b99738d5621ba8465a9c3b092b806199032fc1ddf43a8bda00b3aae8c60bbc43

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 18:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 3.4MB
Sample260820-xc7d5afc43
SHA256 b99738d5621ba8465a9c3b092b806199032fc1ddf43a8bda00b3aae8c60bbc43
MD5 e9d3d7b83fc2dd9cf8172f5df1047f13
SHA1 1435058d3b616f2d9aef92ba63a5eba5ea1616ff
SHA512 38623d96a4560cf15a02a8e59946838e7815f82bb6b4796397ffae9423185625f94f155986aff112d285b1ee2ed8bad931b91409c455290a08ad9fe38780685a
SSDEEP 98304:UFShs/iEKEIx7s4Alr4xhoj9ghi1RebM390bYVHLm:I5JVyxhojD390bYVHL
TLSH
T18FF5B0717EDD8475C1623572CADA93BDA69BEE702F35024721803E3AFA34382593D627
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5640	elevation_service.exe
2864	elevation_service.exe
2928	maintenanceservice.exe
464	OSE.EXE
240	PerceptionSimulationService.exe
616	perfhost.exe
5332	ReFsDedupSvc.exe
4472	SensorDataService.exe
4968	ssh-agent.exe
1792	AgentService.exe
4280	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\ce19152e238bf42.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d7c222dbd330dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006787f5d7d330dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006ed05cd8d330dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b7deaad8d330dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d3f59edcd330dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008aa833d8d330dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000053e7201cd430dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5640	elevation_service.exe
5640	elevation_service.exe
5640	elevation_service.exe
5640	elevation_service.exe
5640	elevation_service.exe
5640	elevation_service.exe
5640	elevation_service.exe
2864	elevation_service.exe
2864	elevation_service.exe
2864	elevation_service.exe
2864	elevation_service.exe
2864	elevation_service.exe
2864	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3116	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Token: SeBackupPrivilege	5332	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5332	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5332	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5332	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5332	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5332	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5332	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5332	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5332	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5332	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	1792	AgentService.exe
Token: 33	4280	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4280	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4280	SearchIndexer.exe
Token: SeDebugPrivilege	5640	elevation_service.exe
Token: SeDebugPrivilege	2864	elevation_service.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3116	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3116	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3116	2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 5436	4280	SearchIndexer.exe	100
PID 4280 wrote to memory of 4816	4280	SearchIndexer.exe	101
PID 4280 wrote to memory of 1876	4280	SearchIndexer.exe	102
PID 4280 wrote to memory of 5184	4280	SearchIndexer.exe	103
PID 4280 wrote to memory of 2212	4280	SearchIndexer.exe	107
PID 4280 wrote to memory of 6004	4280	SearchIndexer.exe	108
PID 4280 wrote to memory of 620	4280	SearchIndexer.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_e9d3d7b83fc2dd9cf8172f5df1047f13_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3116

