3108d3caa2861332f83c92cf579eb674e919a37e87f2c72436577d65b21c839c

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 00:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_885ac018632739170d58b71f9a0d918f_darkgate_elex_mafia_smoke-loader.exe
Size 2.2MB
Sample260818-agy7zssdnc
SHA256 3108d3caa2861332f83c92cf579eb674e919a37e87f2c72436577d65b21c839c
MD5 885ac018632739170d58b71f9a0d918f
SHA1 054def75e9e1663f17c5e2cc663e5629e9af7915
SHA512 20e3b9e07a2985d016170fed7af799990edc944c98f8b3b8e2ff8c9f1e64b737b7192eae98ebdfeaa77d4446994a9cfb971b1e699f9e33fbb750ab8a7516e1dc
SSDEEP 49152:1E4XbjEKOh3SbiwJjn7gu5LUvdW9apuLvht/5ionurM0EIMa17Q/lFTjN4:1rj834iwJjn7gu5LmMapuN/iMurM0ALm
TLSH
T1F9A5BF3136508077C63B32319B9AA3BDB7FAA5304D75524B66910E3C2E706D3A92C76F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2360	elevation_service.exe
2372	elevation_service.exe
2944	maintenanceservice.exe
5988	OSE.EXE
2432	PerceptionSimulationService.exe
460	perfhost.exe
4472	ReFsDedupSvc.exe
1940	SensorDataService.exe
5364	ssh-agent.exe
1956	AgentService.exe
4892	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3e39271be62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-17_885ac018632739170d58b71f9a0d918f_darkgate_elex_mafia_smoke-loader.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-17_885ac018632739170d58b71f9a0d918f_darkgate_elex_mafia_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-17_885ac018632739170d58b71f9a0d918f_darkgate_elex_mafia_smoke-loader.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-17_885ac018632739170d58b71f9a0d918f_darkgate_elex_mafia_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-17_885ac018632739170d58b71f9a0d918f_darkgate_elex_mafia_smoke-loader.exe
File created	C:\Windows\inf\oem0.PNF	2026-08-17_885ac018632739170d58b71f9a0d918f_darkgate_elex_mafia_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_885ac018632739170d58b71f9a0d918f_darkgate_elex_mafia_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 48 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	2026-08-17_885ac018632739170d58b71f9a0d918f_darkgate_elex_mafia_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	2026-08-17_885ac018632739170d58b71f9a0d918f_darkgate_elex_mafia_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	2026-08-17_885ac018632739170d58b71f9a0d918f_darkgate_elex_mafia_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	2026-08-17_885ac018632739170d58b71f9a0d918f_darkgate_elex_mafia_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	2026-08-17_885ac018632739170d58b71f9a0d918f_darkgate_elex_mafia_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	2026-08-17_885ac018632739170d58b71f9a0d918f_darkgate_elex_mafia_smoke-loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	2026-08-17_885ac018632739170d58b71f9a0d918f_darkgate_elex_mafia_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	2026-08-17_885ac018632739170d58b71f9a0d918f_darkgate_elex_mafia_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	2026-08-17_885ac018632739170d58b71f9a0d918f_darkgate_elex_mafia_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	2026-08-17_885ac018632739170d58b71f9a0d918f_darkgate_elex_mafia_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	2026-08-17_885ac018632739170d58b71f9a0d918f_darkgate_elex_mafia_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	2026-08-17_885ac018632739170d58b71f9a0d918f_darkgate_elex_mafia_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000413c6476a62edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b27f9333a62edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f7b26834a62edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e8016134a62edd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000273de834a62edd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000089c6b639a62edd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000531f5e76a62edd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2360	elevation_service.exe
2360	elevation_service.exe
2360	elevation_service.exe
2360	elevation_service.exe
2360	elevation_service.exe
2360	elevation_service.exe
2360	elevation_service.exe
2372	elevation_service.exe
2372	elevation_service.exe
2372	elevation_service.exe
2372	elevation_service.exe
2372	elevation_service.exe
2372	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4304	2026-08-17_885ac018632739170d58b71f9a0d918f_darkgate_elex_mafia_smoke-loader.exe
Token: SeTakeOwnershipPrivilege	2360	elevation_service.exe
Token: SeBackupPrivilege	4472	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4472	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4472	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4472	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4472	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4472	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4472	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4472	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4472	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4472	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1956	AgentService.exe
Token: 33	4892	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4892	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4892	SearchIndexer.exe
Token: SeDebugPrivilege	2360	elevation_service.exe
Token: SeDebugPrivilege	2372	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 3248	4892	SearchIndexer.exe	101
PID 4892 wrote to memory of 5700	4892	SearchIndexer.exe	102
PID 4892 wrote to memory of 4660	4892	SearchIndexer.exe	103
PID 4892 wrote to memory of 3000	4892	SearchIndexer.exe	104
PID 4892 wrote to memory of 3736	4892	SearchIndexer.exe	106
PID 4892 wrote to memory of 5376	4892	SearchIndexer.exe	107
PID 4892 wrote to memory of 2652	4892	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-17_885ac018632739170d58b71f9a0d918f_darkgate_elex_mafia_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_885ac018632739170d58b71f9a0d918f_darkgate_elex_mafia_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4304

