876291307db72e7cc73acab3208ccf5b9edec8ac21f600ff6d177506fecd0e83

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_78dd3049fa7e4a7e4e039828076a6e1c_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Size 1.8MB
Sample260910-fdhzgsgl3s
SHA256 876291307db72e7cc73acab3208ccf5b9edec8ac21f600ff6d177506fecd0e83
MD5 78dd3049fa7e4a7e4e039828076a6e1c
SHA1 230511f1742a209e09113aee8353b00e335f6ec9
SHA512 4730c52f36afd85a9e65616448abebc7b115fb523e621832f7e4c43063d9b81fc790bb76bf0ce0b2378bc654657be4fef0b31440be098b4a271b5a31e625cdbf
SSDEEP 24576:t8/7eWQerJ2PHog66Tyxknw4FYnshx8OfVe247:i/7eWQerQPH16Jx4x8EVep
TLSH
T12595F12075B1C072E56151720E79EB65927EF8344F3201DBB3E86B3EAA305D26736E27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5304	elevation_service.exe
1152	elevation_service.exe
2776	maintenanceservice.exe
5952	OSE.EXE
696	PerceptionSimulationService.exe
4076	perfhost.exe
796	ReFsDedupSvc.exe
4468	SensorDataService.exe
4756	ssh-agent.exe
4632	AgentService.exe
3796	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-09-08_78dd3049fa7e4a7e4e039828076a6e1c_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-08_78dd3049fa7e4a7e4e039828076a6e1c_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-08_78dd3049fa7e4a7e4e039828076a6e1c_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-08_78dd3049fa7e4a7e4e039828076a6e1c_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7080742d744edbe.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-08_78dd3049fa7e4a7e4e039828076a6e1c_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-08_78dd3049fa7e4a7e4e039828076a6e1c_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-08_78dd3049fa7e4a7e4e039828076a6e1c_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-08_78dd3049fa7e4a7e4e039828076a6e1c_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-09-08_78dd3049fa7e4a7e4e039828076a6e1c_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-08_78dd3049fa7e4a7e4e039828076a6e1c_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1672	cmd.exe
1180	cmd.exe
4996	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_78dd3049fa7e4a7e4e039828076a6e1c_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
2376	taskkill.exe
4416	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002c08657cdf40dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f0d9b93adf40dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003bb0ee3adf40dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000344ccf3bdf40dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5304	elevation_service.exe
5304	elevation_service.exe
5304	elevation_service.exe
5304	elevation_service.exe
5304	elevation_service.exe
5304	elevation_service.exe
5304	elevation_service.exe
1152	elevation_service.exe
1152	elevation_service.exe
1152	elevation_service.exe
1152	elevation_service.exe
1152	elevation_service.exe
1152	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1896	2026-09-08_78dd3049fa7e4a7e4e039828076a6e1c_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
Token: SeDebugPrivilege	2376	taskkill.exe
Token: SeDebugPrivilege	4416	taskkill.exe
Token: SeTakeOwnershipPrivilege	5304	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	4632	AgentService.exe
Token: SeBackupPrivilege	796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	796	ReFsDedupSvc.exe
Token: SeBackupPrivilege	796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	796	ReFsDedupSvc.exe
Token: SeBackupPrivilege	796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	796	ReFsDedupSvc.exe
Token: SeBackupPrivilege	796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	796	ReFsDedupSvc.exe
Token: SeBackupPrivilege	796	ReFsDedupSvc.exe
Token: SeRestorePrivilege	796	ReFsDedupSvc.exe
Token: 33	3796	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3796	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3796	SearchIndexer.exe
Token: SeDebugPrivilege	5304	elevation_service.exe
Token: SeDebugPrivilege	1152	elevation_service.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 1672	1896	2026-09-08_78dd3049fa7e4a7e4e039828076a6e1c_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe	90
PID 1672 wrote to memory of 2376	1672	cmd.exe	91
PID 1896 wrote to memory of 1180	1896	2026-09-08_78dd3049fa7e4a7e4e039828076a6e1c_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe	98
PID 1180 wrote to memory of 4416	1180	cmd.exe	99
PID 1896 wrote to memory of 4996	1896	2026-09-08_78dd3049fa7e4a7e4e039828076a6e1c_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe	101
PID 3796 wrote to memory of 5024	3796	SearchIndexer.exe	107
PID 3796 wrote to memory of 2732	3796	SearchIndexer.exe	108
PID 3796 wrote to memory of 2124	3796	SearchIndexer.exe	109
PID 3796 wrote to memory of 3040	3796	SearchIndexer.exe	110
PID 3796 wrote to memory of 984	3796	SearchIndexer.exe	112
PID 3796 wrote to memory of 5388	3796	SearchIndexer.exe	113
PID 3796 wrote to memory of 4824	3796	SearchIndexer.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-09-08_78dd3049fa7e4a7e4e039828076a6e1c_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_78dd3049fa7e4a7e4e039828076a6e1c_amadey_darkgate_elex_luca-stealer_lynx_njrat.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\System32\taskkill.exe" /f /im RoutingService.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im RoutingService.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\System32\taskkill.exe" /f /im PassThruApp.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Windows\System32\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im PassThruApp.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files\BongioviMBApp\BongioviDeleteDriver.exe" -loggingToFileAvailable -showLogs "C:\Program Files\BongioviMBApp\BongioviAPO.inf" "C:\Program Files\BongioviMBApp\BongioviAPOMB.inf" "C:\Windows\System32\Bongiovi\MB\BongioviAPO.dll""
  2⤵
  - Executes a command shell one-liner
  PID:4996

