ebc1916f925c800ad6d2afa5a00393d7ccfba318445376433d45b3a98deb079a

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 18:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_34e2ae2a46c6ccca915de73a82097f0e_darkgate_rhadamanthys_smoke-loader_stop.exe
Size 8.9MB
Sample260809-xcc6aabr71
SHA256 ebc1916f925c800ad6d2afa5a00393d7ccfba318445376433d45b3a98deb079a
MD5 34e2ae2a46c6ccca915de73a82097f0e
SHA1 7c785ed9b1583f50e28ca08b5d5c9770065d76d2
SHA512 b76176ca5a145e357b6017b82a22213669dd10e5d2df31759340a21f271ff0708c421c065961ab880ea590336aa203438fe61ac0388eb07134d99c0887127dae
SSDEEP 196608:Y8xSKVI3YqN99IAP3VZthxaKkBw99BCKgdA3SMhhZZiyc4ooKoC51ANDVa4yBoGI:YQXIoqT9H3GoAOO
TLSH
T1A4969E2A77E400F1D1736331891696AAE5F67D205B3086DF41907E792F339A28D3EB1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
1168	elevation_service.exe
3252	elevation_service.exe
4216	maintenanceservice.exe
1612	OSE.EXE
4700	PerceptionSimulationService.exe
784	ReFsDedupSvc.exe
3688	SensorDataService.exe
2160	ssh-agent.exe
2408	AgentService.exe
5520	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe

Drops file in System32 directory 50 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_34e2ae2a46c6ccca915de73a82097f0e_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-09_34e2ae2a46c6ccca915de73a82097f0e_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\316df19783806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_34e2ae2a46c6ccca915de73a82097f0e_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_34e2ae2a46c6ccca915de73a82097f0e_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_34e2ae2a46c6ccca915de73a82097f0e_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_34e2ae2a46c6ccca915de73a82097f0e_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_34e2ae2a46c6ccca915de73a82097f0e_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_34e2ae2a46c6ccca915de73a82097f0e_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File created	C:\Windows\SYSTEM32\LOGL2DI_COINST.DAT	2026-08-09_34e2ae2a46c6ccca915de73a82097f0e_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122734\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_34e2ae2a46c6ccca915de73a82097f0e_darkgate_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 40 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	2026-08-09_34e2ae2a46c6ccca915de73a82097f0e_darkgate_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	2026-08-09_34e2ae2a46c6ccca915de73a82097f0e_darkgate_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	2026-08-09_34e2ae2a46c6ccca915de73a82097f0e_darkgate_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	2026-08-09_34e2ae2a46c6ccca915de73a82097f0e_darkgate_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000725dc5da2e28dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dc10341c2f28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008dc6b2da2e28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a3ff84dc2e28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000019cbcbd92e28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000074a22bda2e28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003d2a0eda2e28dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a2073c1c2f28dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
2236	2026-08-09_34e2ae2a46c6ccca915de73a82097f0e_darkgate_rhadamanthys_smoke-loader_stop.exe
2236	2026-08-09_34e2ae2a46c6ccca915de73a82097f0e_darkgate_rhadamanthys_smoke-loader_stop.exe
2236	2026-08-09_34e2ae2a46c6ccca915de73a82097f0e_darkgate_rhadamanthys_smoke-loader_stop.exe
2236	2026-08-09_34e2ae2a46c6ccca915de73a82097f0e_darkgate_rhadamanthys_smoke-loader_stop.exe
1168	elevation_service.exe
1168	elevation_service.exe
1168	elevation_service.exe
1168	elevation_service.exe
1168	elevation_service.exe
1168	elevation_service.exe
1168	elevation_service.exe
3252	elevation_service.exe
3252	elevation_service.exe
3252	elevation_service.exe
3252	elevation_service.exe
3252	elevation_service.exe
3252	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
804	Process not Found
804	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2236	2026-08-09_34e2ae2a46c6ccca915de73a82097f0e_darkgate_rhadamanthys_smoke-loader_stop.exe
Token: SeLoadDriverPrivilege	2236	2026-08-09_34e2ae2a46c6ccca915de73a82097f0e_darkgate_rhadamanthys_smoke-loader_stop.exe
Token: SeTakeOwnershipPrivilege	1168	elevation_service.exe
Token: SeBackupPrivilege	784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	784	ReFsDedupSvc.exe
Token: SeBackupPrivilege	784	ReFsDedupSvc.exe
Token: SeRestorePrivilege	784	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2408	AgentService.exe
Token: 33	5520	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5520	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5520	SearchIndexer.exe
Token: SeDebugPrivilege	1168	elevation_service.exe
Token: SeDebugPrivilege	3252	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2236	2026-08-09_34e2ae2a46c6ccca915de73a82097f0e_darkgate_rhadamanthys_smoke-loader_stop.exe
2236	2026-08-09_34e2ae2a46c6ccca915de73a82097f0e_darkgate_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5520 wrote to memory of 5880	5520	SearchIndexer.exe	100
PID 5520 wrote to memory of 4216	5520	SearchIndexer.exe	101
PID 5520 wrote to memory of 3600	5520	SearchIndexer.exe	102
PID 5520 wrote to memory of 1192	5520	SearchIndexer.exe	103
PID 5520 wrote to memory of 4776	5520	SearchIndexer.exe	107
PID 5520 wrote to memory of 3212	5520	SearchIndexer.exe	108
PID 5520 wrote to memory of 1896	5520	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-09_34e2ae2a46c6ccca915de73a82097f0e_darkgate_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_34e2ae2a46c6ccca915de73a82097f0e_darkgate_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2236

