5e38d8af611ef43a8fb4c8e8e5e54bbd5cddfe0087b70a78eb83c216ca39412e

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 18:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stop.exe
Size 8.9MB
Sample260809-wysmestcmf
SHA256 5e38d8af611ef43a8fb4c8e8e5e54bbd5cddfe0087b70a78eb83c216ca39412e
MD5 a629c38afc295662d470fa09215bd905
SHA1 6dd29f7f1fc07779275ec4af911e2031bce8fea6
SHA512 d4faf339808c5c98c28d9e1996c0d30f18202e729fd8f2e0891be18910763dc85202c20370388fbe4c923e2d2d5a72da3aafd8936f643472db928d0332fe617c
SSDEEP 196608:sfbADM6jN99IAP3VZthxaKkBw99BCKgdA3SMhhZZiyc4ooKoC51ANDVa4yBoG8L:sDz6jT9H3GoAOO
TLSH
T1BF968D2A77A400F4D1736231890696AAE2F67D305B3187DF51903D792F375A28D3EB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
2392	elevation_service.exe
4432	elevation_service.exe
3668	maintenanceservice.exe
1180	OSE.EXE
5784	PerceptionSimulationService.exe
3756	perfhost.exe
2784	ReFsDedupSvc.exe
1940	SensorDataService.exe
4928	AgentService.exe
2740	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe

Drops file in System32 directory 53 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File created	C:\Windows\SYSTEM32\LOGL2DI_COINST.DAT	2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\bc8c2c77238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003c7848ca2b28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ddedf0a2c28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000308935cc2b28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000076bcd1c92b28dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000004a3bd9c92b28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006101cdc82b28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1856	2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stop.exe
1856	2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stop.exe
1856	2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stop.exe
1856	2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stop.exe
1856	2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stop.exe
1856	2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stop.exe
2392	elevation_service.exe
2392	elevation_service.exe
2392	elevation_service.exe
2392	elevation_service.exe
2392	elevation_service.exe
2392	elevation_service.exe
2392	elevation_service.exe
4432	elevation_service.exe
4432	elevation_service.exe
4432	elevation_service.exe
4432	elevation_service.exe
4432	elevation_service.exe
4432	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1856	2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stop.exe
Token: SeLoadDriverPrivilege	1856	2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stop.exe
Token: SeTakeOwnershipPrivilege	2392	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	4928	AgentService.exe
Token: SeBackupPrivilege	2784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2784	ReFsDedupSvc.exe
Token: 33	2740	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2740	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2740	SearchIndexer.exe
Token: SeBackupPrivilege	2784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2784	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2392	elevation_service.exe
Token: SeDebugPrivilege	4432	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1856	2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stop.exe
1856	2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2900	2740	SearchIndexer.exe	100
PID 2740 wrote to memory of 1468	2740	SearchIndexer.exe	101
PID 2740 wrote to memory of 2848	2740	SearchIndexer.exe	102
PID 2740 wrote to memory of 4500	2740	SearchIndexer.exe	103
PID 2740 wrote to memory of 5136	2740	SearchIndexer.exe	105
PID 2740 wrote to memory of 2988	2740	SearchIndexer.exe	106
PID 2740 wrote to memory of 2916	2740	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1856

