979fa1d9b3f8da38fa43919a7b8d1dd8095ef40ac19cced72e6d4c38528a3f47c26e10c9dc7e464ef5cbfb8a1cf37b9da0fa8b068118fbfc
SSDEEP 24576:ddewsAjdN94AMdTEvcQFuOjOP95Xdt5c:TljL95MdTAcQQfjP+
TLSH
T14C75E031FE74E036C2BB0DB21B75C716582D7A204F511AC3E3E88E9E59342D267B6A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 4ff92331ccad1c7a3c6a9826792f242809fa473e456b623dd7fd6a9a5546b71a
MD5 da664cfbe0872570b2c73e584e58a0f0
SHA1 19ee70be97d8931a60ac65733297d241e1984302
SHA512 6334d768e9caa846cac8d28770ecf72b6feedae101d850142f79f57f9196f630059d40e18d20609566efb3d938e3bc1adb7c3d72afc689add66c4471f9f248de
SSDEEP 196608:mUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHT0RQk:mUEtQevvqc2W1cpV2EI32T0d
TLSH
T1F8474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 24e2ba2881ecf2086dba42ce9e713f432325c6fd59571e86977c5b3bbaf3479e
MD5 4ac29f731453a68477f36228a0a2c180
SHA1 04ac83cff3327542eea60e78d944820c51b3b29e
SHA512 782712447a5de70230a99e4e0c47677453df5bedd68696a74ce9f74402b91a83bdc50d2430d5fbd69ca17348cdb87e513df78204f9188a418fa2a75c4d637235
SSDEEP 49152:yCbRquA/m2yL5zTfFiV+XenmE3/zr95MdTAcQQfjP+:XoquVjnmi0xTQWj
TLSH
T181D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c7a4432ce7e8f0faa9dce3b5edbcab04b7f7e88a17cb95cd08a309e4d74ce91b
MD5 e8ddf6c33060092fc553cbd6c907e687
SHA1 b22de6ba18f8272de5ef78299eac6f4cf56d50c3
SHA512 dbbc77ec05e4d216d14131c6dcea028dd77a960587bde2a6d77c62d4eefad3beeccf726d5102cd4dc95e483b0ea76e4e3533d8338931cc88b2928aef5624a76e
SSDEEP 24576:vAhGLJIFoiwtA5l7S53yN94AMdTEvcQFuOjOP95Xdt5c:vAMyFoiq5S95MdTAcQQfjP+
TLSH
T151359D81EBF955D4F5B3AAB899B68171EA76BCA65E31C20F2150D11F0E33E809D24733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 2b2e6cb2699425060f7ef7e072e2bab6c1c65bc564b23dcb74fd38ad03bac551
MD5 d33b61681d4c9d0b2143febab6024ab5
SHA1 05ee9074321c28f209f9a00eda4e3ec69e56290e
SHA512 4f12a815c438ddd8f941633a6e6f1b36aca18aa77f48286654bdc7d627ef74e499e63a5e72b65758acda5c477f587b1c44b80755254ef36739b2431eb42c8a28
SSDEEP 12288:Fmw5HEjsChNVBFgl0WDm+CGqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJs:gwuoOWJN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T11365F14937990CF9E9A786388597C136FBB2BC022A21D71F17A0C65F5F37361AD29720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 62aa1d5b962c435021b509c324794dfe4eccc56580944b2a1d6d4f317b9ae3e3
MD5 a1958474c73005e681d50fbc78b1905a
SHA1 605f5d2367c5ab1680c4608884e7b3afffcb94ce
SHA512 3ff88778ca92452e4f540a793d98e80e1ed929635457eff88d0a10edb29002715d4c2730fcddb8fbf252c1c3f38ae84b6db7e93c41c47483de8df348af79cf45
SSDEEP 12288:WBZ1IytqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:gZuoN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T18A5512593BD860FAE1A75274CCE48205EB727D525B3243CF136146AE5F32AC29E75332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 81e68818cb84b16b46d09140eb08417cf87a10d9d9d1a1fbc46dc82feb1832f3
MD5 904bf9bcdd0c7c11b913a123570f6911
SHA1 da9d92167a397156e84e81e8bf8709c99c8bf3e3
SHA512 0aac4ecceeeb513fdfed8d065040dbc3d54348f243116088d910977e5d7578a6243c3d42efe5f1fb9d3778f6d80b23bc373a73799ea31b4cd2a4453ff90960e6
SSDEEP 49152:Qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UD:3QRQyi36YOcPQLvw2gAf+PN3Z0xTQWj
TLSH
T187667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 91098905577e892004e9b0a501d5a7d40fdef0d2c8f5b0e612ec88e74c2487b7
MD5 a542ee17532a92fe4ac0c0c769e1a804
SHA1 bcc3bc98c0f98be0d0250f467b56e09c335cfa17
SHA512 edf10484b4eeb92ce609dc40567d7ffafab842a4c043f1376a984b36ccf4e086ba5960bd2b471512faecb63b4d7253b6020673f251c494270eb58e1f12ddcea2
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UD:cQRQyi36YOcPQLvw2gAf+PN3Z0xTQWj
TLSH
T1B6667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 726d1ba044318b52005ce90306cac588bf537d12bb82bfa946eb9c91ec10f48a
