f953fae29433958363164803db0528f8d2790b77cd253cef439e258596727dbc

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_ad05ee404e20110254d88476d4b43ac9_darkgate_elex_mafia_smoke-loader.exe
Size 2.2MB
Sample260818-aam65ssxcv
SHA256 f953fae29433958363164803db0528f8d2790b77cd253cef439e258596727dbc
MD5 ad05ee404e20110254d88476d4b43ac9
SHA1 f033a78f71588dbff2b5f8efae4f0d21a3856b27
SHA512 0b333a1a02167fd662f592c3d99918618dbe387999b638523b1a7938ef6c7c0528bb590778912b4b48cee0d281d4a2e6a3a4bd679e4d94d46a6de0ab555b1755
SSDEEP 49152:QE4XbjEKOh3SbiwJjn7gu5LUvdW9apuLvht/5ionurM0EIMa17Q/lFTjN4:Qrj834iwJjn7gu5LmMapuN/iMurM0ALm
TLSH
T1AFA5CF3136508077C63B32319B9AA3BDB7FAA5304D75524B66910E3C2E706D3A92C76F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5400	elevation_service.exe
4636	elevation_service.exe
2948	maintenanceservice.exe
4800	OSE.EXE
1792	PerceptionSimulationService.exe
1132	perfhost.exe
3996	ReFsDedupSvc.exe
6060	SensorDataService.exe
4688	ssh-agent.exe
5640	AgentService.exe
5848	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-17_ad05ee404e20110254d88476d4b43ac9_darkgate_elex_mafia_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-17_ad05ee404e20110254d88476d4b43ac9_darkgate_elex_mafia_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-17_ad05ee404e20110254d88476d4b43ac9_darkgate_elex_mafia_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\92abe615e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-17_ad05ee404e20110254d88476d4b43ac9_darkgate_elex_mafia_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-17_ad05ee404e20110254d88476d4b43ac9_darkgate_elex_mafia_smoke-loader.exe
File created	C:\Windows\inf\oem0.PNF	2026-08-17_ad05ee404e20110254d88476d4b43ac9_darkgate_elex_mafia_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_ad05ee404e20110254d88476d4b43ac9_darkgate_elex_mafia_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 48 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	2026-08-17_ad05ee404e20110254d88476d4b43ac9_darkgate_elex_mafia_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	2026-08-17_ad05ee404e20110254d88476d4b43ac9_darkgate_elex_mafia_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	2026-08-17_ad05ee404e20110254d88476d4b43ac9_darkgate_elex_mafia_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	2026-08-17_ad05ee404e20110254d88476d4b43ac9_darkgate_elex_mafia_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	2026-08-17_ad05ee404e20110254d88476d4b43ac9_darkgate_elex_mafia_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	2026-08-17_ad05ee404e20110254d88476d4b43ac9_darkgate_elex_mafia_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	2026-08-17_ad05ee404e20110254d88476d4b43ac9_darkgate_elex_mafia_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	2026-08-17_ad05ee404e20110254d88476d4b43ac9_darkgate_elex_mafia_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	2026-08-17_ad05ee404e20110254d88476d4b43ac9_darkgate_elex_mafia_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	2026-08-17_ad05ee404e20110254d88476d4b43ac9_darkgate_elex_mafia_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	2026-08-17_ad05ee404e20110254d88476d4b43ac9_darkgate_elex_mafia_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	2026-08-17_ad05ee404e20110254d88476d4b43ac9_darkgate_elex_mafia_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000009cdd45aaa42edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004dadefa8a42edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000074fb12a9a42edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e32b6fa8a42edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a247cfa8a42edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003a5cd0eba42edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a27d49eba42edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007e6ad7a9a42edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5400	elevation_service.exe
5400	elevation_service.exe
5400	elevation_service.exe
5400	elevation_service.exe
5400	elevation_service.exe
5400	elevation_service.exe
5400	elevation_service.exe
4636	elevation_service.exe
4636	elevation_service.exe
4636	elevation_service.exe
4636	elevation_service.exe
4636	elevation_service.exe
4636	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1308	2026-08-17_ad05ee404e20110254d88476d4b43ac9_darkgate_elex_mafia_smoke-loader.exe
Token: SeTakeOwnershipPrivilege	5400	elevation_service.exe
Token: SeBackupPrivilege	3996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3996	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3996	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3996	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5640	AgentService.exe
Token: 33	5848	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5848	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5848	SearchIndexer.exe
Token: SeDebugPrivilege	5400	elevation_service.exe
Token: SeDebugPrivilege	4636	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5848 wrote to memory of 2940	5848	SearchIndexer.exe	101
PID 5848 wrote to memory of 2084	5848	SearchIndexer.exe	102
PID 5848 wrote to memory of 1556	5848	SearchIndexer.exe	103
PID 5848 wrote to memory of 1472	5848	SearchIndexer.exe	104
PID 5848 wrote to memory of 3528	5848	SearchIndexer.exe	108
PID 5848 wrote to memory of 5600	5848	SearchIndexer.exe	109
PID 5848 wrote to memory of 5552	5848	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-17_ad05ee404e20110254d88476d4b43ac9_darkgate_elex_mafia_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_ad05ee404e20110254d88476d4b43ac9_darkgate_elex_mafia_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1308

