44ed289d218a260cffb4687b02283ac5bb1993a3e0147447aff3f5100d176a34

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 18:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_0c767fbf98a63e538bcaa140c671b185_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stop.exe
Size 7.9MB
Sample260809-xg5fbstflh
SHA256 44ed289d218a260cffb4687b02283ac5bb1993a3e0147447aff3f5100d176a34
MD5 0c767fbf98a63e538bcaa140c671b185
SHA1 7f32e62fe3943634f9265d6714d64f29ad958d23
SHA512 b5c0459e26081c876d98237aaf32728649acc9d87c3e1e44a0940624caf0478cb7bfb90a0c34f6ae2b8f3e0c5106f38f3df15b07102e7607aabd8c53e5bcf765
SSDEEP 196608:5YirUUeUinB0BtcLflcJN99IAP3VZthxaKkBw99BCKgdA3SMhhZZiyc4ooKoC51Q:OUeUemDzT9H3GoAOOD
TLSH
T16786BE267B918075D2733231955EA3F5A1B9AE315A34428BA3913E3C3D701E29D3E72F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5752	elevation_service.exe
2772	elevation_service.exe
4344	maintenanceservice.exe
4240	OSE.EXE
5036	PerceptionSimulationService.exe
6260	perfhost.exe
2656	ReFsDedupSvc.exe
4568	SensorDataService.exe
4372	ssh-agent.exe
6916	AgentService.exe
5280	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe

Drops file in System32 directory 48 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-08-09_0c767fbf98a63e538bcaa140c671b185_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-09_0c767fbf98a63e538bcaa140c671b185_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-09_0c767fbf98a63e538bcaa140c671b185_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-09_0c767fbf98a63e538bcaa140c671b185_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-09_0c767fbf98a63e538bcaa140c671b185_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-09_0c767fbf98a63e538bcaa140c671b185_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stop.exe
File created	C:\Windows\SysWOW64\LOGL2DI_COINST.DAT	2026-08-09_0c767fbf98a63e538bcaa140c671b185_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9eecd4a6957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-09_0c767fbf98a63e538bcaa140c671b185_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-09_0c767fbf98a63e538bcaa140c671b185_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_0c767fbf98a63e538bcaa140c671b185_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 40 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	2026-08-09_0c767fbf98a63e538bcaa140c671b185_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	2026-08-09_0c767fbf98a63e538bcaa140c671b185_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	2026-08-09_0c767fbf98a63e538bcaa140c671b185_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	2026-08-09_0c767fbf98a63e538bcaa140c671b185_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006f02bd003028dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000025f4d9003028dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000006ed03423028dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000463122043028dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000db0bc7013028dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000409624423028dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
6296	2026-08-09_0c767fbf98a63e538bcaa140c671b185_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stop.exe
6296	2026-08-09_0c767fbf98a63e538bcaa140c671b185_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stop.exe
6296	2026-08-09_0c767fbf98a63e538bcaa140c671b185_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stop.exe
6296	2026-08-09_0c767fbf98a63e538bcaa140c671b185_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stop.exe
5752	elevation_service.exe
5752	elevation_service.exe
5752	elevation_service.exe
5752	elevation_service.exe
5752	elevation_service.exe
5752	elevation_service.exe
5752	elevation_service.exe
2772	elevation_service.exe
2772	elevation_service.exe
2772	elevation_service.exe
2772	elevation_service.exe
2772	elevation_service.exe
2772	elevation_service.exe
2772	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6296	2026-08-09_0c767fbf98a63e538bcaa140c671b185_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stop.exe
Token: SeLoadDriverPrivilege	6296	2026-08-09_0c767fbf98a63e538bcaa140c671b185_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stop.exe
Token: SeTakeOwnershipPrivilege	5752	elevation_service.exe
Token: SeBackupPrivilege	2656	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2656	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2656	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2656	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2656	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2656	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2656	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2656	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2656	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2656	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	6916	AgentService.exe
Token: 33	5280	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5280	SearchIndexer.exe
Token: SeDebugPrivilege	5752	elevation_service.exe
Token: SeDebugPrivilege	2772	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6296	2026-08-09_0c767fbf98a63e538bcaa140c671b185_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stop.exe
6296	2026-08-09_0c767fbf98a63e538bcaa140c671b185_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5280 wrote to memory of 6604	5280	SearchIndexer.exe	102
PID 5280 wrote to memory of 7060	5280	SearchIndexer.exe	104
PID 5280 wrote to memory of 1168	5280	SearchIndexer.exe	105
PID 5280 wrote to memory of 5520	5280	SearchIndexer.exe	106
PID 5280 wrote to memory of 2432	5280	SearchIndexer.exe	110
PID 5280 wrote to memory of 7040	5280	SearchIndexer.exe	111
PID 5280 wrote to memory of 2920	5280	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-09_0c767fbf98a63e538bcaa140c671b185_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_0c767fbf98a63e538bcaa140c671b185_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6296