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1168

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3252

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4216

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1612

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4700

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:784

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3688

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2160

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2408

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5520
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5880
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4216
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1516 1644 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3600
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2484 2504 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1192
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4776
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2484 2504 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3212
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 1516 1644 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1aa412fea632d587dca1cb0157b224efcb2bc6e8a798af932a7fdec9e0c25dc9
MD5 369051b0f8957845073f8ecd87f08917
SHA1 7941f4ee209bc2b0e28db043fda514e68e3c1d98
SHA512 7617b1fd48a9f24880be12c42273c542f85fd58f93d4a76d9bbe2523da505150b3444c191e40cc397b059c73e5a99a60cb48780d37cbf990ff02eb65b842b93f
SSDEEP 49152:ub+632BuPkFKRrdE6ohmstBhuXjfS4LWxnhQ/lFTjN4:w3q6HjBVLm
TLSH
T138D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 3f12df60e594bfceec019c1b980aa38dd485a326b27aa74a6cccc4c55ab47f15
MD5 4437652d3d193caffa802de26c30628f
SHA1 f3f8993aad3d6025c85d48be4e08c1c5bb5e9f99
SHA512 ba6df4c0857c5b28ea0b5a0fc2f7839ef126361aa300e09a68f0c61aec44c41aeb79d956c0bf55dfbb9cf43abd2726452ef6b7689a42187283db829d6ccc7269
SSDEEP 12288:B1XLsswWkxy2lRq2czAeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:vXYfDtczAenQ/tbw/2Mkjy6Fr7g0oz
TLSH
T10765F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 31fc4ffb159c085359c26c576f6d950cddd165184465c484625d1c7f7e913922
MD5 2fddb2a908aef275f3d14609472ef861
SHA1 bbe6cf7a3ff0e35c308400e8f88946d11f87735b
SHA512 32b40d34fd3b7fce868a362790fb66fd0521d6f2322e93d37ae6eb12b33c83384cc4c4eba7d9fd95c13278e8aa5a0f7f1a601476a3eeca57759273bcaeee2340
SSDEEP 24576:K0Le5ji0hmxLrMmnQ/tbw/2Mkjy6Fr7g0oW:KPji0AlbQ/lFTjN4
TLSH
T163859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 60b62c2798f82dfd767e2d2928278812804a02f894fb156728f460cf77069bba
MD5 a8b17391042c3546bb577708eb214651
SHA1 45a13df41f8da2b591cd0e7a542ea8e822a59e06
SHA512 2eb349d5481bd4cbc667999633267ac847a0622678eea642fc642e1c843ca864a08301e645d1c9b1e5a2b0d3b3b16da1e39b4afff126fdd1448d11f4e6fd8c97
SSDEEP 24576:Aa7/ezSC6vUyD/aqgrvWE6q8wyuMnQ/tbw/2Mkjy6Fr7g0oE:3/ezSC6vUzPvxHjy/Q/lFTjN4
TLSH
T14E755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7555c815ea82e6ee0e31834514524fc5837d91710f024ebe81366e5546d3e880
MD5 9d0d1536336d68bc2fd96c11dce85d6d
SHA1 548824a533aa06c1389104430283f692770f4415
SHA512 bee14dc41f06f01ec0ab98fd8547718d1070ba5cc7696686075f4ecfa46b46705c622cab966b96e78ea3669ddba34a4a745f30247924ff81817dfa0da6faede1
SSDEEP 24576:JVbqPb88hv/l+6tnQ/tbw/2Mkjy6Fr7g0oY:JVO88hXl+qQ/lFTjN4
TLSH
T1CD559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 ba820ee2ff9836ecb5e4813081aac4d9917fe29c69d8da17572de1e5e3b12e06
MD5 9c5a6dc84ee5f49d41dad1c6251a375c
SHA1 79b2c21f67a248f273078f1e9abeca417461bc60
SHA512 0f316a021c5ff2cf1b2d1d3ea0c12f1ecbd2372f1c267ddd36cf165d072cf9ccb2d3515cb795b0b5d12d5c9b13504bc8816c8f2bdbd1c2d4c989cc5a5c3ddb91
SSDEEP 12288:WziGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:WzinQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1F15523796A24F897FF2B06B15CC284826B7B0EC1BFD5A74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 6ba209bbd65c804ebca44ce80fc47528ea5d895ba0c5e325515e23a9e2f88dbb
MD5 d54c982735ae5629e44b78562011ae09
SHA1 f638560ec6a77aa5ea8badac9b9366405173b36d
SHA512 fcadfb6a2542cc73791d3d5d1ffeefb7cb2fd82d593a59a5914319648f656fff4e9fe93cf44ab9a793ad6770ec1df9bb953b8dd7057f2902cb43d9453e171ed1
SSDEEP 12288:xeBNUbTVO86UVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:xJIU1nQ/tbw/2Mkjy6Fr7g0o8
TLSH
T11C75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f3db13d1425229da15793a0f606f1e09986aaad1174dfefc3310a21d7a08602b
MD5 147b44cbbf0116e1d6b1c161a9e97081
SHA1 c1915d3f027c7e10e2bf86f0a0fe81a0cd3ef13a
SHA512 0cd3f6712a7290b4c8e56390938e9e9494a68149510a877eab771758039a84c96958807e5bf49856c760af13aaa99f0c1c9c26fb2a9942c3ad4d2e0e91d55593
SSDEEP 49152:LQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH9:LQvGAdlCEL8c/yRNw5C/Lm
TLSH
T14C267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 4d00049f3adef7260d37a6cd003e0b83d8eb7232e9657191400e04f727fe301b
MD5 1461c3621c403aa86974c99c0682b6f2
SHA1 bf656b7c4a6b92702ce25c1fb6ea5ac3f55f1193
