2b46967064a0b54282683f78fb3c77a41c565f13f216ce2c900ccdd128b77e81

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 23:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
Size 1.2MB
Sample260802-3zd9rahf34
SHA256 2b46967064a0b54282683f78fb3c77a41c565f13f216ce2c900ccdd128b77e81
MD5 a0fd2520aa84e386ecc07107013a2665
SHA1 19eeabaad42d400de1acca6819296c8b402480d5
SHA512 5db2097ae481ae7d09d20be85711fe7aaad8ab640216d3566a6cba7b2c7c2331b832e10ee4d2740ce3b0b52a52ffb4cf60727fa93f26fee52e62fa8ede850147
SSDEEP 12288:kxKjIO78itQipnO+E3g6FZ9Ujv88LpenotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:IKjIOQ0E3g6F4k8LUn/P+8s6LvAyr5Q
TLSH
T19C45CF417AA1C431C22117F27DAA9F616469ADEC0B3083C77AD43A7C69772C37A387D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4668	elevation_service.exe
3704	elevation_service.exe
3512	maintenanceservice.exe
3208	OSE.EXE
2808	PerceptionSimulationService.exe
4932	perfhost.exe
5480	ReFsDedupSvc.exe
796	SensorDataService.exe
6124	ssh-agent.exe
3968	AgentService.exe
4968	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\22ae4cfbe05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\java.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008951cfa7da22dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000abd479a7da22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008e0a93a7da22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bebc17a9da22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000008ac76e5da22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4668	elevation_service.exe
4668	elevation_service.exe
4668	elevation_service.exe
4668	elevation_service.exe
4668	elevation_service.exe
4668	elevation_service.exe
4668	elevation_service.exe
3704	elevation_service.exe
3704	elevation_service.exe
3704	elevation_service.exe
3704	elevation_service.exe
3704	elevation_service.exe
3704	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1032	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
Token: SeAssignPrimaryTokenPrivilege	3968	AgentService.exe
Token: SeBackupPrivilege	5480	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5480	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5480	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5480	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5480	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5480	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5480	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5480	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5480	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5480	ReFsDedupSvc.exe
Token: 33	4968	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4968	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4968	SearchIndexer.exe
Token: SeDebugPrivilege	4668	elevation_service.exe
Token: SeDebugPrivilege	3704	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1032	2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 4948	4968	SearchIndexer.exe	100
PID 4968 wrote to memory of 4296	4968	SearchIndexer.exe	101
PID 4968 wrote to memory of 1992	4968	SearchIndexer.exe	102
PID 4968 wrote to memory of 1608	4968	SearchIndexer.exe	103
PID 4968 wrote to memory of 5556	4968	SearchIndexer.exe	105
PID 4968 wrote to memory of 1536	4968	SearchIndexer.exe	106
PID 4968 wrote to memory of 4220	4968	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_a0fd2520aa84e386ecc07107013a2665_darkgate_elex_rhadamanthys_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1032