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5304

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1152

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2776

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5952

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:696

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4076

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:796

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4468

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4756

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4632

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5024
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3989226554-2204910950-1522900112-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2732
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2776 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2124
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3040
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:984
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2776 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5388
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2880 3056 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9addb41081a8966a0111d4d23a0b47ec2f3231bd1fa4c4a99c43e726d374832c
MD5 79dcd14c802f9e9b4a60235a6f7da004
SHA1 ddb30d6430c815fa7fd058ddd35d55f5029d3d20
SHA512 74801fb29ef309d32e84e3cb5d981d74aa392194c17a36c180f03f68e60775a63316347cda9099ebb31fac7a5dc0451c062a89738fc1bf585eab42dbb2910e88
SSDEEP 49152:4b+632BuPkFKRrdE6ohdstBhuXjfS4LWxnWx4x8EVep:S3q6mjBtix8EVy
TLSH
T137D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 07ec4328d83e868376bc9f1fda7c6b3bdffdda122b332969632b0d72cceffdfd
MD5 7530f7928a8dfa8c9374157757088dd8
SHA1 5d4227d3e4ff7de3881a78cf1524c67e68aa0859
SHA512 d107691f9f4276d5a88e24c81719cca0de9bbeb96661e96e44d3510d0a5fba09a83a7949f29347d887e9e72ae025f5392ce2851790d6cf40193bf77eb8f1b63f
SSDEEP 12288:Z1XLsswWkxy2lRq2czAe+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogk:3XYfDtczAeyxknw4FYnshx8OfVe247
TLSH
T18F75F12877D548F9EC6B8139CDB28112E633B8554770E38B03E4A52A5F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.9MB
SHA256 2f18ebb6fa044e4f45dbab6a0d1b002a5f4d9f9137814fd970ec3de51db561ec
MD5 fdfef6bfeb3cdafa893772d2b0876f93
SHA1 7380152f554895805cb0d654980fa315b6a7dc92
SHA512 3cfdc6a4f0a718b086348a175a3b3104cb79a192958c8760eb7032cb1287471c80511de9402228bb1666959d1cb94d29f625879cd4507ad646eb21c8bfdaed63
SSDEEP 24576:n0Le5ji0hmxSrMA/yxknw4FYnshx8OfVe247:nPji0Aoix4x8EVep
TLSH
