57ed9e075edc92436fa7071cc81e13fd3852c6504296aba0fe82693ddce321ff

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 11:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 1.5MB
Sample260803-m6ssqaxtbw
SHA256 57ed9e075edc92436fa7071cc81e13fd3852c6504296aba0fe82693ddce321ff
MD5 c64efa8a83f9ba5c4fcab026a7363f64
SHA1 aa7749dfbfd5d967a4eb4234fe131ea8833ea3d3
SHA512 9f9b3f8fe0246f751f777f1958ff4f3e4a30a569d51e26c5a050a619da431bf209cd1ef7f1b8ad7e32267049c6b51067229f01652fcc5695f48cd11e7844a79f
SSDEEP 49152:nrxRP9sg+UqVks+JwLNiXicJFFRGNzj3:n3MRVkS7wRGpj3
TLSH
T167756B1277F99179F1F37BB19EB883645A77BC71AE39C50E6280215E09B4A40DA32733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery ransomware spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4644	alg.exe
4628	DiagnosticsHub.StandardCollector.Service.exe
3840	fxssvc.exe
5008	elevation_service.exe
2772	elevation_service.exe
400	maintenanceservice.exe
956	msdtc.exe
2312	OSE.EXE
4880	PerceptionSimulationService.exe
2188	perfhost.exe
4000	locator.exe
1368	SensorDataService.exe
1316	snmptrap.exe
2748	spectrum.exe
1756	ssh-agent.exe
2108	TieringEngineService.exe
4184	AgentService.exe
2112	vds.exe
2452	vssvc.exe
1280	wbengine.exe
2668	WmiApSrv.exe
1256	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\5d8be1fbf77cf242.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83765\java.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83765\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000082e66cf73723dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000236f95f73723dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000099e4aaf73723dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008b80c7f73723dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000044e2c9f73723dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009b2d16f83723dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004b76a0f83723dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002860cbf83723dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000afd378f73723dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000077d197f73723dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5c000000010000000400000000080000190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e56800000001000000000000007e000000010000000800000000c0032f2df8d6011d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331336200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df09000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c9040000000100000010000000cb17e431673ee209fe455793f30afa1c2000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4628	DiagnosticsHub.StandardCollector.Service.exe
4628	DiagnosticsHub.StandardCollector.Service.exe
4628	DiagnosticsHub.StandardCollector.Service.exe
4628	DiagnosticsHub.StandardCollector.Service.exe
4628	DiagnosticsHub.StandardCollector.Service.exe
4628	DiagnosticsHub.StandardCollector.Service.exe
4628	DiagnosticsHub.StandardCollector.Service.exe
5008	elevation_service.exe
5008	elevation_service.exe
5008	elevation_service.exe
5008	elevation_service.exe
5008	elevation_service.exe
5008	elevation_service.exe
5008	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeAuditPrivilege	3840	fxssvc.exe
Token: SeRestorePrivilege	2108	TieringEngineService.exe
Token: SeManageVolumePrivilege	2108	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4184	AgentService.exe
Token: SeBackupPrivilege	2452	vssvc.exe
Token: SeRestorePrivilege	2452	vssvc.exe
Token: SeAuditPrivilege	2452	vssvc.exe
Token: SeBackupPrivilege	1280	wbengine.exe
Token: SeRestorePrivilege	1280	wbengine.exe
Token: SeSecurityPrivilege	1280	wbengine.exe
Token: 33	1256	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1256	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1256	SearchIndexer.exe
Token: SeDebugPrivilege	4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeDebugPrivilege	4628	DiagnosticsHub.StandardCollector.Service.exe
Token: SeDebugPrivilege	5008	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4280	2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 1704	1256	SearchIndexer.exe	111
PID 1256 wrote to memory of 444	1256	SearchIndexer.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_c64efa8a83f9ba5c4fcab026a7363f64_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4280