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4668

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3704

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3512

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3208

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2808

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4932

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5480

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:796

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:6124

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3968

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4948
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4296
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2932 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1992
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2960 2976 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1608
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5556
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2960 2976 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1536
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2932 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9d19af95f80024d0e01c5cb61bcd15b14457c7f25bf301d42a2784ec17808941
MD5 fd930262bf76c364851a4620e4b88307
SHA1 315491a2b05254f2b44a0ea5d9fcef3e0b291416
SHA512 d2e1c82c739a4aedea8004032ffe42dcb34d571c7ea99243978b1deb40b9308907305727168b4d10a2b430727652c34af72d24a758a72df9ddd9c7ee54334735
SSDEEP 49152:gb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnD/P+yk25:K3q6HjBo/2d2
TLSH
T14ED59D03F2D900E9E06ED178D7469132E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 fc6573abb779b97e7b17d7a8d8238d81349f7c2a5db4a09f786c621480ebba85
MD5 e5b59e99726cb3d3bad53491a50e5c60
SHA1 32de73f98042ae807c16e2625b3462ac54b4a29d
SHA512 0fa27e8a9ee5aa918c97c3fa02818448605fa5767b18fa27b836a131b87c342a42e6b2bec04aafaa452cfbef8e0433da18aef4b095bb73fa850e437f6cf25a71
SSDEEP 12288:x1XLsswWkxy2lRq2czAsotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:/XYfDtczAs/P+8s6LvAyr5Q
TLSH
T13D75F12877D509F9ED6B827DC8A28411EA337C5147A0E78B03E4A9791F332D85D3EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 b5d3adb1df93d6863ba479f058f5c6e656cdd1289f1953f3bee53213a2003ce9
MD5 4676e2414a52f39fc6bb6983b95c0230
SHA1 f61d2ac17d0cd20580681692b0cfe20721bfae51
SHA512 ed100f134f47b9fbe053f4c301dac29e3fd6745ad86ab18b2c93ab684c98ec4352edb06da10a5cb1a6966d2573293905cf9774d7c1fe7bb841ac557ceff2d012
SSDEEP 12288:fXZNYVLeyUji0h90ZD0wxpGZIVuFrHsbotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:R0Le5ji0hmxirMb/P+8s6LvAyr5Q
TLSH
T1BE85AE16F6748331D073C0B9C5D2A69AED7234825B308ACB4286D77C7F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 bc3853dfc09fdd9317d205b4485fbae6cc6730ebf5d686c81dc5e74841444a74
MD5 f3773bf86fc1d5e123a87ea0c1b6e157
SHA1 5b54c08b30e6f8066e3014a2b8bf82297f0f97f3
SHA512 cb6b714fcc1a3bb3271da43f9c252c3537e61dc2b1125cd5090f806a51e4b77fea588dab7069c63d13192a167bae6a45c5aade4948b32049f9fcfbb883d401ce
SSDEEP 24576:Ea7/ezSC6vUyD/aqgrvWE6q8wyup/P+8s6LvAyr5Q:z/ezSC6vUzPvxHjyq/P+yk25
TLSH
T10F755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 ff233e5041c27341768949da1d121d10ba7f42c286ecea55f340cf6e42abd28e
MD5 30979f10e14e4f167d2f7cd78d9ac3f8
SHA1 c034548f365f81ed331fe1f37da556851af1978d
SHA512 27bde787c41caec1dc036d934acf9779e151e4fe40f79562c61a8a60ec11934107f0138f536231212866f5ebe13f5c9f9192726d7a9a54aaa6af6d671a6941ce
SSDEEP 12288:uVJjBq33vb5O8M+l1D0hwsEBoW/lx4if0Im984otEoJY4IPiLScDI+RBt6LN+OA5:uVbqPb88hv/l+64/P+8s6LvAyr5Q
TLSH
T11C559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 267ef689027b38f99d48304271aea9b4d7d386ce65446ee826bc67d84f0259b3
MD5 004643b495e9cada49a245f0592950d0
SHA1 9e26220363b869731188808ecdaf9b7819e50280
SHA512 39e36435806807d51c4861380e16c33f5e82d0f3e6d0082d666037bd44f6b30612b94e4a1e885ac2b5c7c510924c01d3fb636c033a85872075faf313fbffd072
SSDEEP 12288:/R3otEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:/R3/P+8s6LvAyr5Q
TLSH
T16B55238A2A890674FB3F42B3746E3470E9036E5049C8954B57BE7D7E6DB3542C8438AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 a65b1f247d10a535f7684065414688c9ff328096232e1481cac24d3d288be00b
MD5 eda530bf27670f41db0a10cf2e7f3703
SHA1 4075f85194039db88f011db39e9f3f266d1c58ac
SHA512 e67979c9f0f5888f7717ae3bc8cb795ab1fdb8a6378a2436141c11449325349eaa96aa720709c5c907c6295193bbafb4309bb54e65eb734f520080c1443ec5d2
SSDEEP 12288:2eBNUbTVO86UQotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:2JIUQ/P+8s6LvAyr5Q
TLSH
T1F875DF3BAE28FCE2C27E8DB95A918600E77278304B51A3CBD175920EDE335E15D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 29b41613739f068759519e5a7c10b2d50958dfe9321c11a0ff5864283b338352
MD5 dad3ab8d41aa1eab0bfcbf9b75539ddc
SHA1 1b19454bb88864fd7e8072d71393cbeaa6fe977c
SHA512 e454d9652cfe37eb539ef515bfa7a754c1580889195449a998914a9d9ec2c2a9794cc45b54e1090feeea64e12d42258c6ed2c90e2ba5afe43b583430da34b338
SSDEEP 49152:6QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH8:6QvGAdlCEL8c/yRNw5C5/2d2
TLSH
T1EE266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 f95763527aa30ebfc0b771db81b1a3374ac23ec0dcdef35f1a94fd375e858354
MD5 7269ca956ccc53adf66a9fc60f7faef3
SHA1 d2cb8586f410c7bfbabc1ff2af6cb521ceded0e6
SHA512 803049170878504e51da68172c79e5919d415461b0dce415c2193e05ecb216c3373b34135bffad193c129d2db496c0a8f612267314f062845d93cf80b512f0ef