T17595AE25F6748331D073C0B9C5D2A69EED7130825B308ACB4296D77C7E67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 dac6b971ef1584ff4d9103f3fa835f7b599f478708c9ee03bf882c4b882baf16
MD5 6f4e7fe71f28a336d2df795b5d99a1e2
SHA1 b4732828785eeb8a642d7bbe1d8f392e7c71e440
SHA512 68ee5b9a386631d50261123f1d2325f90455ece11f7f33663008dacb28e7607ee94ffc40bc3195456d92ef823889b43c12e62bf43fcd99ef6c9566c4d50df394
SSDEEP 24576:ha7/ezSC6vUyD/aqgrvWj6q8wyuu/yxknw4FYnshx8OfVe247:g/ezSC6vUzPv+Hjy2x4x8EVep
TLSH
T1A2756D25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E5C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 9c2c310170ed1eaafc458fb9115dec1bfc80ab44ed0eb5d67eff40d7a7e2fd5d
MD5 9595f8d0e96b1e5c1c73308d954a8f3c
SHA1 2cfeb86375a57dcb80a96365104728c8a6d53581
SHA512 a1f96dcb5ed2ecd8d14e6717320f01c439f388b291d55cdb999c90d19b98451b8c39d2ad38b95d77ce9628eaeafebb26cc25dee3290908c1d065359f6b5b2ecc
SSDEEP 24576:ZVbqPb88hv/l+BR/yxknw4FYnshx8OfVe247:ZVO88hXl+Cx4x8EVep
TLSH
T13E559E65F5B48331D073C0BAC5D2AA9AEE3234425B31CACB0246D76C3E67AD5D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 97ca9eb97268cae4213d7004e9d219e874c0418e41b26b119f982658f4ad3a23
MD5 796a0c0bb8d76343a3ae6af5b9202250
SHA1 b907b14a80bb06fc9c72c680ea67d2b313cd16bc
SHA512 6ebc068e29084116e8f624308b822436232e86ebe68053477f552500524412d11868f757f576d22557b1de0f53c3aa1802e6f8274b48b33a5298c43d14dba4ff
SSDEEP 12288:/aM/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:/aM/yxknw4FYnshx8OfVe247
TLSH
T18C6523BCABD9E4E1F69E14331A7572223615FDA0DAB4C11BCB78B54EE4B0C50D06E623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.6MB
SHA256 4bb5d3d8829625d9712d16258e8d142f1910de17fee318a2028abbd46c342249
MD5 225a91d2b0a17d999736c7e6cf9bf152
SHA1 c93fd92a376028cdb1c51856ae447f8fbfad7219
SHA512 b8a7d08b480c77505831538123e527f98525b90e0562a3b0189f63410b62ce80b84aa717e8f45a7c3ae416805334d80b314258d85839e86b298093c6b7d58a37
SSDEEP 12288:neBNUbTVO86UJ/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:nJIUJ/yxknw4FYnshx8OfVe247
TLSH
T1F875CF7BEE28FCE2C27E5DB95B918200A77274704B6193CBD175820EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 0071bccc6d28f145b976875ed150aea703964b1738fc2c19e5665634d8fef477
MD5 35e65772307e6f36c3c24e37168e7e60
SHA1 383beb8e9b53655152f211afdda670c76c9bca08
SHA512 38c66e4720c8f56dfcb35d59837a9374d4dd9368b8d92fac98c32febcc16417f928d3fa1d6c6efc01046c9393abd254edf1a59feb396ae5381f9f09a9a50c98f
SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THu:mQvGAdlCEL8c/WRNw5C1ix8EVy
TLSH
T15C267D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.7MB
SHA256 bf8c2df0201e740154a46c8e6c5c1453874c295a67d7c65ebb4c549a8bec1a1a
MD5 7bb666437d512e2ec858e1409e504432
SHA1 2314a083247960f9a3c76042d2c366c4b68dcdf3