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2864

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2928

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:464

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:240

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:616

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5332

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4472

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4968

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1792

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-552508041-2681165170-3229858294-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5436
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4816
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 2976 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1876
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3008 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5184
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2212
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3012 3008 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6004
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 2976 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9eacd59dcd4a4a9163c6ac9f9b3446ef67f67f5ef34ee66429b7a84be0b32470
MD5 176fcf401d0ed41be64cda2c439610e8
SHA1 641b198b9bb99dec45f31445d61f2487803bf0e3
SHA512 3499d8f883a5f380baa7165acedf34f8e086be0341755b84a65346ff17680117a8b397f24a2ee3e0f681004c7e6dbd6f26126b6d5a568d4a71713f153cea1591
SSDEEP 49152:Ab+632BuPkFKRrdE6ohmstBhuXjfS4LWxnaQ/lFTjN4:q3q6HjB+Lm
TLSH
T13ED58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 7d6793d62582a635a291ad020222b68516177b6674333f0470ab966091c53c0d
MD5 86eb7e17b5fb077f2c613401e941aa96
SHA1 09ff46bb16de1775356be9d16aa7ffea63e4339a
SHA512 1c6e780a7724ae7cb47581effe720e83a7a59f8d4af96f52dca54934e5ea7b5a5aa22017f558ac2bd0ad1619318c26393a60cc442fa8506496ff861bb6d662fb
SSDEEP 12288:P1XLsswWkxy2lRq2czAVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:tXYfDtczA1nQ/tbw/2Mkjy6Fr7g0ol
TLSH
T10165F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 9aa09f267ab0c9b770a4abb585755c3e50674d11e257470304b82f87f69343f4
MD5 23ee0745fce76da8a72b4e3b553f29f7
SHA1 575e1a15d398d3ffbb99aec9e17b98b37edc464e
SHA512 7f92e2d04e707e86ab07391d94a3ce0cd87bf89744467f4876b61aa6b62d87394e1b6b8ce36a157f3f50175e9bf9df00c1f60a180796d781dc852ab52bcb6747
SSDEEP 24576:j0Le5ji0hmxLrMynQ/tbw/2Mkjy6Fr7g0oU:jPji0Al/Q/lFTjN4
TLSH
T177859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b9063d1fc25f46fa25d01cbcbfdfcce18fa2a4e7f69e1db101a13f7dee309551
MD5 2aa51d50ec6d098f2d6ab849150d007a
SHA1 9d42bf702cea602c63bed4dfcc174674c2baf0bd
SHA512 bc1d152d98e701f57868ca074efd5f18768cd7ced3eba2fd90aae82e79cf13d4c2b4e8e1f7f9ab505b9c244f1ca4f78682904a8f7904067ad28e42ec24dd29d0
SSDEEP 24576:aa7/ezSC6vUyD/aqgrvWE6q8wyuYnQ/tbw/2Mkjy6Fr7g0oR:N/ezSC6vUzPvxHjyLQ/lFTjN4
TLSH
T1E0755D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1a97545e0d8ab377308eebd5c642e9081c240bfb777d90d14b002824a52e9c0f
MD5 d15c580260b5d3d5d418ffc3b9eeba9c
SHA1 08137e2cfcad434aa4d24a0846c355cbe3d75bc6
SHA512 fe7aa16852faa67a4d0973b85e8a1121bdf8ed9a31de75bbcf7a5b3e5310f792d849bf7b61d2fefed4f666333d9b0df746ea6ac28c2bbb1faace234685ddb850
SSDEEP 24576:mVbqPb88hv/l+65nQ/tbw/2Mkjy6Fr7g0oZ:mVO88hXl+uQ/lFTjN4
TLSH
T185559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 111fa2f5d8f453593c26b9dd8882acc63e24332bd0b840c9ba07c57f5e95246c
MD5 c48a0ea5cd6ca54d4978293777326b45
SHA1 1e9907282728f258f01319a07a46cfa3213a7c99
SHA512 42a2b4bb5fd5d485c828b34fb238467eb75a8388f6ca8d56fffe4947ef4ace69d031e27a14d9f48797b4c0360f7336b45e2f9be333546cdf8887e9498c346ba3
SSDEEP 12288:Sz2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:SzWnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1505523696A24F897FF2B06B15CC284826B7B0EC1BFD4EB4E6744362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 48d5e03486202588e85df70d5678737734c1d1e7eac09e9d2b649e9de2e48123
MD5 2d17a91825d1607ef40e50cc541c2e02
SHA1 e79510264e5e0540d0941b6105aa1946d3cfcaaf
SHA512 f6c61d66e5b9a5a2fb74ccfca0a11cc48ca0ad380de40cc759dec4771906c896e835a32da19deaa0d77509014fa092d21a8ee8082cd52f8669087fa68bfdfdcb
SSDEEP 12288:MeBNUbTVO86UhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:MJIUxnQ/tbw/2Mkjy6Fr7g0of
TLSH
T12D75CF3BAE28FCD2C27E4DB85A918640D77278704F61A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7b278c9be9abd2d6258d50e7c31cb9a650b17675f3a41974a559335dc85d7810
MD5 d010e174c87c8b11c230f20c7b8eaf2e
SHA1 a30ff8f63c2ea3e269fc353f21b07579ecdf8e25
SHA512 e06a2f9a97c0abf560f4a72ed2a9c092ddd63874cde22cc8931c5d82763f42d2165e6e206bd13541cfe8b92a43a4c4eb7211ea6a326ea60752ee9ee5c15843b3
SSDEEP 49152:qQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THZ:qQvGAdlCEL8c/yRNw5CrLm
TLSH