SSDEEP 12288:aAwSfxL/2Dc34DLLmt0LDQewsAjGotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:vdewsAjG/P+8s6LvAyr5Q
TLSH
T12675E031FA74D036C77F0DB21B26D716582D7E204B911AC3E3A8AE9E59702D22376E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 16bdce40df512aeb1188cba63e84e56c9a8b64299dd028a7ec2f7a8a0736b548
MD5 cafe0b169c6935869fcef9325ae36d31
SHA1 31ff55948c119b5a80c8180b927c2cb90b1c74ec
SHA512 5cafb820f2617c819229a3dd8b17d653075d0ca68048a30e41fb1e1dfd490c839755fadf62d589c20be4ae7d275f545654d68df8c11a2faf725c459b40a8f8a3
SSDEEP 196608:WUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHO:WUEtQevvqc2W1cpV2EI32O
TLSH
T1DA474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f345a13ae741988d8196754e509b52b8526348e505ecae4ade11febb527a2797
MD5 4a89de4745b28048fca01e6c93fc88a6
SHA1 7e9a0e65622d54d995adeb27cbc8a0cabee36ff0
SHA512 e0b980d6d68d9e4f388211df522460f1eb6ebc5100bc4b712f231a93033d0fe035520c8c5b60113570d7d105651b92e13b5a97a21196c1effa41de3f69f77231
SSDEEP 49152:nCbRquA/m2yL5zifFiV+XenmE3/zm/P+yk25:woqHVjnmd/2d2
TLSH
T155D58D0976B8C2E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ac743fb8454a1b110329d0f50828fd6d05c2b12d1b91ffc60a222895218be463
MD5 532844aca12711efb4565da73e424272
SHA1 447c5df9a470b390292b48e94ffbbc99b1a88c01
SHA512 b8b4b7b41475cac56292445a3415bf242300dd04cdfe02b5ba069891058605c58b33a64709dc0c8e2afdf35f04a710feca539354b89843adf0897e0308d53733
SSDEEP 24576:rAhGLJIFoiwtA5l7S539/P+8s6LvAyr5Q:rAMyFoiq5t/P+yk25
TLSH
T1D935AE81E7F955D4F5B7AAB899B69070EA76BCA55E30C20F2260D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 c4bd3621ccb07732755a5a677c933fa75cc323a7f7b79d01ed7aaceced316271
MD5 391b0592a62502ac4ac25650b69eded0
SHA1 9bfa5b47a25088c225336f33549f6c67b604ce36
SHA512 54abff03532e28831fe856ef517df6201dbc89a3a8b9d566d6ca246824dd5f225a1962244fdc80e7f1c67c75ab0c01d8c1b198d6143e0e997c6fbd965f18048b
SSDEEP 12288:imw5HEjsChNVBFgl0WDm+CJotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:7wuoOWK/P+8s6LvAyr5Q
TLSH
T19365F14A36E50CF9E97B82398557C035F7B2BC012A64D71F1760DA6B6F33351AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 8e1d53b966474e7e9e7cb3340ffa5b656828bead44ed4541af0b1435e8e44c87
MD5 e50872040f1c02fae5a35079a104c2fb
SHA1 4415eac8cc8d54ab246e2f53950eb2ccb70341c1
SHA512 12df3f1f7f7e6f69718af5e385348ccb1fd3eb7475a054932852d4cb773b1e5b58d54ce6a38d50a3c0954a3685b0edea65b1fa3cc88588aa95009db9cd53a527
SSDEEP 12288:oBZ1IyWotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:WZuT/P+8s6LvAyr5Q
TLSH
T11655128A32D421F9E67B427998E65410E7727C5213B443CF13697A7A2F73AC25C36B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 1d08502e95357ad0617b23300c649e33841dbdde66bf05f266d5438f0b4c3c7b
MD5 4901ea7f65fdef6787f3e9308298e933
SHA1 9df238adaa72f67ab8589445f1ecf009672d0d0c
SHA512 0057314881825ee3c855aa66c429d0ea8acbb8276b2613b177a86b685c653006f269a980667ea188b838a25a4e6d0af47d21233133e8b282d0fab7fc9b2d95a0
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UQ:bQRQyi36YOcPQLvw2gAf+PN3k/2d2
TLSH
T141667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2201ea5562d54d5157ae24f66ed882508c09d64f49e27f6539dd29314302fd63
MD5 c86b5fffea868cfc53ac22c69f13bc25
SHA1 4466213457eb6e5bed86a78d30dad3789040311e
SHA512 be769a4b62b92816a6e338463080d63a4310ae1cfe188bb686cc74cad8de434beae0851aff9ca36e6507d820ef7e092e264565c58e9aba7037b865eaf771c992
SSDEEP 49152:Jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UQ:wQRQyi36YOcPQLvw2gAf+PN3k/2d2
TLSH
T171667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e51fce61f8d1c8a044e06b1cf6dea5f863af9f7e32f6fdcc17159df0ef05b833
MD5 42097143f49dd665cd4037611c7f70b5
SHA1 1ec1a43c4dc664fc2aee2ffbff2e4daf44f00fe2
SHA512 22df6bade56dc02b163185ce2b42d7a8df82e64e04eaad53aadc7d7af0939319a4bab079d028260365c0c973889e16a33e5799f3ffec83b8da16c56c8980cd0f
SSDEEP 24576:mwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0D/P+8s6LvAyr5Q:w68Qg55nhheWu7PNU3/2/P+yk25
TLSH
T179B54933B2F200A9C44DE1769F4A873196D27C758FE0E3DB851572161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 067a4821fd62bfd2ad80ae81f11a06788b036e19eed84d748cd58dc30546bfa2
MD5 5849dad576fc716f2a54e491345976af
SHA1 cc77389e2a44786e536a320ec079d853d8b9e3af
SHA512 4df60d8fdba23eac1cad743fa80a4c79ef015e57a125a7cf48eeffa6be99f4226c2e82fe644d7d729f93a01dd457b54cda5204cc652b000d34f525b0dac10bc7
SSDEEP 49152:23aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99O:ny5112gYy5azzVvL69nLKnhZ3/2d2
TLSH
T1F3167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 324ac2e6b61a8eac8ab0e6ebafcd643a29ba20c23b978035187caa2e33fc484a
MD5 d0be5a044971c9d89a2210e7184b8a52
SHA1 946bf14aa37a1ff69c62a269d28aa7b1ace2c9c9
SHA512 89dbe69742309167db700ea52e42b66fa335870fa76e364d928a5b966b3cd935638cfe4beb92dfe089460e82107c452f3ef4fae560b9d2bc9663d65ece744bb2
SSDEEP 49152:lB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glc/P+yk25:Lu6JmVxd2dc/2d2
TLSH
T108D59D13F1DA01E8D06ED578974A9232FA62BC490B34B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 fc9094147a4701698573b68635cf66d93511525e1cd94d14f8539e82b94da136
MD5 a7a28afb9b91852f073e6cb564de0aac
SHA1 da3411f285426ed240f3bc4cd915635d105722f5
SHA512 c6a95092345bb09c3a5ad43592511e60539f187d3b3701596a0d4c98cee9f0f99b087981669a1058a7f1fc8d65a8a611139bdd4a2bb580ccacd5d400a3bf3aca
SSDEEP 49152:91hpsNoJpF1A6UU44CwH7R4xw/P+yk25:9mifPbRd/2d2
TLSH