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2372

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2944

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5988

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2432

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:460

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4472

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1940

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5364

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1956

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3248
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5700
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2812 2444 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4660
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2880 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3000
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3736
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2880 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5376
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 940 2812 2444 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 da20d979fc505d9116756df90fffbea199bd95741759c7a68f3b30ea81f26b7a
MD5 3b9740a1bd46d1dbf0d2c395d8569b22
SHA1 afcfcadd1410f0f242ae77ecdc4cddf4c5cdc0e6
SHA512 fa1f816da9d60e49240d11285e63d55f3ccafec36608c58ca7d3f0837180a5a2166d09a87458bcaac08885e86fb848173dce741034e64542afeddcf08ec2bbbc
SSDEEP 49152:vb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnuQ/lFTjN4:t3q6HjBSLm
TLSH
T144D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 86b41c45404d51e19b5c2b89f0a57739d0b50cb4c206eb06f68895fef15e8203
MD5 91c8ee1262f710aaa8d9242c3c14c5ed
SHA1 e20340d2cbdbd900c28134879e46f51bf91f91c1
SHA512 46187ae9f67af34ab1bfb386cadaf3812c52e7baaaea5b326281efb1cb0601b391af270119bd09703438bb6eee9de01096f145ed301e74558dde705ed776b93b
SSDEEP 12288:W1XLsswWkxy2lRq2czAxGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:UXYfDtczABnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T12565F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 5a65ed167897a9b4c3cd256aded48399f21446c84f1e97d928cc0ecc897eadbd
MD5 83826b16a87b2c84130452b460661d06
SHA1 8d803dc20e90feb738b1849b43ffb4f21aedbf22
SHA512 fc1258ff1f08ec6e21fdda66f1ad6b453f55a9999a6b9ed84bd74b48312b57b584bcbd75f318027a048fd3fa1898cd03f8c7e2fe0dd19b5dd576f549b7f103cf
SSDEEP 24576:70Le5ji0hmxLrMmnQ/tbw/2Mkjy6Fr7g0od:7Pji0AlbQ/lFTjN4
TLSH
T1A1859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d138e95cb8695eb2d109e3ec184e8812f7bccc412dbcc6645abdfa6792b58323
MD5 0b0af440d41092806ee534247ca8758c
SHA1 90c43d4d625c121f051a158ccf5f0095edfc5cb6
SHA512 7cd569fbb4ab08579c4398268831b6a2e66e9a7e51a3b0b4a9a69d7bdd85de3fae75686ce899d4c79bf94641d2197ea1d9347dfb695faa060a96fda538f67a60
SSDEEP 24576:Ba7/ezSC6vUyD/aqgrvWE6q8wyuEnQ/tbw/2Mkjy6Fr7g0ot:A/ezSC6vUzPvxHjy/Q/lFTjN4
TLSH
T177755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 97a83c34b5310c21ca0d5edbc32e7d58a8ed5de8786c5a0849780478043ae24a
MD5 68d64b7225a49d28f403f397e2425360
SHA1 4a1697cb39d829889f3ced37b39b202bf216b28b
SHA512 c9f0cc116d6e99206711ccc36bcd9344dc643572f9e9bcce061c664031a05489862392734e7efdb3fba75c32d865cb3084793bee8cea37c90b8ed4c0daba5223
SSDEEP 24576:aVbqPb88hv/l+6tnQ/tbw/2Mkjy6Fr7g0ou:aVO88hXl+KQ/lFTjN4
TLSH
T1F9559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 8032d30d8688b2634692201c30ae4da5bf8f0d170f0412bb20d6484326ef500a
MD5 6002bce81fa46f75ef004c284d336f65
SHA1 c59dd4ec6d0ec7f74dbffdd3c389ac750fa7ebba
SHA512 1a904ea6b7825ef848060bf0ff4318a55dec7bbbee37d15abe17cd740fb65f5f08bfb6b658e1649f5258182bbc9d64e174a9c79bc573890d59707da560802443
SSDEEP 12288:fzyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:fzynQ/tbw/2Mkjy6Fr7g0oz
TLSH
T1935523696A14F887FF2B06B15CC384826B7B0EC1BFD4A74E6B44362D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 af334daee18603b8a0901f3016a6500edc0971b82a8975da1206caa87a5ff1f1
MD5 1d26ad880f4e3ede6b2b5b3e40c973a2
SHA1 9a3909e3ee44ed6f97957653c30df3c19da58d5a
SHA512 eea889e23c47c1b2c7110b05dfeaf9fd51fbb1753df764f84b83b4f32ec820581c6d361b4dbb4111bb5a1f39d6a776a7e94cdced12efa340b66e0a52dd856071
SSDEEP 12288:EeBNUbTVO86UlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:EJIUFnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1C075CF3BAE28FCD2C67E4DB85A918600D77278704F61A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 b96482336df522439b67969fca9ae7d16c46e53ff4d1b19c67c9b2fbb8096c27
MD5 0a4d404c2d03dc5c5a8028c6766c02c5
SHA1 6ab82ec3a2a3decdc5cae48d51a77359b04d8431
SHA512 357246277d583b4163efecb0ad43ee2fbb9c859527363643062e941f2664aa2d7a5e384160ef95c144e4a62f17623624af62411b989d81c1eef49b8dd3327190
SSDEEP 49152:xQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH9:xQvGAdlCEL8c/yRNw5CHLm
TLSH
T1FA267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 64ab5eb67762cd6ace8b95e6f8a6e1573fc5921b8bace95e232ba1c44152cc8c