MD5 1c983e397050e4f4bddb7ce46b0025be
SHA1 26b03fd9cbf3db84a9b2c4e52b36d1c8ce62e62c
SHA512 d7044a6d3d278585fdb960915743a86bc087511eba9ca1efedc2bb09f43d9280a1555241b3799965d9fdc2377acb6199116f6c5c495fdcfab113be0de592530b
SSDEEP 49152:z68Qg55nhheWu7PNU3/b95MdTAcQQfjP+:tthWRc/b0xTQWj
TLSH
T160B55A33B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0f87b0934815f82d85e2f690bc0499be18619b583217869e3d920918c12ed1c2
MD5 7e5a53626f4271f98c1d555d769c5014
SHA1 4c46e4dafb157ec0494d2762885cf9866da6d390
SHA512 9bd1e25dbf57258759bced0bc01a9d14128147c141cfd2ac5444ee270139d74157154e4129229a525df3a5b68a35ecf7cbc7f0717cae4ff208c68b49aff59e4d
SSDEEP 49152:33aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99t:6y5112gYy5azzVvL69nLKnhZs0xTQWj
TLSH
T11F167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 721c129f6725fa800916f279ed6c429adb9c306e5ab9ca1de2899a6b187e667c
MD5 0452befc9458355c676375e068ca8222
SHA1 52790d1e7aec1e566104a1849654a844b543ef56
SHA512 16a1bdaa849cd67b003b769bba0d7b92d8c48d053def32758870ad83c8d36654defca8bec1694f295f52fc779ce0858cef95b74a90f97d0c04671fc8dca7becb
SSDEEP 49152:oB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glR95MdTAcQQfjP+:iu6JmVxd2dR0xTQWj
TLSH
T1F2D59D13F1DA01E8D06ED478974A9233E962BC490B35B6DF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 85618a89746978f8c734b4ee965b5a4ec8b2c56accb9c3211fb28ceeeb10be5e
MD5 f4af5656062c2991a1f02280a73f15c2
SHA1 ff09a9a6e28d3cf9c7e7c63c3b509b05f1cc2bca
SHA512 1671765630b258e761e91a912aff5ee4a765c9c0bf0db4f50e68cbca4fbf2fb89e7f904f57e9cc139c8358a70bfb3c03b53b5049695012fbc987e9ebf63e2988
SSDEEP 49152:q1hpsNoJpF1A6UU44CwH7R4xF95MdTAcQQfjP+:qmifPbRi0xTQWj
TLSH
T1E0B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 06861e6aed6032a1c75e9a0bf0e25da55097380f46767ec2c4caaa25a13b18bc
MD5 8d6818c5598ddd4177ebe072cbd7086e
SHA1 368383c2deb7fbbff5738653fdb97ffb08b67383
SHA512 2378d25bb7ba33485a95416595970eb2c1acea7e0cbbc797c399d6ad1132c2235179d93ff094045afe2533793da570409bff90b837961fe0445ace1528316981
SSDEEP 49152:sSuZQIY0Be2KRRVtOnks6NMHqI95MdTAcQQfjP+:O5dKTi61I0xTQWj
TLSH
T1CAC5BE13F2E941E8E0BED67487659232EA72BC464B34A6DF064072591E77FE09B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 9d3d7e2c3b91d29879c9f578fad7ad7177fda5264704a11fedbb660abeb3f43f
MD5 910a3eab8e82fe3db4257bc032ff135c
SHA1 bdd490f0a8f29f9d69d6a3e0240ae2982127c1c9
SHA512 56b28b710424d2bc8b96feaf1c68148374941d4b8fe10bcb8bb3311a2b55246ade898a8ed6a54dad0fe9064158d0ba11a76f0a9bec52ebee2d28457700478d2c
SSDEEP 49152:RhtSn8EApI0figngiDn0AP5wB95MdTAcQQfjP+:AX2iyphm0xTQWj
TLSH
T11195BE13F2D900E8D05ED174C7568632EA62BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b5d72bea43cfc866f30838a2d1de522a83fd0ffc3bc66be4c58b8452623bbd76
MD5 379f2f96751f7f7f311ca8d284dcb4bf
SHA1 5b34c69c50251651ecab34608dd3c50a1d5a4e27
SHA512 6caa0985f59816b2f46c8559ec1cedc8cc7d80a6596171106c528cb60d372ed160cf30c56bca1ccf4b61ceae554e962a801b314b55f2aeaf717c8d5770ec6d4d
SSDEEP 12288:g8qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:g8N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1524523543FCE81BFF28656B08CE48168AC0E5F47DF02528F67D74A6E8A359C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 124f182bf5c9bad3e0017878c77c61d1dd6cc0a45bd08eb932198482100098f4
MD5 db6403e19f8340606c1ec3358e0b2f2f
SHA1 a11cefe9f8d8a675f13cb106df32661ae097f5dd
SHA512 7616dda5553400f328a23066e278fb956a3e6244cbbd454cba66a2d404d325fa15f067e2b700c9a84ac61e18d02873c839d3b07d55c2eeff8cc8db34081e456e
SSDEEP 12288:sBqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:sBN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T18F4523643F8E81BFF28655B08CE48168AC0E5F57DF02528F67D74E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 1fba700a99afcbe6b1eeee84661e759c7b5e6631d7370cbd55a4fd26e7ba9698