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2772

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4344

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4240

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5036

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6260

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2656

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4568

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4372

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6916

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5280
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6604
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:7060
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1168
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5520
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2432
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3048 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:7040
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2936 2896 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 3c4f60df714a39189eaf9038cec6ed5e009f9ee60516164751f9cc315b37b303
MD5 bc828065becf5e40349aa4a5afd28421
SHA1 c6d4caa854fdb9d4df649e76a16207756cb21a74
SHA512 24dd6fb7e6ec51e358677a5ceb1d2c487a3c0d66f03f75d20673ffc80baae5b8cdc67d6a5cb7ae2cb34450830fd45a7102b27f253ea3eac3bc37f181923ce3c0
SSDEEP 49152:fb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnKQ/lFTjN4:d3q6HjBCLm
TLSH
T1EED58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 6bd223b55b6950f0e3d58aa1050e4ab0de01f7793e27cf828383ea3590d5bf1c
MD5 86b763508cc3c457fa6bc794569ea989
SHA1 b7544350ff7158f30297648df89b80632a566df8
SHA512 391e3bf4817b5dd3d7576a24e223f771d60a4d5d0fa1f0ad927edb60249eb9c11ab1202f9578797c71ec6a265bdd8b300d56817945a7d3b700565e8eb2d51462
SSDEEP 12288:z1XLsswWkxy2lRq2czA5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:pXYfDtczAJnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T16A65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 24ec364f50bd16e4fe50ae0d41ffea874f6e96a0c9a93246548a8c738b5e163f
MD5 6f5a04361eedfdcb74faba19681ddceb
SHA1 a07a1f34798ea425cfd4a837f2de3ff08ddfb146
SHA512 2929f9bfb3bb625ba1067fe34c7b91f23adc9f60f0b98dc562801ea0b3aae7763fee8773eb9dac1b48f4cc39c2d4380393e85fe950f9bba0f792cbe5db705ff4
SSDEEP 24576:c0Le5ji0hmxLrMXnQ/tbw/2Mkjy6Fr7g0oK:cPji0AlaQ/lFTjN4
TLSH
T1F4859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 dff595208ee24f465542f81b1bc7efa613f038d05cf7621b0c5c616961d0fa47
MD5 c283cfa309ff2c960ac40f3cb6beb95b
SHA1 dcdbeef87b333abb98fb717e03c376bc79f03368
SHA512 3a6611df5d02d95bfdad956b2871d5bb0c5b1dcf672239ab3d1c3bf6955a7bae7a8b85e277f3746619edcc68f49c3f6ba17bef275c5e507d2da19e75675a2e87
SSDEEP 24576:sa7/ezSC6vUyD/aqgrvWE6q8wyu5nQ/tbw/2Mkjy6Fr7g0o2:L/ezSC6vUzPvxHjyOQ/lFTjN4
TLSH
T10B755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 41a7f4915a1d41b792de65aacadafa010cb2a90353f85057e217d2e9ae9402e6
MD5 57a737913b314a1228a23017cd04bbbe
SHA1 e5f894ccb81e6d58efd23f95e0a7766d6d0aaccf
SHA512 538924387a7db19f64671143d9799a53d58c9e564268d8880351f6cb9228ca11127373313995e9016f7301e8e9485c4f6654dddd1672e887f605df45b29aa457
SSDEEP 24576:hVbqPb88hv/l+6AnQ/tbw/2Mkjy6Fr7g0oo:hVO88hXl+bQ/lFTjN4
TLSH
T15D559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 a88f8e88f1d6b0ecedd2ed28155f65a5bd5cb3746d095b3705395b27e128cac9
MD5 8f8279df7b74eacd1c0c2a5a83389d5b
SHA1 d55fc3d0abc22874e8983b80a4d4db8a67b29d9d
SHA512 4cc4c2c8f8e26c5c937361d7bd3008712965fc7d9307374d65fa503f9f6e5d9c7b6a864e8095f9b63df31457ea77566af4cf16d14e0563c73e4dbcb26263266e
SSDEEP 12288:+zDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:+zznQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1165523796A24F897FF2B06B15C8384826B7B0EC1BFD4A74E6B44362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 21dace3ec3e5b0bb5bd52de47090b6e88ccab5fb8ba7ff9812191a763a8372e6
MD5 670e4a484f74643f713d4f4fae013b30
SHA1 872eca9b411c5fc01c7b29e47d87658ccd5fbe31
SHA512 ea643e18e8438b576fb97e92c4e7f2456b675b700b455ceae21033e18c8ba2be5b63bc11daebdfcfe1c000ad3e0cdf5470dfbf3e0bf3b08da0a887ca8d76ee33