MD5 dffbd9fcb5e5b5ef2b6eb60691ee3272
SHA1 5c0bb9fe74ac32c30ae4e82a7a44278253cc0fa9
SHA512 30bcf12bbab8f124f36cd2f34168402c07a69392775975ded27a01d0f0b2451339e0568bba809cdd3d7cfb736f711e5fe99a790f76a55c6a2d48fb3dd942dfea
SSDEEP 12288:hAwSfxL/2Dc39DLLmt0LDQewsAj7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg6:CQewsAjrnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1AD75E031FE74E436C77F0DB21B22C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 fecf91920dba5e7f82fd0c127d9390274cf548f9ae634f47054055b56013c9e2
MD5 2b927279bd8fa7ce6300858137e516f3
SHA1 38325e79cbcfa2dcd2a622f3a8598b94a1146066
SHA512 61b5117854e3d2c0d66754876cfdfe4de3c0144a9911cf6acc84c561166cb7dd5522e567d7cd397c52df783b3b4901e67b26daf1238659d78a5cedd5600b1ed6
SSDEEP 196608:iUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHYL:iUEtQevvqc2W1cpV2EI32
TLSH
T181474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d0cefff41a441dc0c5b28156d398510c4c6e2417ce0fc22b964a3775f5351337
MD5 1f22451d2fe116de8beace6efea2965b
SHA1 dc1e76a414695db6b0a79f79ed04d4416c325467
SHA512 440165221d9a60739058dce1dd2c7de2b8da7069d4e33fce1df955a80b300c4efa69406145f733e2094be1a464592dca98845b69c93973202b6a70b8baf0d26a
SSDEEP 49152:lCbRquA/m2yL5zQfFiV+XenmE3/zLQ/lFTjN4:yoqtVjnmrLm
TLSH
T1EBD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 707f9ee1e8cdf577739fdf86ac60d6fcb8eed3f42e9fa5bf6ead39d362596214
MD5 4f1a32856dcf5a0e4088da7b5c4a437d
SHA1 065cba321826c78d8ab70d3b741f2ae17695837d
SHA512 fa34835e536972102a3bf5e84eb143f142d38751cb6b7eed0c8c056b394d4c545ace3045dbed76559c723f00ce23623a9f19c2266828980f77e98bda0a022036
SSDEEP 24576:oAhGLJIFoiwtA5l7S53onQ/tbw/2Mkjy6Fr7g0ox:oAMyFoiq5YQ/lFTjN4
TLSH
T10635AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 ec30577e58567c53e9f52786eb5b913b3277e129e407024643ff4d14c5ef9bf1
MD5 c403b5a06855cc9b02acef8fd5894ce8
SHA1 1f313c355db81941f524de9700a6fade2467b768
SHA512 1c555835479a4781a880ffeac83153179781f250349cf699f192318382452245eb971c52320b8f6a1d6446ec180bb4cce4317df813413f9c54b23cbb1be982cb
SSDEEP 12288:qmw5HEjsChN2BFgl0WDm+CEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoM9:jwuHOWfnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T10865F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 9ac6dad2dcefed7112a6199fd28537c0f8f3f57f695b500ac7e1232ed74d49cb
MD5 a551a36623b18fcbee9b95d1513bbd63
SHA1 ecf49678b339a570de272b77d3d0d7af0d5dd19f
SHA512 b0377270b70b356bcde14af8d7e49bfbd1c0f8078ff2a96cfcefcf963486a5b5daba8d78adc9686bb3be720275b09c4afc5171082dcecc5b54aa75015c8e994e
SSDEEP 12288:tXZ1IyLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWPN:dZu+nQ/tbw/2Mkjy6Fr7g0oPN
TLSH
T12B55126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 48468453270b1178c35b949ee688f0777a2eaf0bca0ec910e6b1b11e132c9ade
MD5 3ecf23b85588327f9062b46e06f069f6
SHA1 a7929e61c434af540d8c50b7247534cb97ac74da
SHA512 8a2ab099cc3e720b952b76831215f6187f32a41cbd60998fb24ac22d2eb3111ea40785c018de50411d9f415ac1d482844013d1c92f06c6e54843f5c737d8edbf
SSDEEP 49152:Wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UB:FQRQyi36YOcPQLvw2gAf+PN3OLm
TLSH
T16D666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 743d535b3f3b08a5b756c04f25ab43fa4f9f59a2586cc7dd057935ece9c736f2
MD5 b83ac6409caeccd7dfce6c72ba6f0f53
SHA1 8efd0d862046f8b04874987e7d8cbc8a24d76964
SHA512 4e5a14570e3800a6175b633c7152a562fc4fcb228b72a7328c7139c907a144631f1107e45bd2d27cda94b99e76bbc49467f0d3f70f626dc644bc7560baeadfda
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UB:HQRQyi36YOcPQLvw2gAf+PN3OLm
TLSH
T1C8667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 64fbf8b97491c7e18a476bfa69da829bd12a8341076f11a162ab70bfa66f14d5
MD5 50a0d5f08a9c47f274f5d46531dbf6fa
SHA1 121105c755105e5559f919e0af6f482269f10d31
SHA512 c303791e00a600281712018cf91e09d031690b6e19fd1b557895a2eb148c034e7fb714bec94c13c39ab8931bf5727c6a0349449d4005948f842ed2f0763f941d
SSDEEP 24576:LwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0unQ/tbw/2Mkjy6n:j68Qg55nhheWu7PNU3/bQ/lFTjN4
TLSH
T1FEB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 525b809ff812f235177efab59bf830812720dc660def9828f14e9f7bdc7975da
MD5 6c270d90f9744e7eb119951a8173f44c
SHA1 dc3eb149f71a2b489e26daec1cdf3115beff2cba
SHA512 b240e0d5d1d8fc4d012b435ddc86eba2465b7473cd5eb4c984f772fb92d6c0ffe94f8bbd66efa1930d42a10d989b5bd2007548cbe68af1a11a6ec08f2b003079
SSDEEP 49152:G3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99j:Xy5112gYy5azzVvL69nLKnhZ9Lm
TLSH
T116167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6c15ef8d648d4d8f5c36e710be2807a412215bef8b4d3ec133811ca16467479b
MD5 f626d60ffe5d2dc512cee7d3260e938b
SHA1 6a00af212c7e30ecce4336bc5a24935e8d312bf0
SHA512 da4335d8792edd5a1cb5a2de4ff19b48d5961d5c0c06ddd9945f2b740d2d7e012ab917653dc8e9efb50e36a37f1591d065732307020fa80c6fc7f425722fa7af
SSDEEP 49152:cB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glxQ/lFTjN4:2u6JmVxd2dWLm
TLSH