T182B5BE13F2D901E8D06ED17887569232EA62BC450B34B6DF0A90B7961F7BBE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3769c7888c8f062c8d630c76614edd5bc46dfe2bba4b18abbf97f0f27ecf9beb
MD5 b87e3604897b6089dc5a17529e1dec99
SHA1 2f5320d5d9fa97025e0a1ff9015a9386250b6ca7
SHA512 863c6269be20009bf8e3e96cfddcc97d62264b7b3f19a28c5e72b0608978ce42fb161ce19f187b48eb7c1685cec137e67243166e8d83ff69a8d2cb515f2628ac
SSDEEP 49152:fSuZQIY0Be2KRRVtOnks6NMHqT/P+yk25:l5dKTi61T/2d2
TLSH
T10AC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3784002c6aa2bded64970d7a664321d2ee66de9a83ff6a9f11f2d26df9248ad2
MD5 e179ad238440c7ea9b1c0f3331a92155
SHA1 8fb724cc5aaa40ffab14476a63344670e2d884fa
SHA512 0b77c1638e2b276a16a75c3009053b1b1f8114f6c7ac33ebe8128ebd5e546eced6854219f1d6ea534def4ef85054ae9331f93310ddc276f62f1c31fecd0d5003
SSDEEP 49152:nhtSn8EApI0figngiDn0AP5ws/P+yk25:2X2iyphh/2d2
TLSH
T16D95BE13F2D901E8D06ED178C7468632E962BC150B38A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 ce1fadfa4d47e64f57ac98338eac6d4e2077d2fc839af2870bb5c4ec8cdcdece
MD5 be93958c663b24845bb8372b0095a20b
SHA1 67594fb80af59771c4166e56d8c88acbea768a8e
SHA512 2db733b4bc63abea895b8bbaed72c00ab128e84283bb5d984e359f35dbeb753b29afbafa92b91f03dfefa95749bbf699ac09d80ec39264eac404ed5e1d9951bf
SSDEEP 12288:KPotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:KP/P+8s6LvAyr5Q
TLSH
T19E55238A28CB0675FB3F42F3A45A2060E8066E5596C8514F776E7C3A7FF39525403CE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 3f6aa9377a81278ef236411fa2470158771f4f28d51ab46aaa57c62216923b96
MD5 bb132f8c5d7a5e524a6a5c74cbd7e39f
SHA1 e1beedb2b69ade37a41241fa17da41d86360d8d2
SHA512 e5e708ad88d53bdcba48ddeaf7b60bbb738722663c247063f4d31b17bf2b9f563b560bebb77a88cb8e6ed0ca8229063be6fcdf418c9c3a73de6f1dc5fa8f2093
SSDEEP 12288:NSotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:NS/P+8s6LvAyr5Q
TLSH
T15655238A38CB0675EB3F42F3645A2060E8026E5596C8518F776E7C3A7FF39525803CE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 97764df838f61496a2a782505662ee0544cef4981f5fa3d7e6df9cf337b8a23c
MD5 e54c763cb9a0f58c6e63dea2580b44d1
SHA1 287a3cbaf836a06f15e5c6295a7c9f17243a2f93
SHA512 92257381f1015eadc308f2bdb167c8a3cef119f888de991c1b8043e5980e604fb18be7fb2405723b0e0288ef37563b077de1655881bda822ee9bffd5105c4cb0
SSDEEP 12288:pootEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:po/P+8s6LvAyr5Q
TLSH
T19055238A28CB0675EB3F42F3645B2070E8026E5596C8518F776E7C3A7EF39565803CE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 f4030ffc9a5ea771c50a55d109aafb02881b07b978a47048db38c3e0ea590817
MD5 698282830354d1316b15981d944dceec
SHA1 30fceda6b6ba0883163b937328cda6e2f52ec706
SHA512 9afff68e423e353871fc49b54dcb368ed8bd8cd0877ca1750d8238b3646e4075d4fcf95656683472e33d55041debb4c2986f4631a48879446f19e1545f42735c
SSDEEP 12288:MVdotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:8/P+8s6LvAyr5Q
TLSH
T17455238A36DA01F5EA3FC2B6D4676020E6627D9497A492CF67193C3E1EB37805C13CE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 7cfb0118ef9c82fb0da216aa1686ef7019a0d766e52eb3fba115876b0b4e4c9c
MD5 71206471a9c84a9b38a60145d21d0dde
SHA1 0a57b3940fdeb838d3b60e6acc5a05292c2d6c0d
SHA512 7f06ca19714f4883086034194d3babbfbb773f5e6bd3dc4752c568b4f4c47255efc6c1626b3ff28453c8e37fb461b1d7ebd511ec2a425134b1912df3810f22ea
SSDEEP 12288:WFotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:WF/P+8s6LvAyr5Q
TLSH
T17D55238A38CB0675EB3F42F3645A2070E8026E5596C8518F776E7C3A7EF39565803CE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 886ce145eb41276d5f1f00817dcaf47797177912d45b8a32f6e9ccf1e218411e
MD5 619351e1d8f1fb2f9c9902dc0bfc4286
SHA1 b24fe5bdc01a226b1cfb07ee54d3b3fdeac15008
SHA512 f41af8fd13dc62317f4f47f6139e38a6b7c41afcb54b09d51a7f6bce64d31c27e752215cbd655aeec7094698ad612372bbdd31b7d9f6a87c8da14a99b28bc9a0
SSDEEP 12288:qeotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:qe/P+8s6LvAyr5Q
TLSH
T18C55238A38CB0675EB3F42F3645A2460E8026E5596C8518F776E7C3A7FF39525803CE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 2aa1a014794c4f4bed643dba9870687316a8928a8cacc59219568c8272692705
MD5 4e72398454e1b7287b2a971643317647
SHA1 4e2b63abaa7b1e06f4b90593449389cdf32c73f7
SHA512 08c210dd4d44d6e1b0c8ba601327c4170186bb96480d5f23eeefac82d903ff915dda32dc31832ce6d3b03aba009611738b1ba405304e511b5ff05ee0c9a9f3e8
SSDEEP 12288:66otEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:66/P+8s6LvAyr5Q
TLSH
T14E55238A28CB0635EB3F42F3645A2470E8026E5596D8518F776E7C3A7FF39525803CE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 2b574c538ca32cdb87403f0ab6f810f420afe8742822b40d4d3088840aedc736
MD5 31e389c4faedc872407f18a8108a3f77
SHA1 14643b4c75a186be753bc76ecfa49b2cd39989a2
SHA512 275b56083ebe740b3b94478ba10d8f4bf539fd4fd03661770e11531e519333c20d5cd14e434d589b8e480f59607385d6d2215d440d75eb7edb16ec6eca8d9285
SSDEEP 12288:RiZwb6zzFEoS2cPvyyotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:UZMSzFVSOy/P+8s6LvAyr5Q
TLSH
T14F750295739008F8ED77823EC8559815D6B27C5907A0C61F13B83A2B5F733A11C2EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 9522f28b35500da06d38e2d9c925c0c521d37633ad2b83571da768fa0bc0a7f8
MD5 a8ae3f1fef465beae4c19ef1553f783a
SHA1 1695a7717c75bceb0ce89460a3850c93c9af2645
SHA512 0aa6d68f723f25988221d854b4444671c2b47083512c22a75cc3611bd15c5b109a392d146a01edd9344c398e297d4e0ccae9cb4b97fe58c3fa4d4bf9bbe43e22
SSDEEP 12288:xjotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:xj/P+8s6LvAyr5Q
TLSH