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4636

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2948

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4800

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1792

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1132

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3996

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6060

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4688

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5640

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5848
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2940
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2084
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 2864 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1556
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3028 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1472
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3528
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3056 2864 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5600
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3028 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 ad8761809b3627087179c808db0839faca4ac73303d47429e8321c7049ce1084
MD5 69116f651af5e40b6a97d017991c4d6a
SHA1 21bc424291e20d514949854dbbaa1239cc0327f3
SHA512 0bc4ed8347726ba426fa626f825c1e82f7b90d2e8ed33acd8b02faf9cf53ce4a17bc1b8133910720fcbad5ec05114c8ebabb6255445921824528fc55050aafc4
SSDEEP 49152:zb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnjQ/lFTjN4:R3q6HjB/Lm
TLSH
T1EFD58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 606464f154cd29811b76dc6bc47932aca225f12586e1a9b1cf187dd7a920bad8
MD5 98884ab1c6e6a89b690179303d9d0160
SHA1 b5a2fa734810b29356902a9503b95a25fff56f28
SHA512 b79249fa6786a6f22ab299f5cda7674cd78abfb3f625370307fd7f258bc81359b44b501059219213e69d28aa8a064254c8431a123b906b0fefeb58a2bf88b889
SSDEEP 12288:K1XLsswWkxy2lRq2czAwGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:AXYfDtczAQnQ/tbw/2Mkjy6Fr7g0on
TLSH
T19665F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 b60b40917202ee79a44d0f082f593365ad8c760301e6f029456d07c045661725
MD5 5185a9645a093d3d3ff41170bc60f3c8
SHA1 882df0297f0dcbc73300589c1eeb8b39c685c835
SHA512 0c95aa6adc4e7ffcb669c68b7424e5b69fdd58738479ec847032cd03014c38a8e0658f2be6c2aba4cb8203aca3c848c39a9ecdb41608dccca720479f6a0cb5b6
SSDEEP 24576:w0Le5ji0hmxLrMrnQ/tbw/2Mkjy6Fr7g0ow:wPji0AlSQ/lFTjN4
TLSH
T199859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b43e7747b319bf88bbd0dadc9667fb81ad1fd7a7f824d8508e48daa82990910e
MD5 8c0fec04c1a75a05a452722f77c59646
SHA1 49716e39e4062273cb23842395f0f65b39e5f56f
SHA512 77b84129a1d0f552b9ded3a86d1bcccaa4f3404654d2d0570f42321aeb6ec6d987fbf98916a565b5c8af2eb572a141c59c707d8708baedb1b4656f3f98e9cd0f
SSDEEP 24576:va7/ezSC6vUyD/aqgrvWE6q8wyuRnQ/tbw/2Mkjy6Fr7g0oe:i/ezSC6vUzPvxHjyGQ/lFTjN4
TLSH
T15D755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f4c472082a47af9394e2387e3ecc3c9b75e7048d0331de49292ebebefe136463
MD5 4d649957b3a1a1b510279e3b0750198f
SHA1 87b2adf45cdcb9c54683e27748e0a79e75f5437b
SHA512 778d0cd99e1b6995cc83b1268ba8e1385b2d036acce971b10e21390e49473bb59b9c93e0c3b8bb01fd4562e4bfa4e8a4e8302b895236fff5bb098990480d4e55
SSDEEP 24576:XVbqPb88hv/l+6snQ/tbw/2Mkjy6Fr7g0oZ:XVO88hXl+vQ/lFTjN4
TLSH
T122559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 c7d997eb47236b754b17e3d07b0557084151e5e3e6f45dd4b2fd5592ed4ef8de
MD5 9ed3f4c5609dd2ffceed80a611bcc9b0
SHA1 f3c1189311ca69d2830763b061f2c96e1859ff41
SHA512 c8c147c9c263b73d74914ddd0ac66bc3e5118296552dfd464ac10ab524f69c0b7ece22f73ef806c9f3f8fef9077106874c6ae751b8256b65ea96138d059b5472
SSDEEP 12288:3zHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:3znnQ/tbw/2Mkjy6Fr7g0od
TLSH
T1395523696A24F897FF2B06B15CC284826B7B0EC1BFD5E74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 41da0f53bb44c1f2303b1065216bc41690db6741cfdc9c88c3fe60b6ddb36af6
MD5 a87e44ff2933651520fe79244bc7f78f
SHA1 854666c88e14ebaecd95e180f775fb7c11a8fb21
SHA512 03617de87e4154556b664212018f5f88eefd18ad349f2289dc6b766f5977c79b2042cc624510f0c32e17fcabde06a584277bd9c708e8f67ab35b6e08a8086d88
SSDEEP 12288:5eBNUbTVO86U0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:5JIUUnQ/tbw/2Mkjy6Fr7g0o/
TLSH
T10475CF3BAE28FCD2C67A4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 f4c082a5e7ffbb305ec8c484f4441565b8b2b30c4f015d1b753a6f61dc008d38
MD5 a18d7a620d12ce586156911448c02cdc
SHA1 0f5cb85a39d0dcb9b25f6b818a85c9ea35b0ca3e
SHA512 f37988fb4f512d5df20d2f41aa6aeab954000362e696d1f9c2767fb138836589d68f8c45912e5f6da7355c00c2c283291d025c4765c4a040cefb09098545af8b
SSDEEP 49152:2QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THy:2QvGAdlCEL8c/yRNw5CGLm
TLSH
T135267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 32ed3c19faacb6dd9559b33dff5ae67a1a63d2f4584ed57a81659a1c02125f07
MD5 a81d6507c5410946a03591079204606b