MD5 fb5adea79f890b677e71306f5fb83ca4
SHA1 0cd1108079f63c2771fa4f0ba60962801a463feb
SHA512 85491dbfe9ceae30b0cd2de382572ca48706ae758bb7cd0aa8bf60570a7c3a07f76e8feb7c8c1d0d93c1c6ae54cee8231e658cebb60309acc32816ff84734291
SSDEEP 12288:fXqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:fXN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1924523543F8F81BFF18659B088E48168AC0E5F47DF02528F67D74A6E8A359C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 f0d7837764db081047bde7999fc1429b55c9f1f800fe16cc9dc050d80015ab40
MD5 0cb051f1265a17fa8fdd93d326bd253c
SHA1 bd38874a067f581a955441934495c40c1c18fcc2
SHA512 ba7b038e891fab7d5ae9272a968185a068f1810c82dd499031cec9ebdda8ee403fd7b5564d5e373a5c016ccf25895dd421713310b4be3c9e8c19d2732b76c600
SSDEEP 12288:wVSqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:PN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1104523543F8E41EAF5A79670C8F48164ED6ABF929F12938F57820E6E0E317C1D9F0069
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 791fc197c7e535fe509963323275d284d9d97047b090fa644204d03b263e3e52
MD5 c30b789b0a159fbd357e77603a216152
SHA1 4d17f0ab5f834f290fbb14c333c79e22141f7b1d
SHA512 37b087a390ca002213a9177849605bceb653939b9af3422243038245283ab35fd07892312bca6e5a8dd072ac5f32c22e59ed420812fee6559fe73fd6b7b50324
SSDEEP 12288:1qqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:1qN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T13A4523543F8E81BFF18655B08CE481A8AC0E5F47DF02528F67D74A6E8E359C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 be6ed85063dcb9056564de212e9cf56cb90cee3f4fff2d65ba56581c9364702e
MD5 8f2868cfb385f4a70441ce5562d2cde6
SHA1 c56c06f478c9cf375e3905350ade95d1799e9c9f
SHA512 90e49456c14aa5de87f4d864135d62af7ec6d35fd2a5a6ec35f3614262222313b81455bfe96c73ee25569513cf0d551b66bd70045205b6af3f2437de9453aacf
SSDEEP 12288:tlqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:tlN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T14E4523643F8E81BFF28755B08CE48168AC0E5F57DF02528F67D74A6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 a0d3c30e08326181765d0b9bb331f363f13230b8080053c7cacde84bf8f5c7e3
MD5 09afc7fa5fcfcc46b5827b1904c10f63
SHA1 24460c0098a7356d6266932657539ca104b7e198
SHA512 965b5e020a95c042a53561be32613f53c655900fcd7740c13b46b4086e348a651b39d5c9a5e2f4eb45ce2db0868911d663a206bd9be0822f110f66da9ee29711
SSDEEP 12288:m5qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:m5N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T12C4523643F8E41BFF28745B088E48178AC0E5F57DF02928F67D74A6E8A359C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 7748af36851d84ff78b30075e4b8146268a07aacb5c1ef7997ee7157595f0933
MD5 a94c15b015f52f80db37995b0a45ad79
SHA1 5662a73a223c506066beeb0a4dffd4d86021bb81
SHA512 9eb094af47421abdf1ebbf2b816773381935a5c1cfe59359c0e286cbefd12b19d99db6888ecf27404f3a5743c72d436c8e60c53a6b49e2fb995f7dc8ce26d8ec
SSDEEP 24576:QZMSzFVSOhN94AMdTEvcQFuOjOP95Xdt5c:QZMSzfz95MdTAcQQfjP+
TLSH
T1E7650294739418F8ECA7813ACC658915D6B27C5A0B60C60F03E4366B5F333E15D7EBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 7e6413f6e0bad0f5f02344155dcfb0eafed7560327574462a1c7784646f8053b
MD5 ea37cf6e6dc264a1c3fd30754f6d72ca
SHA1 18b568ea52c5af49ec4940eb4edd36d2694b7afb
SHA512 4da626d80e1e8e0980f3c4a456585454c7b83985e823271e8abd0e3650fe05f247c4ef2d6662c40548faaa5df0c2df2eda1370477c7335700477dc87854feb2d
SSDEEP 12288:e4qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:e4N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1784523583F8E81BFF28755B088E48168AC0E5F47DF02528F67D74E6E8A359C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 80777f2e1a210b0f09dd070556292a622d907c5ae43afa1ffe5c303dcfb6b693