SSDEEP 12288:FeBNUbTVO86UIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:FJIUInQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1F875CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f9db1712840fcbb6c67020294e0e205d92b2a75e8dbcc31452f56bc277bc7cee
MD5 f8441edc55be9ef66e633c43387d4be5
SHA1 f18a6ba045e551abea0f5c8628c1693322222e0a
SHA512 4a649d1f6dde4ec8b581adf78cdc21fe5066bdfd48a077b661b062dd09805eb243dc79c54405d7123233e5e08905b4c1f084a55b9911264bedcfa81203f30896
SSDEEP 49152:NQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THG:NQvGAdlCEL8c/yRNw5C+Lm
TLSH
T10E267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 4451d93fee9cafb615d44c1b1413640e1eea05871dd2d5135a075620f7ae946f
MD5 1cad5c94819d23054e472f761a3ecd16
SHA1 a3594df2e01053c1724896bbba303ae950a18256
SHA512 80f0adeb7198f52f91c44c4896b1822e350a7b2e8e459794e3c8d466893c6badc888f3580adf067d12271d6113716e4c68812a851cf95c7355720de4112c57f0
SSDEEP 12288:/AwSfxL/2Dc39DLLmt0LDQewsAjqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgy:IQewsAjqnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T13C75E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 57cb5a99beb3bf0694dd60f98cc3ab63b4220c83fd05a414fc8c10867604ac82
MD5 d16f30382c982f66b1b4b9ebbefc23fe
SHA1 d98be580f175d737b5901f66dbadf3fdfdab6daf
SHA512 1f85ba8509bb7f33e782999c18d9392a899e531cc0deb58310afb679bc85251fb6dd9ff57b31e429d1494185ce548b059685ec4ed1d152ecd05944edb9b0b594
SSDEEP 196608:wUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHNL:wUEtQevvqc2W1cpV2EI32
TLSH
T18D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 49d30c89669c08a7c377f678f17d23802757ea952d18c701715dab198bfb658d
MD5 77ab4498cd3d88f61da0ec7ee2f03ba0
SHA1 4084ffb237c1f9561ff331ef9bc2182b13e6874d
SHA512 490aa8d9888e1700c640ceb98271af9e0975d7831120b7e495fbfb5736247800c302d7bc09a10b6fb4d34f52b80a9e2d7bfdc3286f2d4a3e373be7bfbe464773
SSDEEP 49152:ICbRquA/m2yL5zQfFiV+XenmE3/zKQ/lFTjN4:hoqtVjnmCLm
TLSH
T10CD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 e7a80fb9644fa35c69e65d4a2487f1a7142ad9c0f0e4c1056146da7dac42c12f
MD5 0e64f69ccaf6ba23946029c51184b94d
SHA1 bb98ad31d874893cce2ce1b9a339a541e5b603c6
SHA512 aa3026fafa37d608ac21518012b13b00765862fccae72adfd89b0554bc205572930720ebdd8af19a48c7f2f7e685c5534cc7b8698114b390b35897489e07b2e4
SSDEEP 24576:ZAhGLJIFoiwtA5l7S53tnQ/tbw/2Mkjy6Fr7g0oE:ZAMyFoiq5dQ/lFTjN4
TLSH
T12435AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 89b8830025a8410e8a15845cbd81a4b685f2405826969f6508e9019017c02d23
MD5 edbfb3ac312d66506dd7c43ec2de63b4
SHA1 7fda8383851ad3e575b0aad08b7e39336ab54e7e
SHA512 0126c332b091fce27e5af2d7b881e22be760bfbf8714c157e3fc7b0b92b66c8368c65c8b4ae87a0eb423d7750630740b3924dedd9378b771c29b41f2bef443de
SSDEEP 12288:8mw5HEjsChN2BFgl0WDm+CkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM2:5wuHOWLnQ/tbw/2Mkjy6Fr7g0oL
TLSH
T1AA65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 5a5fe83f57340e955b04eea5d5eb442e9cdcc530bc6e080488253c20c4686ce7
MD5 a9ff7dd8702300dd95a34f4bbe630f7d
SHA1 e2d9ab1a1c94407669dab3279646ac87f760527d
SHA512 7c7afb4fa97c156e449c548824f7a2488d267e2214e000168afdc8ec87a1a64f81eeb000a7abab89d10169dac11255335a8cb3672ae35435a4ff7caba0639b1c
SSDEEP 12288:sXZ1Iy6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:MZu/nQ/tbw/2Mkjy6Fr7g0oB
TLSH
T18D55126A37A4B0FAE6674278CCE28646E7733882677183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 66f6090c160a2a70549666fde8fde41b6ac1d83fe168970525b25afea7762dac
MD5 23c2981b3fd4e1569de88e43318a99f3
SHA1 fedea7e01214d1257395f38f9a04dcc180cc7280
SHA512 1e33ed3464cdf953d76561784a496d787a964b48074bc44e9ffb10e14fc01dace1b11dd9370f30bde246ea244ec9b28a30caaf194f12edb5fab990cf3261841a
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U6:xQRQyi36YOcPQLvw2gAf+PN3fLm
TLSH
T114667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 8b95401780110e05593e7efadb35cf9629e6b4dc9bd017ca6fa063ea347e21da
MD5 69bdfca56de86211e048738cff42af36
SHA1 334a4fcd5228e98db35debe05298583a19cd4889
SHA512 f4fad8847db3e99953509b1760c5e67c81b946f2cebbd5dbac40bc43d0896a5997e03f346db5b259a430a6d2a04840c792b95dc21d1ca5993c79b8bf24a3c1c5
SSDEEP 49152:4j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U6:/QRQyi36YOcPQLvw2gAf+PN3fLm
TLSH