T1B3D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 c670c765ec654660f7f8b60cfa147b58fbe27e92c5a6586e41dbb4655bbb56ff
MD5 ff900cc58dba8d71a88c23b391d12c19
SHA1 a77426ec067c75b2e6af443306dbdadd5d3d95a3
SHA512 ef7474d0959ca8ee5bc92988e0cec7a50a74e7050eeb7db68beb2f3f46b8521502b8979b77730fe75fba5dfa26faea59d795cd80a4e27c85dc253d0a05e3aa00
SSDEEP 49152:d1hpsNoJpF1A6UU44CwH7R4xlQ/lFTjN4:dmifPbRrLm
TLSH
T178B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 83d54b9945442746f105010e9ab28dd86853af39e6068cdbde84d9827ddab988
MD5 f376fe25659fb56a0b4fb9ffadece0af
SHA1 7279a4277c8c6853cf48194279305f494649a25d
SHA512 10dce0ec8517567cc677b389a417ee0173307090bfc62e4257dd5295e2469e9b005a14447e154ab3cd65fe4ae5affc0e717b863a1c0c0950a652064361240719
SSDEEP 49152:FSuZQIY0Be2KRRVtOnks6NMHq+Q/lFTjN4:L5dKTi61ZLm
TLSH
T163C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 84824e9abfb1731e88cb2bb59df7038fa6b24c47781f8c1c36e937d5c1895990
MD5 178b58bd9c8cee6cb42b498dda8e4d52
SHA1 8a28f259d502f7f7c9fe7db5244131090c4c4a5a
SHA512 199debe55d4f5180842e1c0405af3dc527a779a968b47e876e9958136b9a49a07499dc50bbac783e1dfc14d1ae727f6f734869879d21a9fc550c6bfc5e453781
SSDEEP 49152:YhtSn8EApI0figngiDn0AP5wBQ/lFTjN4:JX2iyph/Lm
TLSH
T1A895BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 e7d0e28726658534b9f56f7584275d82cb54a7e8e4c613e19456d00a9bba5b87
MD5 9bae73667232e61f7ac908c70f34966d
SHA1 677dd0bc64221fcde724df864c5f9e9a33b92bbc
SHA512 8cae6d23a52a70eebc95c7682fd2e6242369ba79b61506463727aadb94104a3cf7f715b29b3e3111d31e1baad44602fbb372d80f1c077b0d6b7585d6f9245cf8
SSDEEP 12288:EKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWKt:EKnQ/tbw/2Mkjy6Fr7g0oKt
TLSH
T14F5523697965F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 b41ba4bcc3bd1782f0afbd0d3a33565d350086d88ddae076cccee05dd2bdc265
MD5 f1bfbc5892d5dba96dd42505ce532550
SHA1 10099ba6e1d0f1522fca56d1a13e3afe917c17eb
SHA512 6ea8fb5a299acba173793b789d5114f619ddffa5e65b3e67d8e13ed1065d4f36fcf0f674dae2a54a677d56e93777dba103daf2aea910537000fee7cf7437b487
SSDEEP 12288:1nGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:1HnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1BD5523697965F98BFA1706F14C8281829B3F0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 be78bd744b7abe45c4b21bd69bdf87d8b33c293df4b47415550948deaa832a05
MD5 fba7f6e31364c03d4b21121da21b5dbd
SHA1 c8022c8f1cadccc5e2467a2a9e90102761454e78
SHA512 ce5ff48c5bb43b1923dfdb019ef121f93246063ecc888b691ca1f92cd6bdab4efdb3847765fb4b598e9847b730018b1976fd864c0f1e9e82aec9dfcb64e9801b
SSDEEP 12288:k9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:kdnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1A05523697965F98BFA1706F14C8381829B3B0EC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 4c2d3cfb31cc5566dea60ab591fb777843633de4f3fde2645b075e73eda3e4d8
MD5 5e0708d733a0f08973ef7e6eef56f6ee
SHA1 f85126125fc8495936c6d644600a3707d8d08f34
SHA512 a69c087a35ca7c17ff766b53a7ff7cc415c8e08c7ed0c0ef2bebd7c869fd4fe5f67faf24160c60d9537ae2c3516827a224cfa67c512a89975d401ed16efd8fac
SSDEEP 12288:GVIGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:jnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1895523693A69F4C7FD2742B4CC938142E77B3DC5BBA1A38F6B04112D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 fd527fea98d5ed00b37b4df7cb9bd9f1acb99bc2a4161bf1bef7adca0872ed71
MD5 53c9f5e30862ab40eb5adec143f4edd5
SHA1 1049a27065a84aa812248243f2217aad8560795d
SHA512 0f3dffb9447f9aaeb48b2a6ec89bb4271b1a8dd4f6ad718f9f9586f75d3236a5d9ac603398dfa4a0f052e091b7405ca8488b228376b708332fbc5a06bde45e3b
SSDEEP 12288:iQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:iwnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1855523697965F98BFA1706F14C8381829B3B0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 06558f68fdbefd94d4f444ea9b036781b4075795f9c5c2b9efe34f8453f64c37
MD5 5563a782d0d0708f0923c712a47581be
SHA1 cf49b8b80476b344f2fd932d1d7d0a83edc2fb95
SHA512 65eaee624db4ed0c87af41823de7dbb4fca4348157f622427613d969620f85e174f972bd16d0b987ed5c17a3568fa27a4b10898ff19d41f52a6e140a2af4a451
SSDEEP 12288:OTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:ODnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1605523697965F98BFB2706F14C8281829B3F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 cd3aad4996ced5b1db3851f3ab68acd305de5595b37da03e1aa1497b5eb8da7c
MD5 8ce8589f944e03ad42891ee85c0678cc
SHA1 6a0b59947b79a885437cc5aaac6074fe602c86dc
SHA512 e1b70eedec592d5c9821ff553dabd06456900e350a3b57c97afb66d6f52be37daa9c5fc4f11a79c7aa6317f991cfc9844c304571cf3f285fad502be4f1d15e03
SSDEEP 12288:tvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:tPnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1675523697965F98BFB2706F14C8281829B3F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 7cb75777a7aea2105979c41a34eeb794615233b9c6ab99222a68017a8e8e7822
MD5 c4f9833472ad5a9a2f95c8066f695be1
SHA1 1137498151ec420dd2341fa7837336e22e4075ab