MD5 98598ea815d5275fed6655645be7739f
SHA1 2e00241d8c00708355ca366de3066ad548830047
SHA512 f578eb8503546ae782a1580da3a0ebb80121bc23b1d499e4f07535e8c0e14f2f51c7d9fbdff1087fd84c138675dd51f51ac199111bb05e503e197d9088ba921c
SSDEEP 12288:HkqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:HkN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T14B4523643F8E81BFF29755B088E48168AC0E5F47DF02528F67D74A6E8A349C2D6E107D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 392a448c2ebbe012bb072c827904c67dd4657417a9b47357677a26d211079232
MD5 22b4c7c837b8ce741cea89f38ac78772
SHA1 784447cabf987cbc2ff9594958f988dc3040230d
SHA512 e15fa6f7344d4c890f6a29d49baab1cc80a67d331229f444a704713a00333779fb9cfc1e6d28abecd9af099058468c9e1d908837d254d9cc71a2a2066a6ca8f1
SSDEEP 12288:yyPz5L8tqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:vzytN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1F35502173B9920FDE1679234C8A14615FB76BD324B208A9F13A0077A1F376D19EBA770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 04bfc21f93021cd5abbf33c25a8df724a5b4a1eda044bf5687d9747959146612
MD5 942b1ee4d6d3284176dad60352a2d047
SHA1 0cc43ac1292203f9b459630d47d604263a68df6e
SHA512 4280e2ef533f39f7415c031b3583fa62a8428389772579ce11848846a4fc8a4fdf6bd3e007e7add975dc5eccf7a4b6052a33cd9102a8a96f43556bb4c6d4cc0d
SSDEEP 12288:94qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:94N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1634523583F8E81BFF28755B088E48168AC0E5F47DF02528F67D74E6E8A359C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f8df8da62054a52b66d1138d8e722a5a12d582e7afdd336aba71b1954e6d3b62
MD5 5427d711037d9c92a9f799f499f1f307
SHA1 760ff52320acf179a36ec8999ea9a19faa4b6245
SHA512 7730ebf8003b054bb4a2ad3b701a6ff5a9f97a3c4cb77d9a04d3bafac0158b7f9c2abd5177738bbef983dac82448fe0b397bc01d23198c00df687b08e878093b
SSDEEP 12288:84qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:84N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1D44523583F8E41BFF28656B088E48168AC0E5F47DF02528F67D74E6E8E359C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 0319a8724fb0439572112ddc2cc0afb269879f2620fbead5fb1facc695c9005e
MD5 1b32da8deb406cda24243cae9ac9a492
SHA1 847dd885d8a54a39022d56e1b928fc672d52a67a
SHA512 d6fd7222a82937bd8d17f28b0dfe495239d6e583e7846904628d7ad2bea4d225d3b84be41203542ac74314d7f559b9f140f6a76712d34463a42f57090a619b33
SSDEEP 12288:pyPz5L8tqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:IzytN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1885502173B9920FDE1679234C8A14615FB76BD324B208A9F13A0077A1F376D19EBA770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 0983d51ab217e2cb213904a60dc0aaf7ce713b15873dd5203b38e5ec8d883ce0
MD5 3241bcead426a4107c5c27286f79304f
SHA1 1a0f5d54dba9e0c5a43cfe6b59b332220ef7b983
SHA512 2fe50c6db5d6027e643f51c143424eb09db2a8129e406e1c94b062fb8d098691dc844d172be4732433c651589ef46f571512e1dfc5b12c3a100739ca8b16fa85
SSDEEP 24576:KTHaLl3z0zDHN94AMdTEvcQFuOjOP95Xdt5c:KT6Llju95MdTAcQQfjP+
TLSH
T1616502A4739418F8ECA7813ACC658516D6B27C5A0B60C60F03F4366B5F333A15D7DBAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 5f25d9247351f049b6a9e9b58dce9ee944920d0b9e5e3d89d43ba76282f8b137
MD5 83db0f418cd05aa422f74cfb523fbdd0
SHA1 73bbe1ad331787b1e362939cf9d79defdf84b8dc
SHA512 7d053a041e0fcac1242af706c490a9fda6613c4eb201c46b7a80c9b1090aeaeefbb21c29ff4e80c774f16bfd4a3964861256f5eedf12948dc6baf6d1591a7b9a
SSDEEP 24576:P37d9CHKy7GZrN94AMdTEvcQFuOjOP95Xdt5c:f7d9CHKyaz95MdTAcQQfjP+
TLSH
T19775CF90F7E810E8F0B79A35CD768511DA767C5A1B21DA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 8ae31dbfce316031faaf89eecae1279f741c509bc21ea6b58df5b7d0b151a3ac
MD5 894b32b701bd7b8087e3f813881fc812
SHA1 f595d5e3485be2d2ab71a4b761346289875e368d