T1E7267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 ff3b1cd65cc6a9c3ba7b3f8edae371587bf3ec52d842f0fc7325eb39c117394c
MD5 91bb859cf50bc6d04666f7ed17ba2618
SHA1 04db4f41383f8b2b279b7dd1b783c9c3985f96f3
SHA512 ea23e5070535d1083fb41f431776f2ee9adf19a7e13c3e292637b3b8ab7ce3dd57893e78bf49b77b1aa626017e4f9b79a15c410a1b6678180c09070417dd6d71
SSDEEP 12288:tAwSfxL/2Dc39DLLmt0LDQewsAjPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg7:eQewsAjvnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T15875E031FE74E436C77F0DB61B22C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 3c7b4c370e7652013c723a301c1117c58f9ee18f312ae9742696dfc9dafd4ef4
MD5 4777651dea4bc1a7ae0d8bbceb210033
SHA1 bd358d8c4d5d5695e2a8f52b9d828e99e58567ad
SHA512 0e1a5877a2ad341bc80a595cdefd53f8f26fa75b91645017aa8b071992df1f838aac75f5fe3528a8fc9d67dfe5ccefc566fd80009240a30a4cb21c8154adbf04
SSDEEP 196608:KUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHcL:KUEtQevvqc2W1cpV2EI32
TLSH
T109474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 3fc85e665bb30e3a5df865218563503a9cdc9871add64aa04f0cf64936214fa4
MD5 fc8f0f743e75036d45b79e772a646f96
SHA1 f19f5ca5f428adb9fcd6d98a4fcb8e4a54d09306
SHA512 e3b688c6412b564149e7d16d04a3b591d65bafffbcf7f9037ef536a0b4423b033d2fced5cd1e4b2715039710e431e05e744b5fd9f188e345613d04224166860d
SSDEEP 49152:0CbRquA/m2yL5zQfFiV+XenmE3/zPQ/lFTjN4:doqtVjnm3Lm
TLSH
T1F1D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c61c8386741bb09f1d182570b8f2146dc01778c68a6884f5973c6d558bd480a1
MD5 156054967bbf8bbf7671993cf0857593
SHA1 c7227942c809e0fa5c6af17662b151cdcdfd85fd
SHA512 a6c75cc027e8f4cee21fdc4c17af5dbfedf609371f207822bbcffb53dc84c2f63d7bf420fbeab5e0d9abaeda84d5d8aba6e05d8d9eedd9d100a0d11c663b48c9
SSDEEP 24576:hAhGLJIFoiwtA5l7S53knQ/tbw/2Mkjy6Fr7g0oW:hAMyFoiq50Q/lFTjN4
TLSH
T1B835AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 db7b27911f86ef761dbb6e91ee2354b128eb0f54598da54ab74c38289306ccec
MD5 2fc4d54031d098854655e8b17823d1fb
SHA1 7f60a09e1cb3e4922ef63df332db17200a80bb40
SHA512 3aff624217a96dd1733ca598e81f91714138d75b0c45fbc598cfbf1dcc4a8ef5969a17f8699f0b931a341344f414e9826981069367ecd590eac086d9b97ca5d2
SSDEEP 12288:cmw5HEjsChN2BFgl0WDm+C4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMP:ZwuHOWrnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T13A65F14A36A45CFAE96742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 159a924de6ba730c3a098097934aa609c06e36e0956aaa7211ba57fb7f79460a
MD5 b3783b825ed5fc6704134726cc644f1c
SHA1 12ce3492211f13c43521e077db1b077b8adde1f7
SHA512 119770ee568213e6552e1017eef71c4e940642711a013b41af036987c5548d4682d69336f0554c7f594b6b5798adffcefa015200a093d823d893151288a4b548
SSDEEP 12288:tXZ1Iy/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:dZuKnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T17755126A33A4B0FAE6674278CCE28646E7733882677183CF275442695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 0452518de0a07461be783cb3a0f96a8f924427befe507887a480389bb280cc43
MD5 f59cecd04a2338167965619c4eb65437
SHA1 4cd07784a8c6b5237c2c972b675a872b06762266
SHA512 db0bf0aa1203961b9d83189d0133db4765c1ef796cc339eb73a1eaabff036c2839a9cdce44a104dc574e943c93f11ca95099c1f13640ee86f825b8af6b3b0a4a
SSDEEP 49152:Fj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ul:cQRQyi36YOcPQLvw2gAf+PN3CLm
TLSH
T179667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 311aa291c55de73ef57d6999e4d27f6f8b91ef90991f6c86c7b323485fa79969
MD5 123edc906f6d913bb72bba9c384c2be1
SHA1 18d37aa926a8853e3a676c1015796396d39ac9e6
SHA512 cfda6bef53662c58bbe235c35e255b14171a9034c3cea54cadcb5d551d6e5f004b7d7b177a0b9d205e36af2441dcbbdff96a4648a9fadd6ff681a77cb5e244b1
SSDEEP 49152:lj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Ul:8QRQyi36YOcPQLvw2gAf+PN3CLm
TLSH
T172667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6d2c7634e2b3cd995aadce6833dae56bc5344e664c26d30d8a1293548c2511f5
MD5 ba84add3ece28a83de46b672ad96c645
SHA1 6eeefb457df25ba1d3224e8c520096a2df99e4de
SHA512 a5f80be7d8b924261cca30cd8b4f8c64530b2ebbc745fe19dabba6d86ca947aadb362f7bbb3dfa990f6135b78341d3188f888a4b4e08f6e86ae8d7ee0124eebe
SSDEEP 24576:awvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0anQ/tbw/2Mkjy6o:U68Qg55nhheWu7PNU3//Q/lFTjN4
TLSH
T10FB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 c3b627f196015657f8f2687ca42ec3b4dd9df2e520477eaa5741880614364360
MD5 89d811257bdb33e9998d710ad421bd32
SHA1 e14b0e664fac340f33f16baba8937bde4a0c4261
SHA512 c4e25f486e401606e20a5238ee7c265e2ee526270820a8f74fd356c7d1138e2daa33ef4f97310c94f75fdba32c28065ac38da4854e1663910e58d0ff8d7cbf53
SSDEEP 49152:L3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk993:Oy5112gYy5azzVvL69nLKnhZhLm
TLSH
T1E4167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 c45261f2ebb4b313ab9978414d760a780ca42f1b1537e3ea8a4aaf16a25c2503
MD5 9a0cefad423bb8e40af18d4573360c59
SHA1 7d28824086b885a1686db25435999a62c7fe69ba