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4644

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4628

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4908

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3840

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2772

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:400

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:956

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2312

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4880

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2188

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4000

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1368

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1316

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2748

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4220

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2108

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4184

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:2112

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2452

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1280

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2668

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1704
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 998609f56661af35890cc8f159a09fd8a98d2a3c9f8b4524f65ae8b5d754d8ba
MD5 f237df3240619971403f75e3c41627b0
SHA1 f7cf1427e8584390895620ca40154d4de769c188
SHA512 54cd7a3790b084ff65d21ba8159dc3fd3ec7fbeccba9b18ad4f8670b02fb6432fd10c2dcc9ef0c6e6b61f67942a57a4ab74bb975b30f5db6bd10e6ed41a7832e
SSDEEP 49152:Ib+632BuPkFKRrdE6ohdstBhuXjfS4LWxnQLNiXicJFFRGNzj3:i3q6mjBL7wRGpj3
TLSH
T1ABD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 f3489bebdf973a2be4cf654c859efc477c06ab6bd54f4a3d2b40f3ce7e72fdf3
MD5 4041ebcb178104ee3bdcf4164b841e71
SHA1 8137e9bcfa9f544841ebf9dec14b9dfde5c85ea0
SHA512 ce7ad9aadef851a9973f6bd10d1d5665cb6844390037ddd765a98a80071c83609f807c835fcbfbef8fb5cdbae1a651c4f3c56ee5ba4a3cbb855b2a90959479b4
SSDEEP 24576:xXYfDtczAn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UtcKLNiXicJFFRGNzj3
TLSH
T19A75012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 1eced7459a1f6d2c849db84a8ed22416947051089e5e57d0adbb5de9af679842
MD5 5c6950a17ca597300509bbc05e0e2af9
SHA1 12e49d720657afd650608a923de6c78eff126ba9
SHA512 574c8e5fc4d788652918a38b9cde43c8f66c6250ef3e293800141c21acee89cc48f4118712afab1870d9b8462cfa6a53175d11cc4c4cddc51891e30383aa79c7
SSDEEP 24576:j0Le5ji0hmxhrMI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:jPji0Az9LNiXicJFFRGNzj3
TLSH
T1DF859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 a4e9da55c46623434a897d3b3133d3caef771af6a41583e8c1b100cb85cc0073
MD5 cf2d757114ec202cefaab69541d89d4c
SHA1 8388e99f6796f92be02c38a16992e54ad275ad1c
SHA512 cc0b6b89daee96762cc53b69a13ccf614a07d2ace98eeed54730b07497a37bd3f1ea0bf15a9a0b58b85c481306f009b7aa999870073e29dc2454c3f125dca073
SSDEEP 24576:xa7/ezSC6vUyD/aqgrvWj6q8wyu6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:w/ezSC6vUzPv+HjyJLNiXicJFFRGNzj3
TLSH
T1F7756C15F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C636739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 255baa73eac1924599bc626755aa6fbeb74d8b260d4694fe49143672c31c122e
MD5 54e7cfef9bb1b47d85181b674b881986
SHA1 9e24933ca9af8bcf0769f8df7242ea1c419fcb7f
SHA512 7aab27e93165490940e2cdf50ab0751bbb26c2f95f45fd9016f4982622454838e01ffa451025dfd7c792be16003fd1d0925a380c7d77b1406854342906d6f879
SSDEEP 24576:NVbqPb88hv/l+B7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NVO88hXl+dLNiXicJFFRGNzj3
TLSH
T1C3559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ef160b0ec5998f1ff25866e88f7819cdd49cfebb3c7d2477360779e20d8ca339
MD5 b51c63e26bb362082aa19a30f70a8381
SHA1 d58ef3a9928eca4e7cff36491095730cdaaf4917
SHA512 d0701f1adb32f73acc0a562f2ac7b8ecea9d381963c8a39daebc33ce2824acdd0d4e73c5a1320df8ff90b792f37e18428132d3753dd03402899508a076f57a82
SSDEEP 24576:8Gs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:MLNiXicJFFRGNzj3
TLSH
T12A5523D3468854B1FBFD003A867A5828B5885E2CCA555DE2D2543E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 028a8ff909d705d21ce2bdffc81811bbc3fe46a87104a61e2e58eb2b4fe2855f
MD5 7370bfcd64d2ee2e58fdee6d20d89c9c
SHA1 be8035e798fec5944e383f41c413d7b86cbf2e51
SHA512 0659a22bbfc8bfdb20e5b06ed8508842101de0986ac0dfe92eb22a9d96e5e04b1a10025e27d3de63201a17ebe58939d9dfe41110726a3a861b89b9837b248b12
SSDEEP 24576:aJIUz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aJIUzLNiXicJFFRGNzj3
TLSH
T1FE75CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 64c4238b1b30df5c310faa178e732c6711692f6fc7276d1f1bcea4b025eb7b8c
MD5 af8843c162c6ffb71a6d213e5b511012
SHA1 c619c990671195abc4f58052f97d358301531946
SHA512 3aa428acca726e28f88e0a5a10d374582ab411c81b05755099cea5db12966ee92743f4792bb52ed5d317a82b9f1ff0a483425dfdbdd33ad3fbc78985e3c14314