SHA512 0cda82026d288b5cb1414936ad144df2dce7d751f0e7faedcff7409d21f45c9ec4afe1645442b93c6b05ae6e47941ec9c2cec73087e385a17bfc40d7a0a5052d
SSDEEP 12288:jAwSfxL/2Dc39DLLmt0LDQewsAj7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg/:cQewsAjrnQ/tbw/2Mkjy6Fr7g0oF
TLSH
T17A75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 5d687a2ee9789252a0a6c727339b7aa92cacd3d829d6f53689a6f009afc202dc
MD5 807886a2980f192263659699f26cbae3
SHA1 c20502b306ec8bf414dc7d5414196b216dc0cffb
SHA512 ec8e77753bd917bcc3b8ea3f77f2c08fece948dd6a9f7b030a8e3ad8ced63a4c828cf842aee3068391d0fd7c8ecdf68b3f0bbaaaf0ecadf2b58425f1c3e347c4
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHoL:JUEtQevvqc2W1cpV2EI32
TLSH
T1A2474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 ea271f7d4fd1d6582bd72331ed6906b8b8aa0945d4bebb42d5f173d757775787
MD5 3753d1e8fce34576155be73a717c6a8b
SHA1 1048da4ebf0df58cac4f4ff3741efe53e4fd3640
SHA512 f44a17b1e5e3437d379996c922029cd82bbd6d09d9bd2dbe6c2e8bf9ae35f6240f00de1505b2b2f80d67d56be894a1aec03332cd44e69b9567f5b0054fb55861
SSDEEP 49152:nCbRquA/m2yL5zQfFiV+XenmE3/zLQ/lFTjN4:woqtVjnmDLm
TLSH
T131D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d3f05c15278844459fe55ca416916117e6ae1bca965dab2eb838695987085b2d
MD5 8514ffab7aaca5952861f4a7ea89a322
SHA1 1fd531edb5b65931fe9b45fa9a46c1929c8a9ff9
SHA512 e400e5514e8f6ed068eef341c40d0cc7a9fbd5222286146dd242e23a79a21421aedea8f7a0c920f524702553e688700078a3d8a204afc10e34270a1f5e7d0b41
SSDEEP 24576:PAhGLJIFoiwtA5l7S53QnQ/tbw/2Mkjy6Fr7g0om:PAMyFoiq5AQ/lFTjN4
TLSH
T14735AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 1866b6ac4873f2fd02563976ab66b7be12067b102a053e831b1306868eb39972
MD5 ca5f69673e0840295bfce56c9041ce1d
SHA1 e977439425d714fd98cd04f99e99531095a328f6
SHA512 2d2a1777ed51cad248b92f68ed1f0c8856e6f87f47f28c0c4283613873f5be25c78bd6b2e9faf665e6e2c1fdd9a293929ec59e576e0346064a8029cfe5ad9b2d
SSDEEP 12288:2mw5HEjsChN2BFgl0WDm+CrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMi:vwuHOWonQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1B465F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 568b8dc69b68628aab9d8d82f9e0f8d5673fe57ff2d9aaf896966c14d6f41489
MD5 c76e35827e00daa41aa507d98b1c7e37
SHA1 a4ed968a6eab84a69cd0d8124bd31f114e9dad91
SHA512 06722524d4f54b76b7d847cb9963304792067b2ff3cb0c36f9e3485cac426132a6e3e758b690153880985767d31ff899391bbdfda52058ff223787f3288e632e
SSDEEP 12288:pXZ1IyLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:xZuOnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T17C55126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 27d972aff863c396b6c10ec671d54d9eccfef9d0534ee0ac985f4f9c0deb0d8c
MD5 d2b79cefd6802a16e6a71147749e6799
SHA1 135a39acf44d86edac354338c9915c698eea03fa
SHA512 b25baa0ac81b05ab90a294dadd28535286c85c8c1ccfb880046c483faf915faab7eeed9a08106e51ec224fa1416dd04821691ab2ce55cbbcfb604fa98a9c5c88
SSDEEP 49152:Pj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UB:+QRQyi36YOcPQLvw2gAf+PN3+Lm
TLSH
T187667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2e8ef49ef1adb3625cc7df8e33a623839285f2b850655920fe38a2db2a03f7e6
MD5 34ac622f283082881482c540e48a8e14
SHA1 6c5ccab84a1f25f28e1cc02a74329a22dc7ad653
SHA512 d2a7b9cdbcc25535237919fc5c9a4bb6a305493d3171b07729db1e8f9369cbdce1e5f35ac0f2506c853882a48b1b6440b52ca08375c4c74a0e099fa47a09b2ac
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UB:qQRQyi36YOcPQLvw2gAf+PN3+Lm
TLSH
T1FE667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 24765bfc25257fee81114a246022deeeed893cf6d24c878f1de902ceec9b9abc
MD5 6382070c66f0ec57728d0c53b3197ef6
SHA1 65b75c5faa957cf64a29c428a3761f54ed346e3f
SHA512 4860d626963f8e7470e47c34b28fac2dc27bb6ecaccceeec8e2c4e8bc1ef60f7a07494b6e2eca9f14b93be295270740e62c525f7e61e3dbcf19bbd4831387e75
SSDEEP 24576:3wvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0+nQ/tbw/2Mkjy6v:/68Qg55nhheWu7PNU3/bQ/lFTjN4
TLSH
T1C4B55A33B2F600A9C44DE1769F46872196D27C758FE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 544372d6c23d5650ef055409ea413abd9f2e6c98d20ae4273b447ed73e08edfa
MD5 65cf7aca54143144d98000c485c3420e
SHA1 8a70ac029adc6e28f7465b17c35b9cc3101b69b0
SHA512 579b38587066ca82ba9a0317812bd38b4439ef84cb70c7d6f80462f1ef91466b8a26c4f1d790f71d180b602077ad735b284af0570232169b87ec2833919ea75d
SSDEEP 49152:F3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99j:ky5112gYy5azzVvL69nLKnhZtLm
TLSH
T1CD167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 d51e69c7763595d718a583452fe5f89e49d88b9a73ea18579c2f7c936297acb7
MD5 46562c1b92fd6fd38aae6cb3f00b3496
SHA1 78f6decc1d8b235f4b03de5597d91c442a76081a
SHA512 d5b069343da6129f40b28a3c269ca64b06286313b95104e12fb1574b390c7e01a3a214a0ca060d547f57e3ccd4353ed67960c24775e3f58e33fd0fbe2bc9625d
SSDEEP 49152:QB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gluQ/lFTjN4:Ku6JmVxd2dJLm
TLSH
T105D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a985834da15b5c6f1af8a8b4949d0cfb489d956d77cab99a21e8f62dbc21c8db
MD5 755992035a7c46e2bfb937a41b169a66
SHA1 7e2cac74e771206e08d91499f119dc6de32b730e