SHA512 31b51ff2dac36f33cc0c2a0259b4e3ee780f12b9d00185c8be1ca4c45737144bd6eb056f27c5bd341f7db93943a163b98f94fe5799f67d2830209e0d283dc138
SSDEEP 12288:8iZwbDzzFEoS2cPvyHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:fZM3zFVSOnnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1C27501A5B35058F9EC67423ECC528906D7B27C5A1BA0C71F13A8362A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 14d0bf112a3d5626fe4be46514b509f722634b1cb2aa25581b803ffbcb7bf0ef
MD5 66583f25b434656509b513c20a04f782
SHA1 86b34b0b18db894509da53b55261996141bd1b66
SHA512 8d60bbc7740c588b9e259050bf9793f881debd61c9e93f9029f933c8137fc5fdb44bb292e92f9f8e3594a2994d0826dc80743eb5ca4aad115cd16e33071dab26
SSDEEP 12288:aOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:aOnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1555523697965F98BFA1706F5488281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 e29ad4bf536ecab056ddde4bf55502ee6c3dbbe20afb41069da25f4e9d240628
MD5 248f796be0e50184059ca20c0d6dd5ab
SHA1 4944007ff6ebbfe657b5b566a43fe96eb9866d88
SHA512 801bb471fce5dec51d7751f7e3942b12f97e7eb110cd1df5806ea4d86dbd2117598e49984ebd6721cf168acffa34699fce4c8a4dd659e7487020624cf53cf8a4
SSDEEP 12288:eCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:eCnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T1B75523697965F98BFA1706F14C8281829B3F0EC6BFD1A38F7B4C1129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 fe65514300b615cda1aa3b1c046af71c53f9fe3bfdf11ff6b4d9b5538bf4b898
MD5 db0c7ba787c9d484283285dffca52a14
SHA1 c161dd9ee2177ca3e4af627a1a3898342086be4f
SHA512 fcd714096d2181d01985550770cefe2c664779f8b952c7b212e56082e09aa57e555939285b9248948aa120b2680637dd5155e80de79dfebeb74a7b449de7ffde
SSDEEP 12288:HyPz5L8LGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:qzy7nQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T12865021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 2fc3fc42494f98f0912129116db75c4fae601e79545908749e16e56d71de1da5
MD5 d6c2ec74018a338dea29f6b7600f1ab3
SHA1 9666ab9ac02803b90226e245554ddb2f81a557f6
SHA512 d7b80c073e542025ef5a4c3506e1b27791c7ad1d098e39277a9de29241e31caa58a35224e3e5173c9285afad48c3d56e787f93cdc693ef22dd08756a3b169a90
SSDEEP 12288:DOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:DOnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1A25523697964F98BFA1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 b51a8db83059f495038728cfd9622b4cb2d8c797b08bc5bfd331cf480b7737b5
MD5 202d6fdd4fe00be08eb997579acbcea5
SHA1 8d3145e6a956ebd78c2075cd1c9c305cf0036aa7
SHA512 c1330801b60db71f54428b03a6454ad01bb4f30c9bca37303870c5914c70dea63951df82737e564fb2b82e90dd8d7d2fbcba786e1908d114731aec8b276da8fd
SSDEEP 12288:aOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:aOnQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1355523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 b99f6ed7f1024cdc4260848ac161c5e9f78a1ca6052d35343c2ae6b8e39bf81d
MD5 811bae249abd365dded0c9f6e81cadbf
SHA1 8ea724c6a1b119974d29115c257e6eadb5295f3e
SHA512 bafabe65b98f4fec91d97af526ab48cbb0e712855a2f84944d2d6744aa7ae98c37689d1343349868a5dcdf28c1ee0f8bb141d39418a5ab03df27725222221f87
SSDEEP 12288:xyPz5L8LGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:gzy7nQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1BE65021777A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 032054ce848e53fd4e6cc65839d46ae0e8895a40e1dedcda915425ca65729ae6
MD5 2c18dbbe73006d4b4be2056269c57d73
SHA1 8dcb4a5f9dfb58ee6cd44bb8b0963091f9919065
SHA512 204249e965a1b178f58f57e9d8b9ee47162a8ed82643f30a1e228ff577395e940dad7489419b274b8c683ada2b9d49cce5059f992a8ef888f3f25a6c93b862b2
SSDEEP 24576:zT0aLl3z0zDNnQ/tbw/2Mkjy6Fr7g0oK:zTDLljEQ/lFTjN4
TLSH
T12E7501A4B35058F9EC67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 31d479480283cc1d060a9e328e0e8821e97a060fa5228960b21c242bb9f9fc14
MD5 5a9e48aa7b04c7280854829e9d34e3b6
SHA1 63e6a62c9e94911d0a5f2596915d268ef551103b
SHA512 61962cf2f4c1709bc3bf22184275fcdda4a92a890c5bdc6c9e099282dfc751873ad7226ec1d3fe73073edef38052f810e1397b924950447d57f4d97f24b3a12c
SSDEEP 24576:d31d9CHKy7GZ5nQ/tbw/2Mkjy6Fr7g0o4:91d9CHKyaTQ/lFTjN4
TLSH
T1D985CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 89b9c516e4baa23aae568f234e499837e0a48e527037ec8110dad6cac6718443
MD5 aa019d7ac6a65dbbc9bde494bfe00ccb
SHA1 6216e7a66e8fec9a1f129b7bd06014def2206bf0
SHA512 9d642ce58a95714f75c29468bdddbc05671073c998017cd5e54fe27b934e421b6d0bf1e20af8c40472582956f16b8be78c9d1b351e040f83823e97f4097c636f
SSDEEP 12288:2dGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWM:29nQ/tbw/2Mkjy6Fr7g0oM
TLSH
T1885523697925F98BFA1706F14C8381829B7B0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 fec0990ee61653895c9c0618b3c1cdf581f35db9a650f1dfd005d84d80b0e8c2
MD5 95dcd48d66e3de6e386fd66d2c173240
SHA1 106313eb6372e600ff14c68bfa5545997287a5f9
SHA512 fa804aecf38f883bda4e5d480fc5f964dec04c051997143c379a649589fa5158af42d4598c5c74f68d15e288aa21ece75829a17974fb60eeb55e26e4056c79e1