SSDEEP 49152:IQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THn:IQvGAdlCEL8c/WRNw5Cq7wRGpj3
TLSH
T1D0266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 7afcb6bed5fb45318f22eef3d85bbd7984108129a8be5d334ab236f460826480
MD5 c2b22f2ac809de2c1f3aa1389fa55f58
SHA1 6ef33aa3dfafebe99a42f5afd1649036c29da7c1
SHA512 afabee7a0e9335a438ee48269acbb16947e43b1000d8d34d7428d35576798b9c5e4af03f9641de108c029d39346ea646f488bb88a3aaff20b9e84cf5bedf0c60
SSDEEP 24576:RfewsAjt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NljtLNiXicJFFRGNzj3
TLSH
T16875E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 57c36faf62d2f5200dbbe99fefc65bd95d50fcf0d7640af6ae17439a7c03875c
MD5 e9956e0091c6ebcb4292dbe861c7d104
SHA1 f6ab1964bc894908072a27f2f0a1cdd430ae48a4
SHA512 238461e48b9a3bbd2fd85a42bcf78c8c93549666acb97d0faac30dacccb38dfb82f850868dc6457551848e226310d020418599b85a9dfc1a16fa264c0ba48900
SSDEEP 196608:+UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHJF9:+UEtQevvqc2W1cpV20I32P9
TLSH
T1DC474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 e6e6645e2e17cdb751d8856afcd1f212b041eabca1fde583def6729ae76dbdc8
MD5 becfdc0596153d61c216806cc46073fd
SHA1 6cd0c9a8dd3f0532eee0ca338d0fabdc9c8cc4c8
SHA512 fa6145c37a0f2fca182b917ca4bcd66eda37dd84c98891d70c654033122906ae35e6555614f5d67c4fbd66e931bd3c89c86a10b3abdaae3b8da35446215b9545
SSDEEP 49152:3CbRquA/m2yL5zLfFiV+XenmE3/zNLNiXicJFFRGNzj3:goq2Vjnmm7wRGpj3
TLSH
T119D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9d2444cc549be95517a181b9ddfe102a42c1115e1d807a73fce1f52137574c13
MD5 feecf6da443bb8eefb2242c3c79458bf
SHA1 3db0004dd7b11f46390c2bcfe56d839a1f4be884
SHA512 9e19b6a498ecc6feb36078cd8a891d3b3f8aba14d62e106e631e03393a2203c0602892fa1decf0ab9925fdf14d5a9797a8dd21ec1cf0b69901f095b1c09957ac
SSDEEP 24576:wAhGL6IFoiwtA5l7S53G/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:wAM5Foiq5WLNiXicJFFRGNzj3
TLSH
T147359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 a73cbde80791bcc43f81c265655f5afd04e9097752b9ccd209674cfb0edcf604
MD5 fd2bb96260450fdff3ef15a51553ab63
SHA1 92a8070bb345ee132ad78f72ec90850aaf4177d3
SHA512 2c8a47e134129b403ceccb57d20e9dcbbd3b63422587fd89da9290a4603f7253f42638d678f6c22a5126f80c3dc2ae2c8fac62c9a40ac646db7021659b644077
SSDEEP 24576:BwuROWp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BwSOyLNiXicJFFRGNzj3
TLSH
T10065F18672940CF9EABA41398657C035F7F2BC152A21DB1F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 0b70216c56ab1bb3a33a81004505e4239e93d63b1a55d95da589c4daba18a93b
MD5 fe44c9037c93c84181b8aeb8a58887d8
SHA1 7e58425f5691e1f7523e99d56cd73688ac352333
SHA512 e6c204bf53b0cf482a0fd823026f0ea36c5ed4c82baaee217bcef49e905d9f595b4d235f7c8003b8c219c9bc0cbb75b43e0b462a8afe44cda2a1498b316979ec
SSDEEP 24576:SZuA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ALNiXicJFFRGNzj3
TLSH
T1FD55129622C420F5E6BB403DC9F54504E7A17C2A573643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a256020459d9bb6de69189822bc78ad43ba64a3c4335ebabeb1cbba4bfb0806a
MD5 c6ff24c212c8b1f71fe97691b10be708
SHA1 4283c0093212e4726dea94bfc60ab81674903867
SHA512 e178d51973c132b310351961dff09663eb068962fec54d6710e63e2ba5718850fc79228b6e692207793e0c876fe02c123880c676389ddf0dd41bf1a4eaaf4a93
SSDEEP 98304:rQRQyi36YOcPDLvw2gAf+PN3/7wRGpj3:aQyiKanX+PNTF9
TLSH
T1FB667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 54c95c529cdecedeaccc0c93defebc78c31741b5dd4178bd72ab6cd9f686baf7
MD5 a003ca095fe5517bd5c42f2411b32a16
SHA1 8784f3ecd5b196b07a6eb86aef14ae60dc4b83d1
SHA512 88d67dd3310dce839b609e897df4e2b489c85df5e2d1e50239a2b26f30b34c995afa76c2910edb0979ffb3792004cb273dab67e5e37ced7dbd00e4636527cc74
SSDEEP 98304:wQRQyi36YOcPDLvw2gAf+PN3/7wRGpj3:nQyiKanX+PNTF9
TLSH
T1A1667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 15503a8113348ed34b2e79ece539a57d71b2e5db81deaa68f9e07a15f20da3ff
MD5 9b79c161ac72a0530c965757aa6afaae
SHA1 8bba739b51a0cb56b40a0f8753d6b2b9203d5488
SHA512 17e4d3966ca75b811c9cea05c76437a2da22f8db894c397905e29ae1007ac0e5ea5e69a8cd5bc361c9eef839ffbcdac8cbcd772cac41f1dcf058aa9572337a78
SSDEEP 49152:X68Qg55nhkeWu7PNU3/9LNiXicJFFRGNzj3:BthTRc/97wRGpj3
TLSH
T1FCB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 e7a870aa8a6deac74e72a2e144f52931986f9951d31725f0128fc56ab1a9a5f0
MD5 51f7eecd69341d825e45e4ae77ccde2f
SHA1 d4ff73418f7fe2902d01b088228c15fb6f4c67e5
SHA512 c54a75c612e05119e4b7d383190924ed55ade0faa3c60e85fd8bc5215e61278254fd48fa9433673ed298ebd53a1af3b33c4910dd7a8adc9c8c2883172cc7b63f
SSDEEP 98304:Hy5112gYy5azzVvU69nLKnhZs7wRGpj3:aLIHRWhiF9
TLSH
T1E5167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 e1e46d019a35aa9682a3f04ead13497c2bb874ec9c5b31b6ab1f07efe5139c00
MD5 fefa9d044e64df5166fbc622dc3458e9
SHA1 a584d967128c59422fa5ba3cbc81d832e5ef7fb5
SHA512 eaff524053307a09b9c356ed338b6a364f1d25cfa5b940ba90b3ca6475533c28b75f8f63893f755de6df69863ac78c50a2ceb31e075145ffe0f15a0d8ef568b7
SSDEEP 49152:1B+taZ3usBWOBr4tEGa0bqx0z+n217aau1gl3LNiXicJFFRGNzj3:7u6JmIxd2d37wRGpj3
TLSH