SHA512 d20399a13f60506c301cdf78a240fa8fd0b5850844bd87b79519fa9e2ccf3304ea5e59ef4f41882b88bb1d9aa14c6690d9d7552fae799dc26da0d3841510388e
SSDEEP 49152:L1hpsNoJpF1A6UU44CwH7R4xVQ/lFTjN4:LmifPbRDLm
TLSH
T173B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 737c20d0d6bc9749db5ff666c10c26ae8cd3b0a1d8b6f1764e001b87a031a063
MD5 4125e538f1740deb7a190efdebfaafaa
SHA1 6ed3e288b525c3fe90d75dc04e97e19ce73a44d7
SHA512 d7b7d451275d9caf1dad22f90a1609fd73ea599aeee7d63e51a2ed470b1f83196338d6aaf1a06dceeb22625dc39d70b4cf5f050d429b9fd0707cee1d497b7eea
SSDEEP 49152:sSuZQIY0Be2KRRVtOnks6NMHqOQ/lFTjN4:O5dKTi61pLm
TLSH
T13BC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3913c22030c88db69144cc2c4dc222e276521a61f0e6bed092f430d193729ded
MD5 91a4cf12879b5b8f6222d8b4aa1a9b63
SHA1 23a4f89d68df5b2087ac38d34f2a7b981c0dfdb9
SHA512 36652f92c2e1487623b9606a14ba40888951ef794424112c3e2a25f5b51103614501ee14d7af0a9c6a067a6720c6c3d02f81c4f8b54eefa1c811a0c4c09af68f
SSDEEP 49152:+htSn8EApI0figngiDn0AP5wBQ/lFTjN4:fX2iyphnLm
TLSH
T10D95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 bab89f0f7909d9b6787c83de0c87a3bc1e3b2c05b6615a8dca9a5c1b84500bf3
MD5 9ed92d2d77613ac6ab6db8f31642c4eb
SHA1 5835815cb99069ab331ac28a88999dbbd41faa63
SHA512 3f10a6f4c062b203a73aa34a65d8b1385d617001c77833ad4f85b58e08d10cb434493cd933961e306365cb58032df4f9a015fb5a7a4c3d4f967779b2fab51952
SSDEEP 12288:EqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:EqnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1D55523697964F98BFB1706F18C828182A77F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 8ac301759d63881e469130811cafd9a9c059397e2e230c52668926c0e0426bcd
MD5 4cc8ddd89f9968110e0e0a545b466c00
SHA1 45cd3d294ef23231ec3093eadec830470a474423
SHA512 9c166af9a61fb0404a56650ea519b55f35bdde85b9751a5d5f23432d087a13ba0d9c6cd07bbf540b4bd22b409d67863d9d15811715deefc79e0fdbb6fb16248a
SSDEEP 12288:/XGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:/3nQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1145523797964F98BFB1706F14C828182A73B0EC6BFD1938F7B482129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 0b0b3735192149de0a4b78a2ff3a93da1f384c77929dff367a66c20eb5f6bbe0
MD5 b94eb698b79a68eef32e41a33a05c2fe
SHA1 c083ba86e8742fa47a4515d0e6f5e4ea275a588c
SHA512 57d00361ab494019ab9c4c3cb068fa3c5100c54b4339e0f220130b6946db830c29f06e228397d87c7b557bfa5e8491de1e36f7de8867ea755cb71d71bff5dbeb
SSDEEP 12288:j9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:jdnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T16F5523697965F98BFA1706F14C8381829B7B0EC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 334849d73701758fe6ef7aea4b110378a8ad42b80659bc77c593ef6c6da19eac
MD5 07c3ec1f5aad4be707b271f1a3aa13d8
SHA1 f9cd5f8f2073df3d17db4fb6fb6db0296a9598a0
SHA512 af97f9bddc30635fe371c638b8d002cdd65d2620c88ba7aabf254eaae0a7c7f0353d54c238e98b8fe063189a0ab27c73c447191452db7926bd856c19c2d9af75
SSDEEP 12288:iVQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWL:PnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1A15523693A69F4C7FD2742B4CC928142E77B3DC5BBB1A38F6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 0000bfb5082bca20fb5acfddb2efcb20c163566399e464768a51a377211b4c36
MD5 017f353d63a71d807ec75c109169729d
SHA1 90ff6032aad9c06d300e4446589c2979e4246021
SHA512 d3032ccf9aeb8472de8f9366faa3c2b679f6b0a9e323b2b8bfc5a037f65f011c928b222ca9bad097039d61227e6ee986cd4ee94acf08cb8f32dd62743c097b49
SSDEEP 12288:soGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:sonQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1835523697964F98BFA1706F14C838182AB7B0EC6BFD1938F77482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 874a411b0bac06f638bb6a8adf557c97ddd564ed5708a9f859b3588ee31f4926
MD5 5530e3dc7c71dcd6c6ce6683f19b29fe
SHA1 1221db7c5de6c68064ec9207411106efd06192eb
SHA512 0f4102b2f4917fbe1c9ed953265ab38d4042ee0ba6831c2b3b9355f600932b604531ef4b0ef035ed51f9627d601aa9ae93622d74d07aff32f032fc4c932d0392
SSDEEP 12288:ujGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:uTnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T13A5523697964F98BFB2706F14C828182A73F0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 12db65dc967b6c9f3d16413d1940dc847c3d8129d112a52173b5e953c40ef6a1
MD5 2d45be0db122c119b4401a8b956c49b3
SHA1 d4b80e68c6a5147e167eb8c97af161f0697f1ef8
SHA512 6fc62031d2edaea8c7fd37d6397a198aa5df6d3cd262f8d6f527f0e0cfc43366047aa9753fc040a1cfcf6f1c486f095dc9f0993dd12a05a6b08be393568fbe84
SSDEEP 12288:nvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:nPnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1EA5523797964F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 3334f45eaf4ec49a27402c05f4c0039c88d24d6b526c6c328c4395d0defb6b90
MD5 af99e856d64a7724010dc9ebf587a989
SHA1 da85727e5f1fdfb3709e2d2e5958d14cf0d36ded
SHA512 c437c08572e28fd14da8b1197977a055810402f9b1fa083cdcbf119d2380f87255759f96feb30b6091cc8c07de23e6fcb5f11a6cb4a2b129a72ccc9ec02b3a36
SSDEEP 12288:ViZwbDzzFEoS2cPvy3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:YZM3zFVSOXnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T16D7501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 484cccbcfa19fc03b5b6f7087dd18a551915644bc8953e3661e809c83a170cca