T1BB5523CA38CB0675EB3F42F3645A2460E8026E5596C8518F776E7C3A7EF39465803CE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 56704caab0c658a802e3353255d80c67de82499047055f97487c699e6b443b1d
MD5 850f8324947d57b3176368d69c3f4281
SHA1 364914dec8a9839a920c592fefbf0a77b8a33948
SHA512 7c6a34b9cee6c0ee9e52b185815b4983dc868ee508878033475af00aff468a8d12b579d9a557155b4acea4d06c65ac480fcb58ad72822820247e92814056908c
SSDEEP 12288:QHotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:QH/P+8s6LvAyr5Q
TLSH
T13155238A38CB0675EB3F42F3645A2060E8026F5596C8518F776E7C3A7EF39525803CE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 7a8338ac67b41525c587caa042b2549672d87cb5fa5a6083f7bd9ad85f4051f7
MD5 ec72cdc2e2b34f0b3aafffa063fd80c3
SHA1 3def553a19d7aaaf122459815d3c4fc62a276a00
SHA512 00e61bb381d2547665187f8d084889e4271f27177f1ef255238bd4e1cc1b67766e9caca3b54714aec7363559729f50de36f1d97b4998b89e13659687565a8a0b
SSDEEP 12288:syPz5L8WotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:1zyW/P+8s6LvAyr5Q
TLSH
T12D65124733A521F9D13B8279C8661910F772BC3147648A9F13A83A7A2F736919D3BB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 ea237ee17020c52d32c91c58c949bf72994e7bb43a7c9aa05cfda2a6a7b9229f
MD5 ccbc4cb1e69f739e95b4580c56f7275b
SHA1 5b8c78d474210a3727da12efc1d6a7b18e463c65
SHA512 ada18a2257e4ca3adff0b808a2ed3e02b7ba04b023f11fb95c96813826d8f8d74d51b809fcd3c6910c32c8a02110f104e950783827d3a91e5105b01f71cfcd54
SSDEEP 12288:zjotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:zj/P+8s6LvAyr5Q
TLSH
T11755238A38CB0675EB3F42F3645A2470E8066E5596C8518F776E3C3A7EF39425803CE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 1c60afe39f028932ffe44b370d80340e040030a597029440d67a0935d354a87e
MD5 e9697f724dd8e8efc21efe6ad5e02e13
SHA1 28118e872236aa9f1011ca7fe8fd571cde8bafd8
SHA512 a5673d651b19b50165e53cb36339f38016aa9a5c856ae844aaab39282d6269018b54de9b02e1ea57c963452b7251ef0d912ef8f003c29898675972b70882da59
SSDEEP 12288:JjotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:Jj/P+8s6LvAyr5Q
TLSH
T12055238A38CB0675EB3F42F3645A2470E8066E5596C8518F776E3C3A7EF39425803CE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 3b827fa625dae4e5a0b856ecb3794c8653bef06ae20776731c4998481a8c5043
MD5 b1735e7cf792255e1a379e75a01433ab
SHA1 4fbefd9aea195c4f90c89d0a303586c609955f4c
SHA512 d878adcb63518fa545d974bdac7289c8c46c32056d775da378e4b451721d141ec89e97b7480e55122d8ef678082e148ab88633fd4b8d115aab30e3b2b511c4c0
SSDEEP 12288:ByPz5L8WotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:QzyW/P+8s6LvAyr5Q
TLSH
T14365124733A521F9D13B8279C8661910F772BC3147648A9F13A83A7A2F736919D3BB70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 107706e53584438fb59ba641d92fc6c9f2c8535e359e68390e7c4e4aaaa42667
MD5 2d665f0a12f45c425c38003fea0856fd
SHA1 e18d472488a8877b1b0c0489a8d61f6af99cdeb0
SHA512 287d711c20a3db5a736db7fb4577b588b629f775d1c8d5e0762ebdf987078c41b9dfac9ba5da0ef3edbfb7f152ba101a0d3dfe2ace5007e9d1f4abba976425cd
SSDEEP 12288:8Cd9eWYoaLHF3z0z04PDvhYotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:lTHaLl3z0zDY/P+8s6LvAyr5Q
TLSH
T1B8750295739008F8ED7B817EC8554815D6B27C5A07A0C61F13B83A6B5F733A11C2EFAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 a390e0a92d207302bf890b31707f88d77879f8ac14be26886f9a3f48ea80d0da
MD5 b6b06dc8178196284c50df9a96519cb5
SHA1 d2fc260b91e6430b2bea0f3efa58d83c83c0f974
SHA512 8bacc427b1946af4bcb4a4aff77b4dcbe66942a99e3b5e7a25c902c45a40fe5d36caa158550ff973d804e05e64378ea5f1e27ec48e8b2816c1baa94625d22a4c
SSDEEP 12288:Wi4e7+RdTfgwCHKy7GLbbdIvxotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:W37d9CHKy7GZE/P+8s6LvAyr5Q
TLSH
T1F085CF90F3E414E8F1B78A3589765511DA767C5A1B70DE8F03A8262A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 b48fd41298cf84a408f77c84eace99b6ec5300e955745184f11f90627c646ccb
MD5 3aab06d7f9c971b8871b282094cdb391
SHA1 9184d2a6670e75861921589d1416057570559cce
SHA512 229c50ef49f96c4f81650345544a2516db04844260f5a62d6617580e0860633e74bad7071a1fbff077cdb7314728e08f8200281fc56737da94b9acc143acb066
SSDEEP 12288:bIotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:bI/P+8s6LvAyr5Q
TLSH
T16B55238A38CB0675EB3F42F3645A2060E8026E5596C8518F776E7C3A7FF39565803CE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 97a9354113fadb28d71099cba3cd7c2f885a68e5c32b16a677ba6ab3c4592100
MD5 ecb7c12de6a84688d732659fde62d78a
SHA1 3400a8112111986fe9cfe63ffbd1764a308ee981
SHA512 daeeec63c29887be51fc0311131de8a025368d9ae26a293073e53f0abe8c5079365d409fb6576e32019f6dc26aa6d72c844e18ce82c2e4e0661995f3343179ee
SSDEEP 12288:v2otEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:v2/P+8s6LvAyr5Q
TLSH
T12355238A38D60675FB3F42F3646E2460E8026E5496D8514F77AE3C3A6FF39425803CE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 19362302cc24762d2fdda8929af976d3ca732ccc608ee8a75f87b31b684b4c94
MD5 c9aefd794f322637e0ada665e763064b
SHA1 90ceed73327796974dc3bccaadb611ed4958f6f4
SHA512 f0393eae3246de6319fe6456d9f5003429bc24f5a8f05a7a415a22284cc971cd40be8b4a5ffc219934301eed9d18b04dbbe82fbcb5ac4e0fb46bc382cf3735d9
SSDEEP 12288:8xotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:8x/P+8s6LvAyr5Q
TLSH
T1D355238A38CB0675EB3F42F3645A2470E8026E5596C8518F776E3C3A7EF39465803CE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 db992ad2831d724bde546b942dadb4321112f34234ec817178e4411c05751906
MD5 4d2b93764e6bc2350347a4236fe4d6c4
SHA1 65d6b8dcb90755f56955408dd8b44ed23832f115