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4432

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3668

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1180

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5784

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3756

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2784

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1940

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4928

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2900
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1468
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2848
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 2996 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4500
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5136
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3008 3004 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2988
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2992 2996 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 da028986e4958beee1d3af44a8d99b3a16cf45d02ce761f1bdc6ba9ee5ce2c7d
MD5 afbd91cfb651a147fe4839c703817165
SHA1 dfad757aba8d3b41bdd1c6efa456dde3ef88da6b
SHA512 29cf4e4b04888d63a8c58cdc1908e8a1094041df309baa3b968c34b5b371c744a7b52d7c92696e355ab03c7d67b767775d1aefcd1f59f4df9956706d316bd84d
SSDEEP 49152:vb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnuQ/lFTjN4:t3q6HjBWLm
TLSH
T168D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 53fa6814aeeb7ad655995ff77f9564cb3eed5f418dbe75ca69fde0ba57d2271f
MD5 dc1b10a11ab7b2d83587934f01304684
SHA1 781ed25089cc3105fc4de7fae963fdf4fae565d5
SHA512 9813f0cb0fcc81dab4fad00edfa1c1d1a81d78411a4d8e62a0762b6134272119201b4a9c816be5aa1fa643543ba88e750e83350aa2c30aff1a91d0c90ae0d04c
SSDEEP 12288:V1XLsswWkxy2lRq2czAVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:7XYfDtczA1nQ/tbw/2Mkjy6Fr7g0or
TLSH
T17465F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 62ee7b5c5cd98dbe8859461c55b2b77b25392ef3bcfd5b5506ce95e4e0cf6c22
MD5 1da936b1597555cb13325fc3607bfba4
SHA1 925bc380a36ac711e9a77db6a9ceb1b287abaa71
SHA512 cb7d42b6b1d89abef90103af1e63ca8759b35858556fbd6f322c2f10b6397a153b530f708817d3456fff1ff406bb851e8fe367b266548593ce0bdc12f2ea149e
SSDEEP 24576:70Le5ji0hmxLrM9nQ/tbw/2Mkjy6Fr7g0oc:7Pji0Al4Q/lFTjN4
TLSH
T14D859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e7012a9b462ca3887ee96930b7f431045639c2aeaf012e530f4e200e3a594365
MD5 21ca4445dc144d521a082ae5abda8fdb
SHA1 a22cdfb9608d0942e9f533a878bf47d085f977ba
SHA512 e467615f86fcee82639402475a99a207951adb397f1e74a5e42f235b8503c4d6348f14071b0fcc8310c687bf8f697ff1ec9f834c2067066915923d42d3cf7c69
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWE6q8wyujnQ/tbw/2Mkjy6Fr7g0o7:+/ezSC6vUzPvxHjycQ/lFTjN4
TLSH
T151755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 4f9bca9a16861005373e747f40b1f515cb35f6630f9bd92d9d5e7c78d7809ad7
MD5 ed97cbea779cf70272dfe6f9bf3f3138
SHA1 063c06701b5b3012049dc7f8b62b4f2ed1a9c5b6
SHA512 bb59884fbade071c81a3b20b8e182905bfe9ab178a93a62f9f32bf5dd13f5dab4f2b10d7a3e58ca8413173853d7bf136ffac0fbacba67ab112614c11108f0ce1
SSDEEP 24576:jVbqPb88hv/l+6anQ/tbw/2Mkjy6Fr7g0oL:jVO88hXl+xQ/lFTjN4
TLSH
T18A559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 75560ea3c993bf17eeebd833680462a61b47ef7f905d0162de617778bb888203
MD5 0a1b444d5a74e542c0c57fa76cc99249
SHA1 57d95717a7c0666de5bdfa3b6bf9ef0cf1d82d3b
SHA512 1d474541cf49654a7494ed42a816558bb2fbdfebc1c4a0ebcfe35a8c9d5a958ef229db110ffd47c71e4f3763e280e54499e988090bba7a6c4132b5bdffdb3596
SSDEEP 12288:Hz5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:HzJnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T17C5523796A24F897FF2B06B15C9284826B7B0EC1BFD4A74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 d3bc016c911151124ab9f179d1522a70bb8cc3731ca74697fb8db30ae89f430d
MD5 7c4b68df60f4f10338eeb874171c880b
SHA1 1a3582294c456fa3126e5533bfba8aa1be7f8d8b
SHA512 199149ec361ba02bad3e7501ec569cbb78552d498622182186ab5413d8f2b5d77c51d88222ce993177d7d90f58dd194fee30b68de989c59d1908a2935661203c
SSDEEP 12288:5eBNUbTVO86UiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:5JIUinQ/tbw/2Mkjy6Fr7g0oC
TLSH
T15575CF3BAE28FCD2C67E4DB85A918600D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1d3b0752a36f0b1b95db1eeb0f117833efa1c5876bf7c69a4299d335c2360d61