MD5 41758e07dd31da9825634bec03d10f0c
SHA1 981c1134d33af0d819bd888f1ed97f3006f1eec4
SHA512 2234f1467fe9517c99d6da579677d3e836ee77f5864262550055af5728e7a73c20fe30ab57c4067b26c98804a4f78661e013aaeb20e9a0e6e1a290f4baf2c079
SSDEEP 12288:XeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:XenQ/tbw/2Mkjy6Fr7g0oi
TLSH
T16A5523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c7e83fed44e499e0f6f2af7299ecb880b4996ed471307eee9120d80b64f1ea82
MD5 bf909476422dafbb8265d477ce4ab1ff
SHA1 2e2eb28ab7172f50418c401fb7a055d4e8e61283
SHA512 dfcf663fb2744a4169c72f8b6b2fa095a27ccc386be5ffaf44b662cb1341a110e7a79b5c8584b53c0d4d4444ebf950f882ae12c54797dceff3ad20812e87c7ea
SSDEEP 12288:fyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:fynQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1905523697964F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 5401f1875b3a8c2679e9955aa8b0b4410395d0431aedecc1088c30e977919dcc
MD5 1cd5eb0b7dd283c7973651543feefaba
SHA1 75df555a7b3c5a8c513f521ecffd935747e7f6c1
SHA512 07ba8feed804301208273c9527f57d65e6dff6552128a05c212819892411f2a5647b1d572e76098474410009c8006eca488796bfef653a94e2bd62c0f41f4b39
SSDEEP 12288:qyPz5L8LGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:3zy7nQ/tbw/2Mkjy6Fr7g0oM
TLSH
T11065021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 520ae5d1ecf1070e82176b4a433871a9774df9c6402b667a9c3e98055aa6f7c1
MD5 fea39fc734e42146f0184515d2d328a6
SHA1 564104a7af5c6a131d68f5094c94cb5dae2f9366
SHA512 37f616d6fe9274b311c05498902a842a299e6a314ff8801437d1ee7176895c12c638f4ec7ac5c012a147b04454aef0ff76a7b13f21aa58b9678756c093a98b6a
SSDEEP 12288:OeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:OenQ/tbw/2Mkjy6Fr7g0og
TLSH
T1A35523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 4035e8ed8ed5ca1793dd28364063bff18d7964fe320d63d72c35712d216c5c83
MD5 f1665d9df70027203e8fe9b55988969e
SHA1 e538e403e02a8bb4773b8d03da59854dc838559a
SHA512 9f8948ce55f7cf99ad21b15bead3684ea403cc6f5492bebe9c49dd845be12e221d641c0366b987e132580d4130f747691d799aed4ec789d112197a00dab82a5c
SSDEEP 12288:deGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:denQ/tbw/2Mkjy6Fr7g0og
TLSH
T1D45523697964F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 793b15802eaaaad671a2021baa8fe6168816a5771e54ad5e75c0e6dd57b37f7b
MD5 28ffcd64ebc0b93ad3457da0c5f2242d
SHA1 e850d79208d062c47b1fc474c1f8b2e691d91ba2
SHA512 2abb5c92fe7e106c0f02e0de41b6e008dd8616efff8f71f70a0ed3fa0d22bd30740594e8528fba1d0990519a96cca5c798cf1ffe7f8aaca8fe12257e845bcbe1
SSDEEP 12288:jyPz5L8LGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:Ozy7nQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1A665021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 ab5cebebc2a84efe97e7ed7ca495bba01a4fa469e4ee322fc3ffc4976032df8c
MD5 e72bd307e6176f9dc25cf6eaf0abacc6
SHA1 60ab4405eb921a1df36e348066eb355776642785
SHA512 70adc0592a6ce5330be2325babb30884af88dd3f7763119eef0f6cfc111b1f9ea3b5f4f50065982b61269bd6052dd8daf1853c6f50c17a635152697f7cd2695e
SSDEEP 24576:bT0aLl3z0zDNnQ/tbw/2Mkjy6Fr7g0ok:bTDLljMQ/lFTjN4
TLSH
T1547501A4B35058F9ED67417ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 a03f3c3fc7b1d7d807205dfbb1560e66e0cc82fbb51a6e329bc8665465d83c35
MD5 c56b949006cd7bb3ef90a6389c227250
SHA1 24c5beaf3d14fe970344af701de89906b09a3446
SHA512 ef23e1695449b4a4a0c7d35d6640e1cec051f379b48e837e9b7b027f376cfdc830e68d4f74acf904e87f9c4f0232fa32c09f1b949a63e560ba60ae44c5875bff
SSDEEP 24576:331d9CHKy7GZpnQ/tbw/2Mkjy6Fr7g0oZ:H1d9CHKyajQ/lFTjN4
TLSH
T15F85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 4a732377bb4674d6ae2aeaba607f17a425da628cac7bd74aef8e15d887e62f1b
MD5 000523a7876d9274a090dfa4146d67c9
SHA1 8864563307c084c9dee5763cbca0cad8d144f7e0
SHA512 75463caffb63a96d48ab504e0d8fec35bbe852d0e8b0bb45d8e13616ce9780b631f6e6b1c53196a7e9f8c9647828d0b025a966a1f40f2b3387ef0d2e2718d0e7
SSDEEP 12288:vdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:v9nQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1DC5523697925F98BFB1706F14C8281829B7B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 c92dbb7c780ca983a8cee5e308a7073a524be0fe4e6defa4793037836db90a17
MD5 0078f2ae179bd839573b593c482e2bcd
SHA1 5fd24321499440438ff9d8d31e95c7ab30925703
SHA512 a24faa92b0ed3fc20a7dc46647484a3b30940d9392209aad9038c11663ee1736812ae85db30f5e56e0513349c9465c335db27bfdae92693816f9e58698ed03b9
SSDEEP 12288:XrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:XbnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1E35523797964F99BFA2B06F15C828182A73F0EC6BFD1938F7B481129967D39406C63C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 f2fdac4bc64fb0656aaaa7694a29f50567818e313bbde3809c183230bc3bb33b
MD5 8de6833e22d1301311c2da2e4593cf12
SHA1 45bd4bccdc694f68f06ebcc71eee0ca80b09a552
SHA512 aff119603dd75d0f9821da123feb4d022f50d4af8f7b1fcbdebaf9d5d9e0fb5bfeb8fd48029d279162f08de517aef96a627f53fd44a41ad07f53e9c064325135