SHA512 e331ea5585bf763253d6a20acd828c6bed1a4b85583a007677524e7df0b49029d841c21a7bda6254e32c78c019c49042fafc2dd48626cacffb0474e5d32d1527
SSDEEP 12288:CjotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:Cj/P+8s6LvAyr5Q
TLSH
T15255238A38CB0675EB3F42F3645A2460E8026E5596C8518F77AE7C3A7EF39465403CE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 bb9a566eaa06e71d032c45db3fdf9d9707d3da9a96d1f1a446e723a5898bc0e5
MD5 261a2d68f6bcb74e4573f272180474be
SHA1 70d44dba59abe2117f537145e7a51d6cdd979cc2
SHA512 7cd8f2c2fb9502c170fffae9cd31a29734f8f2a06fdc70478e6df5aab5e727debbbf7c78600dc9f9672944f393dd76da61897aeae4a16db822a3e46020f33f2e
SSDEEP 12288:CIotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:CI/P+8s6LvAyr5Q
TLSH
T13A55238A38CB0675EB3F42F3645A2070E8026E5596C8518F776E7C3A7EF39565803CE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 eb1798bf356a5b6d8f62f7361a3c696080fd2e704469eec9ee798b5de0944ed3
MD5 a8e0c117f98f83875a8bc582a6dbbd4a
SHA1 a4563ecf30d3cf9320a4fae3bbb1c14d82e018e3
SHA512 082908a20a38923a0f11b131155850a0a926fafe4a302f618a17e98b6ce7f41b1ceb6167315f395983b50f1d4f1e1ff66860dd617af5301d85ceb4655d336d34
SSDEEP 12288:OLotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:OL/P+8s6LvAyr5Q
TLSH
T1C955238A38C70679EB3F42F3645A2470E8066E5496C8518F676E7C3A7FF39465403CE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 1700384d578ba912c0f9efbf1d0aed57d160a7c659f4a043df0c0c66500eea16
MD5 116bd3602a7785e92873232fb9c91809
SHA1 f37043a3f2aacaec2d425aa41310e007c9795754
SHA512 8a2e4508c902bc01b7ac4eecf7e1f5d142d43e9e001ed45a3abccf27f5e10661b70025beeeb192b0444816ab5a0813dbbe640da399818fd5b311b6cd0a7236d5
SSDEEP 12288:zFotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:zF/P+8s6LvAyr5Q
TLSH
T14755238A38CB0675EB3F42F3645A2070E8026E5596C8514F776E7C3A7EF39565803CE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 f7af27aa3ba9a04340e1919bda2c009241c874c8029c8303b10ec14c6d682c4a
MD5 7f933bbe532282a67a6666f35d287172
SHA1 2b7a0db74e36df3485088e8dcc305fb5f5e21427
SHA512 c7ec0ddfbff6f53accdfaf02f81cdd1ccd8e1e3d71dbb18773e89e2cccca2730afef670bd33dbfd72576f6546267278855dc503eb95c76bc2e5842d00086daa5
SSDEEP 12288:4gotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:4g/P+8s6LvAyr5Q
TLSH
T13955238A38CB0675EB3F42F3A45A2470E8066E5496C8518F776E7C3A6FF39465403CE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 82e0db0f73c50fef1e3c18980344a48f70dc2a4c4956a471a108c2a83ca7300f
MD5 0f29b3a5b4b3a75047c6848e07025f7c
SHA1 42a397a3db08e0bd9c2afcfbbf8e88b8ebc4af36
SHA512 bcade11f5475db7916be1ee4b01fdb3479051b58ab200b357a19a216d5df8d44c84d0ed4b3a0c80437a686352662afe4cbe2e78b394a594965d33327447ca69b
SSDEEP 12288:+FotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:+F/P+8s6LvAyr5Q
TLSH
T11355238A38CB0675EB3F42F3645A2060E8026E5596C8518F776E7C3A7EF39565803CE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 4dc0f6aaf3eccf4dfce1ca49841f62093915aabac85ee49636f0073ea84dca1d
MD5 8611382525ac9845a821bd6a0772284c
SHA1 0160bee627dbb1183d27f9ba131c64152a0901d8
SHA512 29131b6e5d0dcaa905743f205c8ce424604e560f3dc8edd690f89f68fc91ac4e532a55c2afafda5873bae59bfef5b0fb2458ba3fa69cafc4c452dd3ed50f6c02
SSDEEP 12288:nfwvD5uX64Lk3tRX69qkyAI55otEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:nfwvok9RX6wkyAIX/P+8s6LvAyr5Q
TLSH
T1BD85D029EBDC04E5E177923C99B7460AF6B178691B31C2CF129A636D0E33ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 15b5d302fd058867ed59f4ed25ed5a30a542ced1d750871261e5e8ab13417088
MD5 2eed398111b9d30f9e9e3c8d4868d436
SHA1 d85796a657f82c92928d48cca559aa0ad6c9b086
SHA512 fd9d986f8f1e37d4ee0e8866990c8deb8e9eecfb66d0ad7598eceef3b52391bfe0678be1fbab1e4eba7f14a51d7e60a7156b248a96b5fa6d36c9aaef5e57d33e
SSDEEP 49152:TYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0M/P+yk25:XySzPE/2d2
TLSH
T18B066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d629d5e865d7caa18450e84eb8f8eaeeb426d84816698fc8f2b226ad9760844d
MD5 39cc299360166eadaffdce48b158e4aa
SHA1 c004c5b23ed58b1dc1de95efe4f68e779c75d3e8
SHA512 07a3e1ccf9aeb2904c8638301b7e631a6113d4a69acec24ee4499863268e1e495567f5d5d3d5495e13c6e84167aa387f0b3934e507b8ad28bf26a394ea31cb25
SSDEEP 24576:D47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYC/P+8s6LvAyr5Q:D47JUQj1irIhCnDHUPfF/c/P+yk25
TLSH
T13E65AE1EA3EC01E5E1BA827885154A5AEA71782D1F31CACF2270937D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 f03f0fecc3908f4a91f1a2c12b643515be856f4a77f174e2b1b999cf460b6bdd
MD5 a75ee4db428b8a30bbcd98b7ffba7298
SHA1 0cb4562c67c6c4db0604562315e2d152b8d2f28a
SHA512 2593074b7998e34505dfaf7d5bacddff0e8669ca612f1d12b8fa1661e5782759976a478ec0ab02fb3360c3815f7e0b7d194b5fd70f2b2b19f1f222b0e319e51e
SSDEEP 12288:vNsfTotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:MT/P+8s6LvAyr5Q
TLSH
T1A465014AD29802E8D12E627AC7565940F7337C2587E0D3CB63D0F93E1F766909CEAA53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 6c978fc2d71d5eb27d6a77910de70fc0048a823a6a06fd61910eb3e16d4bfb8d
MD5 1ab0bf5ee7cf73d50f7c43ae5b0d6261
SHA1 1c9dfd90e18bf1fa1945df541f4c78534f5ee9bb
SHA512 0566a31d5d635c8b172720f8215ab302018af39d8865a433740f559a4d9587c18c033f9d0a5cb72347f68bae3064a147887bc6cad03e88efc19bc5343f8a5e4b
SSDEEP 12288:VpDi+SU3fMSdtBnyH4D/54EJZE/7zRV4/7v1PnHcZ3/JI1ST:VpuBUPZt4HW/lJQzUz1PHE3/m1ST
TLSH
T194352800766AD75FC6AD40321E37D2CCA7707D41EE04AB0772C8873F9576669BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 57bf86b931500b662eb893a5544982ebe2f76d1ef153bc198450132c98bda7fd