SHA1 4220ad70753b6247d85714eefed67962385a38bb
SHA512 7fdc721a7077c41772773277a09584cf7bdf3c4a7f0e89d40f742333cea5f5e11a716bff889d73800fa2a6ce3e1a22ae5660cf24115545f172f6cc1b758d6c80
SSDEEP 12288:zAwSfxL/2Dc39DLLmt0LDQewsAjiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgK:sQewsAjinQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1D875E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 789644db5a58e886bfaf21d29b284c1b2956705e396bb3c9757ba3c0f41896c5
MD5 28418cc98ff388a6e9a9ded0de775661
SHA1 e8f19a19126a712669b9c4c2cbebe13016889779
SHA512 5f624c02c4e869b422f0e835c052c781e4c1abe2090e5362f85e27b64c0130811e1c111e47cd8c438fe379c459bb20451e6711e6edffbef78a99a515335a09e5
SSDEEP 196608:4UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHVL:4UEtQevvqc2W1cpV2EI32
TLSH
T19B474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 bdb51de48572e64ecbc2040c80d3aaf63151982a8341d933cd64fa98069de669
MD5 43ac1cfa0ee43e6edae03d9026917c70
SHA1 20d0380fb565ae9ea8de206aa7921121b6ceb89f
SHA512 a555e977be06139e389b2981b94e9fa8cd4822c42d8602e73777afa8a10679d52bf5e45978f3c536b7539121e2d462dfb17d204deccde65316814d1b4c145f0f
SSDEEP 49152:oCbRquA/m2yL5zQfFiV+XenmE3/zCQ/lFTjN4:BoqtVjnmqLm
TLSH
T19AD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 54f62b70a0eea52863bd232ff9d81ff72343c237758ee4657f8929b2f8cf186f
MD5 84757a3aceed6ae57321883ac4f2edf7
SHA1 9fc261474b7da675c4495e1c2c447e843dd69677
SHA512 cd28cafaeada71f28611c994d8b7d5b802519ca3853ec61fad7bca03e152ea9a6d525be7803d02fed760c56d70e4e54d34b849a64eedbd64a680979a3244babe
SSDEEP 24576:7AhGLJIFoiwtA5l7S53lnQ/tbw/2Mkjy6Fr7g0oN:7AMyFoiq5VQ/lFTjN4
TLSH
T18535AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 f18df1c2fefbf3edd5a9035329802bd3b9369c476b483b74d9fa88a0014be530
MD5 2e5817341c336ded76792cda8712e6db
SHA1 3b626260d02e53fc61bff12fca5188b7b1cba459
SHA512 4395bd842b7e17364d86b585304c06a45d9e4f85f01626a24f8c0c092327644f6c4e31f3da5918e2d75b4bf797df3a417669241e489dbb3b24be85c5718b033c
SSDEEP 12288:kmw5HEjsChN2BFgl0WDm+ChGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMO:BwuHOWmnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T15765F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 a2f62548eec4ee2dd0e134b5aef180777c8abdbb87fcd6aea643fe1fe7d962b7
MD5 5b7c19d125715789dd9c03e122077798
SHA1 029bd2cde145b9b49b1eb1f95a9e9fa4a7ea42e6
SHA512 a63d51340066b7c03a64d0305f8ef3230fc2e4f2df2c5e93f608445b594f14f695689a17c5d62a9b95d51b0b05c19ffdac4025fb24a32ff187c20fbb8f652823
SSDEEP 12288:yXZ1IyyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZN:KZuznQ/tbw/2Mkjy6Fr7g0oZN
TLSH
T17355126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6e5cb6a014c4c6ca5b38af9ec505f3c80e68ae1215500c63b515030772bcf122
MD5 ff55c6b4f2401ba8a661ee90a45d9446
SHA1 c278a4ce91320b8ddc6e75659559c319f444cfac
SHA512 308e5801e1b2e33ac518d4f89f2a4a9886d93126ecd9591880ad724301c049d8ed29367466e1b4cc5cb65768e6268b2a74913948f49208ca4fd93767af53d403
SSDEEP 49152:vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U2:eQRQyi36YOcPQLvw2gAf+PN37Lm
TLSH
T128666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 6673c8863a51ed21efe743b8c8867a77a53d0d46f4eb806ffa040adb2cd39b35
MD5 d55661e1038e909dc4cfdb3d98c4395c
SHA1 19ef649188dd9dc6a5e21bfa7fadc7858c6ac5b0
SHA512 416a8a3d4b38da2b8adf8c6cce5bc09e60fa4b2facc15969c0c4abb237075d59b260a885691541aeeb70d68a670f0b043c60d8ebf11ca64acbfd88133df35d15
SSDEEP 49152:ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U2:tQRQyi36YOcPQLvw2gAf+PN37Lm
TLSH
T1BE666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5c99718ccac659c6c4f4dd99f7b3d0efa27e2a7feeb9453da9d60383a083b893
MD5 ebd9b31e9fec9c65937d2727aed3d5e4
SHA1 7f614ffca0377431440c248b6d89d0bd0cf8940c
SHA512 2c2c1f92d61d0c08e9ff6990e4fe1c860d9728da11c50b16c84391c3b063adc24a2de3a31b6bb4005ed699a8c7ec7ea1d050d6f024cda10d4db2da3854d8e901
SSDEEP 24576:RwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0jnQ/tbw/2Mkjy6T:968Qg55nhheWu7PNU3/SQ/lFTjN4
TLSH
T11BB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7dd52e05386d99db52b1d8b64882bd385bbb5d42ce2e607f21df951763d9b027
MD5 7dfcc9a151cca8864d2152fb513d3e23
SHA1 9bec492165d966ee5d78fac6af321e6d579c9962
SHA512 c97ce67d192f72ce2740e0a367df0bc1897c3132c36fab63febb082dc0decda392b1a210fd125557f5b7f8e757bcd54853bc16eeb61046ce7d30a4e1fa2523c2
SSDEEP 49152:63aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99Q:ry5112gYy5azzVvL69nLKnhZMLm
TLSH
T198167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b9eb8b371294edeeb95762c839353482d21fa1349df7442d96b17bdd0f7fb482
MD5 6ea1892436ae3ce55d0b18be0b82d9a4
SHA1 de26692942c374b0d2491e8033914e5ded897453
SHA512 2b241363e42e19ea746a70af9c9d2f0ae45a425f724431615bf8f3d9416ce9571bf407524777df41677fef581c6aa974fff7bc4fbc08b320372495d8deb9ba93
SSDEEP 49152:hB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glzQ/lFTjN4:3u6JmVxd2dYLm
TLSH
T10FD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 788494a825835f7488df25d70f0e264ecd6ef928763bce71253e64e5b2dd4015