SSDEEP 12288:lkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:lEnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T11A5523697924F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 045c4f6862a2a80a1583acee7dd6c251427edd0cd311797af90f58f778fc943c
MD5 85127e98cd5fd0e72d2530a629ba4ada
SHA1 835d8fc89faf1a40d20d334839016ed927be2b04
SHA512 3e472e16c82e4088f96333704aeafab5eabebd742d364a3494506bd18c9c23003c8eeb37b005cc50f580533142d9ac491550f4625cb57982c978cbc5704970a7
SSDEEP 12288:yeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:yenQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1E05523697924F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 02f5923a06c5856f407cfebfb3722b4ae0653423ba77a0ae130fd40afd4d7dbb
MD5 837acf70a0a21ccf2085d155dcd6a3e0
SHA1 fd1838020b607a4b0b9396bef04145ea4104cd96
SHA512 f9ce6cbfa6bbf9103e6e0bbdd1c4b7d027ace5e8b8c490d2cd73f45c554a8e271779402cadf3a4d411583847a3dc6d1aa0927447900b1f458f479f2ba114f983
SSDEEP 12288:2dGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:29nQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1AB5523697925F98BFB1706F14C8281829B7B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 fb0e472309377d878a502f0ea06b743788a739b1ff6760b52955c02f7092bcc2
MD5 84b9e3d7bc6e68b16b1b60046be872dd
SHA1 5a81d9f53e0c971b60250c94ebc6aca44ebf99d2
SHA512 394337d645333c09a38c9f6aaf512a7b9563a97f9c9e078dae08d48aa8647f40c06b3f3cef809b44c156e4074ceb1429a9185376452bd0c54b39dda68ce49793
SSDEEP 12288:52GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:5WnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1185523797964F98BFB1706F14C8281829B7F0EC6BFD2938F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c2611c5dda426f981da0ed10ab5114a59a8414d47a47d2a4d44ed58979568a9d
MD5 db268c2c49242f4590c60398c0097798
SHA1 f03a2183638058ac41a378b900ef37866baf8d80
SHA512 73ff4e97bf44a15cd7d396c34715d39ae5b7102e981f0699354ef437b67263b233d3138f60414a4c99e4870882dbc7fea7c321eaa449f7d61fbfdaae84b55c4a
SSDEEP 12288:zoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:zonQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1295523697925F98BFB1706F14C838182AB7B0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 697ac5d43b5bfcaf6b544d059da9c548920f802aafa68d68761db084fb110781
MD5 8a41f2a96c6bf75f52b6f083e472671b
SHA1 3fa1c52e481bb5e014aa5cf109bec67a9e9bd5d7
SHA512 7ba6583f7247c84c9c67eda8858ec8a4e995b3cc358e91a79a8923348d83e6458de29c7f2c5308ecaa71777266f8826b64e1d56daad92708d6467d94948188a8
SSDEEP 24576:rfwv/k9RX6wkyAICnQ/tbw/2Mkjy6Fr7g0ov:aMnYICQ/lFTjN4
TLSH
T17585DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 3967bc244fb4a2f1e21ac6fdb28d1f9e44d56a9debbfcfe9c2155f3f35a5fcc4
MD5 d93053e967d4e3b79f74b553c39f695c
SHA1 254df3a96694303a09cf5074d491b4f656c5e158
SHA512 5c51a0634070fcf6aeedefeec464ad5d71ad34da5c1170b6cab0cff776b80eaae163dc8d371e66f712a6a64f7bb8871436792c81a2cc5543a4f18bb804091548
SSDEEP 49152:HYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0hQ/lFTjN4:jySzPeLm
TLSH
T1E5066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 72a4290a9274f00abc8759fd8744c8f10f44fecc75fb20e79dd39ab69c47ca7d
MD5 506ea4115bbb92197ef480e6f300249a
SHA1 69939587e203852ac5a36c3617000f2db2574662
SHA512 89fd79c95721d82781ded54f0da7b0d54d8a7f6fca5f57dd3c52043e1794e0700220064a37f34e0a3fbca3476aaff6297d350ff17f4c238b917c7df9b2dc6c15
SSDEEP 24576:H47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYnnQ/tbw/2Mkjy6Fr7g0oF:H47JUQj1irIhCnDHUPfF/xQ/lFTjN4
TLSH
T12565AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 bafba62328524a73b87b87b962bbc942e6c736644ec827ad21b872c0afeb573c
MD5 d215218f8bee470384e2c5d96091a6ca
SHA1 be2d80266c2cf77d017a8f8b3bec9aafac20c15d
SHA512 cf96b5d0facc794960299dd768d8a452458b8051ecd07387d9c65adfbdb40df6de7284650115c1553b7d5487f4063f25441a9b983028d3d11749734c5d2d9169
SSDEEP 12288:LssfOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:HOnQ/tbw/2Mkjy6Fr7g0op
TLSH
T16565F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 9e47adc76e95d2777ab75277aff8008b760077648edbbe04a470c45906af431c
MD5 d8980d94e91d44b01e1c56dc6fa2884d
SHA1 f71ca160d6bdf29b9a6f8074f7749cef2aae1896
SHA512 1581baede7366d3b08e343ed82eb5c227820b611412b1c998131c51953e47217e2aa35e2df9f1dfc198a8f133fe913b43bb8ee570236efe98b508f15f3523afe
SSDEEP 12288:EqKqiU3fm2EbjtUi7msDnWkUuGyXK5TsehFLW+FH:EqKtUPOtUi7msDnWDuP0TsefLWK
TLSH
T10C351800766BD75FC6AD50321E36D5CCA7707D41EE05AB0372C9873EC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 9066f80a077ac630cd41e4b8a75c74adc6f6927f6b4da9cd5506936c8a9dc8ac
MD5 e92b25b5690a09a0073f3fbea22c2ef8
SHA1 9074b4693c6ab7646e84689d2663177a03fb8136
SHA512 8ca0b504419778b757295611f1b0ba375fdfc4814751ccb761dba03741371ca57e6c8f06d01c5a10513fcd64119ed7587d2f1e6aa4b374b46aed2511f0744dda
SSDEEP 24576:2OUi7msDnsUi7msDnsUi7msDnxUi7msDnkBUi7msDnjUi7msDn4fg7Ui7msDnbUD:2OUi7msDnsUi7msDnsUi7msDnxUi7ms9
TLSH
T1D065C7815537A38FD1FB6032072A6B4CA7A8DC4777096F26B7C8053AD827B2570B93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UIU_INSTALL64.2026-08-09_34e2ae2a46c6ccca915de73a82097f0e_darkgate_rhadamanthys_smoke-loader_stopexe.LOG