SHA512 a315955e1fb93d7f952ed8b59d6b4347d1202c9b5da521b467122987d6a3b668fb701c0e6f643392421ac3efb4952a20efba39163a668620dedf65954a48813d
SSDEEP 49152:qB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glFQ/lFTjN4:4u6JmVxd2dqLm
TLSH
T141D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0c5a921f49747c3f67fe0578b149afa26b6d3e962ab1938db7d0434538ae2825
MD5 4fc3bf627f607b64d7bb7e9b922a8545
SHA1 fbc1accd210e404eaf1ab9b6e0909fc41e2ebaf1
SHA512 4e69c7057d0c614504ce6876a6d31d51d08902674034153ea163d926884e6989402971431f702a27e965db03dba64b54ae043329d210c6056363515aeee3ffa3
SSDEEP 49152:J1hpsNoJpF1A6UU44CwH7R4xRQ/lFTjN4:JmifPbR3Lm
TLSH
T10BB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d21aa4d341ddc4d0a05575ef5f31a36d184722ce87b6f4b559b14fc7e28029cf
MD5 c39830d2415be868d03bdec01c1673cf
SHA1 72712d8d1188082306dc5efd4428ae8f01c9ceb0
SHA512 23314d4df7e61c392e5e53843af1443418b8d6120cce70c8c0f7b3a200dd25d1f74d6a10995d6e06409c6caa74e1a9e4cabf698cb2900fe05ec5043791971b11
SSDEEP 49152:vSuZQIY0Be2KRRVtOnks6NMHqKQ/lFTjN4:V5dKTi61FLm
TLSH
T183C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 36e654205e34b25ed1e59e2aa1388abf6123b3e66484f8eb31382d9307fca1d4
MD5 788a65fac2d4bd0fe709ed31b9fab563
SHA1 4b29e6152d3136d96323fe06a984248df02dc62c
SHA512 bc433818dbe4e3d25391f36efc13e16a526c0d72df4f04134fe249d9b1e89573a1c7c53a50a53041988e2275a6b9d29351ba647331282ea18e3030a386d52905
SSDEEP 49152:ahtSn8EApI0figngiDn0AP5w1Q/lFTjN4:bX2iyphDLm
TLSH
T1C595BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 cdb1da57e1c05bbf5e37a218ef1cbe5c404f43f23dc896ea5729d03c79445dc2
MD5 77597d8d616c01b738fe3bb4f24b083e
SHA1 6975ea147f86b99e387899dd4bfb8ef97c16fc03
SHA512 a6ce0a403fe73b12e866e46c40ba69a74f630666af98f28464e6e0778f34d917da6cca0289c849870957772030fb2a6e6cf47130f40ca2785926363342c5c8ec
SSDEEP 12288:vuGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:vunQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T14C5523697964F98BFA1706F18C828182A73F0EC6BFD1938F77482129967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 25e55aa786511857c7ca3bbaa488d596ac2b81eabbe9bca779f35a246dd9832c
MD5 636b4210c6f4280e84a18370ffcb6ccd
SHA1 92b89dcc08b79fe88770f0097668856bb84935a8
SHA512 e7b6fc30e6cd87af8f223c3440af7b0ca9a77acaeee5fd437b6b66e9d051809ea53bc641eaf0906db9e3a2cf93ecf08ec9cdf30e19796593415e3001e429e9da
SSDEEP 12288:gDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:gznQ/tbw/2Mkjy6Fr7g0op
TLSH
T1945523697965F98BFA1706F14C8281829B3F0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 3ef91bed1ab78146395ba21a1973eefee90510f32cb6dda83800e88cbdf8f256
MD5 4bb26b267d48f1e6142c0391838c0b87
SHA1 6f68d0f8ccc9a09e04a71d54e5f31b96e324acf9
SHA512 2da0aa317a5084c374064cfd4c778fc5166d81e96dbe999c73172915ce00d0f3777b64ae5b7555368b7c9ad8e0429cdf2f5119c86807d0181e3ceacbb57e81af
SSDEEP 12288:x5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:xJnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1BA5523697965F98BFA1706F14C8381829B3B0DC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 3ca6755b0c2909d6dae6f0df1500770c65c3670a3a993570ed6fe4e9c4a64957
MD5 844fb706df7e08cd8d382df0bc04c383
SHA1 2025c4b02b78873e4867c082bed8583783a99ddb
SHA512 562a1db66c048b7dbb2b8720365ba3601c305f7ce49267086d8c6b1d6cde8ff3642bfddaa60c27e6265aa694b95c9a3755394d3e06f53979320e52e382fbf11e
SSDEEP 12288:PVkGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:mnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1305523693669F4C7F92742B4CC928142E77B3DC5BBA1A3CF6B04111D4E793D41AAAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 6e00e7f2c29b966ec5b7d836d6dcb72f2863bfcc4354563c2d8149f855ef7298
MD5 84a4a4c5eacafcb7b22a04e84bad1002
SHA1 e1960d8f3d39b6caa11e0a72438dff01f47031af
SHA512 b5b1f7dfa6761ebad2b0d6264c31b4231b56f339b713eee5de3069ae41919789b07ea390a263f2650939fe7c0de54ecb9048703c76865b2e40abf1d6b13cc9a7
SSDEEP 12288:7sGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:7snQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1845523697965F98BFA1706F14C8381829B3F0DC6BFD1A38F77482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 408bb8f0d75927c312723e6bd6b39027882fb0b58ef2f06c70f266efdda1b576
MD5 898f1539482ae46c2f972ad9696edf04
SHA1 761678c102fd389c4f11408b49f8702eb280340b
SHA512 9d048e61c0d1058d5a439bf8c1bd2fac4f21f63f558636d5643a319b5d3c3efbb83651f98ddf2e161f97d90709caa8c5bf7028256af11dc026a63f71c67be338
SSDEEP 12288:WHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:WnnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1245523697964F99BFB1706F14C828182973F0EC6BFD1A38F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 6826a55137cbe38c7fd1a21031d03e0c251de1c7e333549245b5935907068a5f
MD5 e91069d2367c236ff4e1fd7e088277da
SHA1 a201e88445ee4bc099554f13314ac043fb9db91c
SHA512 7c852b79cc7df3b57660b837f05df718c8295ba8e39464291d5b44db6c59d7184baf01b42ef4b0fc0748d6e1ffc7ada64a4699379ed592d9b3b943f3fe149c87