SHA512 e1ff45f5b0788add1f5a0e95013403b0876b974ddc292552a15a696400f62d524f2b9438e15df7828315d76fc427bcf6c2fd3e6d9bd377e38cb57c2ddaf5fb2b
SSDEEP 12288:TAwSfxL/2Dc3zDLLmt0LDQewsAj//+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGp:M+ewsAj//yxknw4FYnshx8OfVe247
TLSH
T15585E030FE75E032C2BF0DB21B36D716142DB9604B611AC3E3E89E9E99705D1637AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 29523baa1ddf57a4273bdd70ab3bdfeda2c5d135bb4566e6b7067b7f0f79e889
MD5 71bfa229793b7f0abb2cbe7c0da23218
SHA1 2376a6e3fc45ea76c3c65d5e7a6dfe3f681ba377
SHA512 52d2d610221fab4f91d6b96554e83eb000bb55978012960e8871a3e0001cd06dd7380f2d58c5453023800c3b69e76dab4509a8a34f7ab8265c0aafa4d8b1b248
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHv:JUEtQevvqc2W1cpV20I32
TLSH
T1C3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2187dccf7b986adff103f55e18809f9f0d54a926efd067440f0b7fe3d3c74781
MD5 62f26d91636d62ca74eda3f84d9d2fc2
SHA1 53b82097344593e173a321aab8bb542b34d4559a
SHA512 2b3899bb2cd95adf9dac62c91a3680237b99186483d558bfd4a24b83309002a33dc2145a0b8e5634af40c35701a97e84c43deef5cc1026a87d565cc814a0fbbf
SSDEEP 49152:6CbRquA/m2yL5zLfFiV+XenmE3/zyx4x8EVep:Poq2Vjnm5ix8EVy
TLSH
T180D58E1976B8C1E4D1F6C77886A2C647F37178154B30A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 f2762a0be0a8bf2600200b6819a717ef31b68fa4bc7f237368513a8f748f39e0
MD5 ab4c6890cdf4da02c0f37f4af7a718c8
SHA1 180c187d9a02d9db61a770f7ad9c599c20ad9b36
SHA512 ef51bd8447a76305a1b2d99c71410406608a31be7ecfaa74ca74bdd36622b5f71e14b2afd6491e73987baa03ce7ffc1bb19763a0c2939019828bd889a3c7fa79
SSDEEP 24576:GAhGL6IFoiwtA5l7S53S/yxknw4FYnshx8OfVe247:GAM5Foiq5px4x8EVep
TLSH
T1C335AD80EBF955D4F5B3AA7899B69171EA76BCA65E31C20F1260D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 e4100527289999cf3ad95cf9e15133ae6362498f882e436a459abacafd57aa2f
MD5 a53ed93912a181cf52e77819281f71ab
SHA1 ed0026d7681032be9d1bfc04cddb007a52b4659b
SHA512 d9ef6e943db59dd29452bc1753849a4e9ee82b18865bdd1b38c3c212122ce2081770a8c65ed49663e88374eae4d46434d7247634aa77360fb0c32178f230ab53
SSDEEP 12288:8mw5HEjsChNrBFgl0WDm+Cx+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXy:5wumOW8yxknw4FYnshx8OfVe247
TLSH
T15A75F14977E81CF9E96741398657D136F7B2B8112A31C71F4760C65BAF33260AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.4MB
SHA256 0033430e1f3246838156a444f5f6af46d1377275538c1cdf78c2751151e62918
MD5 5a677a339b00163c08487e21fb15d612
SHA1 6ca1ade6203b78747a9fcd8a3c01aad4fabc6695
SHA512 1dd27825964b6ed7d205fb7aadc9896847a42688a9c7a18446eead43126fe1b118780fad8f1c5b42aecb74684bc4777cdbc69bddb11e91a8a99fc404695f5ae9
SSDEEP 12288:kvZ1Iyv/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:cZuY/yxknw4FYnshx8OfVe247
TLSH