T12B667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 370730449015051a1035213e8d4035aae4dda7a5693539b071ac90a961659e62
MD5 afc68e8bd4321c507e62fcd91c5edd9e
SHA1 3bb6390e71ad8b4949676e41b998ba3814011642
SHA512 3d1b78293e311d1af8dbe7fb083eee0e8a95369a24be6222525f74540671fa72d36c672283c3630652cd80db5d9bbe4e924f88b91b34d0385f8c1cc894209f8d
SSDEEP 24576:pwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0vnQ/tbw/2Mkjy63:168Qg55nhheWu7PNU3/aQ/lFTjN4
TLSH
T1B5B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 2c86543facebff4b56fae1a519ee9c82880ec61e811a12af0cb424e953017e52
MD5 80510ee71854b2a2edecdc41bd4f7225
SHA1 df1f09a46ebb36ccfc1b029e4b379b3a95822075
SHA512 ee478932d6b7da37e54fb39409468ee5406b6d02e4107af7a2b1bc5d2bf235ab5cdc6b17ebf7cfe87fbcd77697fa3a40812c859992c3c692bc00e91300a53670
SSDEEP 49152:e3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk994:fy5112gYy5azzVvL69nLKnhZYLm
TLSH
T1BD167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1b120dbb87eaa6894d1c1446ff89589bad7d55280f20e4c57b8ab619f438d0dc
MD5 d977114efc0d25c33431d250b9cec217
SHA1 fd74200200c1017104fa3f71d7824529fc1311f8
SHA512 9ff82677d6a702a2e75996db9c9d03e17bd6e393c6443131b3e16d86981fd41badaae20924ac3f8cb1306e4245995ae991810a52cd377edb668435f3db6c96f6
SSDEEP 49152:QB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glZQ/lFTjN4:Ku6JmVxd2dOLm
TLSH
T185D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 723fc82a67f3f47098de9b2acea0ce611a05b7eae7a813455b759e72a5816b9d
MD5 66895b33c513df652aa6f5b586709a03
SHA1 61775ea65532a483e323dfd94085205a499dc255
SHA512 0152ad77a5d4dfc0fe6afe11007f5e07fe392fd17be80151f1573474768b5a8da049b2394f97b779055db510346f2b3b01ab9a8c8a30c06e9cd1e6e8a6051ee5
SSDEEP 49152:P1hpsNoJpF1A6UU44CwH7R4xoQ/lFTjN4:PmifPbRCLm
TLSH
T165B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 0a67c7ba6ea4ade85a89fd8c9b845a51e4cfafb3559c2f4a3dbde4b1d3b91bfd
MD5 a3083501737e67963a770ddee52ce09c
SHA1 20cd9efe1d298fd3e9928e07e452f2ca2bd8e552
SHA512 fba63d10104c57ff476a232812ca3099f2aee968ef4fe746050b0b713086c6f5f0d91657d79a039bd47e8000fd01c08b0ffa06a88c7ab16837b2e37692e4fc89
SSDEEP 49152:7SuZQIY0Be2KRRVtOnks6NMHq/Q/lFTjN4:p5dKTi610Lm
TLSH
T194C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 35ebb8fcdda2ed623fd52670809cf3460818d8edd3fbedff303cb64d8123e8a0
MD5 05652f7ec45b49c9b7a124029a453ae1
SHA1 a331cdf9785a3186d3b5777ddb492d66f5828b13
SHA512 40a5a2d5b1986f6f05174156b38f8e406080ae19b5ffdaf4724f5bab7dcf5c4238da6c44a176f302474111cfd2786763bf2a6bc4d8328f3df4ff962d6eb7ef0c
SSDEEP 49152:9htSn8EApI0figngiDn0AP5wUQ/lFTjN4:sX2iyphmLm
TLSH
T13995BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 8f69ae97ece5342a12e20b1d2e37ee16839a9210118886d7a46331cf0d945947
MD5 ed478cbb188735082721f2dc21c73c1b
SHA1 a15d8b233e13c5a8d3f620e171e9d5f3d3009772
SHA512 c4f9c01df034222f6cb8a5386915fbda0f0faec5ed6d4c5f045993eaf32b0ad966bb4bd656118f00de51d55af5d5034f6a6a3a7e7489f0a4d1bb2ba2f7051722
SSDEEP 12288:PrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:PbnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1785523697964F98BFB1706F18C828182A77F0DC6BFD1A38F77482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 6075976811c7305e35b0c80fdc95995b7887d037d5169b36d723879b63cdd055
MD5 97ad6aac26db9dbacd5f970300086d12
SHA1 c8b74a572da0581279c756b795285dabe140f60e
SHA512 10266d313f844190b3f9485d8436872d3a18c189c4054cc917231dffdc39a9804ee0363a7c8405bc65e7ef292f327598ba2f044cfce844b646d2888ac7690ae8
SSDEEP 12288:tmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:tGnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1985523797965F98BFB1706F14C8281829B3B0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 a1a7b09efa02221e2eadee284b79096db2370944badeb8f268b28e3e7c6b3540
MD5 542a330201ca5fcaa2fee74207569d21
SHA1 d4bc09e453871650a27b3201169dcf6538e9b0be
SHA512 af0e0fe7c0f2b337f44bce4c90ebe3fb2d1fa1ce860e36495fcdcf3d4e97f6d50b8ae18b6a43fadb24d4b3c00ae513eb195774cabc2be8c559f8590e59c08652
SSDEEP 12288:lQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:lwnQ/tbw/2Mkjy6Fr7g0os
TLSH
T1585523697965F88BFB1706F14C8381829B7B0DC6BFD1A38F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 f082bb78cf3abad00dfd36a871843cbab30f957d9151056ba312332085c3fbaa
MD5 56f7e83fdffd99ac98e1f2711c1b80c6