SSDEEP 12288:zLGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:z7nQ/tbw/2Mkjy6Fr7g0oa
TLSH
T16F5523797965F98BFA2706F14C8281829B3F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 99729069a9b89f74f1694982acd4835af4279a6e049e48cfb072b3a9be0d001c
MD5 94b42e9412afd7a4ce23366a92ccb838
SHA1 c2f06f7a643480e054e3494d05df6bea6710ea7e
SHA512 7643be6e78a19f4f934c7a9ef409e209e4af3a125160fead806b4fa3487f603e1ad43e426c71424f776e551996695f61fe7a03b0dc5fd0ed41d551a95333d93d
SSDEEP 12288:xiZwbDzzFEoS2cPvyjGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:0ZM3zFVSOTnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T11F7501A5B35058F9EC67427ECC528906D7B27C5A1BA0C70F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 1f6afdd8c059dd963094e2b98f30f900f5d6e417f03608f12447e43c02355a99
MD5 08222dbc058ad5fe6b6ee73ac5b1d54f
SHA1 6f7c42aeb2a2a62446a53cf543b677133166caec
SHA512 2aeb9c22dbc2c41e1e7b08f89420f2107fbcd1d9471c89d8bb249eaa80ab5cc4fcc7b732019916fd9db0e906d35d2585ac04b8b4fcb306fc37f38de08f701108
SSDEEP 12288:d6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:d6nQ/tbw/2Mkjy6Fr7g0oc
TLSH
T11C5523697964F98BFA1706F54C8281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 3aa683611269da5283275663ab19fde332b5b12dc272c74d3117b6f3e00e5e87
MD5 af2f2e229462a0cf45de0465902efb0e
SHA1 397634b9ef84d7b9dac162222798a8425525063a
SHA512 c79a02b2e30511180be30d4a17af9791fe8d5ae348a331bafdee27aa1dc80608a6ed4b770a296c22d897734a35a99f5322dfd97a4e78ff464c43abe37bcc6234
SSDEEP 12288:SmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:SGnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1995523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 91985d6ffa110d036d9db783e4eb442f1d3e8acb05dfdf3db255cf0698c446f0
MD5 e61a22a8ef57cb5fc1fbc638e2dd02eb
SHA1 1efc490959119bb0dbd1118713e4d37dda95a518
SHA512 ceceaf66adb85ad955fab6460ede2602c78f12821e7fa0ff63d3abea8c3e014f3a6eada3acc3bc061cb804a3a6495e6b32858e601b8c51bd0e6c56f8246ddab3
SSDEEP 12288:FyPz5L8/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:MzyfnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T12165021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 a0c827ba853fb6da64d197cb182838b8ce711371b9264d4ef64a875a5ab6cefa
MD5 9b1d285f258b6200caf5d515c7407b5e
SHA1 d39715223c99502804b56a42772824e4d655c1cb
SHA512 e6973818acd6d784e8b5a2a05f2c412216c8ab299cf5d7048a77b92f92e94365ac0b9a585b7f8bfe64d13a0bd8b9e66e3d7d273d13a501863abaeedea1913247
SSDEEP 12288:r6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:r6nQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1215523697964F98BFA1706F54C8281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 24d88c3232d46a1a85717bea560d547e02f187ae4984091483f3366982b43ade
MD5 0c182dc4ddc4e75f0321e0686bc5a901
SHA1 6b9cffc63bf51a85f9bb4fe0374d05e6cce753a1
SHA512 cecf5a2e26e9ae016ba69c4da02bd47d9c6473caf0fd74918aa9ef43e73ffab82f81e56fdc83c87ab4a7d1213fb76b61e960c16801258d41ecf6b3eef6742f5f
SSDEEP 12288:/6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:/6nQ/tbw/2Mkjy6Fr7g0oS
TLSH
T1165523697964F98BFA1706F54C8281829B3F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 9d3fae232000e5ee76f4af356f66d5f29276baa5a53cca920ef0c7adcddad6f2
MD5 3d1997158e776025adfdcba097e6cbca
SHA1 343a5a7ade054da1a27b32f4044e11435b724284
SHA512 ed948dd33355757fec0bb4f65da09e2d6ec7fcafdb73c2dd12c577c9f78302fb29e50e5fc5850d932828849a1c6e9802f9d3196d2c9a5582e74febb1d1fb37c5
SSDEEP 12288:gyPz5L8/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:RzyfnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T15265021773A570FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 5a9628872264ddf8e4dcd2ccd2f8375b37884f89cfbd857673ff30675ef21543
MD5 f442842476a3a3a7f83dfa3939f31d5e
SHA1 e9982c057c430d661223edeb6e88f139c331fb9c
SHA512 dfbe0f4308677cf37ab5df6b67514d5f611fc5d36080c3b812d5a71356429104b4268660ae833fc97a6aeba012fae2fb396927b8257c3add3ff335241899f03f
SSDEEP 24576:bT0aLl3z0zDZnQ/tbw/2Mkjy6Fr7g0oB:bTDLljYQ/lFTjN4
TLSH
T12A7501A4B35058F9EC67417ECC528906D7B27C5A0BB0C75F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 28c929cc899339b154759e720f20933731752b3df01e710f748810791e142533
MD5 1e80fa8aed84c20a78a62d4cadfe4c00
SHA1 6aa89c4743d3c6491e42a9f090c7a4c984be99f8
SHA512 d7cf3786efdf90e933588a0a1966b0c1a562ce3760dc68130b0755d8222414df9c97b2464a99d79542ae5317dfc8d39d827d2aac98315369f374a0b1a46723c4
SSDEEP 24576:A31d9CHKy7GZtnQ/tbw/2Mkjy6Fr7g0o/:K1d9CHKyaXQ/lFTjN4
TLSH
T1B285CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 f3975da8f55b60be23564f1989d7d9b0b60000750fa737751755f2d4130f24ea
MD5 31f253a5b04ab1f247621b5dc86fe05b
SHA1 423d9a713aa998d161335716ac065a1fbefed670
SHA512 440fca2328e1461716a62c8270e692365c83f4348eec38082ab49fa4d651e4804ead7a0a5ce16a5425e6fa83c4b63d99e05fe2b0598d550fd841799bb274047b