SSDEEP 12288:vrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:vbnQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1745523787964F99BFA2B06F15C8381829B3B0EC6BFD1938F7B481129967D39406C67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 bfbce47646369b0deb0cbff0173a76779762e76a126e4167cc8bfc8a2d019ceb
MD5 de23a188fd26794ae3b5e8aa2ac6c42c
SHA1 babcd84119d771ae516601f1522cbaffc96f4546
SHA512 ff2fde452bdf58314733f1fc1cc7455d449010c1040f01e9fa7d8db173a37720e91271f04eda793fc3cdbd20aa713c1a0def768e0f3d4d894e8fe3e09a72b8d8
SSDEEP 12288:jsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:jsnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1D15523697925F98BFA1706F14C8381829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 5b75bcb19d7ab43f9774d2f4cf49ab43da48243578dbbd6b98f643f7010b8c5b
MD5 40c039d5f35c179a1442ec5f23b3474a
SHA1 fe3368027ad83da71e718afdd128706f248d0a9c
SHA512 678331cb0f8f4471907ec23aca2e0b1ee5f66f70fda330be4e7334258552de421cb527cb4b9be9a643539c0012d65b172bf4597758e1971dbce4fe7312710302
SSDEEP 12288:IOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:IOnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T10C5523697925F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 02a81592129f603fe4e85c9affaa1d77e5b6c769bf46eb82efe1361a908ee4ed
MD5 41ff310c538b2a240006863e710a2d1b
SHA1 328ee7e3e452d3e812ab33098b2edd80f039cfe8
SHA512 e0e60b8f82d90c1c056296a9bbe0897a78b1270cb5b70ad292c5e38ad8ad30b9af2aa153a47ee79567c08570afdf97e47dbcd8995fb756ff2617d82cac79ca2e
SSDEEP 12288:9dGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:99nQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1735523697925F98BFA1706F14C8381829B7B0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 f23999d40e0dc67a4927f5259bf128a43d14dd66efb08cec87b6bdbec3dfb75e
MD5 9a65c729ff46237e63be353ce0a5714f
SHA1 0d56e0f665fb67fb8ecd3e4a825933032b71d055
SHA512 7467433ba34dd275fc69d44539a5271a3b180c39a71f42875a73565645930b0974df3d471f4d3c63b1cbab0a1130e956de0ec2202f60b7ae43ffb85073da107b
SSDEEP 12288:o2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:oWnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1805523697964F98BFB1706F14C8381829B7F0EC6BFD1A38F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 31d8d98dd076df95bbf5c1cefc4dd607e42827d1ef734fcba51b19d188c37f6f
MD5 47904dd81be49d1dccccce151bc794e3
SHA1 d3929538b3a0b4d44728bb330353fc5aa986c40a
SHA512 243fccf001f4870328555b6db83d21282a5c1fcd45dea1e7205b3dce2c8bf9c924e7127ee82504be53901ca94b3121ccdb8a9fa43d426ea10f657eeac8520a00
SSDEEP 12288:pQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:pwnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T12A5523697925F98BFA1706F14C8381829B7F0EC6BFD1938F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 b7774842e2ca52b1c5494199ada737a66d1a1e88c445b95d3025051d90704aa6
MD5 f0eff9e1daba4d95402d84fa9b70729c
SHA1 41e804b22604e0f88acb3a4acaeec5390de73ae0
SHA512 019d9f607679aa0586f9c5da637d1f805163d8188a690ffc2d49186d5dc900189ddcd223f66d09696297226f1cadeca8b40f38c442179620da6053c6f0103fe9
SSDEEP 24576:Mfwv/k9RX6wkyAISnQ/tbw/2Mkjy6Fr7g0oY:7MnYISQ/lFTjN4
TLSH
T10985DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 44aca55a8833f8b865994b07f48c79f280d319ebe87b2529e15d808bda0bfb37
MD5 16ac96851d33420c1f7f6b70a1b3485e
SHA1 b636a565e69ca3579e0669d9cc797f71bae73ed6
SHA512 8c9139a0defb7707ca97713baedd5e856c4c47405b270bed589a48a666bb66b15d270e3733e0643352cf161a8adceac74c9e76e855340a1cad0dbac395eed076
SSDEEP 49152:1YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0hQ/lFTjN4:1ySzPuLm
TLSH
T132066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3d6831220ce7a9a596bf006102f055f584ff61271f43303468acd9c0dbc2af86
MD5 bbc94c0a4b72686dd7c0cb7d8cf49480
SHA1 ff0d3414ff90f308935f488a5a0605d32d95baaa
SHA512 73351465eef663dd353f7c36517a040b88dcf225e99f558cad5c7f95622be26db4ae4859ac629ddbae52a32d9a193d5ced9e76fcfa864223d2f3beb19601a423
SSDEEP 24576:747Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY3nQ/tbw/2Mkjy6Fr7g0o1:747JUQj1irIhCnDHUPfF/xQ/lFTjN4
TLSH
T10065AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 dbc5aff8beb29f53d1bfecdcb8793e3b7d9892f064059f7a8e1c2441b88273ab
MD5 3f365d89f49f60d594f0974300ec6e19
SHA1 0c83e0ba6d5ebe3e863f4fef440816d4082d2b2d
SHA512 610a3e3417b91c57cc626a3a4350264e8f9a3e30573f84d6d9cd6cfe142e46b4d44a0351e32c0661ab24cb27273eb237a80a6668dbe38c3f86a38c8823275771
SSDEEP 12288:0ssf+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:a+nQ/tbw/2Mkjy6Fr7g0od
TLSH
T18165F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 94d3a4a3f800c9715e577d9ca838b48b6269c1742abc76602a8dfa2cd23591c9
MD5 ff240b2a8deaa04ddf8e14b72462bdef
SHA1 9fd73fd80660f8c7e427b07c364fece0277a8fc3
SHA512 931773c558af1bfc1ff6f1159a5937d822a815d1118e4fadea5e9af7eaf3e933bb0ee6cfb173c232ec279b25501c059f4171940ee95fc45d372108a6b22c4466
SSDEEP 12288:B6cdYU3fFucjf92wxlOyH2WHYlLOX/T/p9YzprPRo:B6cmUPbjf99h4ZG/T/nYzpFo