SHA1 c0d3ecb57ba4a6c498254949c2887427cf772dac
SHA512 99cd63da79150d4e5f39a976881c6646fec10ad6331d44ec9331d0e29c233e5a6d6e8a9cdfe12c122e988e340ad2d7ebecac717017e41333ab6a18ec4df467fb
SSDEEP 12288:HVtGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:rnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1595523693A69F4C7FD2742B4CC938142E77B3DC5BBA1A38F6B04111D4E793D41AA5B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 582ace7f614492a568677d9fd2aebdf6de1d5f79590c7c8a4ea75eca7538fd74
MD5 4a25075774e20f5f01ac83598e543af6
SHA1 9958d658a0ee29dbfec5669ab4e40ecba4b2f658
SHA512 db1209fb686c501df82e1ae184f2439d93a67a4d0c8be05f3c2c95f7093a403eee00939d9c251411f0d824e5c0fca260d4bdc83fc7933e2ce65bcd236f47a0aa
SSDEEP 12288:YlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:YFnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1E85523697965F88BFA1706F14C8381829B7B0DC7BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 dbe1812c8fe3a8a03be783fbf83be4c9e3b7c08d0be604112966728b888e096c
MD5 1cd9136ce27a19dbe3c9e91e7e2de2d4
SHA1 44641a00d546747d8ffb21b4de807d8d8e9e4508
SHA512 3412fabe90b438cf04c5d090692662780288479f62b12665871a03a3172db6a252b98898734f0956b7d7ab24311434870377bb6d394f9b4f4f67d004df3184c3
SSDEEP 12288:pSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:pSnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1CD5523697965F98BFB1706F14C828182973B0EC7BFD1A38F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 806d4691b298fe8a592cf159fd1dc3a6c12001ceb1319e9cd0bed3f3f2c201dd
MD5 7916e5e02cb256a67da4245dfa400ad1
SHA1 a4c7c59e906a8c60b23397e23c022547e1d38447
SHA512 0bf7fcfd8b012769902e33863565ab564a1e65c85d301d3c1fb25b348f239fd85d02a6053249df8c201510d79aa1d8eeb11121801ee2d7fef076c51ae57f3794
SSDEEP 12288:GeGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:GenQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1AE5523797964F98BFB2706F14C8281829B3B0EC6BFD1938F7B481128967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 a592f1bb97547237e954da2fa6b5c894fa497fc8bfed85fa1d75d27d07477b04
MD5 7a8c7fff07ed079e5b655acd2fb8ad81
SHA1 dbcb54e6d6b8b3843ba35e72394255a47d3a0e00
SHA512 d9e7d254c43a7770a0f5b92b844e9d921f6e663413e4a3cbc91a4ea154448862d38f0a6eb4b6557760fc3575e79fcc53300273fa14fca277867c692c18ebd64d
SSDEEP 12288:qiZwbDzzFEoS2cPvyGGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:NZM3zFVSOmnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T17C7501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 ca666d8435f985e0b63156654254089502197fc80d0b2bdbca6a755a5e40cc17
MD5 d3500e0f3f217c12ff3714cc13ada9aa
SHA1 13e3e53c8880785484936741e0ead8a1de2e92a8
SHA512 42e63d5f08b61d143ddb0f8e1f2a33f58345e282007aaf683788d21b2cfeb5ebe6d68be1df99d78c36d92a875edf6351e22a216cd04f2956f890c515f14a659c
SSDEEP 12288:AvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:APnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T19D5523697964F88BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 84ed99df3cb7a721c49f9487fef32ca8992dd8f33b01e6b468002c3277f86492
MD5 e3d0b3934e2d5cd964c717cf49202589
SHA1 6c31a9b119b91d5a0163c228bd94b4db0ffe0fdb
SHA512 277437db7172bedeba56713a960dc3e4d419f13593f683d993ed944580696007c8d1cfba1c5db94a76055b54811c229a0c7732e1e6f73e277daca1f129c0687a
SSDEEP 12288:+TGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:+DnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T11F5523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 da849bdf3133088301f789d545be099118fbd81dbbd83742c08aed4d87a98030
MD5 f7554bff4a8dccbe6baf64e273e37893
SHA1 1a72ea04a7385a3b0918f56cca3ae3d1e7c50147
SHA512 68155aa2559fca20399a92090773658f373a3a1f9d1461c4cc0a07917c0c3fbffc6eaa0589383ab271d03ea244919d13eaf2ed7db1009f53c6e10b8744c5a465
SSDEEP 12288:IyPz5L86GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:Jzy6nQ/tbw/2Mkjy6Fr7g0oE
TLSH
T18365021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a42f0950f0ad2ba57d6f0e10eb3dd74a74cc2aed019f8a8cf8494768e68911c6
MD5 60c39c44a64da8bded4966303c4ff40c
SHA1 c07727db5a322ecd133ebe45fd9c9a8d33d1415c
SHA512 b02ddf830fd1ae8aedfcd78fe4d5a3531d1148ef08460c7001685e58b12c9788db61c3f4cc7f109deab0506a248572f0c2c0b24c8606bdae2fc36dc41825a87f