MD5 80d186a1c4b2f00f5573b301de807d5b
SHA1 84d1a1f1cdbbeae4e4dab64eae1dc835f5b3eb3b
SHA512 ddc3c3cf26037e8899bcedf7570dc1de84830a8cef64de64db2557693709a41a371d584b413dcdb48808e609ae0d083454ca3cfc194dd20fdf89197d4a9129c4
SSDEEP 49152:l1hpsNoJpF1A6UU44CwH7R4x0Q/lFTjN4:lmifPbRqLm
TLSH
T133B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8f1a70a393c9f1b159121e9106241554822903f3f666cc979e795e6b090ac469
MD5 9b56a37c2061e7e26931d3c016feecbf
SHA1 d0dea43e31ad8074e7bf7599340f38824229737e
SHA512 bea8b29b6d06827aa0e123a40805012d869007889c5ed87e5d35026362e78a1b946fc4218a7874f8b0a4f4b260d1d5d5da6a4f0be7de9e07c6836cdfb9f7752f
SSDEEP 49152:GSuZQIY0Be2KRRVtOnks6NMHqzQ/lFTjN4:I5dKTi61YLm
TLSH
T17CC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6000ab33c831d48df6f8e8a0de4993088dc80053c9f87339be24498934ef6e46
MD5 891958e58bc96f554218c918898dfcab
SHA1 97a40bca80a28f8c95db04345d0ba1bce77abe49
SHA512 0679fce1f8ec14a20eda829b757fc62618c456f4601a80ce6b0e3be6f42d378220fad1e23e8c9ba11e8d64ec6c6334eae8142b1df0cf5b71a2440cd408cb7826
SSDEEP 49152:DhtSn8EApI0figngiDn0AP5wQQ/lFTjN4:iX2iyphuLm
TLSH
T1D395BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 0bc339da70af28aaa04207b35684bd2f0d2dec753ae2ef38757ed73d90305875
MD5 c2a10639f676c587cf6dc3fab882f82e
SHA1 85cffb22b128793cb5b30924df73b30bdae50314
SHA512 94073d794712856d4814b07d175a37fb3c1dc5f91d248fe301773784ff7ff52d70e26930e81e78a265e2b77f40f207c2d29210ff0255126475d290a33ce952fb
SSDEEP 12288:5PGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:5vnQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1EE5523697964F98BFB1706F18C828182973F0EC6BFD1938F7B482129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 78701ae2b153e7bbd22da4ae9b3ad90d13c508cc0a2f6db885e3210dd0d08dd8
MD5 d7849b4953719432241d9a2a6ee3cdc5
SHA1 72ae3e45007609d8077a6166427f0d60a191916e
SHA512 3c97fb8fd8fcefec2bc0fae96acccad6fca98cfe2349fe22a1dc4970bfd003a8fe74fb0848deecf0274c1146ffb5108a38dd3a6712d9853167ffb7b42811a246
SSDEEP 12288:weGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:wenQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1D35523697965F98BFB1706F14C8281829B3F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 8b34a13c5ce64dd4422a945784029f8fb2657bfe90379088f282a0e3982b052f
MD5 826cf079b6c6f87331e92e33bd645ac7
SHA1 d58016b01556b87a687bc22c8a67f31ed39d78df
SHA512 8fb3a2319f783aab831d7416dde9ff083f68a070cf4508de092dbcb9a9455f5ab4cc1d31251cd667a655693082e36a71198a37cff4cfb70454f95d417e06a53b
SSDEEP 12288:DcGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:DcnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1EB5523697965F98BFA1706F14C8381829B7B0EC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 8085660e59e636cf8e4d380d755cd578b820170cfcdc20089fda768d3e6d86dc
MD5 9d10177b93fcef8f4f15efe68b080fcc
SHA1 3bfd02f879bd4d29621ec898f50204664985d978
SHA512 e42ea1cb34032562efbd3e26663c6f38ec689742ad8394a081d347220adaf81126da1b0b8566073b1edcf2aca596ec7583707e100519d79bec06ed8dcb1e5e8f
SSDEEP 12288:4VlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:snQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1B25523693A69F4C7FD2742B4CC938142E77B3DC5BBA1A38F6B04111D4E793D41AA6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 663c3a51248337d40130e255b300e4ddb61178472cc34a4cd585991532aab743
MD5 fd7c6525ecf13f9259d4f593c2e35b39
SHA1 0138ef83b2cfa8d33c1a66106d6b7f2244fe032b
SHA512 8a8360334536477dc7ff887b44fc8c2101f2d35a68c06e66ed43f54e2f1f56d48206efd3203ba581fe71b7e2baf6d528127c459995c82de55e33fd9ac7c337f3
SSDEEP 12288:XdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:X9nQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1D45523697965F98BFA1706F14C8381829B3B0EC6BFD1938F7B4C2128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 7ae316155961f8c07466406b2acab6ad796322565fddc145918381d674d19188
MD5 761ee88611cac5b30f2bf2f034c3c256
SHA1 861a62b499bedeeddecfb019cd0777f0d5b4daf4
SHA512 41d6994f6f054ac7981c19c45c0ea48b48fe40694a73d1d8bc145e397729ff1a8ccfd2c7631fef1dc8dd3a4747e8a3e238f11c31b1fdb64d53dc7ea61f9e9624
SSDEEP 12288:NqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:NqnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T1345523697964F98BFB2706F14C828182973F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 76d96fb4be01fa905c1da6e4fc45a2dea538588069643def6369348c81b8d205
MD5 5052eeb14d198d64138a6e3dcaaf031f
SHA1 dd11eb5f89049f4ce77dc6ec621feb2b2b2ee4bd
SHA512 5409cb211be3f6950e821018598133144a31a93629e8fbf71fdddf500b9056b882ca29124e107a13b2273098d8b96885fd286414120f06cfa1980a27df4d30c5
SSDEEP 12288:62GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:6WnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T17B5523697965F98BFB2706F14C8281829B3F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 a18e6f0e12042e95a9446895af32b1ebb4bfd1677455b46eedbdc8448ae274f1
MD5 39db389e9c751619143865fa3e67b047
SHA1 abef106d20a3aa4a37ff8a7451ab1c4a44fcd24f