TLSH
T111452741766AC79BC6A940321E36D6CCA7707C05FE059F0773C8873F947A668BAF5282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 e73560a3f338f76c3fb5e535f8e44ead4eb5fc0047d9aff696dd31e1a113dad9
MD5 2df027fc7899b38d818f2312ab09316e
SHA1 c0d1d2a351c09ce4d0ad97783b3560155a9e2ebf
SHA512 d1f5863fe2c76943991853b91a39a31242efdca9dcc0c6c8e56b60ad4324b8ecc740fd151773dd8b647c9de44388ab37dc820060f65258dabc3e9cc678dbc05c
SSDEEP 12288:Cj35fvq8RE7rzacZo2+FkCucuY9KQxAYA0THmwfMcP6:Cj3xCGsnC3PxNqXvN1
TLSH
T1E7552B01A5E7E35FC8FE90374732868DAB746C06BB452B0573448A3C987B67EB5E22D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 88d49fcfd06d0921940ca965d54e3a37382452c2984fa3a515a80883f6853605
MD5 bbca1325f75217a379211c3d2be0cac9
SHA1 4027f1e0e925505d55ed318a0625c6e001f64412
SHA512 440b0f0d09718418cf8622db6a1a6c0f61f01d03190a85eb365c15aa26a4663325761e925c9a0ae0e68dcf4abdcd3318f16106b748611dfb6b18552b456aa67b
SSDEEP 12288:x67mGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:YGnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1825523656668F94BFA3B06F058928111673F0EC5AF90D3CFBB082269957D3C40EF6789
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c8200e19aee4eebc3dce80645785f016d584646916e27acbe6be0032a3823807
MD5 f974808fcdcf848b71ddd8a895e7b1c4
SHA1 08a4d52da34b2e873ecddc99161aa929cd2367b4
SHA512 db4fe78326c9978a9c7f06da9baa1928db4a556abae3d7d5f6a8f157e4fb90d71621db32f8f31f28b0b3dc54dce450743388091296070446d6b1ea4f110384c2
SSDEEP 24576:xgb6bmBIi49WNNFpg1rSvFv7bYEnQ/tbw/2Mkjy6Fr7g0oz:xgb4mBIBhGF3Q/lFTjN4
TLSH
T11E65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 4b4ef3f18ac7ed141b929d0199d0cc13a4600417806d142831c8981aee0f4b25
MD5 b3a4fc3328b8120ee3974b84d38f4256
SHA1 1587107236e9074c349790d6d557d19461f6d778
SHA512 6a02793474d1a13a1f9f56b01a807b493c7d66a819a55cbe61034e0bef1150304c56164608524ad6b51016107b54494841a1b34fdcc729c8630f41c8fcfe307e
SSDEEP 24576:QG88u8FpJqH1Qzria7/mnnQ/tbw/2Mkjy6Fr7g0od:D7ZFPqVva7/MQ/lFTjN4
TLSH
T1E285F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 162761f90efd1a189fa8fb38bfd80f45f0eb78d193b58641ce3394818ac41c3e
MD5 5f5498fff865218d0b893388985a361f
SHA1 dfc0cb14468e1ba376fa2e7cec8f7210827f2662
SHA512 13ffaa0e9b0658cb634fd66df6f36645c3223221318f36d092f1131210b2c462c63e87fb0265ed734925f8dec5a504e2c1af6fc020e31460d99ea90d9e1d2c95
SSDEEP 12288:tHvUrBFrEjwaQjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:tPUr+NQTnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T12B65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 dc5a5116ebccee90d053467939a32f962f2bf692074404e8ea80ec62870d7410
MD5 6a04b1783c95fdfcd058d53b22fad9cb
SHA1 eac0d81c0f034d7f24e580865467f68a6becd287
SHA512 90b6a6980a51218c0512b357db05530a8ca271ab8e97f2e2d3c7256bc71d33a781f4e34cef381171581a84565ee051ddd0b491dcf120f11428650fb1235af905
SSDEEP 49152:KBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjDQ/lFTjN4:1G05lO43bVLm
TLSH
T1B1D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b3a6e91090d3de8edcab430c048ef86b63c2309b1d7be283162c42261a6aa342
MD5 fa05af7fa5683ea21a778210acc8b07f
SHA1 e2783e16c102b199fff817695db92253b17d1e59
SHA512 f21af96565e684889a86b75d9670067ad2f2fa791b1bd5eba29d1d021f31dbdf1d3da460e6a7d26fd823e417a4588f72fdbddef1c78aed0e90328f8594694a5c
SSDEEP 24576:Sfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnhnQ/tbw/2Mkjy6Fr7g0ow:6a5POZ3+Jt2pasx2+mbQ/lFTjN4
TLSH
T18565AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 49c1a0f93f2980b0903c7ab9442fbe97cf71d5a24450488734563b280c435671
MD5 0ed554ae7f3c8c61f26b2d3fcca8b42f
SHA1 73b5a2e40418df660294b77170a19f465a8b57cc
SHA512 e7a729f703f4488c711086de14f21db51b297e3314ea82cd9d67c2d74257f7153039f527425907814ab8ada06d024df52f443cad3ebf37b682774a193c3fe275
SSDEEP 24576:zNcwHdjbyQ4nLC18lb/EOjowL7Fk/nQ/tbw/2Mkjy6Fr7g0oX:zNc/zEOVHFsQ/lFTjN4
TLSH
T10B858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 13aee80b633a54070813ab7de69c2c6336ee5adaaff6737cfbdb7e63a4116f9b
MD5 91cdeb4db6134d66617f4bca08bd0228
SHA1 000b33563ca9afac007cce1dc09de389b0e570fc
SHA512 a4b7bf279aac7987bf748d87c54b272f51619fd2ccbe1fc830cd0989c31c63f3bb39ba78011539ebb4875f5874ecf6808ee42b25aec91cebbf909b0af9e9c699
SSDEEP 24576:K8kNvNnaFeYhJNtmZBm9nQ/tbw/2Mkjy6Fr7g0o/:K8MwBtOm9Q/lFTjN4
TLSH
T12455AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 ade7e60085edad9ccaf523953195b136aee0ef8197d8d86708eb846d761ca7c2
MD5 933f7353ee21b816085892910e9647ed
SHA1 b60de1152565e07f9a60d7dcde16adafd7c2c32f
SHA512 2939a247ef50e5df532c71c1fda2548ec509ff20a12d5eaebe50e8ec38f189d45feeb96fe3e72ce646cb9f977b39d59e316f2f132ac2d0c5f8d8b75cda922c8a
SSDEEP 24576:hD3FHshBIYQgAqnQ/tbw/2Mkjy6Fr7g0o8:hDVHeBIAAqQ/lFTjN4
TLSH
T16C75E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/460-312-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/460-81-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/460-87-0x0000000000960000-0x00000000009C6000-memory.dmp