SSDEEP 12288:CvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:CPnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1F55523697964F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 d61a3af9fb464319753430a7e5b7b7194dccf6d0fe4cc9771d26c90238f6d4ef
MD5 88dea70c30abc575aec0127ffa36eb68
SHA1 c346ba3b7d96ed188057d53bff3d42961cf52b21
SHA512 943ccb5b1194215b9275766a6f430e17318529e7a8a0eb5d44e32a62978fc727e3ddd220ff0d6b047a542ed5014d090f2dfc266c182561951bf89f581bdee880
SSDEEP 12288:zvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:zPnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T12C5523697964F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 cd5d7d22dc699f87e5a9a92c1d77a69b3551e6023045488820807c1e93e62941
MD5 bd2c3d719939661b465620c081622800
SHA1 8608b8f0bee510843f4178d6776a3cc6df145ff8
SHA512 972851e29721fc4ee86b62b8a642e02a633f0323139818ae6a25092bac77c6f22d8956070c367a3213806814c11b76c7d8425bdeee5f805e86fdebbfeeefbd9b
SSDEEP 12288:byPz5L86GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:Wzy6nQ/tbw/2Mkjy6Fr7g0oH
TLSH
T13365021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 21e62b9dde46c4b06a964b0085687307a01f409d2ecc15115295c0d61c916cc0
MD5 24a733909f1f42080f615c53baedbf54
SHA1 20f34e0f89b0311e21f38434ba324149b5e4525e
SHA512 5d6e7cfcd76f5d83aa657293558394459c80a9ea73fee1b1948575ab015d4987c6fab9317e80a1ba4efafb726ff2bab53c318ed1e64587309f6f8bc9dcf57315
SSDEEP 24576:jT0aLl3z0zDgnQ/tbw/2Mkjy6Fr7g0o1:jTDLlj5Q/lFTjN4
TLSH
T1037501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 ffcc2df1b14ca1996fa18c8d7cd1f73d4de2fca893bd7b3b641d3a13446a5291
MD5 7167cc6d2ee7d5bb24a14edbae8ffc61
SHA1 b9519c6d93ced366a2161fe3d8d39b6337cdb998
SHA512 c9e42e988a08b1641b50a25986e28ee9975669bd88c0e790e782b6943f269a765bfc5407b8954b156564f96cbf95bd7611ee94458d0098579ab4f9b04ffc8bfa
SSDEEP 24576:F31d9CHKy7GZcnQ/tbw/2Mkjy6Fr7g0o4:l1d9CHKyaiQ/lFTjN4
TLSH
T1F685CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 794e93116006791862ac41d444394f05b372b8f306f472c57d6eb6fa83ad7d12
MD5 6b4cbf30bde91d2aa5470024343973a3
SHA1 11e64086278d9e6203e6b9f1c855df9e560877c3
SHA512 fd9d9e57d7555dc7321c813b46901e8d1a0f193cffcefb41ac9eb296a8038951a035978e2444f410988b8444675a77f2a21c08c0f75438832dfb66337e0344af
SSDEEP 12288:qwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:qQnQ/tbw/2Mkjy6Fr7g0og
TLSH
T1F15523697925F98BFB1706F14C8381829B7B0DC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 2e4647d785d24c2b17ea061be636aab38d390c20bf1fa54b324d14da2ba4383f
MD5 f1572c2745e72ab46c6ec296bae68d58
SHA1 6e5974bf26e5728bb71bde54a523e7a6c7f9968d
SHA512 0ee1f3aac33cadd7d8fc8c526dee69c2b7be9bccf6ddbe62a51f54a846896a0ef17f95ee97ceb0b7ae92c1278c00eb2f13db58982edbe8b484fc9c50a974294a
SSDEEP 12288:+aGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:+anQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1A85523797964F89BFA1B06F14C838182977F0EC6BFD1938F7B481129967D39406DA384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 d97e2b8b490b0860a018e383583bd0723b7c0ff4b98e0565e97ad1f15cd78252
MD5 d3cbd5f2d077c0d83ec762f74b32f9f9
SHA1 050b1a8530bc4e8773cbe8be5550e74a67818868
SHA512 5706c4f1a2877f488b6fdebf34626368deb7f7f17d6f21d7fad629a914b05e105eff3949d8d2b8b10f4a8a3a66b7aa3b190b41dba8d4855a7616ddb48d26c521
SSDEEP 12288:HBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:HRnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1D35523697964F88BFA1706F54C8381829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 f8170a02cde565d9544ceb7eb7041ac4be91f316ed829f6fd9cc185daa1ae7fb
MD5 6516ca40d8a95923dacc9455fc8756fe
SHA1 4d0e826f3d31746a802abe2856398120bb4a643c
SHA512 d5a22a024f0e4e3806de838c14bec52d2378b552b4b85637227f5c60b11b03d858688a4d288bcd67d4364622adae2a55d9647951bb176a46feba59e02fe926e0
SSDEEP 12288:EvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:EPnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1265523697964F88BFB1706F5488281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 83b1f263dcc88874c39f53b06416603807ab83bf11f65bb0ef39401a052bd98e
MD5 7f7ad6520e8cd80496de02d82b1bd816
SHA1 43e13c93a5a8f80dff8866c83e4cbf90e6f78362
SHA512 227c966755507787ca01914bfa5a1364d12d6acb2372b173870b792049e37b2a11e050f8488c330f47a918d8669d16405861c9354db7c4e804d3bcb2bd0e111e