SSDEEP 12288:oZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:opnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1CA5523697925F98BFA1706F14C8281829B3F0DC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 b69a1b5bab7932f465ac39728ff3e4bd1ed4069c735c745f8a01a79e9b79f92e
MD5 c8752a5a4dec03cd01843f0893b71017
SHA1 c3944e9aeca9b02a1117d952aa5991056d6da2d1
SHA512 f0432aa7eda3e091aeac9600cd88ffb3c80ef6c4ab41097240cf4810cb3af8c7e2f26b3373888ce4a20f1ff53041a9937fb40d81119ab59d088ee3eb2ec8c2c5
SSDEEP 12288:+fGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:+/nQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1F55523797964F99BFA1B06F14C8281829B3B0EC6BFD1938F7B481129967D39406CA3C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 786baa8cc2467d60dfab796076c0d9d8a243199a81477dee549f9c396e4bd627
MD5 eb2ee0f8e3f9186948efc8226cac9ae8
SHA1 010242fe482ab8851d28d1ced8269a64d20209b6
SHA512 230f10b413458b4e75cb8b6d9dc5bc254187d9423d1e0d9f378ae1b1fb3679b31a4aaa532d34d97829cde2940fbb0d5522d49e9aff3a5b32cbd2d8af0ffbd73e
SSDEEP 12288:UAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:UgnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1935523697924F98BFA1706F54C8281829B3F0EC7BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 d606e89b5e6b5fc9d65dd45026bc3ea5362b6ba59c9441d584bf72ac8e8d8386
MD5 9e18893846dbd56a83132778dc9b6363
SHA1 c912ab628eca3554b270b9ea24c3d3aac9e10f6c
SHA512 22dc051babea75ff17b2e05e7576a554b125137609d8204641162c26de7cbe8729ef951d8a17b5c0bee945d8af34b1eefd82a24d00e753f96125e5f4c892fd64
SSDEEP 12288:l6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:l6nQ/tbw/2Mkjy6Fr7g0ot
TLSH
T13A5523697924F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 cde6aa6805e8586860d15f6f45e51b61c29da5900bff37dbe2faeb02b69513ff
MD5 abfd2deabb20b947270d1e91e58ce546
SHA1 a491aeeeeae687736e4bd84ac8d6d415b2b39b4e
SHA512 653bd55ed16049739183ff074b954c94cdc3e4d61dc5849835652393b5714ed3544ca06430ceff5b26ee635dc2005155ebb31ed00ac065709a57255736b227cb
SSDEEP 12288:DZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:DpnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1C85523697925F98BFA1706F14C8281829B7F0DC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 c6c65c93de23e6795600b8c3c3fda8cc6100eeb68373b76092145716dd648387
MD5 e466f3d95f074679e318c11e65e5b6f6
SHA1 a9f4100dd8058c23809b7aaabc0792e8f8c1b75a
SHA512 0b9863a70323521f12d08c42d92e45afa8f88104f126edb6d8d31eea8d333892c7fca6b73459309615369416234d48bc0bf78579744ed80ad2f5c796af406af2
SSDEEP 12288:hCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:hCnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1EF5523797964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 a62c5877a7c4d28b9443d69b5f38353ca5e6cbd3a4d055b1181f73f72e40b148
MD5 2239c8caf752ebfee949f13fd6a95b7c
SHA1 fdca6a703fced842a84d1d1a7fa69e8c47a1e3c9
SHA512 3b131ce10eaed9d20695b297dd37dba5ec5ab1c7c3a73ccd3abc36cc9a9d2f7b0b0a1cccbf990dac4f2c1930b1eac29469f468464dd02d1a632d1593e693a30b
SSDEEP 12288:osGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:osnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1FB5523697925F98BFA1706F14C8381829B3F0DC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 0c3dbba093c3e10760e379b1d818b7e7d98d7504a7473d22282de28dcce3d60c
MD5 b535164b87a6a8ffb51a7704c7325399
SHA1 2df64c0feff75bbb4a651ba3b458237d41efdf55
SHA512 42ba18876f22274c348f27952b667bdcecbb3e8e3ccbe62ab0ba5acc7914cff2eeb2e8cd0dfeb7bb756a176d499829af83b01560337bcce8cffadef8796cfc4c
SSDEEP 12288:sRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:shnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1005523697964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 04e74cffdc8f7947e8155878eb9605cdea47f6bcc8f77b09af3ed73044885d04
MD5 652f42d469d4c1e0fab00c837ac517a0
SHA1 d19ebbb7d005c5b88f31204ffb01fa4ebc08473b
SHA512 313afdcca08d1a2e76a462366ede143f88dd79b1947efa8b5e8b553b67aaa8d6ba383e8e8869e348499e7e15b7e96a4fe83382711da47ba4018066fb58430fe3
SSDEEP 12288:VsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:VsnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T19C5523697965F98BFA1706F14C8381829B3F0DC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 e0014ca862b780aec0dabad2213ad3e802fd4e5199ea45081abbdf3d6dc387a3
MD5 b5399f2f3c8c38269be3cab0bccd1c5b
SHA1 c160186e96ab634516cf553bab3acc3d2a9b6cb9
SHA512 da1b4cecbbd3d33b52e9644ae6201e16a494d87ebf527094950bca273382f81c1ee31593deec4090ac4ea7d400c9f01a41e5efa3cd7594fac739386c1789b5ba
SSDEEP 24576:Ufwv/k9RX6wkyAI2nQ/tbw/2Mkjy6Fr7g0or:jMnYI2Q/lFTjN4
TLSH
T16185DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 9dbe83fbb701b4de270d030a0b0792ec5316bcc2dc4bf6f80d3a3dfcece60988
MD5 02a8dac226c2eba6857749a655c4c8e5
SHA1 9f3615003839f6a108a2c63900dc4ff2fbb2218b
SHA512 8e00f2af9637d549d31d826a0ad197f4d8c78dc7ec017cb8a050dc9deb5dec2b71475792c6816608c1a7d81d6287d202e0450b459ad2d709910c8e73ff82aca4