T168D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 28e8c1b0a92533ff13fe2e37ed1b4633f49afad9f3e98516697bc071b27afc39
MD5 c16bc0a6b7141017163608529fd42396
SHA1 b7c8c17fe782a789e98c356413525fae090ffbc2
SHA512 7c89e90270549fb42f643d48ad40a75c42c4c5a265169b4500893578ccd2e570a0ce2a0043e71b53dcbcf1f922934b59ce78be1f2c0281254e72262c5e44b5ef
SSDEEP 49152:C1hpsNoJpF1A67U44CwH7R4xTLNiXicJFFRGNzj3:CmifPqRm7wRGpj3
TLSH
T127B5AD13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 35e538e24f7e37dab250e29e57cd4377b2b7f95feb02bd496283ef4505f9ea04
MD5 753602e8117fac12f887486186c88f0f
SHA1 0f4d94c9ff998ef0a5571926a586ddb685e3a309
SHA512 3a39f0ea4f28f10c34f3191079587941391ba422ee5a4ddfc96652001c35da93372c0b3efb0a737055d49b416fcabb9cf21f4bc049318aa6126f4ee294912ed7
SSDEEP 49152:bSuZQIY0Be2KkRVtOnks6NMHqALNiXicJFFRGNzj3:J5dKqi61A7wRGpj3
TLSH
T1AEC5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 08e8dd141326e21db543cbb13fbbea7d07103a70fad3a7e898bf1a5c51e96d02
MD5 8a38894866accab74e89929ac03271a0
SHA1 f76df6ec55ccb3dc330c06921c6af8a4b1fdcd99
SHA512 9a7bda7e0f4260ae1102428d6049c49e28db7d61ab6faf118533b501003fbb90fecaee23df8df70e5667cc79904e516becb7d1da3e82e8c50171958f16b1f572
SSDEEP 49152:ChtSn8EApI0figjgiDn0AP5wnLNiXicJFFRGNzj3:jX2iWphS7wRGpj3
TLSH
T19F95BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 a0eb64f5122fd14e59ca00ed1744e236c142ba394c1b75f8c5abda9cf56a2988
MD5 b6251a03895f9ba653354a68e79f2f07
SHA1 782310303e1f62e4a3111a1844711ad111c496cf
SHA512 61c7ddaaa72bb078699da1099b04347ece9ca7cc09dfbd8f8426686c496e80e15d764391213c38785e3b5296669dcac41ab2ad44135c6a0e0a586a5ed9472220
SSDEEP 12288:DCiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:DE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T13C5523D2548955B1EAFC003AC6755428F5881E2DEB5618E3E2483D1EE278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 3fce52a5573f32e418a08425eff647fb02954affa69443b79b1b37e39c4aa7b6
MD5 0c9e66d796f63b3c18be261a16f90765
SHA1 84f342c94e9dbd565659015158312d1385bb6544
SHA512 6240f83ca1553858d0ad2675d160681c7a635d361b04c1e99705b9bfd3f65da5ec1428fd90b9c368447af38cf70647bbaf5a5ba3c2cc0bb5d1d6edbfc74e9397
SSDEEP 12288:mNiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:mR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T16E5523D3548955B1E7BC003A86754428F5881E2DEB5618E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 42ea28eb65909fd7c3d4c81da29f7824b1ad45941c56a590dd2ea6e3a873f10f
MD5 94dfffa1e6018d8fe2128fb07d86d08f
SHA1 757e62423cee078d2b68f2d6d628a7abf232fe14
SHA512 5ea4d2257476991b5fb81c7b4beb83bdb9c3dfec5306237489275ea04ea869d3cae3334bf7b6af6a4561f3529a83d2dc2f0204db3a1e8c0b6b451c6170c9e028
SSDEEP 12288:J/iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:JL/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1865523D2558955B1E6FC003A86764428F5881E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 f78c0bb6593932d6b6bde4b1041e3977f9149d0495f5059728548177c00f71d6
MD5 24b5ad2af81e5d1bd4086f2ed33e2a91
SHA1 bad4dbcf14f2f568fa3c2ccb2e4b4163ab693482
SHA512 a0f29e3c3dcd017bdf55431f755646d6390b880dccb9742f1617684be4177357ae142d6f6fcc2e608aa38aba7b6961bd5e945b7b93015c9fb029b6cfd0d3e871
SSDEEP 12288:KVciJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:B/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F7552392168901E1E9FD8039C6764424F2A47D6CDB325AEBD3003D1E5A74BDADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 0a9f8840d3dfd3e179e353dbe48c1aec22ccabc491f7ec5e14b07722088e7087
MD5 de97ce8fcb1ce34c15ff2c407810f7ae
SHA1 f676dbb632a125f206017f6ac3333dfa3045ba6d
SHA512 9f2f7af4b4f3b2d3bef4cb5ebe1e30515659bb94258d6fbac2aec54b75c31ddbd22e2e7a3cc13e776abe0a50cf6e21485d46f261c304a0258568f27d5d658b83
SSDEEP 12288:OkiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ou/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AE5523D3558955B1E6FC0039C6764428F5881E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 52512e316468ecfee00ac0cb316582efd968119fba059bfefd27a290d4520e23
MD5 9c1765fd5cf13ad87c7f7f781025acc4
SHA1 df09378a5409f029f1c175d60f19eb5686a844ba
SHA512 a687f8b9621fa4d8e1cb6920107e7ebd9c3ada65ccb64f862f6f0403175e180bf43df6c1c7004d5344afa113e72c1c139700ea5de4c9b7768b350df13c0814cd
SSDEEP 12288:H5iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Hl/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17D5523D3548955B1E7BC003986754428F5882E2DEB5619E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 d806e2b7927c852f99df65990a61034c3be586385694a8da05bf1c69c5df2563
MD5 1a42ed538a0e2136f0d3f4684ce00a9b
SHA1 f7c18bf7566d1dc1777cb82c0c89d337fcebf527
SHA512 5a785d087e347f77cd046abf7b0baa4deae2b5da2e4e225e59d4c41d3560459a1ecacb269517958009823202167fa6daa75cb02dc2a4c3d0fb4012c0b5b37b02
SSDEEP 12288:5ViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:55/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1D95523D3548955B1EBBC003986754428F5882E2DEB5659E3E2083D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 8323ed3632622e9b8a18940fac43081ab1a6e7813d909d3f965d8d27157e570d