SSDEEP 12288:QwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:QQnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1FD5523697925F98BFA1706F14C8381829B7B0DC7BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 d1c7d0fce34d4f5d079e04b0f592ca561d1fa9e5887add4463510b9c1de6da1f
MD5 55f17a1ee2bc13543a94205e9424b104
SHA1 11b9e574f3d32508c98238ec846c10dc46866cc7
SHA512 b19baf0e0391c6d96a9b394ec319624f60fd55c7d475b1ba7c5be24b26d4a33d3caf8e93c0b552c0b1a481e66bdd8d938e94a6040c27099b43db73730bead588
SSDEEP 12288:GnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:GHnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1FF5523697964F98BFB1706F14C8381829B7F0EC6BFD1A38F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 dee11660cc904c33d7a42cdbac52db7b736b46ee4ea9aadb892e5c76f140e404
MD5 6f6be5255050a82d2d9d1c4df4ba107f
SHA1 95291242c34b70396a87a75575b941e942bf2858
SHA512 c653a13a223fd145e63784106770828b15c53756cade64339568fc07535ce78ad1b13fff329ea4eac52718f4f106b48e0a27a2ce1e8e8e28f867dc9a4c1a3545
SSDEEP 12288:/lGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:/FnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1565523697925F98BFA1706F14C8381829B7B0DC7BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 3fd85d67b967a9b193cef2622ce2cd5ffea64aa0eb510b78acf8c14cf9819112
MD5 06d9b36b73d3f1d8c2010bb7500016bf
SHA1 c74c52f1b8c8cc949e1e9440c46955db412bb17d
SHA512 6fc89644851f915438983853b66345d6b66d015a044ef73a0094313fdc822d0a04cc801e0a0fa98fb9e3468848932929e0279614ab9d951ec44235a95a4aad26
SSDEEP 24576:Ofwv/k9RX6wkyAITnQ/tbw/2Mkjy6Fr7g0oj:FMnYITQ/lFTjN4
TLSH
T1F185DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 d830f44439b6ed1832f7d0bf5f368a3599906893228ed37356163fd4a8d499b0
MD5 706759ba7e87013a319299c9e499f7d5
SHA1 d61c075d6bdef32069ea1a348d21e38c12127be2
SHA512 851539b0929e05b17ed0acfca7ca13b75ee00815e9fecd0e1420707568ee62882bbc4715b8c640af6298843a03179279bd49b3c39e5658a3001a5c2c5b996933
SSDEEP 49152:QYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK00Q/lFTjN4:+ySzP/Lm
TLSH
T11C066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 889b490531b4f8f6c685ede6a03cd5fe27c3d0bff6e5f6e5f12794181042d047
MD5 02b77e165cc81a8488b279da55eaab24
SHA1 c672cdc29c360e818ba247760d42ce851ab428ec
SHA512 c7a8bd67e0b4b3e6cd3b135b05374b0d0fb01418800464ae085491625837c45c8f8362b2a9bc563661e752b13a336a213c8a3751ce2cdd3ef9a897fa8d0a1a28
SSDEEP 24576:/47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY2nQ/tbw/2Mkjy6Fr7g0oU:/47JUQj1irIhCnDHUPfF/EQ/lFTjN4
TLSH
T1E265AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 76630e6102b165dd9b4ddb6cc4b69aa23c72e29b6d7d3fe4913c1869d041be6e
MD5 81bf7417069e0b9f182c1f664f5674f6
SHA1 e4bbdefccf79dc9e170a3ddf12c46c7c0c0966f7
SHA512 1a7f967fcf9ffce53196ac9b15b1efb0d008fa234c438c08ccf7910ac2bef2a1d743add1f93fedf945cc562022c0d9cc1c1a3c1241fe8f9aa94c9585432e5729
SSDEEP 12288:8ssffGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:y/nQ/tbw/2Mkjy6Fr7g0om
TLSH
T19865F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 fa76107eb6a12e4d3b21e145a2fb5a0577594de31832ef5fff31054f86425f06
MD5 2c01a2a8ff9231bdbe4537ba398c0d6d
SHA1 b88e7ecf122c77232e5690f1896df778603fa97e
SHA512 8eda73e3916dbef47c38e112a72059b061a056039011a002d7e225e38d3bbae9cef2631514fc16732df266ef603a8cea8b657ab49e77fd6393772d89de2327ca
SSDEEP 12288:EI2B+xU3fmGqFmNeLcU46nX2nJG2KIaDMC2RzzIsFWuKjwFOx:E5YxUPCFmNeLcUlIFKJMCQz8eW/Ekx
TLSH
T106351740766AC74FC5A940321E32D5CCAB707D01EE45AF0773C89B3FD576668BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.6MB
SHA256 82055dea9054a29ba2a4e4ceafa3ab5e5918b2e9000b7a9753e5e646f3a218fe
MD5 a35077824092ee53e66771b9486baebd
SHA1 93f01eb294ef1c257090ed05f6aac38049419bf3
SHA512 2854873c4c0ee5299c4f7a6437ea9a1ab60dd9e18c1621c6f49a38a100b931813a65bfaeeeafd9b4d2a609a1a535921c67848a891e389527127d63fef2b5968d
SSDEEP 12288:ZZc3emEV5bihV1YGdmZkNeLcU87FnFlNeLcNFk95DMcbDTN:iPvNeLcUsFnFlNeLcNwwcLN
TLSH
T161851A816137E38FC1FA5032073A5B4CA7A4EC16B7496F26B3C8447AD826725B4F93D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UIU_INSTALL.2026-08-09_0c767fbf98a63e538bcaa140c671b185_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stopexe.LOG