SHA512 298a93b68a3dc06a92c5e9cfc048b8e0b5189a6f6744aa313cc453375e498845ac66ece6c135ecaecc6c77f7bf1dcb517ce5230c10ebfd08146915ee7a23310b
SSDEEP 12288:c3qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:c3N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1224523543F8E81BFF28759B08CE48168AC0E5F47DF02528F67D74A6E8A359C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 0c5636e6df3e5d29cc1307eb98810ef694931bee71914ab0960dc5fe1a548294
MD5 3d5032d8397fbb4bbe63a1e80dd7ebac
SHA1 7ae54938a5a675ae3fb504fc62af873ffc7d13f7
SHA512 6338de0e8cab8ef99e02293e02b28782b6d8007752b826ea67354f83f1ea67c3d4948567760f9eee9734f22e0c68f8811679b0b0926bcad14cf3cebb88a561ee
SSDEEP 12288:eNqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:eNN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1E24523643F8E81BFF19755B088F48168AC0E5F46DF02528F67D74E6E8A389C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 ab8d341afecdc436d78aac72dc399f6589e0e5f04c5ccde9ecb9920b49229eb3
MD5 a4203de9607850267538133b560b96b0
SHA1 0dd775ead9f97c249936b17916fb184e423f8d26
SHA512 5b1030df09ee60c38ae95654523c2c6a4e562cff8f7e0c59d6d7ffca6770b18327ad0faffc0d7d1ec5282b8dd7a91a9aa84098afc97a20047a2d10ebd8c4dc53
SSDEEP 12288:o+qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:o+N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1D64523643F8E41BFF28655B088E48168AC0E5F47DF02528F67D74E6E8E399C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 4b6f534ff31e1c6c96fb9cc49ab44d8c60069150e8fae794aa2afcfaa8654020
MD5 64793bacbcdc856a8957500520fd85b3
SHA1 d74a0a1a4807e6861ed38a6677aa89a012ed8d3a
SHA512 5dff046f2cb814e96464905d75ae0c11f6303eef2b3b1510595b435949859d9ecf36385dbafbe89561c8b252438239501acda3217cc269bda81590ca7ba35825
SSDEEP 12288:i4qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:i4N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1AD4523683F8E41BFF28655B088E48168AC0E5F47DF02528F67D74A6E8E359C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 3837dc14be0053b764753894806f59842d63ce9112513810045c366e62a70ce7
MD5 c5f3d98d3f8cf3b1a12d74f523701b18
SHA1 e41984f510ab98b26a640af9c92dcefae7b29347
SHA512 e3bfc648d8be5295e871f2f503abc7dbd852f2423343d35371d14a0ce1574da1725d84b6cb59b122cfbc96731a53544ca95092c2dad471ca52f19d93031dbee7
SSDEEP 12288:R3qS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:R3N94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1154523543F8E81BFF18659B08CE481A8AC0E5F47DF02528F67D74A6E8E359C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 41017118131d16ffdd2f36c9de548ae66f818068c22038abd3a5499dbed16dd6
MD5 9b6de189126562e742b217611b6f64ec
SHA1 f37f98553e209e4abe2011f7996ab8ec3236993a
SHA512 d14a18c62bd112afdcb3c9be3e52f5d6d0c98043e0282b9e6b2b4e3cb7902f98eb1cd8c636072a00f1cd2fbc1551559cc9b29c28b7f6cf52a10e30c5e395d647
SSDEEP 12288:qQqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:qQN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T19D4523683F8E41BFF28656B08CE48174AC0E5F57DF02528F67D74A6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 7af7f15a79fa5dfe5545fae814ee4367a43d67138666e32f47a0e91cca0268cf
MD5 d444264cecfc187dd32e273d982c4074
SHA1 4f81b9e50a300fb66a1115d42d57fb216ca67d1d
SHA512 042d6d36a1346d71c35d505608460cf25d5bb552df9b8caae43ff1134891232b3cc4a0890a0fdf8da8ec7dd50651a78a139dcaf364e64435e2e1ef20de2b065d
SSDEEP 12288:EqqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:EqN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1B34523543F8E81BFF18659B08CE481B8AC0E5F47DF02528F67D74A6E8A359C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 8091aca706a78b360279c8430d7a3dd1327e76998e889692e422295d22b68e85
MD5 0ff13ab04e1ede14bf2a40209e3f66f1
SHA1 a77bf25cf6025871c781c48f794a840db67e35af