SHA512 2aa2a313ef37709702acf29e01fa889019922b935e66a8b99420cbb9ff43553723f02a40f99b9ba1de522cdb60642bd6d1800206ed09b3a66bc8d16770be9dfa
SSDEEP 12288:YiZwbDzzFEoS2cPvy+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:bZM3zFVSO+nQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1D77501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 460231f66e88d1ee794266c815c5fd1bb037ffc37185666f9034bdb5f5a3cb40
MD5 14c56d16680b7eaf4003e0e5cd938821
SHA1 0e9c8194112e26f4b088e3d649ab388ba518de03
SHA512 034594d0fd20ca4befe46cd5b08361f98f8dbe3329c92f1641d1832b5a8d57a651e348c38b1a2cc4ec35f664bbc139fad8669e25f88b1141a0c6da618996d0fa
SSDEEP 12288:2TGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:2DnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1045523697964F98BFB1706F1488281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 025da77f8e7c7c48f336cf9ec554b540d2f6cf47456cda65b5274381609ad584
MD5 93e1159cd9c6434c8e70dac4b192a028
SHA1 6bcb7860908817a718f963cf4ffec4e24ede495a
SHA512 c54bfbcc949edf8b8d3c52e82a878685e92f7740550bc5fbd6fe5335761a5d7418246f8315cd806a3b09970b6cfe734ab83b4924c4013ca17aaf9ef0ab81db8e
SSDEEP 12288:FXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:F3nQ/tbw/2Mkjy6Fr7g0oE
TLSH
T1925523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 29c78732e0793bb11f7982a33b4154b1f866f0a97ef0ca307d21e8c7aa260e99
MD5 caf514b984b489b9e11a43589757c960
SHA1 5252f35d5b5c0d8a8588a71f0c9f641717d47164
SHA512 c5c7f8ecf1d52d918910974a13e8793d7267706a1e71614e2a904e9d9c21e98811c48395920cc225498265a23dff0614a56350393ce5fccd8bdfc54576004e07
SSDEEP 12288:nyPz5L8yGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:KzyynQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1D165021773A570FAE537427888920A02F77678725B609BAF2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 bb273dc0ba60c45fe559a7f4b904cb25fe0cc31abf90e7ba885e529d0a8f8889
MD5 e710e9fc154fa301bba8afd6eb5cc8c5
SHA1 c752b7fc59bd1c8a9f6b51080a3a7e9bce08f37a
SHA512 72413f8a6849adaa3e2dbef3ac853d9384bf05651bf66fb50d47d086f5b9c2bc1c1131616d28a43e06c225a4b9068f16aa26aab6b4dd248a1e1348462a7ddb59
SSDEEP 12288:8TGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:8DnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T16A5523697964F98BFA1706F14C8281829B7F0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 f7ffb02894dfddadd04154f12f9ae29a7ca1c31f2090476922e696a3bdc2e741
MD5 e8667a6706d0e8f5923095f19ff1acb8
SHA1 bba948e79a1a51a3de288f301d1ef00fa61bba87
SHA512 7d053f2898139dabcd8fda8d20ca9957ff706cc85ff7ec0f97f065671c174cdcb82bc02c048853a2a8f080970c63a181f17aef133ea6ea4f08d39a7c3baa0d81
SSDEEP 12288:nTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:nDnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T19F5523697964F98BFA1706F14C8281829B7F0EC6BFD1A38F7B4C1128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 013bbf069d274c7d66e3d54f75884a7fd1bff043d03201f3d0e87c56b12d51db
MD5 49c3138363efe069d7255e22c5ce8c94
SHA1 96e0dc79e90288d855aff8e845aabfb91b3e0304
SHA512 60aea7ab3934265193cd04eaa9a0d9d8dd19a87006dfc6fa94fc6804d3c032fea58bab1796140fff3aad7272803d7761e585dd7e58bbb9e8971d2713660ef917
SSDEEP 12288:6yPz5L8yGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:nzyynQ/tbw/2Mkjy6Fr7g0oA
TLSH
T17B65021773A570FAE537427888920A02F77678725B609BAF2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 963caf1ae9fd5ef7a4e2414913e7bfb4682a9eedb498599fbc44bdd0dec50c1f
MD5 a5ae4900178a2056989c6e7a33ba468d
SHA1 f037b1bd4c2cc5d949dffb80c981fd24f6101a02
SHA512 a5f043a9fa2cd1c281ca99edbfec3a383615e680ab708bba1e9bd0561e835f5134feca69de05c69cb416f93f7ee92aecc2959e24c76798cfdd7ed8bc49ca6718
SSDEEP 24576:PT0aLl3z0zDMnQ/tbw/2Mkjy6Fr7g0o1:PTDLljRQ/lFTjN4
TLSH
T1AC7501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 6da97ac06520e7a50181d89605f04df258dddc7b77ba8648e3e5f2b9b922f064
MD5 657aa2cac48d65d8ff9907db993d1bd3
SHA1 18dbe468a9ef64e90f604a215c2ed97ff1681c87
SHA512 7db8319c60048ec08d96e675fc5f1cb87116797bf91a5c9b4a645ad72f3c5cc57e15ea20f2969df028c22c56d5b03c9cfe14be6471cc8353130d338631a82659
SSDEEP 24576:E31d9CHKy7GZ4nQ/tbw/2Mkjy6Fr7g0oZ:O1d9CHKya6Q/lFTjN4
TLSH
T1DB85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 632a0de3025372b54683ffa609c77cb56aa22605b278d861c11abbd0d2ef733f
MD5 377b8bc9a27ab715b62127aed2c090c7
SHA1 097719343c318ebb5cd8de8c12f4a26214bc65dc
SHA512 2d04d855a51af996c2eddc3d1f40f3e16dfcb56ed1697e0446a1ac52db499a604682175b1dee72ba5fffba3d0bdff2b0360101527ce01a6a1bb4c1a5a507e343
SSDEEP 12288:A8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:A8nQ/tbw/2Mkjy6Fr7g0ov
TLSH
T18B5523697925F98BFA1706F14C8281829B3B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 30d63a1bff118dbdf6b4785a513d83ea35e71474edb34572add07ef7487fca94
MD5 7adc44e956adf059bd40d5e9031ca339
SHA1 6e05ac51382e69fd10a704c36fa89a355ae39cf4
SHA512 0198bfafea8b65681bfaf1e2252c24637553c6f5d8096906820525fce97a8477ab64861c1cddaf9522e36df466fb54aa398f49be9e79bc167b6837c9eb900cee