MD5 3c1f2f4a1e26d7d90a853559c87f2712
SHA1 41d5df16b46e9c98c996d68926d4a03750dfceab
SHA512 c0b48e8136687a1453a94f0371c9acf2d49e127865b0fb75fee70c7c2a1c4648e4bb7378b1befa368aca8757f7e7c781850eb15d9ac9c2da951b37e83bba3593
SSDEEP 24576:PZM3zFVSOx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:PZM3zfVLNiXicJFFRGNzj3
TLSH
T10A750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f120be5b110652ddc52c0601589bd2773d23d1aeab309eec683e6d0a1aaa34a7
MD5 a60ee60d0eaffc0c3ea016d6d4046ff4
SHA1 1a889813bea59a04c8b78999d3a5686725eed0df
SHA512 f8d4408dabafbc630a5009ba8a18fbd021c323e03b0b4c98b99e3e6149078c1d30edc8c5476daae95786572a4c050b24c6e782cd380b51ca75ee0fa5ec18f301
SSDEEP 12288:DGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Dw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1095523D3548955B1EBFC003986764428F5885E2DEB5619E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 2a6eb86eb665a41e06bc11ea9a7fd33e8fc80f49714c603757d1aaea30a9d751
MD5 4a35245525198088565eaf8a0e0a39b1
SHA1 51e6158f3c08d1a887a73b075eed1809b961e8cd
SHA512 3a89367d49a32609ab1a5f3e8022763ec97e1aa01994af256cc084b0fd38e89a9c4fc63e70a120f59bb90e41650548f9ae2560eaf0893defbda146a7b9f3ba8c
SSDEEP 12288:/6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/c/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EB5523D3548955B1EBBC003986754428F5886E2DEB5619E3E2083D1EE27CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 9589084e59cdd2cc78325529dc6911d6efb90bfe9a52e9f0c04854ae03fc68eb
MD5 1bf2f89e286943498ea734b3354a2cb5
SHA1 cb8b610093ea4c3935cf4ee355139761518c84a4
SHA512 3a11356e33bcff9c99183bd68da1d5d8056ce26c1e2b055420a59b783193e0d4a82944fd5e518d357efd9aa6e3361c88922434a477f7c56d907c5c04aeec7e97
SSDEEP 24576:6zyd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6SLNiXicJFFRGNzj3
TLSH
T1BC650247629530F9D17A8139C9620911F3B57C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 fda2ba65f72b88f194c8d68ef52a9e65415474e8fa90fcc9f9081091c960d050
MD5 1cef8c232ebada40d1b1dc21a6d93d36
SHA1 3fb021e9bb99020504fd63235fa61a49eac3141e
SHA512 a7769318113bc22792137d173fae6690c5ce888b4a717e5f08f2c2d5dfd13f6f19086dfc73e69ffa69f96c4b3e50c01755f53ac934c2b7577a8df939ae361212
SSDEEP 12288:tGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:tw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CD5523D3558955B1EBFC003986764428F5881E2DEB5619E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 55eaa890cae31d7068a0594ea76251bc37cd7a545150860859332b6b1b559722
MD5 2d712580c1ccd660ce9e8b04d11825de
SHA1 80a6025174b4ef5f1fb7711030260521b66cf415
SHA512 dcbf1a9e953c645012f26c7d7d08dcc2e1b9e2b29ca9392dc9f1f67b083fcb6e18eb3366af71a354cb95c9ec930618ab028a24825d5e180e76f9f1269cce2f47
SSDEEP 12288:yGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:yw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B75523D3558955B1EBFC003A86754428F5881E2DEB5619E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 af467f19f73b4f77f498ff1748c8316a799e1b1b0b2e3313fb08f1a64a73a31a
MD5 ec06c972fb17dbc8c87ccce9aad1e89c
SHA1 d74d25823a7c41289fd13a740e1b8b1db80517c7
SHA512 124b80edbb82ad26b7a6092a1c2aef9e58cca8e301e1f2d87f378fd26162282fdd7aab9c6b2eea3ec5582ef3cd3a596e81bddcd5e4e5062c77d7a2b9dc89e4c4
SSDEEP 24576:Ezyd/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ESLNiXicJFFRGNzj3
TLSH
T14A650247629530F9D17A8139C9620911F3B57C3647208AEF53642A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 cb0dd4521eaea2d96187a0fce6bb0b12936d9067332e5be3aa0f21e9de2cf530
MD5 9b984bad6c7cabc7634d6478107a8bb4
SHA1 2efa0e3afe9a92c8ed5076f7391553805f107d37
SHA512 ad6ff76d07a509ef0528a57dbc50adf9c0d83d37d5821d5a9bab3a859e80a0791434d66f7869501ba8811610e50af1b8af1fd2cb0587e9a5225fc881efbcde46
SSDEEP 24576:9cP4mcvIjkGOxhKP2l71nNKbrh/8KBY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:CP4m4IpOO67W8KqLNiXicJFFRGNzj3
TLSH
T19A65AE2DABDC0096D0BA913885658A49FAB1742E1F3286CB1160A33D7F77EE54F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 ddbd08bf49501f33a63f6b8e103f3f9c6b434d8d85ac50cfe188f60d63eb94b8
MD5 56e48dc10825b1f0293aa829873c86cb
SHA1 e745735bdb8647d52006db8bc547d2c7a81b002d
SHA512 cadf8e14225997661cbc0976914f034f8b2c5bfa8b43ba5b9f21c805b9040e7866732b72386ed8fd83721bf9a3c0b08d68ec33352b57479c749cb9f1d85d7711
SSDEEP 12288:Ypsf2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ZA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1FA65F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F3AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 350B
SHA256 44ce18f7fff58ace779ea2f0f80f8e73d4139786e1eb39c5dbe0ebb149a429ab
MD5 25f75f8624b8408bad2b64dda1f3a85a
SHA1 871700625afed75ad91b1a3155fb5b4bc71a6a5b
SHA512 eb9dd4d28db0b7d7a1f5b1f6dddb6c340a8e4b6a6ab2461f0aa25a03cb5cf2c1783e7497c48506dcf97417b5b2f443724999f524daba0595567b787e4da9670a
TLSH
T13BE08C4316D51614F9B31F05DFF8807297237CD2981ED16C50E4030F1EE0604E6627B3
MD5 SHA1 SHA512 TLSH