SHA512 f9a0dee0f2c2b5cbe3651f61748e42e421167ca65613981acf1a15c7baadda9c0386e59c3b064926d47930c60f17b4d48bf3cb064ba9c5cfeab9eb36cc1bc082
SSDEEP 12288:8fqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:8fN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T11A4523683F8E41BFF28659B08CE48174AC0E5F46DF42528F67D74E6E8A349C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 79ac8809608c464f61accb0145fc8e4d9459e7b4664917ade61c226a2afb0198
MD5 247bc02faa57a87ff1899dc38f6f9dcc
SHA1 b158323d9ca81bca2e11aa5eeba2ed027ef0d558
SHA512 8893a8b6404aa059a93fb8a536092f326f30e9c24682a6e3cfa40206fbbd013c90fbc68b81109740fce1bbb59eb1bce776490fc318ab9090de2d4a0c7b197408
SSDEEP 12288:kqqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:kqN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1794523543F8E81BFF18659B088E481B8AC0E5F47DF02528F67D74A6E8A359C2D6E106D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 bbc271b0f7bd27445c32e8981f4f05c1b524e57c94279a323a77371c8c7489f8
MD5 5d8515b2f65ac32769fb357519f53d43
SHA1 9af39c1bf4f69d3da7f686aa69e7f9dfda0cae92
SHA512 22b893db9e4337821ef2d3107279ef3f53028bc3868381d547a5261a2a282f0c682e15bb664d9f4db75019d12ef9339d2c29242dd72a2a0abea0dae17e60e75b
SSDEEP 24576:afwvok9RX6wkyAI0N94AMdTEvcQFuOjOP95Xdt5c:mMnYIM95MdTAcQQfjP+
TLSH
T18A85CF29EBDC44E5E1B7923C89B7460AF6B178591B31C2CF129A53AD0E37ED09D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e83c88c4d1a0cc44d1ff6db8f31a65275dcbaf4b9710ac2e01286c6c922e298d
MD5 c51365f33bfef304070b7d0264005bf1
SHA1 dab3d203edb5fe54960b0ef09caaeaebc597780b
SHA512 f4bd086b26fb9b1e26ae855d9170cd1e8f40485c5b645c9034a5a45bfba2ad62c6be96b22daa8a2ee7f133a53b5090623b45f3bbb4767cd23095301f5130865b
SSDEEP 49152:GYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0h95MdTAcQQfjG:4ySzP50xTQWj
TLSH
T1A8067C96A1A801D5C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 31930aebe2f121757a0b0a408843a30d3ce8f2b222122944a617960bd9621912
MD5 6544bd6c913ca9cda0b838f34dc68d50
SHA1 e451f8e767d111504674779fa06fb19a1659dcfc
SHA512 282440dabbb720c69f6fedfacf15878a46016a38b5b31f162deed927acf3f100ac6dc8275d7a0d34ca8393cbf239999695f76407554e92785d2af94775817b28
SSDEEP 24576:h47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYxN94AMdTEvcQFuOjOP95Xdt5c:h47JUQj1irIhCnDHUPfF/R95MdTAcQQq
TLSH
T1F765AE1DA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 2be2ae5207cf9f332a4440498d059180bc5c762ca2883595cd69fa77ded4dcd1
MD5 6e76911c742c27bc9a53bbad78908821
SHA1 d2154de8320e3cff62b582ef6c8459d9359fac9e
SHA512 ed3173ab84eaac2d9698cf393671880bb6b4fea229b063983288da82823a84a32cd4bdc974d86c66bb52645ec7a43309ad57877ff239394757cec3a56be619ea
SSDEEP 12288:TNsfoqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:QoN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T1DE55F119E68802E9D0AE6271CB958640F7277D258BE1D3CB53D1F93E0F366C09EE6613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c80b7b5d4687e8d5f2bef4a39a403ad365a5a803d56ae618159f7374331081d7
MD5 2e6c86825bcd381cc846e015a057160c
SHA1 26c387193c311e437cc536233576429e9a37c491
SHA512 97e3a20d69a70b027ab5641de542333a2677bd10d2e83cc1b40c922e2b1dd1db624d1e5ff15698c10f356eba8e9dbf182d944fda7490605172774426b7e48fe6
SSDEEP 12288:707AqS9hOASLdTQO8zJl/guKLQFuW2qFwuODrdT5wgTJvFv5moa:wAN94AMdTEvcQFuOjOP95Xdt5c
TLSH
T17E4523253F8D956BF1BA56B048E8C1346D0EBF558F0191CFA7824BAE99349C1DEF102E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8c3ae9e8ed8f73eb0465aa6b5aa967fe00fb6af00cf3691b250de443d6796a94
MD5 672f48174755b6eb3bbc0b166f52c8ac
SHA1 b3a2ef3dbeeebdba42a735f770f984f75b88de4a
SHA512 2d798fd1c4f5e6bc7d9d80e09143829fbcef39d4760eef7d1d2facba58099990277060da9070c5a883c278263a0e100aa2b7d423f2b1a487c62d589b0ba8261a
SSDEEP 24576:4gb6bmBIi49WNNFpg1rSvFv7bYmN94AMdTEvcQFuOjOP95Xdt5c:4gb4mBIBhGFX95MdTAcQQfjP+