Download

memory/460-82-0x0000000000960000-0x00000000009C6000-memory.dmp

Download

memory/1940-110-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1940-103-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1940-319-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1940-104-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1940-317-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1940-315-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1956-138-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1956-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1956-136-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1956-130-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/1956-129-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2360-24-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2360-116-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2360-25-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2360-16-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2360-18-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2372-32-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2372-145-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2372-40-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2372-31-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2432-71-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/2432-69-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2432-77-0x0000000000B30000-0x0000000000B90000-memory.dmp

Download

memory/2432-298-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2944-62-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/2944-66-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2944-43-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2944-44-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/2944-51-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/4304-6-0x0000000000D60000-0x0000000000DC6000-memory.dmp

Download

memory/4304-1-0x0000000000D60000-0x0000000000DC6000-memory.dmp

Download

memory/4304-0-0x0000000000400000-0x0000000000634000-memory.dmp

Download

memory/4304-8-0x0000000000D60000-0x0000000000DC6000-memory.dmp

Download

memory/4304-17-0x0000000000400000-0x0000000000634000-memory.dmp

Download

memory/4472-314-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4472-92-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4472-325-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4472-326-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4472-98-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4472-91-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4660-323-0x0000015C1F860000-0x0000015C1FAEB000-memory.dmp

Download

memory/4892-320-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4892-153-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4892-147-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4892-146-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5364-316-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5364-117-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5364-119-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5364-125-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5988-281-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5988-64-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5988-56-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/5988-54-0x0000000140000000-0x000000014017A000-memory.dmp

Download