Path C:\ProgramData\UIU\InstallerLogs\UIU_INSTALL64.2026-08-09_34e2ae2a46c6ccca915de73a82097f0e_darkgate_rhadamanthys_smoke-loader_stopexe.LOG
Size 9KB
SHA256 e421763722d220e6cd62e08c1dde9eb787be86754639ba6925f578d4e442d2cd
MD5 299fec4c5887d77ad30a3bdaf082b8a0
SHA1 dcf569d04a065d37a73d04a9d8d65637eecf8ecb
SHA512 0a9d733f84e564324d3019b7ecd93e9a86d2125e9af4b8bc6417a48599f2f84225f36bc86ce52c7dcc6b293ac6d50672ee924aa8c99846e5f791e7c0acb2e566
SSDEEP 192:4cTM0Ovyxl9iXAq+5GQu0mG/ul9O90fXhwg7hs7LPUpLRtLeWxvsN1PjuCrouY1d:4owyy
TLSH
T15822074E0F4597D41985467B027AEA056050AF0D1B13EBB376AFBBEAABA0014FCC477D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWow64\perfhost.exe
Size 1.2MB
SHA256 669eeaed9b4b21be760b454ac8fbe3e8db8ad71c70a4cdad93bda9b3030e6c8c
MD5 335c7dd7ae7b4343a3b520b58c427429
SHA1 57c86dd0ab27a40d286b90e073c914ffdc41aa73
SHA512 59eb2debecb45861deb287a53299d007a9d516348137d8124812edc12fb02b50c1e54ffee4872881dd47f4fb8f816f7377c066f7486b931ddc10c719035ddba5
SSDEEP 12288:k67ZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:vpnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T1DC5523756668F94BFA3B06B058928111673F0EC5AF90D3CFBB082269957C3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5fed1bdbe81fa3188b992092ac57f044502fc74bc9422967d27ba5c427bbe71f
MD5 fed2213fd7808e2cad50440bf23bd72e
SHA1 0931639ccdc2442c244e73d559607ebd378f6237
SHA512 488f423dbc289c16483c512f36c1dbab1cfdcada1f30a9d26d1b903c8ad11d79cce524f341cb02ce1040edbc9f80a857f7384224615c14029d5a16b14affe586
SSDEEP 24576:zgb6bmBIi49WNNFpg1rSvFv7bYMnQ/tbw/2Mkjy6Fr7g0o8:zgb4mBIBhGFnQ/lFTjN4
TLSH
T1AB65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 081209d7da627913d0266ca14ae756e407542394b1cb9ecf8434ace4228da4ae
MD5 99a9bc09407274e5b632d4065b2d683d
SHA1 08fbbc65fa5ef0986402444bdad836bf16aca4c9
SHA512 14c5919392c84df714313cd26f2d63d48bea9b6129d156df563158c8d0bfb00f6c5be8bc92fb875565938875ea2f516bb9b80b1aba3d0f558b46afe5bfce3281
SSDEEP 24576:pG88u8FpJqH1Qzria7/mXnQ/tbw/2Mkjy6Fr7g0oN:87ZFPqVva7/kQ/lFTjN4
TLSH
T1E185F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 c5cd62c802b64001e4d911a84472423d9a47e8660d1277ff43fc437da0f238e8
MD5 2ca4513ab671db7be6c621c6615a4637
SHA1 fbc8ec00cc5a5f66852c8b5a3ab9904e4eb072c8
SHA512 83a1f095f732ac1260ea0b3cfd7f67832d50a00c877f4f2b4d7dea15fa93acf7db4871730aed4f106f3d9e4a12e9ad808c78a398c5e0fb9117234784a9686b73
SSDEEP 12288:OHvUrBFrEjwaQsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:OPUr+NQsnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1C265E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE86D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2fcbee362c83a2c5861e015a486ce4b71723d373a3d8ab36f42ea8d493f6b518
MD5 d6b0ff2a603010fd9cebd5e83deec6a1
SHA1 10c70d00cd5ca3d50e52d01466d0cbbbd7f1c4fd
SHA512 982f41fa601f561080bdcc860674e9512c7703cb39b8085b818d36d50a361b46b7c0302f2cdf0a67039629a497d32968ee81d07fb91d462bfe46b0a772a95b6c
SSDEEP 49152:GBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjTQ/lFTjN4:pG05lO43b1Lm
TLSH
T1BED5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 26c3f5eab650dfac673fb0f94f67dd538539f183edd4fae15aebac515326a556
MD5 3bd2215af8b55c7cf4b638b3abd6f909
SHA1 136880c6359a323ee4eb7ff5f6e792d2bf5e1889
SHA512 b775d493fa4cff686a7be28fcfbc6a3bd6fbf813ccb3d04aac1133fd19aa0bd1d67aced7bdc45c70c1dfa209841107c4e79eb268db0cd019f7129f3cf680ebf5
SSDEEP 24576:pfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnhnQ/tbw/2Mkjy6Fr7g0oQ:5a5POZ3+Jt2pasx2+mbQ/lFTjN4
TLSH
T18665AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 086e618668146f946ddbc078f5a710c2ddd487b361d7e5f4f38296eb7c7a0f1b
MD5 499d83a918150ede97bedb9fef3cdcf8
SHA1 c9841a128c5c5671d6892254ddcf19623fad57cc
SHA512 2e2b79b71e9519db6a1be3b7d980a0366de2cd451aa433de324be17acabb8c041561cc1a6e9c071706d568578f7abb0382eefa4f563f45f9234ea05e914a9cb7
SSDEEP 24576:RNcwHdjbyQ4nLC18lb/EOjowL7Fk/nQ/tbw/2Mkjy6Fr7g0om:RNc/zEOVHFEQ/lFTjN4
TLSH
T1DF858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 7a1bb39aac542b645d93aeb266449f5e5c9f298191a80a9f15450796e0b6027f
MD5 25d063406dbdbc12c3bc6c08c3326e07
SHA1 b10af28166b6b7bf7c34ea57f945549b44015f99
SHA512 2a7430d293fd5cf432de7e57067d5f5e3d0052587909f78728e8867d85e22789fd769c8f4f77c9afc652e5c4be3e3abf35188c15462c77559286f2138c224f5f
SSDEEP 24576:D8kNvNnaFeYhJNtmZBmCnQ/tbw/2Mkjy6Fr7g0oB:D8MwBtOmCQ/lFTjN4
TLSH
T17455AF2EBAB846E4D1BEC6B4CD238512E6727451173293CF5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 476ed54bd4e6399654d7ad2523cd273bec68ba235ebb84bd7c910e19dc1b19c2
MD5 82698477ca1cbedb3a5f79a1c03d8aec
SHA1 19c6c873629113e518097c2fe7807ac66feeae98
SHA512 1680c94cf83ceaedc69a5ba51adfe71dcab22d31b68126d5581ca263639094ec2a941a44772bd74bf849526cabebeb26950933ea3fb48428dc2c271233cb8d20
SSDEEP 24576:ZD3FHshBIYQgAKnQ/tbw/2Mkjy6Fr7g0o6:ZDVHeBIAAKQ/lFTjN4
TLSH
T1D775E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/784-443-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/784-424-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/784-211-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/784-205-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/784-204-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/784-444-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1168-16-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/1168-15-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1168-224-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1168-22-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/1168-24-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Download