TLSH
T114659E1E22EC02F5E0FAD2B89DAA4417D6B278160731D2DF1251427D2F3BEE49D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 5afc021fa77094ef9346209cc059920ac6d7769d162fcd79f0590ea980021287
MD5 a4425d4273101239956fdf1b2b1c400d
SHA1 df9ff415ea509a1f7eb89a2502ab11d566cfe940
SHA512 a80d6622bc01ddc97621745e33a42a98dcc315e3b27c30719da6ad4bf5accd1e2da355a9c0cd90d60ad2fdc7680f80117fc234d2951bbde10c2132e3db4f3a2a
SSDEEP 24576:LG88u8FpJqH1bzria7/mhN94AMdTEvcQFuOjOP95Xdt5c:K7ZFPqVea7/295MdTAcQQfjP+
TLSH
T1AD85016577E501F1D47BD13889864663FAB2B8210360EFDF07A88B551F23AE14B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 06a7bd8b3fcc0bd589dcca2c09e0ae73483b7cc47e748e8908232c1ede1b976f
MD5 2a14814f47cb4d3775507b91863494a7
SHA1 d219f6fe69be1f548c629430bcde126357033a2f
SHA512 5e7ad67d6357bf62a12f5522fe2f6d63fc16658c434653bcffa85826fd59f4a988ad08af07ef93ae57562be3d1983d08cbb965ed422c884c901a01cc710f60c2
SSDEEP 24576:lPUr+NQ1N94AMdTEvcQFuOjOP95Xdt5c:lJQz95MdTAcQQfjP+
TLSH
T17A65E12E36DD18E5F676A17C89868219F772B8620712D2CF02E1817E4F37ED4BD39624
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ca4280c06f25be617f5e728022cb2c51951f014e2425227ea1856e13b127be46
MD5 99a013516ebb1a36c83b036e357d4477
SHA1 f7bcbf9ff17c6c4ec6461888c140ad3c2555609b
SHA512 c6bdc5543c1be253ec555e976fc82268390de71716452ba5cfdcbd10aa6ad5520cbadc2f012f561686afb84d91c9cd12653a3d7e92786f84a8de82c414579b5a
SSDEEP 49152:/BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjD95MdTAcQQfjP+:wG05lO43b00xTQWj
TLSH
T134D5CF6E62EC11F9D1BBD17CC9C6860BEBB23815032556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 29b1ca630932c686a4c364a5c01da43c919776366a52c9df32c96d43dbcaf4f8
MD5 6f147ce12d32a56a57ba5bd71b63979f
SHA1 7716c7bd09a4bc6fe7a95a22e71612eef90a0c98
SHA512 ed9ceb67d6a2f36723baaac9080266fa95a4adaabe7e09810414fed679a979ed51d5ab37a44f8a520ab1bf58aad80f89c51b91e05959496a878aba6ec5f78fe7
SSDEEP 24576:pfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnjN94AMdTEvcQFuOjOP95Xdt5c:5a5POZ3+Jt2pasx2+mb95MdTAcQQfjP+
TLSH
T12265AF5DA6EC01D5D5B9D17DC583861AF5B1342253329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6ec6d667cf1f0d392f821a61fe67d07391e269732a346bb2e298882d4c3791b5
MD5 b8c4ca769478ea00624c16b923fe6d6c
SHA1 2b14ce83b62dd62bcb5fbf312f475b66547213cd
SHA512 59880bda16cd9dc7656a6b3fd905b28ba75285f56202194698b53eeeb976a8aacbb969ce483ca7550ef0464630d0bf8a1e4dc9492357213283b60c169ad0c9a0
SSDEEP 24576:xNcwHdjbyQ4nLC18lb/EOjowL7FkpN94AMdTEvcQFuOjOP95Xdt5c:xNc/zEOVHFW95MdTAcQQfjP+
TLSH
T130857B2623E901E4F1BBE1BE89779546FA71786517308ACF0291851F1E73BE45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 e95ef2f9af8749009112f1983e64a104edfd61e16c04677f67739ca1e275f1ed
MD5 59d7a9fc3a7a5b6b50469e7800362ff1
SHA1 999febe13bb19a53883d5d9851c53c5151516057
SHA512 272bc5fd5d30dd774830f78b31576c2f65ed10f1ed7e1b63c421b0f547d6096d7d5d7adbd2c41c5f3329d99ee1ed8ec7462f46b5045191adfb0d920257bb0c79
SSDEEP 24576:D8kNvNnaFeYhJNtmZBmfN94AMdTEvcQFuOjOP95Xdt5c:D8MwBtOmV95MdTAcQQfjP+
TLSH
T18F55AF6E7AA846E4E1FEC6B4CD238512EA727861073293CB5390C13F4E279D89D75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 bbc3694f8f4ca02f6326d9e97eb239d98f5185506b3769e56a8e798d211f7ecc
MD5 7dc6f3b995d0bff9677af1ba8576844a
SHA1 1ff6a2d4753fc0b5a63f241eddc47bf3866bdd7a
SHA512 b5177d03f1015c94b25531d849a32317487f5a218903c8c6b3c88a403ac2bd13cc5b755ba1ebdf92d7e942202b293bc77c432c133e1f8ab6cc39b8ea92d0cb77
SSDEEP 24576:gD3FHshBIYQgAcN94AMdTEvcQFuOjOP95Xdt5c:gDVHeBIAAk95MdTAcQQfjP+
TLSH
T1CF75E17DEB9C00E4E57BD1BCCA638506E77138A9072256CB02D481BA5F6BEE46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1400-72-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1400-66-0x00000000006C0000-0x0000000000720000-memory.dmp