Submit Download

ArmReport.ini

Path C:\ProgramData\Adobe\ARM\ArmReport.ini
Size 782B
SHA256 d07699f0b523af43c79955dcde796f50f6b2b9289772c4442f05d28d6e8b1866
MD5 bce1e1c2b37b73deb297cfe4dbf2d0c1
SHA1 518a3e71b8f11ac19dc9ffc1f18d1cdace958475
SHA512 613113e8a7829106282c4e37f21fff99ee40be329af1f5d23ed77ff07a3d94059893443abf5a02ee1ec8c21c3b5379e4be1331d556d6c007c97ef3b18287b820
TLSH
T1A301BC831AE91120F1B21F44DFF9907357333CA35C2CC86C90D8420E89E1A80D5B2BBB
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 185KB
SHA256 fd8fa0a723aad8c6f74e05662bb3962a11f16acb13195cf73ea330100a90144e
MD5 02a2c53bd88849d635e985274c7ca2ef
SHA1 b229a28dfaf7fd1cd5fda4c9cab5828027d509ce
SHA512 e656eb3fe2a436d4cfb5cdaa2de1a5af18acb53e28b74f5f67ac44d95766c42827042da5ea800b67d271452a3151df14f9c5e4a1aeb7a8f6ac0be638b517b78b
SSDEEP 3072:hT4DJA0CXkQqSmSgojgTaDuK1+4xKtaU/Q+QPYtY7FMPFTMNropXY:SJYS0
TLSH
T19104D44363FC1209F6F37B41AEB852A44B77BDA1AE3EC15D1685015E48F0A90DA72B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 ac37177971336182c1188766c4f86e83332d0ab5dbb42d3fffe486cd36272bfe
MD5 3c024dfbc4eb5b105afbbed55f40cf33
SHA1 ec259010023b2efd7345f034eb8efd1ed0f2b74a
SHA512 32f1cdfbf0d63aee06be0f379da2dce26781f8e1f424295dea8e5c00eaf8447cba6578f23822e0c7679153d5d527efccf291ac24c63c85c432985dc69268c765
SSDEEP 12288:nWiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ng/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T166552393928C55A2F6FD103986398438B54D7E2C9F5598D3E2043A5EA138FEBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 e379253c3a2c5df669c20ca091543ac83c250262380a90a85f98511720377745
MD5 9971b8102ddee99946af1c71f7cfef41
SHA1 5fe8aaffeaa9d801f5ad21b091cb2f1bb7de8db2
SHA512 2585a84cd33f547b546cfd099c0b0878261d8eccbb2da3475f107abfe3b09654ab5f3d1a2bc30eb5192c1462b4f3c83168e2e68b364faec297dd7a690af75c40
SSDEEP 49152:ma0h2GEkuAe73q3pp46zwwQuLNiXicJFFRGNzj3:ma0hNYG4Jw17wRGpj3
TLSH
T19D85AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 d62563c9ddf408cad52d44b23a607e48c61a81c7260fe0a9735e449094215f26
MD5 b593c9b60a623e3cadf6cd16fbd47c69
SHA1 fb6ddc33a9449d182916021b945e079a2713e500
SHA512 c6d3f7692b725991dd269d4c5af88c84b2c1162c86b8446006aeab5d4020ea4ef2ea0125e075f45f9daf3acc4ad7b2316b93a2c81aefc4fb7470a9dc1186687a
SSDEEP 24576:9hbHjPh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9hbHj5LNiXicJFFRGNzj3
TLSH
T1E45512BE129C20E5F6B5903D85668409E370BC29172193EF6381527E4F3BFE94E38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 b97472e503181cee7f9fc36551e85741fff3eaf27047b5f2551c31e355bd4dfc
MD5 15df3fd645ad90e77215639d3fcc2bfb
SHA1 c58f0520ae48aa2e923f171ace2b93318c818fb2
SHA512 da6f8b5ccd2f3da367351d16687b7216f42c774c8f3b6552b3a2a322c275b65a36b4461c930856d2dc4f0678bc02857d4f89ac7a2394670a9b847cb365b899de
SSDEEP 24576:A3YgnJcRTk4yti+R5dBR/p/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:AIgnaTk46pBR/pLNiXicJFFRGNzj3
TLSH
T13445B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE89F39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 4071885002581f94fc890318dc684b0ceb6542c325b311c8da23f2802967a041
MD5 af9e9ceacb36bf8a4f8f5bb30f4c2854
SHA1 ca5211dc56ffd24907d790a6ea45ebd648fe066b
SHA512 1121b5e4ba91ed9268829ad5bba4621a54972208a20b153215d1b8e5daeff07890642d60e1a98493a258b85fd0bbe53f3e35aa15ebde12cd8cfba11eaec2a11b
SSDEEP 12288:cKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:cM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1505523D2518955B1EAFD003D867A4428B5882F2C9B2619E3E1543D1EE27CFEFCF38562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 4dc20c526e8f15107663298b06862999b901f1e581877641220f4add1b9ef9fb
MD5 58c8eea8bd8e39854f00fd5f7d1ef9c6
SHA1 c7d6f016b03d004f7ba219fff5d72b9ab6d10bfc
SHA512 16b26e7f09adb3c6d2d2effd1cfda00a11ec189ae8c8b1e02cb5a5078c632d7a489ed08125e3062eb1a8157a4fbdd4f8443a34a3626ac5948cc55704de0802bf
SSDEEP 24576:yAL3UTn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:yAL3UzLNiXicJFFRGNzj3
TLSH
T153750155E79400F5E97B813CC9728916E2B2785D0764E7DB03A84B6A1F237E28F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 ebc5364c45d90cb60c9f9cdab20aaab60e1f619ed01e96da915bd5c1ed7ef371
MD5 e78029b325a063139da4e450e7b37e96
SHA1 effbb6a3fba7c543c87453cbb5e1a8fdbe143fba
SHA512 2124bc48f23424d1e0f80f7790958a6d7bc23ae8205ea63e2816070f93df80d1041ce7969cfb131960d5816608e2026cdb3f66c273ed452d05850997f56646fe
SSDEEP 24576:9OT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:9OTLNiXicJFFRGNzj3
TLSH
T1EE55126A32DC10F4E579503D8AA2820CE3B1BC29072257EF4290557E5F77FF89D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3b6c6bf2a4bd414a6707e2b68d946130fc16e6a4c126544c04071b66496f4eea
MD5 be91b83ac07bac46f494adc1ec1fe69b
SHA1 33d1331d21a995f931d2bad233a2c1b3f19c6a58
SHA512 a42bc3cef44071e2a3e7b9414a9dc228bbc080fd1ce370c23bdcad896c0aba3a9f71e9ef74c7b3d40a72c22dcacf8c5cd3c54895e3bc2858f30b1b2b4e5e3e5e
SSDEEP 24576:Z7NM9YqZqmWMUkPjZM48Mv6bEhsw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Z7cBWMpPjN8DbEhBLNiXicJFFRGNzj3
TLSH
T1FA65AE2E6BEC81E5D576D13DC9A28205F2F1B8611B318ACB5162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 e54606a407b8b10362c7e12d743539dccd0ef1d1f21e2633b8ad37fb6827a602
MD5 e42b688b920eb174492587116cab8a59
SHA1 359e31d4fa1a51b35ec101c4c354d3fa1cee69f1
SHA512 c39d024048a1e77d262b328df4f22e8c453b7b32ec334facfb072f0149467c946c74e3d097413fe404374508b55e48890bcea9b76f186d1c4729f13e09caa67e
SSDEEP 49152:iF2YuHNETovAvNYf8kmQLNiXicJFFRGNzj3:r6BCf8kT7wRGpj3
TLSH
T162858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 78f300bf5a71a99b78f308a16e5e6a371a6c18481c0552df25a4450e5e5b2c1b
MD5 25f96525c44d52a3d47d80d2104c1488
SHA1 6b757d522f9f6dd4ed9bee8c5ca6a56eaf5d9cd6
SHA512 57aad4389017b6b68bb2a40566dc8f1d75a75ac6eddbae1a5d7aa8549a612094db65e6ad98dde307e8fab3db324ae3f49a5481e8ee0ff99c9b0763f1bb1e167e
SSDEEP 24576:FAFs06+Omlf8NXEbTof/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:KFs060loXuOLNiXicJFFRGNzj3
TLSH
T1F465BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 d6a4f3da724316e35e31a573285958543808288652b2de0a2ab753e75a990019
MD5 e4db6695c027414be4ed0d643d5ab2e0
SHA1 5f4610ca8f9741bfab7fb7f85a82b21f3bc8af5a
SHA512 f0c419bc7afa373700a44eb03d06d2cacea3bbbbaa84a77d07f7f255f0d9d678e9748c620a0e285d8261da73ed31323a9433ff97ac1d3485972246e6f1ee0fea
SSDEEP 24576:+JnJ5D3WXO/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+JnJ5DGXOLNiXicJFFRGNzj3
TLSH
T1DE75D02DD29810F4E4B7C274825A1A55FE72383D2F226AC724B4E5357F22FE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 10f0113183ae6414c6dc42ab7530e2318f6ca6eef96df0a29b455ff7bb51b87c
MD5 005b5ff5cf092c4fa1bf3adf581a17ae
SHA1 a7acaec51ca9bd050f03986951f1070b85600385
SHA512 a9eff79be67fc6b22b21f2f50601dd5f65206e723cff887b22bcba20c2a264d80e0f86cb53132e5d20ab71eb0ea3ef6ada59b9e217bdf9a2a34f7a556b2f67c8
SSDEEP 49152:bg06DIKdwc+eQnSt65aVELNiXicJFFRGNzj3:UC7wRGpj3
TLSH
T190956C16B7EA5294E8B3CAB1C962A5159B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 6c848b97d0636c5b7a438d6bae19cd1eeabba5da8502fe8c0ba7018597c42ac7
MD5 35101ce4034897390955863b07d5abb8
SHA1 eb9594b3c4ac392114ff60ad0de38da3c01f16f7