SSDEEP 12288:ASGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:ASnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1265523797964F99BFA2B06F14C838142973F0EC6BFD1938F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 1362b444a29e559daf1afcbcc90991bfb1e3dd76344056e21f8c92f322bced04
MD5 2c10d782b0bea6e82972d29a18b6f8e2
SHA1 53164ddf2e9aa48bc1d9e5cb0020799550534634
SHA512 c6afe45a363f8deff0695698bc0b321800d4dc44e41e2c516c3e5cfefd10b6ca9f55fc01d3afbf35be47d6eb5fc733bec2a1a131640f7ed77fe7a24b875dabfa
SSDEEP 12288:A5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:AJnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1705523697964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 45812ddb73d6912c54ff75e9ededad885619e71982cc9ac97d2822dfd8cfb4fe
MD5 8a1f6e6220337ae1a12255d8e83d81bc
SHA1 038783b8c380e856982e40ce8ab2568802779ee8
SHA512 fd8cecc128792287cb20a37dadce7d07d5b4ca9940d5ed666d4d0d7183f7a4e548902c449c67a81a29bbd313c099586ea6e24a3660924eb436848bcf06c257a5
SSDEEP 12288:GTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:GDnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1BD5523697964F98BFB1706F1488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 10e4d203d993b23dfd046754577e6993b9b4246b467e067ac2276903e6ee3454
MD5 aaccdc37a601bfbf192cb9ba00935ccd
SHA1 e54ad08798311d9706c6ef9513dc9fb0ba1fd3ee
SHA512 368ae54836504c7a0bce76041708a40de60d53c2920da1a182d1527e76bdafa83b7ad5e00027fdda290abab10b17dde5bca9a5f7f3a5d458461600742fc7dc9c
SSDEEP 12288:d8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:d8nQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1FA5523697925F98BFA1706F14C828182977B0EC6BFD1938F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 8414a849c9dfd775e80d7d507b9e61ca6715c7efa1d1b8fce9507d3170f2b09e
MD5 4c22d6fc4daf5d3862c8f7adafcd25a5
SHA1 18cb3bd82f1238aa9ed9f827daf5d6ce74b5d4cd
SHA512 175341f6586f392fa27c38ad81358d668ce0766ab4ae9759db70fd8ddbc838b3109282f699ee825bb3ae0cce1d9bc36ae912620c31d7f71003305af03314cd45
SSDEEP 12288:PrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:PbnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1C05523697964F98BFB1706F18C8281429B7F0EC6BFD2938F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 c7f593163d2a48c72d42c9e9eafc55ffc10542f806799f2ca1ced0e572313441
MD5 2e2a28f427228a1cdaa4ee3c65046f50
SHA1 e26fe933c02344e1df2426a147ce314998eaf4b3
SHA512 faa0c08afcb3ca15377f8a257b71fc344c96da755a3173f3f1325e145c375c60dc2874e1243c2e38791e51adec47aefa7c2d9b23ef175877be6dd57d65169bbd
SSDEEP 12288:WdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:W9nQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1AB5523697925F98BFA1706F14C8381829B3F0EC6BFD1A38F7B481129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 0cda1f727ca1d4ec68b59dbb2a810ea8a9b3d4c5c484be1aff541f1190c21292
MD5 540e7d99a98f48dd89bfa9e49f5d3145
SHA1 6b2ed548013501a0af8f6327695de47a355f6e35
SHA512 bdee8a33633c85ac6e5c224eeb0ebd2160f784a258d4c0087b40336afd14762072553119d9e75bc7ed945ec45913fb94954d9976fafc2097a88bc368cfb44070
SSDEEP 24576:efwv/k9RX6wkyAIHnQ/tbw/2Mkjy6Fr7g0oV:VMnYIHQ/lFTjN4
TLSH
T19785DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 eb33c49aa958e018f9e30eef8219f4dcc227e4a19c39c4bd8d54988282e0559a
MD5 6fc852fb392f438efca4a69d40532d4d
SHA1 83a767bdc01232a5b36df04d11459a78dbfef5ff
SHA512 5a37e317e59b056a3624bd6a578ede8195c4d8dbe86d4f96c708b959235822bb507b41fbf643bc75ba223df491724ba552f921c451ddb6776f3a9736d83e1d95
SSDEEP 49152:SYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0wQ/lFTjN4:MySzPbLm
TLSH
T19B066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 26d77487016aa4272292d3ce44c7e4f619e3d9bc3d2362b8b89e4b118621c2ad
MD5 394f35214306ffe9b310eaf264c70449
SHA1 263534d16fc2542d4dd72a081e92c74c8693f876
SHA512 4575195e017184fde2bd09e0472c24b122250d1501d814827ccf1bf64f6f9fb6c01b8552e7d8afa942283c3ba2a1fb0ed2585a5e06826ab00a5745424f946834
SSDEEP 24576:Q47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYOnQ/tbw/2Mkjy6Fr7g0o6:Q47JUQj1irIhCnDHUPfF/AQ/lFTjN4
TLSH
T15965AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 a652aa8fc4e61542dc959ccb77eaa61c8b3e3fdac41f8625e4b3f692334d3e94
MD5 b37a059dd38eb6a6632133da8276a49f
SHA1 39cd801123ea1e1716a18c5bc779748804fd6af9
SHA512 9449b6227a79907c499175f5e30ccffb7128362d12fed396c5a9252c11f4085fb441b4a748960b5c38a7706cf5442d2a3c2094214af4e30070733514903e668a
SSDEEP 12288:nssfDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:rznQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1C165F019E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 36f2ef4131feaa3e9d20441113dbbb0c94f8149970bf7c8de210d90ca02a132a
MD5 d6b6d640c05161d37ebd0be5afecbad7
SHA1 d9e9d9bce7bf23297b313cdf637e736becce721f
SHA512 fbbf13933d4c6c19c24bab4c762c90861a415a4ffcb638ba3c8a2ada4022c122e649fc61e51b2cf6692efa448f16347b6c8e56e40998ff3c8fb24eaa1911e531
SSDEEP 12288:uWdYduU3fynUSin87EyzejDq5E6O4kjIJRmlD1xBj8aI7U6Ql7:uaYYUPxSnjat67kjIJsD1xBjNI71i