Path C:\ProgramData\UIU\InstallerLogs\UIU_INSTALL.2026-08-09_0c767fbf98a63e538bcaa140c671b185_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stopexe.LOG
Size 11KB
SHA256 b7d458b7120eb566ae03dd1ea12989d23b14fe19f5ba2d89a2fe156abb565a4b
MD5 de9d782e6c628d5faa4b76b6122e4902
SHA1 3b13622d156d88fd6858ad6ce3cefd6121f622cc
SHA512 df75d5606a50593845a8e41aa26b02821f6c093c284b94af8c6423abb23cf152544614869d4342220a9130039e51f71c7447f79afd9efb9cc1a001a96214cbde
SSDEEP 192:4bnwzH/L/rs6s0Rf+rszVVmUUgrB0vy8bZCl5aE6KpJmP1c:vvR24zM4JmP1c
TLSH
T1DD32268F0F5797C5349146770139DE066050AC5E2B01EFBB75AEFA8A8BE2105FCA4379
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 a0228162226e78712affb994c24b0d71851fa0eb35da4bca45bd1b2b8f87a99b
MD5 b77dff4c71a4b1207500e069b783afaf
SHA1 93ca90273b1c8e9e27376e49df838a8ee64c16a2
SHA512 adfb7e10b89c86e84debb0e95572d9c5bf0278b82a1ee1c8e8e89aa2de6483d803a23ebec5d403eb01ce7c9f5b6f1abfc9a6aec7fcf03af33ee8f64a1c84f02e
SSDEEP 12288:167XGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:83nQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1CB5523756668F94BFA3B06B048928111673F0EC5AF90D3CFBB082269957D3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 8841d330be9848d460c17e6b4f6bfca1a5d1e3e643ee6dfb901b929583e1d9f4
MD5 613175c79daf33accd50332737aa85f7
SHA1 ff92de9849b30f389fd57843158836fc8479fe7d
SHA512 d65371e797d6766eef357baf2ff3508ada2bc71550efc1ca710687ffb36a8c60a8185dcfbc61a41be1f194fee795b7851c46d59a454f8562ed219f4902cc58f2
SSDEEP 24576:rgb6bmBIi49WNNFpg1rSvFv7bY5nQ/tbw/2Mkjy6Fr7g0oi:rgb4mBIBhGF2Q/lFTjN4
TLSH
T17E65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 241e61eb07480643e31da545f1a1a3664ccaa87f3440be1edd2c9667d1129a5b
MD5 7c2564727f3ff4c7a404fa59fd3c1302
SHA1 00db1b274147268c1047fde5d0ffb685ef764e51
SHA512 f248e2b3baa4a48b64227be84e3f0555c7851042260959354877c549d4c2470d2904ba0299070606fa8f0886137d49696e80d795560347ee979022b447e109ae
SSDEEP 24576:QG88u8FpJqH1Qzria7/mmnQ/tbw/2Mkjy6Fr7g0oV:D7ZFPqVva7/xQ/lFTjN4
TLSH
T1DE85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 ef7d348c1266f625e844d8548676b2460b648d94b8b258e7aec472c503d93dba
MD5 5ece5644ea1303d5fac83706bd4ba47c
SHA1 0acd70f6b71cf303a85e4296a167212ab7304645
SHA512 06f04a0de2cb8b3a5f978c6ac9d43991e49e43d69f2582ee4ae4760cd2b2f419ec9b8015b7dafca0249bd54b806355ee27c878deb040a364481d5a98c9e1b99f
SSDEEP 12288:7HvUrBFrEjwaQHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:7PUr+NQnnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T18165E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE86D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2c0e61512c567aaf4880b09befc28f4425997466554e04409227a7ba893be743
MD5 9b1f79d08829a4d9cf4c0fcc0b8862b9
SHA1 71486c0f96cb2bc57ae5dd6330885093bd4e1c20
SHA512 301b925114102be45335af973ed57f166af28b66949feca084b8c74d8a7327057b27a4af0aba545a1dfb6bd160a8753a093c0d6f125ecda83bb28d9ac3fa7dde
SSDEEP 49152:FBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjSQ/lFTjN4:OG05lO43bgLm
TLSH
T1D7D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e63814c6af1f084cc3d04e8ef384967115782f4ff5ba0de85a2d5da46862cd96
MD5 99011dc6cc88ff4ce2dba76b4d58693b
SHA1 ec341eb37407ee92beb6fda844837a148616db1a
SHA512 91e62c1bb10af896d2d4759978c6e83c09c454568cf6b891e0d53bf423e8346354023091bc6ecfe07a921f6f79175d524eaa64f214336d8a6ab7eebae841dc55
SSDEEP 24576:xfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn0nQ/tbw/2Mkjy6Fr7g0oM:Ra5POZ3+Jt2pasx2+maQ/lFTjN4
TLSH
T1D865AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9a3e76b1ec170ce3d4078d9a244416cfc6d2c103cab8e8062fff7e6abc39e983
MD5 262a20a51e2342c0c0e8a015e4621ff6
SHA1 1cde69e0fe910eb9cfd29a249bf408d5e2c456bb
SHA512 ebea796d831b2d16ff2f3ba0134e668b0b766817a7fe54892c8c7d2eda445b979a3dd1ab022e10aef2670432df08ab00984235326104296721e24b598a4de5dd
SSDEEP 24576:bNcwHdjbyQ4nLC18lb/EOjowL7FkOnQ/tbw/2Mkjy6Fr7g0oM:bNc/zEOVHFRQ/lFTjN4
TLSH
T14D858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b83800ac97dee298fd54e33174dbb8a6af840f4c9465d11496d625e5d5234c92
MD5 d6af15646bfa8d2a0729b474d78b3af3
SHA1 9b2f5e2df7bfd9bd044b95d702f4cf0e7dc15316
SHA512 be84b4d4ead5766428f099e32a478e010c2be82bb014ef38a42a0f580994a0d664987851707ed87adf11c421702bbacde4d00cb16d5ac2cf0791debe7d1a77c6
SSDEEP 24576:B8kNvNnaFeYhJNtmZBmFnQ/tbw/2Mkjy6Fr7g0o1:B8MwBtOmFQ/lFTjN4
TLSH
T1A055AF2EBAB846E4D1BEC6B4CD238512E6727451173293CF5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 b06ece94c7bef7796f88fefd459c8e99fa0b47fef780e0e760bb286d13328fa2
MD5 b5a536482936ac584587ec6cdc01a0d1
SHA1 d5793847c9293bb12caf8558fb6a99ea9bce6838
SHA512 55e5cdbf8f2af8b5ac4972e7912cc3a6bcd24bc862f351381ce171fbd8f36a2a2539debbf2f3f3f9bd1fc45f27da78b29dabc325d7266c80b18896066e93a43f
SSDEEP 24576:LD3FHshBIYQgA7nQ/tbw/2Mkjy6Fr7g0oE:LDVHeBIAA7Q/lFTjN4
TLSH
T10975E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2656-217-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2656-211-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2656-210-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2656-449-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/2656-451-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2656-431-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2772-32-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2772-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2772-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2772-263-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2772-25-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4240-427-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4240-173-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4240-179-0x00000000008F0000-0x0000000000950000-memory.dmp

Download

memory/4240-172-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4344-37-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4344-50-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4344-48-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4344-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4344-38-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4372-436-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4372-235-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4372-243-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4372-237-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4568-435-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4568-224-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4568-433-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4568-223-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4568-230-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/4568-432-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5036-429-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5036-189-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5036-197-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5036-191-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/5280-264-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5280-271-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5280-437-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5280-265-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5752-19-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/5752-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5752-222-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5752-13-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/6260-200-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/6260-201-0x0000000000830000-0x0000000000896000-memory.dmp

Download

memory/6260-206-0x0000000000830000-0x0000000000896000-memory.dmp

Download

memory/6260-430-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/6296-187-0x0000000000400000-0x0000000000E41000-memory.dmp

Download

memory/6296-0-0x0000000002CF0000-0x0000000002D56000-memory.dmp

Download

memory/6296-7-0x0000000000400000-0x0000000000E41000-memory.dmp

Download

memory/6296-5-0x0000000002CF0000-0x0000000002D56000-memory.dmp

Download

memory/6916-248-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6916-257-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6916-286-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6916-255-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6916-249-0x0000000000730000-0x0000000000790000-memory.dmp

Download