MD5 711e47d8b090ce2f20310b54b7c8157a
SHA1 c888d6262d3a50b080d033758286578569ffdf04
SHA512 126f76ad317214e6ec210ebbceed12924f921a8d81af8467f165478b327c96eea2662c761f57974f5bac7224abccd5046c0d52933797ea030c6699f2c00040ee
SSDEEP 49152:UQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THo:UQvGAdlCEL8c/yRNw5CYLm
TLSH
T111267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 c96b2ac0318534ce917223cfc85a584db611a56e7fbeaced79361b85046c2779
MD5 f6a81e33ecbe1a8914d846f616c12534
SHA1 3d896ea9525d1274c20daf351163fdc1b2038b1b
SHA512 5a073fbe863813332e2a42eebffd6f4f5b32b2dae860f58aac161c798387ee5101b9dcb2037cc71df9fb135df2a0cc0557f80838f6a9b4ccf7eac8fb071e93e0
SSDEEP 12288:sAwSfxL/2Dc39DLLmt0LDQewsAjIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgH:RQewsAjInQ/tbw/2Mkjy6Fr7g0ox
TLSH
T19F75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a1ab4f69cb700c9e5bbc658c4c7169c254341b950f792859e7d6f46eb292ef1e
MD5 42bd1bdb1a1e1d10d5889ccf8f915a95
SHA1 1a7e9a6ff64467ac35b5efa17653631a7c1f72f7
SHA512 674572b2bd41558c44cab9551447aaeb8b00157ed19c90d905a440e0a9843fe24d3ddcafc15e3c65c7c595b6f376e1ca7e71801a3b73ae0ed41ac8c01e2d4442
SSDEEP 196608:BUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHzL:BUEtQevvqc2W1cpV2EI32
TLSH
T12B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 fc253bd1d6c5ba4a8e16f54fda823a698548295e0e5b7169bcaedc6b3f7924a8
MD5 1e182f0cc1c29426272c754a523e694a
SHA1 a056db9f9cc226f9102d3862a5dfbfb208c7f879
SHA512 706c85373298f665b1840faf537bd7e41a8fa26842fb9be7948cf5d22e714dab7b129ff9eff038ff89c2eaa4fd8afb5de1e3b465441c4a9b3d4e2a313dbac678
SSDEEP 49152:rCbRquA/m2yL5zQfFiV+XenmE3/zoQ/lFTjN4:0oqtVjnmMLm
TLSH
T187D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 8ce5c8f2a19948394142c229f685438139f05795b77871000f889f2c1a0ba7d7
MD5 4fca16f1a42f7d4a86678287044161e0
SHA1 52910dacf998cf75a14ebe5a1ee04a36f77fa3a1
SHA512 f328bb0d7719beb02a43b6cecde85739ff44bd53f899cc3b895ddae826d8f9ee5ea0494f5a8587fc61fe1af2ab3517d2bb4b5d37e0afb3fbfddd4e7f453bc674
SSDEEP 24576:aAhGLJIFoiwtA5l7S53HnQ/tbw/2Mkjy6Fr7g0o4:aAMyFoiq53Q/lFTjN4
TLSH
T16235AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 29e444ddd7807d655147ab4d5fd0454449937d2f392b8886be59d47bf88245b8
MD5 821ea6f92d02e9cc6934285c9a7d2990
SHA1 cd5e8a806f62729ce78a06527fb7b21d36787145
SHA512 59eb4ba872eb3955a7da25a53ecdf3516f14ce92ceb7d2ad529c61ad95378106c0b177b0d08cab2cd62004a5fe4809e856f02ded0b0236e1bc5adc4376807c5c
SSDEEP 12288:Ymw5HEjsChN2BFgl0WDm+CoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMD:VwuHOWfnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1DB65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 09ae19abdf9cba7beef63e65ef84e53b0a20a5885daf47692e9d9d843a69845f
MD5 d48ca9458bf2fb71fb34abe60825d280
SHA1 9ac54f7c8d5175b0f9ad4feee0259769ffbdb7b9
SHA512 ff321db96a2ea135d43001cc9ec26c3a795a6cfa33b1fc4f7a9fec4b020d9d978df054ed095002878f95d720c5ff1d5486a1bc57a3fa1118789ea7a25a9b0330
SSDEEP 12288:cXZ1IyYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:8ZulnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T10455126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f9e7ad13169dc29dafb8d7e783f688f8b981fb6a6d1d41f2fafbe8d44e235dc6
MD5 b260a6805c60d43f7b17391b797ac73c
SHA1 6e9c88161702995d8812357bc202e7a54a3f3d14
SHA512 92ed0cae331ed410286f1ab358cf0b90ba55a9572baeeb2da88ca96a08be93a10e52009a7c6327355d019fae7bc761dcda8abbb68811233c4ecd0a1753d41058
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U8:bQRQyi36YOcPQLvw2gAf+PN3xLm
TLSH
T195666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 65d3346336be8d3d87066afbea099232ac5337685fefeff47f151c738ba09280
MD5 794c31e2960fefde505248e75693f183
SHA1 3ce3e536b8e3974b846b54d5b32b323cd890086d
SHA512 2d4a0ff091834e16e72d7224e988b100f4f1ff7ac4dbc6c921d747e13a5cf26814feb10684851060db0a9d2509f7f780e03a21035266fa09fb529d77018617fb
SSDEEP 49152:aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U8:5QRQyi36YOcPQLvw2gAf+PN3xLm
TLSH
T177666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 40a0ca39b2565ca3aa4d6febc79c31150316ede346a3eb803ce392009d53a999
MD5 23fde79e6e78c2cd7e012eb8ccfc68f9
SHA1 193b0261bd3d1a8d92b447986763d88a8d33f1f9