SHA512 785af01789e7ddeb6b25f2a526c1d1ee29e09a07645ef5f614ab45b78f225e87457210400c4e512350f15b856b54a3e75994b3b0d2fb9eca70273083fc4fb421
SSDEEP 24576:Qna/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:QnaLNiXicJFFRGNzj3
TLSH
T1725512AE278C70E5D57A903D85A18504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 eb23ac82caf363332fda3877a510e0fa1f62d3dca91ce568196afd9c336fb251
MD5 d758496898a764a5cbdef8c8cf4c2fa0
SHA1 a07f2ef6b461ac31881c7a019edf87e869bbcc7f
SHA512 b161423192e4afe0fc3539037b0b460a2d14feb221dd4ef6ab84eae260e45a1720869b3fe55b7a893fc7f5e59dea484b19b80a381295bc9dab5ad069df2ce5ae
SSDEEP 24576:NIyR/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:NIeLNiXicJFFRGNzj3
TLSH
T1F665124553C860E5EAB9013CCA774064AA74BC349F2156EF9180BA3FAF36FD59E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 c1c75a68af26d652b41d983d29eacef3b89a22b119005a572c10229d86b32fd0
MD5 ae854f4d025830daa41db69effcbd79d
SHA1 b2c752872093a962da4d17d05c37a87ad472e724
SHA512 3c4df7c6a5a8f8c5cba28f5f5ce882a5e9ddd811f822c679106e2c4e360313b16ce835f52368575dda38d11879c6d441aa438bc717777703c1601e489070b8fe
SSDEEP 12288:wy3iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ND/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18C55239A118964B1EABD003D86354824B1943E3C9B2628F7A1947D3ED339FDBDF38952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 1361eda9fa899e04c9990d7d2e5f3cf2ede6fc66bf401edb6325b99341a130b5
MD5 c5b37566e5f9edab1d5cc7c17223d570
SHA1 a8cf5e1ffbe54ee43672573b5595cdb0126e076c
SHA512 680e6b6a513ba2f86d70107fa339851448d21ba194820f1fed154c6f0351d8204a75fc36ed8d0d0580ebe9e4555f773e823c57e8cb93a030653ed4288ea3258f
SSDEEP 24576:UQ9MxZKdcz9dw3o/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UVKZoLNiXicJFFRGNzj3
TLSH
T1FA558C2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 778c03967cc8f6d66b189075f51b134b3bf29add1ad462da74ec73de02af8ef4
MD5 5000928ef37568c3bd928732ca003b4a
SHA1 1094292f6283a332114517f9c0f68aabdaf6aa48
SHA512 975121451ceb6abb0659d8eb52a92259702d495c2b8c5e63634512c37ac391184718d6bcc04c7630d412897842da99beb128b10bd3ea7aeece5cc4a8739362c5
SSDEEP 24576:myocDApt/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:7ocDAptLNiXicJFFRGNzj3
TLSH
T14365E05FB76D40A2E176813C89858204E7B3B4345B6257DB6181C73D8F37AE9BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 6cc38250b3d8e4a8f8d00ba5a6a1bd097bbc1ebbbed159a50321ebb80b44199c
MD5 060b323aa39b19982c59a0aa5d34e2cb
SHA1 a705647592abf12c5035820a1fab2ccb86433437
SHA512 f2a6676170bd3773867c3438b870d771105322f07db27903ce8c8febc2a395bc2f9836e668cf5c4ebad7e2b49d03394915c892020db6f16e6f890093d5dbfcf1
SSDEEP 49152:PWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKtLNiXicJFFRGNzj3:30zuNIn7wRGpj3
TLSH
T1FFA57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4f6e022660f62e8f6d058d6c7bcff32b207cdcd81ef2b1f127da91b866e24de3
MD5 f6bd6140a5ea4c5644b0e602b1c0863a
SHA1 8bbfb6bf19799a1845f3585bb99fc0f1e0f2a23f
SHA512 f81f904b2e284fe123efe8e89450acee112e28840c9858e5b91c21a5b70a9fcc19d569b259d57970e63e2dd5332a46852ed4e75aa5b83a4abba3d9df357875da
SSDEEP 24576:r1QT7EcpfxR+N5AWAz3ooiYzjMqba/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:WTDxR+N5YzTBjMzLNiXicJFFRGNzj3
TLSH
T17655B02EA7F815E5D1BE85798A23C512FA727821033193CB42A0C17E1F7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.5MB
SHA256 967fc1946a0cf41af4642fe15dca3e3451840b9cfbf468c6e36b3d3000e4d22f
MD5 d568c7d9988c9c4e2197ddde3c5b321c
SHA1 11aa9684fe357036cb1abb024d4ca60040aa5c17
SHA512 8c4f4a1795f6b6cc0178f5e94220a8f67c7be4d2e997afce79d662ff13deee86e307fdae2d9f28a06d3cb281a1e26d6ad934e3b555736d15300a0ce5335c112a
SSDEEP 24576:nTMdOz0FFS+UmSLm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:V0K+UmSLmLNiXicJFFRGNzj3
TLSH
T1A175E17EA39D14E5E57AC17CC6538906F672386503226ADB0290C17E2F6BFE47A3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 1.3MB
SHA256 adf16d8069334749f3badd9c49d5b74c61a0474151f596dbcb18d66fa333950a
MD5 94b8fe6d40ea844576e51a23e4b215cd
SHA1 278b9756048c3282249c5d3df11cb1fbec5d2c3f
SHA512 e3c8452247ea8e78566046ae060d923fa96af0cfa36ea8e197a28a6c534312ba34594d29d26c0476abcb8ad1f8b5b84cb3853531067786fb26f9a4198f1b2f9f
SSDEEP 12288:d4KTiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5n/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12955125A13D830E0F5BA5139CA364014E660BC3957251AFF71D0A97E9B36FD9CE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/400-64-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/400-54-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/400-66-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/400-60-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/444-355-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-375-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-388-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-389-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-390-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-385-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-386-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-387-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-384-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-350-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-351-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-352-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-354-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-382-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-353-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-381-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-380-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-379-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-378-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-377-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-376-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-383-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-374-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-373-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-372-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-371-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-370-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-369-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-368-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-367-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-366-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-365-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-364-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-363-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-361-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-362-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-360-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-359-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-358-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-357-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/444-356-0x0000020DC9D50000-0x0000020DC9D60000-memory.dmp