SSDEEP 49152:/YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0VQ/lFTjN4:7ySzPiLm
TLSH
T122066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 8b01f25564fc91c09d83eface5f2b7f6a03a08606abb705a1fdb9804220d365d
MD5 c9164280b4abb0eff78360c42fb45271
SHA1 c1d856bf71aa427eabd5563c27212eb3c86f8cc8
SHA512 572d6284f36f7632749c5c892d9050d5dadffd09efb0be56a46a6c596451d221ea42951bb849eb4e4e1a52261dd688685a97c4f35176ef3c862f73879443b4fc
SSDEEP 24576:o47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYDnQ/tbw/2Mkjy6Fr7g0ok:o47JUQj1irIhCnDHUPfF/FQ/lFTjN4
TLSH
T1D065AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 e7ae8db6dae0282da957901a6a886716da4a9baf960e1aae09ab4cafe99b5d89
MD5 ad23b6ef81152c2d001c927bd4eeaca6
SHA1 33d410b2ba215675bc3d0039bd2afb05e8b5f007
SHA512 40f0694a2a80d0551dc240da062ebcb3be32492c9c7d14919be008f51498415cb85a1288f2eb849c57ab9c80671eaf156515a96cfb2186381c110b38f8c8a8bd
SSDEEP 12288:xssfKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:ZKnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T16E65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 800fc8bafc1256f220cae570cdbf952bd3a44fc9fb8ac445c473450f5387a284
MD5 cc113788ec9aff2e30def37107df8db2
SHA1 815fac2801516b4f9c7b53fbe6529fc8f79c7bfa
SHA512 2b519e324db699172986c508f0ea3b0e422db35a0aad4288bb30083b3a4b2e945d83e3bd4804795d74d14321e165e3e5244e30bd1ba4a89dd9643657798b30f0
SSDEEP 12288:DjOady5HONyUJ27GGZT6giBKl7Qs4KciaRM+03j:DNdqVT6xi7QsnXaRMt3
TLSH
T1A0451751766BD75FC6AD80321E36D1CCAB707D01EE456F0372C88B3F8576668BAB2281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 2b8ebe7e0db659f941d4867878d07b1a6c14a64d26431e3963777b0217d8d1a7
MD5 7f178be7ce9f39dfb479327dc0c5c7e9
SHA1 ffd51826cb00a90aca7a42826c2f6a24f49b5029
SHA512 ac8cbf80d7fe71321c196a98500643b2f8177f1d8e1666a1bccc4820eeb689970f6868d1c1e7fde8f6c8d7e65ed77426ac08bc20cfe44f6291dd711c17834fb6
SSDEEP 6144:uID3exfc327IwveWXdoKDexHdYKCzoKDexHFXEB/hJGXd5K6IYlE3zO:aE2vveMd/eXzXdE6IJ3zO
TLSH
T18165F941A537A38FD5FB5032072A9F4CA774EC06B7096F26B388053AD86A715B4F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 7b30e7dc83c22a049492815bea932c49039dacef3ee6547a1facc5928c71e50b
MD5 86ea38ebb7ffd3e14bdd9ff459aa6835
SHA1 a57ad7a48e9258ee4654093829c9fdb598d4cb73
SHA512 82d069e34b4ec10087b5e4e383b23ec71067778634d3b6433408dcc7a230a629526f2aaf85ded752fc415329be1835c4d27b294e11ddc7639f3b311039d18886
SSDEEP 12288:O67SGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:BSnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1D35523756668F94BFA3B06B058828111673F0EC5AF90D3CFBB082269957C3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b62380c8752d1721bc1d32f0413b5f902152f4cefac788a33f2745bb8897b567
MD5 32a22a7f20922a4748b194f618d0c440
SHA1 fc84539b5ded7d44d03e34bd8c89b4ce04749893
SHA512 272e9825777961d1bc51a4d1a9e7cd3f0a1f165ba29c193654897e796f7df7412be748b3702af1dd57d617bc4c60dff70029f9955eb1ccefbe695e99a211a13c
SSDEEP 24576:xgb6bmBIi49WNNFpg1rSvFv7bYYnQ/tbw/2Mkjy6Fr7g0o7:xgb4mBIBhGFDQ/lFTjN4
TLSH
T10065AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 50c9ebb71db324664eae774b1945cd160026461f8fb66219fb7a74dd635482a0
MD5 cad31642b8880d1fd06e59349432bb9b
SHA1 7a24fcf1dffeb16dfa7126e164e91856bb4050ee
SHA512 0a900b8897fab3e7ad4239fcae0fcf8333dcb9b7236b6a69f1bbe6ffd096bf0bdda2907697fad9642d8f5b98b2c0e2acf755351900e017db3bbeefdda06e3bf3
SSDEEP 24576:WG88u8FpJqH1Qzria7/mTnQ/tbw/2Mkjy6Fr7g0oQ:97ZFPqVva7/AQ/lFTjN4
TLSH
T11785F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 5adb051c0c97c2cf47671e0809393484c412538cf448e3e9589bc727aab79b84
MD5 33cf5530a90bbcd2b24c2e4dcbbbe8d1
SHA1 266152fbd97c2776e4e0daa9dc052cc5964050b1
SHA512 9105b0d41106a8c56fedb25c5b92e25ae1bdba4c8a8e444af70e7b2404ab07ecd1ba72caf9cbdce442528f09b2b4bb7077c8d4f0ffec77efef557529421b6dcd
SSDEEP 12288:KHvUrBFrEjwaQ3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:KPUr+NQXnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T15A65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE86D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 3340972a10fb2d4bf00a76470b2e49fecdef12f938c6b2c4d1295a10eaf10545
MD5 0a515a4d8e5d2db026bc1e81733be2c7
SHA1 f6d246ec79abe91b4144f1bc6d37b36fb39a86c7
SHA512 d08d17afff56f87a02db61968d205182560684975c7b0eb2757d39a99d27a64036fefa3fba09163ca0a18ae5a497dd896f3618b745d56f4cfc1943334180e149
SSDEEP 49152:GBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjnQ/lFTjN4:pG05lO43b5Lm
TLSH
T149D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1015f0d3430e90affc07249977e84a2279d0f9556b4f3a9ffff23bff04edba92
MD5 77bceef8cc8a76cfabcb47c31055fe90
SHA1 75f65ff5b50dc1222076af2e7d6ac56952c5d4b6
SHA512 425826f833b9f20860ec0f197825532ca616d655e507030a7f5698c4c0c46b75d6c46d051699752b9f74a4a48d8f2236eb46edb9c40fe0c8f29e5b8ad2a21dc2
SSDEEP 24576:Lfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnVnQ/tbw/2Mkjy6Fr7g0oR:Ta5POZ3+Jt2pasx2+m/Q/lFTjN4
TLSH