Download

memory/1400-64-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1400-241-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1760-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1760-125-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1760-119-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1760-130-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1760-132-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1836-13-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1836-20-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1836-21-0x0000000000D70000-0x0000000000DD0000-memory.dmp

Download

memory/1836-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1836-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2076-8-0x0000000002880000-0x00000000028E7000-memory.dmp

Download

memory/2076-1-0x0000000002880000-0x00000000028E7000-memory.dmp

Download

memory/2076-249-0x0000000000400000-0x0000000000830000-memory.dmp

Download

memory/2076-98-0x0000000000400000-0x0000000000830000-memory.dmp

Download

memory/2076-0-0x0000000000400000-0x0000000000830000-memory.dmp

Download

memory/2160-360-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2160-357-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2160-99-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2160-92-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2160-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2160-359-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2176-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2176-362-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2176-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3324-54-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3324-60-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/3324-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3324-215-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3856-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3856-158-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3856-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3856-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4452-114-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4452-113-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4452-361-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4452-106-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4752-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4752-45-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/4752-39-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/4752-49-0x0000000001B40000-0x0000000001BA0000-memory.dmp

Download

memory/4752-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5188-86-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5188-346-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5188-79-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5188-80-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5188-373-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5188-375-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5512-327-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5512-76-0x0000000000400000-0x00000000005D6000-memory.dmp

Download