TLSH
T1FE451740762AC79FC6A940325E32D6CCA7707D05EE056F17B3C8873F9476668B6F6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 629179714bb57a0bae6c80e0da2ae655e030c25261812e947e13841aada32b2c
MD5 4a35ec0e8f7634d32f60df2ee581a547
SHA1 a30bf416eb53173bd2eebd9c15ed089deee24197
SHA512 f7116df39bb3ff90c899770082ba9177ba2a49b73d114c666474c1cc67c4c8e6c7940ca817cad5192027afd5b0cbf47baec630aeed8fc06390b090c5b50315e3
SSDEEP 6144:GnGw+25Zkpcf8+OpCfdp6fab6fQb6xabmxKLV+FvsBshKdPQjfaL3DHIN888DaXy:GnoAQadGaIQKa+MVgsSjfaL3mltgP3RX
TLSH
T134551B01A5A7E31FC8FA50374632C68DBB746C07BB452B0573844A2CD87767EB6F6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 de5dc6b609c929fca8d1225ae9275772e130dd6130dbccee1ecf78fad2b5974c
MD5 9af9b9fc6f2183d07f95b02486d34f86
SHA1 a8a399b76331e0bdb740a9afba6dba3f8f05bda2
SHA512 a6172b14d8e2174100c92b1362674445fa66e7b201552e1a5249814871afd4b52508fa234b0d148967832c1cf4e62fee326d909ed5c6aa5c87bd6c8c86bf6ecf
SSDEEP 12288:u67bGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:hLnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1F25523796668F94BFA3B06B058828111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 f913cce57d854748eb1222df9cb164e89e26c6c2b445758d6dd2e4c21329e9e9
MD5 bd7585478aecb4b4ea64a828e17440a1
SHA1 2545b26de1841ba32feea4cd3ae068a56068feef
SHA512 5cfb64db8944f26486d8fcc0fabd9d74b4d16fa4c6c7aa18452f4f607215c4a0d9fa708f9a68531d2e88ced71c1d455f9d3b17bc6c03048760ca7f09ed0147d7
SSDEEP 24576:fgb6bmBIi49WNNFpg1rSvFv7bYRnQ/tbw/2Mkjy6Fr7g0oJ:fgb4mBIBhGFOQ/lFTjN4
TLSH
T15165AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 783289f1b3b6113414dc65b8aa650778e98a6368385a87dfbb06f95aeb3039b7
MD5 00d962526a6033c9d550682e336c232a
SHA1 975f575bc065d663f0f573812f8460bd66e3cf5b
SHA512 c819b2c5192d20d3a52df8724a9dbe157f265c336dba766e5c32f376e881c894abf8afd0006d60005643b81044e53b0e53d80c2713811d602bb17d10b099070b
SSDEEP 24576:eG88u8FpJqH1Qzria7/m+nQ/tbw/2Mkjy6Fr7g0of:17ZFPqVva7/pQ/lFTjN4
TLSH
T15E85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 17d0fbd8bdb89f60e86a5cd7320f35466dda92cce30c99c786a2234e4755920e
MD5 d84a26113b3a8c48b9ba10bfceba530b
SHA1 2927a625856688860fffe008eb379f2259bc2cb5
SHA512 738f7acb9809e354afdecbcec9bcd243d1b5a8802defadc3e9ae2251907bf4dbc7be1e0145246f0d2cacfc0654df80d52b92b9fc318e1ea01cf56e3eb7e0e029
SSDEEP 12288:WHvUrBFrEjwaQ6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:WPUr+NQ6nQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1FB65E12F26AC18E5F676A17D89828609F77278521752D3CF02D0817E4F77AE86D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 5e29a4c0aea3c0aae76535f93807b3c428c16eb4e0edb1d51cf9f4c699f33fb2
MD5 77d85cb9a73db378983a7f302fbd9c1e
SHA1 b954d71236b8b23302a60cf80f2ac0c74519b44d
SHA512 2c707131118f2fc61c7953387e4792854a1be63aab3d446dcda5d93737973a6365bc688363e1de545e1d2e2675efb899e7480632fed406ed31c2a05044cd1a9e
SSDEEP 49152:nBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjqQ/lFTjN4:YG05lO43b0Lm
TLSH
T19CD5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3f8b45c7c794bf665d1deda7cf771f0e73a1d3e81adf1161ad36aa8a88a2daee
MD5 ea6fb2527be0fc0e7a207f49c48d6788
SHA1 1db6f4715a030cdb20c1237390a6fd848818266c
SHA512 b3ae28eb14ce92d8bfb826e4b1476f1b1a0fdc42cc9b2dc946a612d79d3315a7ba25d8f862def65466a6532dfdfa001e39a551b351fdc2de3e1bdde75e100d51
SSDEEP 24576:Ifa5POZ3dpFWVM50JicR2hG0lasx2+47eidnwnQ/tbw/2Mkjy6Fr7g0o8:wa5POZ3+Jt2pasx2+mSQ/lFTjN4
TLSH
T11665AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a581225c05351e629f02ecfb3cdb47f3d83a3ef38b3f1362705eea37ae5ca752
MD5 9d029c313b21ad308c3881f86705869d
SHA1 59c30a33394514bdeff92ace60b90ef12a386a43
SHA512 99431d3a896ddb0217c566b56c34047fcd9cf676d2c5bab197adc0a3b7eab80f708318127cd7b9101429e085bd502ef5f4d8e5d2ae351336c19aabcb8df4ec89
SSDEEP 24576:INcwHdjbyQ4nLC18lb/EOjowL7FkGnQ/tbw/2Mkjy6Fr7g0oM:INc/zEOVHFJQ/lFTjN4
TLSH
T1A1858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1a0b94b4e070c1ccfc1085b39c0ede5c9e1abf403d8967f3f38fe57e31f787c2
MD5 89e0ee732a3b017297dda3efb89cc81e
SHA1 b8c9bce946da6fdf4e2b448173527d0fd97297b8
SHA512 2d0b5731a864cb569561c3f4478d57c839f93f69552dcde9c95d6916c37b66598f468b38f1cff18ab06b3074efcfd8e14d5263cd4127d16046a13dd17252b0eb
SSDEEP 24576:t8kNvNnaFeYhJNtmZBmHnQ/tbw/2Mkjy6Fr7g0ov:t8MwBtOmHQ/lFTjN4
TLSH
T1C555AF2EBAB846E4D1BEC6B4CD238512E6727451173293CF5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 5a697e84dd1826cbe3bb626ff8b276a5c37c5197fee0c716a1bcb3b68e298f8c
MD5 924678b6bcce80df57565166d5df9287
SHA1 ad154cc2604300f7d237e414374fd23757c41124
SHA512 ea7f13ce557d8a5caad61011f5d990e5a5d9c60070ad27347c8a9234e973145a4520c391c0eaf201f6b1aa906fdc31b781c021544aa13ecc0902653837d9a43b
SSDEEP 24576:qD3FHshBIYQgAPnQ/tbw/2Mkjy6Fr7g0oP:qDVHeBIAAPQ/lFTjN4
TLSH
T18975E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1132-81-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1132-82-0x00000000008D0000-0x0000000000936000-memory.dmp