SHA512 cc9325fa4da443997c03d019b874fe052b51a6feb5d81e6593459e1af49baffd9cc9ddbe1f96b0e612f19895457cc8bece24dfe1af500e1c7d3c2c0fe0cdac2b
SSDEEP 24576:iwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0VnQ/tbw/2Mkjy6f:c68Qg55nhheWu7PNU3/4Q/lFTjN4
TLSH
T1DEB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 919b43d8b3cbbacd64344cf753756131cb630c2a5ce5dafbd3bd0091cc956dbc
MD5 200acb320357622a273baaab9dc644c1
SHA1 0992808145eb935987eb2e3ced2d98010428c55a
SHA512 2539a1f91ed84f94b39134b7834e60bde6ad531522223a7d7fe9f500c76ee4cdfbdf17a622b85ee371b44345c7a29e28eb7e5e2e927adb59623d9bdf33404bf1
SSDEEP 49152:o3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99O:Fy5112gYy5azzVvL69nLKnhZ+Lm
TLSH
T176167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c79a13d4b27632f85b3e00f1e879d8c4db5045d36f644b9456ad9698b2244ef3
MD5 2cb22093d6729b847030c9067fea4e36
SHA1 36df20a0319462a49ca6979c8614c089f165a82b
SHA512 e006b4865ed41d7c4e6cbb3c5bf601f36fc536d7b3508973bf8edfc4d4bd2ce508d76f6cb70d655a2f0fc3c1d0fd401104b9b2cc0efeeb24c256b09f38b7c67c
SSDEEP 49152:dB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glFQ/lFTjN4:Du6JmVxd2dqLm
TLSH
T1D2D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8aacabfca6d5fda7ae16cd67f398d1a73eac6e9a4a6958c8b2ce3d37272b2400
MD5 4765a3508b37612ed58dff33fbf979da
SHA1 941ef884a816a3ec79798cd8935e1573d71a22c5
SHA512 a0290433e437a8edbcc84feae7884d53758078bafbe2d1f8971483aab91c24a416818e1aa67c29d4d1a05c579a31262a9357599755a8c3b28453c41ba55d5b32
SSDEEP 49152:D1hpsNoJpF1A6UU44CwH7R4xCQ/lFTjN4:DmifPbRMLm
TLSH
T169B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 be2792fde5220a8f88143c65d37e9c7c2d9cd86bc92e6da2df17d3768a0d9303
MD5 1946063aaaf98309b203caa6623c4012
SHA1 5951afc7f5a391adde2717b762a0cb0709fae079
SHA512 99ecd5fc59315c4d24a1494c807420df846d0c44dcb73a8d39a62c803bec614bb5bc5aa50711243123f95a02f85b62138b0ba7c7d41a4d68ba188d6f761d38e3
SSDEEP 49152:WSuZQIY0Be2KRRVtOnks6NMHqlQ/lFTjN4:45dKTi61KLm
TLSH
T14AC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 bdb721c0d64860cf7bf3a92a3b57b0b18aa2ce8289d71d3df388d03423e5500d
MD5 9155974ab50466f532dfa2848b8d0e75
SHA1 05fcb5581b61bc8e61644458f61778ee14d208f5
SHA512 5ac033d314128431f919e13de3047bd5f8001b2925548a9950dac6843f2e56ee68284be40879a0e3b7cdc673e594c66fe3bfadd620d3a3b827674a3226fbaa26
SSDEEP 49152:zhtSn8EApI0figngiDn0AP5w+Q/lFTjN4:yX2iyphALm
TLSH
T1A795BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 d660b61c3ce6b58f1931d1a44686f48215cf8d01fd8f675852aeb1effb246228
MD5 9d7f3e43ebc2b212c7b8bf2941b684ca
SHA1 2a5ff6695084fd42624698ed6f58c7ac2594dbed
SHA512 f93beff836de463ea666e1289afa53fd8f94531581167ec77a78613484c31738bac298b7875bec6881f59a132bda0d602a562cc5072e4f341791b7fa8dc53d41
SSDEEP 12288:vhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:vxnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1E15523697964F98BFB1706F18C828182A77F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 3545ab9f77615df44b4c04fbe091a1b79b8798357b4ae327810aba2fe1ec8ae8
MD5 a9c9daa3e789ed17b1bfd74be1cb0bbf
SHA1 3fa8d1951c908d48dd44f0a865cd42223c2ba3e8
SHA512 5420ce337d0cf729853fc2f5af56c8c339ca2246e65a4b83c5a29e9662976889b53a6389871683bbd11d47c4f01aa4b665037f6c6546d1f870e6df3ea282c4d7
SSDEEP 12288:MUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:M0nQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1465523697965F98BFA1706F14C8281829B3F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 6b1a0e5ea1751a13b0b24facb01473fce88846579f0d225cb747baad657b021e
MD5 09b2634a300b80bbf93b69016ef5c98e
SHA1 49f10fb4b2fd6177cb398ea13f7e655f5a9805e3
SHA512 a59c1359fc19ddaf2eb20ff86490df02157fe8dc8c10798c7c1d621a3de2466a2eb0da52acf5cab8f7dfb3584fd0681dc4b43d5934e82e42f9ac6ae128d897c0
SSDEEP 12288:5KGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:5KnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T19B5523687965F98BFA1706F14C8381829B7F0DC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 8fafae876901c9756da77eb9bbdd105600c0f3aa46dfacaeffbd57276bde12e6
MD5 6b90c17e51d4432842f39fb953a8c8ba
SHA1 79f0edb74f59d5ada0bdcb8b947f91e308234b51
SHA512 d0003c611925ebe990f249a26118ed9f3f5cef1b2f5fd8e95d89eb1b83cbe211abd84b23cf7b58276c705fac49e76d410d0df72f8dde3b06455b96abdc61b040