T1D465AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a50f54db6b205b7fb8d0a2cbbf7514ece523d84e7a565a7607c1dc81876c5879
MD5 2c1d7a2165e8e328f884e968826fca48
SHA1 eb4a90929801160f993d735ecd5427d876ad3ae8
SHA512 a098b75460ca2f8e16854da7f9d9471bc108d6358b097367de85fe3a9bf87e06771baa024fa0f0cefb90d8a7c11e2fd38aa49943471663d768154459aaae716c
SSDEEP 24576:sNcwHdjbyQ4nLC18lb/EOjowL7FkLnQ/tbw/2Mkjy6Fr7g0oS:sNc/zEOVHFgQ/lFTjN4
TLSH
T12F858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d4604b2c31459296fe57413ee9ff64b63567c437420742568a64c2f43f788eff
MD5 c3a963dadfe9bd365a01f25393fa3ead
SHA1 6586979b1ba8c1e0c57c4e94087da6da5e5ad3d3
SHA512 d47dcabde363d8817f81eae1eab58c0f281ccd5199564c19f3fe97194bc08688a4ec0cf92198aaef41e77d16594210f29247c6b5464a37e1e4ec15b9ba5c1929
SSDEEP 24576:N8kNvNnaFeYhJNtmZBmhnQ/tbw/2Mkjy6Fr7g0od:N8MwBtOmhQ/lFTjN4
TLSH
T12E55AF2EBAB846E4D1BEC6B4CD238512E6727451173293CF5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 70fbfe2553238993af32a2502979a672d0968800cfc2ffe14bbb6a2e774f4f79
MD5 4a71929ce85199b0d532850286b443fb
SHA1 b01d048ccef9247e1a5eb845ee92f3263d6bdba5
SHA512 169f964c862b278b28f1d4b0136438da34d1f59e0dd09963460a6ed446fff7cf6f06a32dd4f794a8f3e68819a885c8a66b270f6e1346ff708da292b67cb0dc24
SSDEEP 24576:ID3FHshBIYQgAOnQ/tbw/2Mkjy6Fr7g0or:IDVHeBIAAOQ/lFTjN4
TLSH
T1F275E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/240-299-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/240-63-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/240-71-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/240-65-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/464-59-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/464-274-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/464-52-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/464-53-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/616-81-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/616-75-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/616-314-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/616-76-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/1792-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1792-136-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1792-131-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/1792-123-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1792-125-0x0000000000C90000-0x0000000000CF0000-memory.dmp

Download

memory/2864-140-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2864-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2864-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2864-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2928-44-0x0000000001790000-0x00000000017F0000-memory.dmp

Download

memory/2928-48-0x0000000001790000-0x00000000017F0000-memory.dmp

Download

memory/2928-37-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2928-38-0x0000000001790000-0x00000000017F0000-memory.dmp

Download

memory/2928-50-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3116-8-0x0000000002650000-0x00000000026B6000-memory.dmp

Download

memory/3116-320-0x0000000000400000-0x000000000077A000-memory.dmp

Download

memory/3116-1-0x0000000002650000-0x00000000026B6000-memory.dmp

Download

memory/3116-0-0x0000000000400000-0x000000000077A000-memory.dmp

Download

memory/3116-85-0x0000000000400000-0x000000000077A000-memory.dmp

Download

memory/4280-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4280-375-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4280-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4280-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4472-370-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4472-105-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4472-374-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4472-371-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4472-98-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4472-99-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/4968-119-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4968-111-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4968-373-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5332-318-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5332-87-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5332-388-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5332-386-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5332-93-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5332-86-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5640-110-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5640-22-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5640-20-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5640-14-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/5640-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download