memory/1192-441-0x000002C892C90000-0x000002C893310000-memory.dmp

Download

memory/1192-509-0x000002C892C90000-0x000002C893310000-memory.dmp

Download

memory/1612-330-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1612-128-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/1612-61-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/1612-67-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2160-230-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2160-426-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2160-238-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/2160-232-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/2236-196-0x0000000002180000-0x00000000021E0000-memory.dmp

Download

memory/2236-0-0x0000000002180000-0x00000000021E0000-memory.dmp

Download

memory/2236-7-0x0000000002180000-0x00000000021E0000-memory.dmp

Download

memory/2236-8-0x0000000002180000-0x00000000021E0000-memory.dmp

Download

memory/2236-6-0x0000000140000000-0x0000000140B50000-memory.dmp

Download

memory/2236-194-0x0000000140000000-0x0000000140B50000-memory.dmp

Download

memory/2236-202-0x0000000140000000-0x0000000140B50000-memory.dmp

Download

memory/2408-242-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2408-243-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2408-251-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2408-253-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2408-249-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3252-34-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3252-229-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3252-28-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3252-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3252-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3688-216-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3688-225-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3688-222-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3688-429-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3688-427-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3688-425-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4216-59-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4216-40-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4216-48-0x00000000023E0000-0x0000000002440000-memory.dmp

Download

memory/4216-42-0x00000000023E0000-0x0000000002440000-memory.dmp

Download

memory/4216-57-0x00000000023E0000-0x0000000002440000-memory.dmp

Download

memory/4700-192-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4700-187-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4700-195-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/4700-410-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5520-259-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5520-265-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5520-258-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5520-430-0x0000000140000000-0x0000000140172000-memory.dmp

Download