SSDEEP 12288:tVHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:/nQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1CF5523693A69F4C7FD2742B5CC928142E77B3DC5BBA1A3CF6B00111D4E793D419A5B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 545dbaa091b0ad7b27c31c93af3be9a1eb60cdf638fa68e33ada72fef2a2a802
MD5 8c0d7fcba29baf18fa0d1a24e4bc0a9e
SHA1 9fdbacb5589ab68de0fcca36198b899c37324734
SHA512 9d803766305804ba76d080eb9c584d848ec0a77fe6bb44e8f31cd8e9fb84874e61b54a576c24f7187de90d5995aeab9e9148dc122a65d799498b84bd6492155f
SSDEEP 12288://GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:/fnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1205523697965F98BFA1706F14C8381829B3B0DC7BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 f367fbad85b282bec014ba3d1d0f6fec48cc64a1ff82e53917cde334d7667a38
MD5 de8ae9f85e676d97ea2828414903b51e
SHA1 262d2c9f5225fe30c8fe71138f7c8cb2aeec685a
SHA512 bba01cedf676ffef384653f17088f7c0e3d88d3ae522bc01d0e6597442192f6e992786db308250d51ee505152dfbd3959afd5d963baf599f54c95843aa23b5c4
SSDEEP 12288:FQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:FwnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1BA5523697964F99BFB1706F14C828182973F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 1ae672ec7e2e624a13c7ad297fa75470f54d4991bfc3739bec6f27254ae259c5
MD5 2d6aa713b6ebf7dc69c937f8f4ea026e
SHA1 21c5e7e863bf3dc1f699a0f25820d6ac52786237
SHA512 78ec86564077c14881ca8688ee6a73f227032762fd47406b5cf59b919845f719fcf9021b0f8aaa8d4ab8c2ae4ae97c04cd29a1d2fc0cadd5716224439d5bdba5
SSDEEP 12288:vsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:vsnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1F55523697964F98BFB2706F14C8281829B3F0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 3b9eb2f558fe9c03b6a7d8302f8bb8be4c988e055cf018f9d4e15f0d0a84ad0f
MD5 106ffb6e0d47ec059353e1b58835f428
SHA1 0bec99dc7dc0a95ee30b1bb0925c1c568a2cd7c8
SHA512 4bfd8c936c471ffddf8ed94ed2948e29d5c1d8ef95068913ebf7d870754456377671dfe1f1ccb0a82c871a1d1cef1e7b7f5e0b6fbdd878e4ca4069a9c23d08b0
SSDEEP 12288:PiZwbDzzFEoS2cPvy0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:qZM3zFVSOUnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1347501A5B35058F9EC67823ECC528906D7B27C5A1BA0C71F13A4362A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 201d80a9b27c2518e79c6666a0b1db51fa20cacbbd782745f31c2f95e08b739c
MD5 5c0ac01211d79a7e04e77a4756b4b16a
SHA1 9991f9d2230ebd17303f3a7c4043b725cfc89f6b
SHA512 5ba84b3991d8d0c4cfe4a9ea511879a20a50f6211f7ab05b8ff6c2e04583c52352c9b0547b61191f4e1b2df142f05eccd29a4d4e1e2bf5bef8b89c508e83a9db
SSDEEP 12288:yVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:y1nQ/tbw/2Mkjy6Fr7g0oU
TLSH
T1F25523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 b5dfe786b8c23f24fdc61adcce517989f6350df60d55acd5aada3cd0cb79de65
MD5 0d3b6a3e8706cb4a9eba3cb6ed935354
SHA1 4d6e4a2d51b72966ca6917beb3c8d3d32c988dd4
SHA512 1b4fac6c93eb98c701a88fad977c3f8825d6a8d57fd69162e4327533a471ba925e204102ed99fe271d167c1f3462f7a2219bfd87a8623c7b0fb5d7b99ae555a1
SSDEEP 12288:UJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWN:UZnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T1E55523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 f1964f067eb2fed5d9e5e040327c652342818c39a98743400ecfdfa98d13b91d
MD5 279b387f05d7797742fbf187a3a8c4f6
SHA1 e46437a4fe141eab7b67b4ada0af1ccceb011c60
SHA512 f47eb618a4c858c135257c75ce0bcf22f588a6c85d0be77ada69248771209aaba6fa8c45084318ea67bfeeb484f9fd71f348e319c237441b778b7e0426526927
SSDEEP 12288:VyPz5L8YGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:8zyYnQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1F265021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 be47ad57fc2a86fb8295e8eeeecf2292acfb20faae73fd32d42909e632abef75
MD5 d73d703af781d8fb208001fbaf05e3ad
SHA1 2ab1a602b729bafaacb527ab8ed1ead3f2e7e49d
SHA512 d11b057f14d6e1e8be6c92a769a3af2fb5e46a03d3e04565fe5ab24ad6331e9425ab03484894f15c80ec7ff17d95c471cbcf80242324d4037432ae7d7d77c79f
SSDEEP 12288:MVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:M1nQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1A75523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 3b7af4fa699f517dcac193871a96e9563d75643f0707d92065f480e9aa53a69a
MD5 e8b8ded56536688b0e932da64bd860f2
SHA1 00c92823d2a96eb0e25d88bd35b0a5ef7de15e4b