Download

memory/1132-313-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1132-87-0x00000000008D0000-0x0000000000936000-memory.dmp

Download

memory/1308-16-0x0000000000400000-0x0000000000634000-memory.dmp

Download

memory/1308-1-0x0000000000C20000-0x0000000000C86000-memory.dmp

Download

memory/1308-7-0x0000000000C20000-0x0000000000C86000-memory.dmp

Download

memory/1308-6-0x0000000000C20000-0x0000000000C86000-memory.dmp

Download

memory/1308-0-0x0000000000400000-0x0000000000634000-memory.dmp

Download

memory/1556-331-0x000002C4A34A0000-0x000002C4A3B20000-memory.dmp

Download

memory/1556-400-0x000002C4A34A0000-0x000002C4A3B20000-memory.dmp

Download

memory/1792-69-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1792-299-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1792-77-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/1792-71-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2948-50-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/2948-56-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2948-54-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/2948-43-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2948-44-0x0000000001770000-0x00000000017D0000-memory.dmp

Download

memory/3996-97-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3996-333-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3996-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3996-335-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3996-91-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/3996-98-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4636-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4636-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4636-37-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4636-137-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4636-39-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4688-116-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4688-124-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/4688-123-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4688-316-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4800-58-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4800-283-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4800-65-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/4800-59-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/5400-122-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5400-17-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5400-18-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5400-26-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5640-129-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5640-135-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5640-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5640-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5640-139-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5848-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5848-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5848-147-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5848-153-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/6060-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6060-110-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/6060-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6060-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6060-317-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/6060-104-0x0000000000780000-0x00000000007E0000-memory.dmp

Download