MD5 7bb1f18f79bbfbb68b9540307db3fd15
SHA1 5733272ec0bc2f2c48de4e7ff81497ba5107ef24
SHA512 c1e9b423f6579530582dbe4f072cc39a273274e4b52ca12a88fda38f34fb60e79a04f6e48dbd02d9000f2b9d26410040974548616411c5a1deb82ab7aa58a5ac
SSDEEP 24576:qNRLLiwCm0Tvi3qaQD/wV/Vau4l8DIyLgPvXM7lib:qNRLLZCm0Tvi3qaQD/wV/Vau4l8DIyLw
TLSH
T1E955D7815537A38FD1FA6032072A5B4CA764EC07B7096F26B3C8553ADC26B25A0FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 da9a8bffe1fe064cd3cd8a3938a47d2ea4fdd3dbdf5d86d260018c3e5ae8a66d
MD5 8a19e66f94476be3154cb83b7e594e82
SHA1 fcfa53d2efb0fbd8dec52f0891c7ca3e4a76617b
SHA512 4294fe119eb87711f1d272ffacd209bc4d182780f4b8d388c8346007a1844dbc15336ba18ffe824c7c4bc45386ea000b561a367fbc01806e40c5d1cd0842cb37
SSDEEP 12288:ez77otEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:M7/P+8s6LvAyr5Q
TLSH
T14355238666CA0A35FA3F42B1646F6030A5077E644B8490CBB75D3D7A7DB39C18C63C9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 e862759ec990268bb209668d8b59cf9cbfcc48bd205468e09a037e8f5200860a
MD5 d41933dcd979a00984dba6ab446ccea6
SHA1 5e25c2dca4d1aba8f2792a22cc8bb0eae08a7e31
SHA512 5dcb0672e76485c54547abed61c1c3b70d1115f20c5bb4328d22c33615e9ab0cc70323ff4cd4eed1e38ed3ef7b15a9f06adab79b6ada00fd92ecc4600976fe93
SSDEEP 24576:3gb6bmBIi49WNNFpg1rSvFv7bYp/P+8s6LvAyr5Q:3gb4mBIBhGFC/P+yk25
TLSH
T11365AE1E22EC02F5E1FAD2B89DAA4417D6B278160731D2DF1251423D2F37EE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 94d2e0883f03a255fa6ded9ac48f7806e455272179d82df2d3f65eda4c556858
MD5 5c272581ec52a0f2793f5c725f16d6ac
SHA1 1953d2e737929c0d2c0b62873dc0b0b918811b48
SHA512 ab7fc03958daf4dd7ac5fbc10e4ca50b946a60d480af109c5ebec1b180f6b2de81e670a58191aaa9bec1add61c522080302e08b75547a11a2fdb47e33c1fa709
SSDEEP 24576:rG88u8FpJqH1bzria7/my/P+8s6LvAyr5Q:q7ZFPqVea7/R/P+yk25
TLSH
T17885F16576E101F0D47BD13889864662F6B2B8250364EBDF07AC9A651F33AE50B3FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 23d4bd2e45b81640fc585a055cfa9e58c50f60c130fea8439f97a6b7ac932aaa
MD5 f96f8f70cc00a0a8215ae7a7ee4e98e2
SHA1 01e5047af0b07b7353c0ba727d58c81a9bc71217
SHA512 16d75269fae57d704d1b4ca13059fe5f9da8f776a514bcdf45f7099702944be480e31bc5da41236323dc26afef25ae76151440e023965cc50a6d079585be810f
SSDEEP 49152:2BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAje/P+yk25:ZG05lO43bf/2d2
TLSH
T100D5CF6E62EC11F9D1BBC17CD9C6460BEBB23815032556CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 4eb072813c79ac18c9609581fb53ff2de35cba5bdf786bbdb5108a32a2463f3f
MD5 93fb95cd9f8f5ae9c56cc7c099c2052e
SHA1 c9d1cbaf626bff00226037112abe61e1879a6bd1
SHA512 f12a3bc1f9c6bd87df217926e5aefcc03e9cd4bb6cdb3d3bc1a6aba201404a2c1016abad11db628fd597a78a226e9efcde9aadfd3317839ff1099c004892ee6f
SSDEEP 24576:Kfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnM/P+8s6LvAyr5Q:Ca5POZ3+Jt2pasx2+m2/P+yk25
TLSH
T15F65AE5EA6FC01D5E579D17DC583861AF5B1382153319ACB022182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 7671b96517694961ac3ad78174da28457aff088948270571ab20fa5b28eb8114
MD5 0839d57c9708827957cd9670800f8083
SHA1 86c9c659841cbb3e93defc62a04b057dbdaf4523
SHA512 fe9bd0a181a273e8f442cd44460063eb869147ba38300901d3a61ebbbd9ca0b8eda785053299e1b4c3a631c52cf1156cd2cb7011e1617cc95540c7ea5a045321
SSDEEP 24576:wNcwHdjbyQ4nLC18lb/EOjowL7Fkq/P+8s6LvAyr5Q:wNc/zEOVHFx/P+yk25
TLSH
T120857B1622E901E4F5BBE1BE897B9546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9413cb3a860da87205f43638f3541275a62b6d0b0ba96f813bb21213159c33ea
MD5 375de455fe19acf9550b4253581c40f4
SHA1 6864d28fd28994e1ca9651d385dab96988c80bd5
SHA512 812e84f5dc2c9cc207bed1510e1ba5799fe5f3091979c5d247b3496528bb8972969a98a66e509c08afd9b4ce954337b9d6b9a39033a1d6efdea0eca31de73fba
SSDEEP 24576:z8kNvNnaFeYhJNtmZBmg/P+8s6LvAyr5Q:z8MwBtOmg/P+yk25
TLSH
T1C655AF6EB6F806E4D1BEC6B58D238512E6727861073293CB5390C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 0161b988861eecb913fdb1fee9b869b86a1e1d921ffd90600a8387d30cbe131d
MD5 5f71035936a9c13a867c66bac2f32045
SHA1 144f9c1c9216fe12de9e8224450b452a8dd08929
SHA512 482509355cf2f68bc0f097b2e8c2a2eb29427a2c5b5ad8ea1a907d40c9f513f910deeb6e93c552f9ae837c76e5d7390191f1b2f096bddf5ae5170440ae6aba16
SSDEEP 12288:yHvUrBFrEjwaQuotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:yPUr+NQu/P+8s6LvAyr5Q
TLSH
T1E365E11F22ED18E5E67AE17D85864618F772B862035192CF02E1917E5F73ED8BC3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 e5308f79afed3873dbed6476e1b483fcf80b20b660f256cdf507893714099372
MD5 6405243f53078adb111b04ed8102989c
SHA1 5a694ccbe282774047af79f7d17ec3f0c98cb696
SHA512 edcf6be700ea49e046faaf761bb43be0a0dd38fe16387b5917cac81f3a3b7a60ebc06faff697086f721d48ca0002814d7c5dec365a3b647b17e51e7f8ec227a7
SSDEEP 12288:uQcMxWDXN1Dp/fshBItT1IQgAvotEoJY4IPiLScDI+RBt6LN+OA12R3b5Q:0D3FHshBIYQgAv/P+8s6LvAyr5Q
TLSH
T11575E17EE69C04E4E57BC1BCD6638906E77138A8032156CB02D491BA1F7BEE46D3AF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/796-366-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/796-99-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/796-368-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/796-365-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/796-105-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/796-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1032-313-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/1032-85-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/1032-6-0x00000000024F0000-0x0000000002556000-memory.dmp