Download

memory/956-297-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/1256-399-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1256-165-0x0000000001A20000-0x0000000001A30000-memory.dmp

Download

memory/1256-149-0x0000000001770000-0x0000000001780000-memory.dmp

Download

memory/1256-296-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/1256-185-0x0000000009E60000-0x0000000009E68000-memory.dmp

Download

memory/1280-294-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1316-288-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/1368-347-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1368-287-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/1756-121-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1756-290-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/1756-127-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2108-291-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/2112-292-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/2188-99-0x00000000008B0000-0x0000000000916000-memory.dmp

Download

memory/2188-285-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/2188-94-0x00000000008B0000-0x0000000000916000-memory.dmp

Download

memory/2312-77-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2312-71-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2312-283-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2452-293-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/2668-295-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/2668-398-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/2748-110-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2748-116-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2748-289-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/2772-43-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2772-50-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2772-349-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2772-49-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3840-28-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/3840-30-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4000-286-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/4184-134-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4280-592-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/4280-1-0x0000000002420000-0x0000000002486000-memory.dmp

Download

memory/4280-6-0x0000000002420000-0x0000000002486000-memory.dmp

Download

memory/4280-0-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/4280-298-0x0000000000400000-0x000000000058F000-memory.dmp

Download

memory/4628-15-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4628-23-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/4628-24-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4644-346-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4644-11-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/4880-284-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/4880-81-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/4880-87-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/5008-40-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5008-38-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5008-32-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5008-348-0x0000000140000000-0x00000001402E9000-memory.dmp

Download