SHA512 642c6ca79a5ebb04fcbe3d7eb34d0da693d7fd754fe9db1d87e55f8db7a2229602fe6fb6b72256eb797f9ef278f31be0ac19208b196aeb033bbffbd3606fc6ef
SSDEEP 12288:ZVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWI:Z1nQ/tbw/2Mkjy6Fr7g0oI
TLSH
T1F25523697964F98BFB1706F54C8281869B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 ba236018d7cbb16297d63120f1b7a72429e662b023620d00df0f10870ccbae75
MD5 7be7f382a6659130482bdd7774f07810
SHA1 4cb001ab7b8f2c44f81ee20d1e823544fe0a76f5
SHA512 cfffecd634c233ec42c163c61ea2fd1e38c62f58af907bf34a6264053d327c6ff676d667e0c89dd69edc4abdb04245dc96069a2b225c098cd45643231473af57
SSDEEP 12288:QyPz5L8YGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:hzyYnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T14165021773A570FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 3b093b4d5f91fcbb47b078f1cde91f88669c0dd304ae3ada489d6b8a119838ed
MD5 db7a0d9a93e7c910abc5705eac7f130f
SHA1 79e5d0cf8abf4ed59988196e34af3025b795cd2f
SHA512 d53170c5d7ca601d394b4d8b71ff9a35582b95ea5bd562d24818fca5bcfecf79453744c932e01549143e1676dcf26b6c7b5c2d04f8e102c55b93e1f5949358c0
SSDEEP 24576:1T0aLl3z0zD6nQ/tbw/2Mkjy6Fr7g0o9:1TDLljjQ/lFTjN4
TLSH
T1777501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 76a15b2f9bfd42e3a1075ddd8adf69dba04702ada8efffc3480b627f66d68989
MD5 0875830f46d73144056c8bde72bb0685
SHA1 b5c54db1e3d2c58cb28d3743f7b4c7663b38e4c1
SHA512 0cdff0770010b769c6499b85bb7fb409b6dde672f984ceffc219c1ebeb0701c533a74bd1bc64f12d98400676ee7ec4a7427570ef908f9578e327e6248bb13222
SSDEEP 24576:T31d9CHKy7GZGnQ/tbw/2Mkjy6Fr7g0oy:z1d9CHKyaAQ/lFTjN4
TLSH
T19D85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A4261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 89e8b14f1642fc248146932ddf7569dc8d62dcc769c2363c707696a4e73a33dd
MD5 3f69dad8e54452f9509f8f67464f4951
SHA1 d5710ffa597de522840db3c1b47d7ffd8e410734
SHA512 44001f7e5a5dd9f42f683b25b9ba10f3761dd9a17f7a3df698cf186fda2616d444aca7c386b7e8589353c8f12d1cfd53d47315adbbec02203c4ac738c8f6da55
SSDEEP 12288:9qGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWq:9qnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1C85523697929F98BFA1706F14C8381829B7B0DC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 4ac822893e426fd784aceca47d0baa0ba70fdbab7f1488f2bdcaea7ae69a2232
MD5 5169cabf2958373f55ef8a793eb24e7a
SHA1 70b69391cf581e1e5e3b4aa806698c1a92b8d495
SHA512 a8b772a2df46184c59ba950f4f8d259f0d2696edfe4717e78b1b48a842fcfdb6d426f415a7018d2c1db5a22d375cf82639294a99a8975c3b9c95d7b89a8c6573
SSDEEP 12288:i4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWF:i4nQ/tbw/2Mkjy6Fr7g0oF
TLSH
T1575523787964F99BFA2B06F15C8381429B3B0EC6BFD1938F7B481129967D39406C67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 5b6696fad9b87b1c281252f37a1e5ae01e29259aa9b4d1b7ba17a4081b0729f6
MD5 4bf3d07b95b5efba75ae15ca7a647acb
SHA1 8b99c587e6c842f587e20a3ca7c3eeb256b81b07
SHA512 37117464b8b38418227fd6e278d002f4a5cd6603661500f746841e5521802e664a2dbfe379dbb18ab8863a0bcde41cdccdc8fc03bd95cf9b4d4cb000ea47ab93
SSDEEP 12288:frGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:fbnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1A45523697924F98BFA1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 d9b71a9f7346decb253e67ddfb6e62192bcb1379d1057acf976ee5d4e2cd66d9
MD5 d6a2f797497fb5f33193ec1a2b5008de
SHA1 4aff1833154e7dae0cde9bd10f94b1e9f55aea9c
SHA512 425c8028f8acc14e54a81445cb6828f65ffdd97d6f327cda4e066d4f0587213609a6d23139629c5a8341c806ddc3c0f4ec78c2e03575a470e02a08cc9c5fdc0d
SSDEEP 12288:uVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:u1nQ/tbw/2Mkjy6Fr7g0oV
TLSH
T18E5523697925F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 cd03c2c529f24ff0e799a3bb9a6b93189c4dcafc96b7b94d50baf42160c723df
MD5 41438bc3cf4f42e4c359a7cde70b53b4
SHA1 cfd9e9d52d351aa0772bc49759223e4cc5b7d736
SHA512 7f80d6a413bcf2f8afb650df4dd3000e934eb13ee2f320aca4249c0cd86669009a8ad2de9a39d8e19f3edeac92f6bbd8521204e6f83098824b5dce130c37cc98
SSDEEP 12288:+qGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:+qnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1AC5523697925F98BFA1706F14C8381829B7F0DC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 13b170458038cffa111da2cd310f28e63887fcee50fb7e29bf109efa1afeb19f