Download

memory/1032-7-0x00000000024F0000-0x0000000002556000-memory.dmp

Download

memory/1032-0-0x0000000000400000-0x000000000053E000-memory.dmp

Download

memory/1032-2-0x00000000024F0000-0x0000000002556000-memory.dmp

Download

memory/1608-382-0x000001A208DB0000-0x000001A20903B000-memory.dmp

Download

memory/2808-293-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2808-63-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/2808-65-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/2808-71-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/3208-59-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3208-52-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3208-53-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3208-241-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3512-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3512-39-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/3512-45-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/3512-49-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/3512-121-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/3704-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3704-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3704-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3704-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3968-126-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3968-137-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3968-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3968-132-0x0000000000BD0000-0x0000000000C30000-memory.dmp

Download

memory/3968-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4668-110-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4668-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4668-14-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4668-20-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4668-22-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4932-76-0x0000000000810000-0x0000000000876000-memory.dmp

Download

memory/4932-81-0x0000000000810000-0x0000000000876000-memory.dmp

Download

memory/4932-75-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4932-308-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/4968-370-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4968-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4968-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4968-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5480-93-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5480-87-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5480-384-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/5480-386-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5480-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5480-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6124-113-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/6124-364-0x0000000000790000-0x0000000000962000-memory.dmp

Download

memory/6124-369-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/6124-111-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/6124-119-0x0000000000E50000-0x0000000000EB0000-memory.dmp

Download

memory/6124-383-0x0000000000790000-0x0000000000962000-memory.dmp

Download

memory/6124-420-0x0000000000790000-0x0000000000962000-memory.dmp

Download