MD5 9c056efe94eae29d19b77d2473d75fab
SHA1 c8a21ef0d87daa1804ea8c707c2d9c7f41dd2292
SHA512 5ac7e82478aace4cf0b7baac1cb926ecf554ad1d133414e0f5d374ae828b03568a7240100511d4a13fc2087c6cb6081a5cd97ff1f4e2f12f43727b294f1c393e
SSDEEP 12288:mNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:mtnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1465523687964F98BFB1706F14C8381829B7F0EC6BFD1938F7B482129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 a6660f0d9ed0fd90ec798b0f42f82b83e775c24976cf6dc0695605a329622e17
MD5 0c1f344099efc56b9b8728f75be43f27
SHA1 c8d1a1c2be20eebaae6910b3afa1a7b81d95ee62
SHA512 e8e3bad0fc52eb222a89231ebe0ae46f2daa687bead9360a098ddb162d0cbc8823f4dd9fc52cd2f1031741069c51d38be595b2a9abebefd726036040d1101f46
SSDEEP 12288:q/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:qfnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T13A5523697925F98BFA1706F14C8381829B7F0DC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 cb2eb9b579500cbdc2c117b341a88875104d6859ea567b153212d82ea5df647a
MD5 af15df688fea0ef56d67c6bab67adc4d
SHA1 ee3265aed1dfd2e5048924a69e1b57d2d3188dc2
SHA512 a6839b05a23bc5e4adfd1db242e65db0545464b14a18c1204ead0b111ec3ca4e5e0018f3a6256e9bef8f2695843c098be6484d1c043e0738918878b9976cf224
SSDEEP 12288:XyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:XynQ/tbw/2Mkjy6Fr7g0oW
TLSH
T10E5523787964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 3426e2242f6b9845336a27d78d97f110983c9cb4235a7e5a2e4808261eb41cbd
MD5 148fec3ee11e2c20afc0bdcbd84dd8da
SHA1 8e306ef3158f47c06cb1be73ddd5e5c3a1f67fb8
SHA512 d8baf09bac80f718427ea72c1d756de05a9881063345c7e1ac2eee3c4af74523b3bd63f40205c3114b75964b02985df3d50252450eaa1e9395d61405dee5bb43
SSDEEP 24576:Nfwv/k9RX6wkyAISnQ/tbw/2Mkjy6Fr7g0oS:8MnYISQ/lFTjN4
TLSH
T16C85DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8e5d02cb7a39023421701b66a1f1f3664dc8490bcea55b3c081e7372975841bd
MD5 84fa0139d76f824cda9b95e2c8b63077
SHA1 46049c1228769be1b4ef314361908f2874241a62
SHA512 d8130e67882b4e3895fa243eb1fd467c62d30de67254c0dae91d4d3d1fd0780a688335884c39373c98ba05b667713ebaa08a552dfc716536798629de001297b2
SSDEEP 49152:lYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0eQ/lFTjN4:lySzPRLm
TLSH
T1A0066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 27fd8ac9f8db7761b519f4bb1205d3cf86f8ad7830ac217faa1f3baef7df3891
MD5 a8c9a3410c62b5efa20996f97c615127
SHA1 91e007ede4f9592e8980dcbb15b17b13b57bd2f0
SHA512 f04b7d66a555d0f9a0c50a62598554c5c0ccb1a0d8cba3bed9026b62c564f173880a2205efbb9fd0c4e9c1b28baae7f934dc3606f696672ff5b02cd94c7fe998
SSDEEP 24576:g47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYknQ/tbw/2Mkjy6Fr7g0os:g47JUQj1irIhCnDHUPfF/uQ/lFTjN4
TLSH
T1F965AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 23f922396f449f77571d1b12b3c686fe0174cc1f62839b215d268f5b12f850b6
MD5 c9ebb848b05072d20f073b308ec3061a
SHA1 db41b0ff4a480a9490c640a154cd208a75689ecd
SHA512 adca09e7f2eab432f9c2c394f5b5cbaad4cf5f62ea482a7c7195596151c9392aaa70154c43eaf4acca3e1184c883df161668bcf5ca215488a23c6e5d243e6ddd
SSDEEP 12288:jssfFGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:PlnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T11365F119E29852E9D02E5279CB428641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 abe8968238fa20c8eeb0b2c8497d103ebc5de663f20c1bf39eb2e4a2b0d8a35d
MD5 bbeb19bb7bdd6e9e9e2a07e29fdabb95
SHA1 6c1db6eed4f341ece4debb95df21afa01c87d4aa
SHA512 ec197fd793f59e716d32de3612b9070e3eb33c4428abe65b07dce0cc6c0db88feed363fc3666d808fecb504e5ce28f98afaa09023fd84ac66764ddca1cdee3aa
SSDEEP 12288:Uj5Iey5s39L1Irz9HGOQRhOfGj7q8mK7XZH:U+etReXhGxRQfGj7qlK7XZH
TLSH
T1BA453950762AD75FC6A940325E33D2CCAB707D05EE056B0772C8973FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 26598641204fbdd3fa6671246f74e883da730d35afc5b0c992f8f0dc4d868fed
MD5 7c896a6e0669edcffc216114270b1e3f
SHA1 973638494193b164af51b7b7bd08aebe529c628c
SHA512 4540ce379eb0d51e808883e8cfa1f1017bccea6dc9f791ce67aa529e35f2c694e06bf57cfb9d40f764364d9ca6324fe3d3cc472651e7580c35734ed7db1235db
SSDEEP 12288:ls13aWECA3B62KkQ3jQAh6I083C8pNPpU:1KdEI73/vPW
TLSH
T12E65F7819137E38FD0F76032072A9B4DAB64EC07B7056F2673C8457AD86A765B0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UIU_INSTALL64.2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stopexe.LOG

Path C:\ProgramData\UIU\InstallerLogs\UIU_INSTALL64.2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stopexe.LOG
Size 2KB
SHA256 cba2e9639e55642df2e18a025520888a6fe89ea0901c226dafd7eabf7ae0a7dd
MD5 6e10cf8c39c7d3cac2df5d1a301c154b
SHA1 19256964e24f2e79607f1d089bd12372b427fa84
SHA512 ecf5bc89d3ec60b18333901fafb6fbd5b269a143e045463c83866fdf479ec754e11e5ee9573f00116fd2e0d5384b1edf1513823469c5f7a06474131c74f080ed
TLSH
T18341185E4145D0E9942209365779FE2091787C1E1808EFE336ECA387DB84302F9A6BBE
MD5 SHA1 SHA512 TLSH

Submit Download

UIU_INSTALL64.2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stopexe.LOG

Path C:\ProgramData\UIU\InstallerLogs\UIU_INSTALL64.2026-08-09_a629c38afc295662d470fa09215bd905_darkgate_rhadamanthys_smoke-loader_stopexe.LOG
Size 4KB
SHA256 d72b8738b8196f6160a67741fd51eca0d913a571f3655b10959027ac70dca548
MD5 f050315b43316e0756ebdbdbf3eb6997
SHA1 a39ca47f380dea7098aa40fb701abba1bbb8b2ed
SHA512 36e841190dbefa70631d945be9a693232f298f1721bff8242a17d16e3c95ab498c46ba047037269f718763432aab5595c716d434f2cf258d36d421ada9fc51e5
SSDEEP 96:4B4+mW4nG4Q4o4i4U4yc4iE424ma4lM4Q4A4x464C4Y48l4g4545494+4N4+4R48:4BH39/dbRcULC9zpidLlF5WIsnkJ8HpH
TLSH
T12691CB5E4645D4D9841209374678EA20A178BD0D1918AFF336ECA38BD744702FEA7FBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 e02826c1728bb0b091b6e2654107e947777d713e4721babad73f4f5c0c667be6
MD5 99e072d343506def0bd92436a17c9265
SHA1 be1b6c4aa79a119ccf5f8ae87678ea36e86e6ef7
SHA512 e2cfbd098ad6f852f361a7e7b3622eaaef955743d550f9ff0a93d1a4fc9c5bd2027210b499a7c89022e0c03348de8e97a4be2e8262fe1ee9bba7592f54f483b9
SSDEEP 12288:H67mGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:OGnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1A15523656668F94BFA3B06B058828111673F0EC5AF90D3CFBB082269957D3D40EF6789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 20ffe4db0710885cc40ebf885df1f575568608e4b78a775dee4c0b85ec56e99d
MD5 ce244eca53016810ef17a0e99e8aa616
SHA1 0bf414bfa0b6794c423facdd542983dbda23b8c0
SHA512 784c8d7c244d5af6865a0002891ecdb3b5aac4bcdfe2ddcac7b7c8c9d92d0bfa1674d34d581bddbf3e295f510f6d43ef0bcc6e5f66c99ab2df24ece992cf250d
SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bYjnQ/tbw/2Mkjy6Fr7g0oS:Qgb4mBIBhGFkQ/lFTjN4
TLSH
T19D65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 933aaa90178a86b224dc1738a40fa3fdbd4a124bf18c2825eb5f4a294820027e
MD5 577230b1e962548a3057393dcfd0dec8
SHA1 ebc6d2030a13450bcfd8a02c7ab649bbc43c7ee5
SHA512 407554f6ed162ad7bef6e2bf811a9433c4cafdf34e05c92e9d898071642bb7361b3037d534b9d694bf1fb95e84f9b62e24c4bc652f7fa285676ed540e1483266
SSDEEP 24576:wG88u8FpJqH1Qzria7/mHnQ/tbw/2Mkjy6Fr7g0oq:j7ZFPqVva7/QQ/lFTjN4
TLSH
T19F85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ac613e3b4807b3a6cbeee69efe89370248b18b0e375d2d7df19ed1c9a0d543f5
MD5 23c70b01438153bd185bf875f68e9b2f
SHA1 29a5ed1766ed00939fe85fa62013abbac6ead07c
SHA512 af4d4b7c47ff5cc2b12be22788f8353553850e0e2c08a6a7a0191dbd9d46fd254fb81b6a283ed41893143e2d195b2fb074efc322c6d4f3ec186b13be83091a23
SSDEEP 49152:LBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjzQ/lFTjN4:UG05lO43bVLm
TLSH
T1E9D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0a80233ff4c2e6eb94d1f4cba28226cd462c12ad3e9da50adf21a131da6f07b7
MD5 50285ad8fa0f0032fbfb6ae9b9786466
SHA1 be9389778f473d460b696985c377b0433878d243
SHA512 474f9a8c7536c102fbb597a41a38d00abe2d02328a4fe258f099fbc02bc97788dae990d6b65f1f0d9c8f797b712acecfeb0bee8e79bca2683bb4825c54f03d1a
SSDEEP 24576:ifa5POZ3dpFWVM50JicR2hG0lasx2+47eidnenQ/tbw/2Mkjy6Fr7g0oZ:qa5POZ3+Jt2pasx2+m4Q/lFTjN4
TLSH
T16365AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9710462ce00ad06d239cf76073b7400aa4386e49c9ff3f20c6e21239d842e79d
MD5 a60f6bd93795ebff80c71e8b58577583
SHA1 0e0fa652905a9370f6b0d49ac7460b2ac4109075
SHA512 0c06ff1699db95de142f5b49ee25223558d1260d90d1f00deaf0fe7f6e0b5638774cf0c442703c1b820937d708e6dc06261a7f4e442295e2d222da33f7f92b2d
SSDEEP 24576:7NcwHdjbyQ4nLC18lb/EOjowL7Fk/nQ/tbw/2Mkjy6Fr7g0oq:7Nc/zEOVHFwQ/lFTjN4
TLSH
T1B1858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9f5e7614c8b8668388452d0cdaf4f16cac3a2914389a21e0d2b37cc05d7bbd88
MD5 6a5f59daa328ff2f0a333e1f37a206e2
SHA1 aeebc69a15d76e0c02ac237d997479bf101bf96d
SHA512 007ff8e41641a310816b6d54b9519360e8a6c2103820a80657fa708d8c68c6479ad74829dcda62eeb5fc850f07a57745b393e051c202d670726fa06d3881ba75
SSDEEP 24576:48kNvNnaFeYhJNtmZBmpnQ/tbw/2Mkjy6Fr7g0oq:48MwBtOmpQ/lFTjN4
TLSH
T14355AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 a4f04cc40f4571969d840b23dc4527501e828da4f45a124f00b7de7a1f004576
MD5 bc60f31627e1285b8416d326a31b4610
SHA1 4fcf7cf8db844aeea120a6efb8928c5dd4168f65
SHA512 2cd3f3b4afd6492915b346fa1a3f4553d0a12e2bcb574a75eb65806431ad5647dd6c753c11fac4d2e408490340c0881e51cc9cd819e9903a7549afadbccbf83c
SSDEEP 12288:THvUrBFrEjwaQzGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:TPUr+NQjnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T13D65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 f7f925c767dd0c2c4f5f0403fe2bd4f8ddeb31b6a576e45819b4922d83d717b0
MD5 f069b0f44b19374f1cf68b1f67ece2c0
SHA1 948167cb155222ed06aa679cf7aaea44f332d1b5
SHA512 27f83e2e0cbaa1372e1b83b4c4ca4722412663b6729bac84045272ad2b425d113ce0dd1ae385c852ffe8755c8384141ef4270109af7262d940d405d1e10ba65c
SSDEEP 24576:AD3FHshBIYQgAKnQ/tbw/2Mkjy6Fr7g0ol:ADVHeBIAAKQ/lFTjN4
TLSH
T18975E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1180-706-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1180-53-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1180-61-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1180-55-0x00000000008B0000-0x0000000000910000-memory.dmp

Download

memory/1856-6-0x0000000140000000-0x0000000140B50000-memory.dmp

Download

memory/1856-156-0x0000000140000000-0x0000000140B50000-memory.dmp

Download

memory/1856-558-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/1856-566-0x0000000140000000-0x0000000140B50000-memory.dmp

Download

memory/1856-9-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/1856-7-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/1856-0-0x0000000002030000-0x0000000002090000-memory.dmp

Download

memory/1940-555-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1940-548-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1940-757-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1940-549-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/1940-754-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1940-755-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/2392-22-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2392-16-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2392-547-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2392-15-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2740-585-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2740-586-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2740-758-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2740-592-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2784-771-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2784-772-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2784-753-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2784-518-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2784-525-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/2784-519-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/3668-51-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/3668-54-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3668-39-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3668-40-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/3668-46-0x0000000002360000-0x00000000023C0000-memory.dmp

Download

memory/3756-509-0x00000000009B0000-0x0000000000A16000-memory.dmp

Download

memory/3756-504-0x00000000009B0000-0x0000000000A16000-memory.dmp

Download

memory/3756-743-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3756-463-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4432-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4432-569-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4432-27-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4432-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4928-570-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4928-580-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4928-578-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/4928-568-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4928-576-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5784-157-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5784-151-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5784-141-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5784-734-0x0000000140000000-0x0000000140176000-memory.dmp

Download