T1A86512AC37E860F1E1A7113A89F15206E772B4A2677183CF4768625EAE71CD09D3D723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 66c1bdc4cf7a247544a165cbb44fdd5f4dafc5e4e8c8f66ff08ef49626874571
MD5 086da514cdcfa33fec96a4248a970532
SHA1 44686d73c200c0d753df0541787d47e7060aa780
SHA512 14b951b4bc8c7bed626e9045c3782ade6f0f37f79a363ebb2625fce9f7e7a077c89bb7be226520617050aa759c91d5aa779a232a61b6d9d764d537bb5324e90d
SSDEEP 49152:ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ua:tQRQyi36YOcPDLvw2gAf+PN3cix8EVy
TLSH
T1B7667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ebe8737ad9f627af3fa48be1952817b298bee94b9c712fbb7244c54a85791b22
MD5 c8f0f63670a565090099ec8e74d3c385
SHA1 f2b77b28850afb0685ba3a68ab51306717622577
SHA512 74c1e314bbe9872ee3935379ab9fb6278e174b0b67ded2aaf6690dc64f581a72fa59614d200678a95783e6164e6330df6117ec8f7f8ee40a48b3f8221fe493b1
SSDEEP 49152:Vj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeLAaLSF259ruMHwpXMi4FqJLd23Ua:MQRQyi36YOcPDLvw2gAf+PN3cix8EVy
TLSH
T15C667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5b7779d31815fb8371ef1b11b50f4200dcdaf2cae6778569e6c94d82a501d1bf
MD5 f74614b0577b4f2090f6ff2e1e2a89dd
SHA1 672a0c86c36d7a4320ca8883fdf6ebab3ae96678
SHA512 fab7e4c626e24944a255e9d74c01673a1ed0fd02d59f07689e8cfb3d34bf2d5332531dcba6565d88d45d97a98fa72c1406d2d448449a624548a5ffa9efcc87c8
SSDEEP 24576:zwvLof6SRQ+rn/fDboqxN1nnh6v7DaHGTNHu7PNU3/5W/ohL0o/yxknw4FYnshxa:L68Qg55nhkeWu7PNU3/ix4x8EVep
TLSH
T1FFB55933B2F600A9C44DE1769F4A973196D17C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3a3be6c119ba965257035e509fa349d4af0e1240e7c29e9b249fb7640062db9b
MD5 6e7f7e8435b14fdf22a53fcf8e80a321
SHA1 bbb35caeab925749532eb47d399b0fd535a111d1
SHA512 74346fa4ae7adeecfb69e616d9d741589ee62b8b08962deb7510526d9ab798920af7ab3f4d4d9449bdab21ac1cda85869f84b9ddb9c68b38301bf736ae9f6849
SSDEEP 49152:t3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbvN3Oh6tznm2FQ/nho2qkrk99Q:8y5112gYy5azzVvU69nLKnhZXix8EVy
TLSH
T1C7167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 6fc4d18031ff6839e1af12ce8325525e502c283c915ab1b8a8df04780a5fd549
MD5 96e89ad39ad1e75346617180a637449d
SHA1 15496dbea7956cba2b000a736ecd9ba9b6e68207
SHA512 6c0a22e6d5f9e825f9eb6404cd2aaf357ed50a602b062c23dd395878854bbdfca2d593b45335124cf3b7a52dea85cab55c05d06eb793b051d45fd80118ee08e1
SSDEEP 49152:2B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glBx4x8EVep:Eu6JmIxd2dBix8EVy
TLSH
T10BD59D13F1DA01E8D06ED479974A9233FA62BC490B34B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7a86bafd37e6b8597036e0945e966caee9d357839a1ba7e893539ca41da6d12a
MD5 72dc032975784423644631b28d267d98
SHA1 c97ef101ac43cd1b7d5df9ef5e9fcca0bf142cc9
SHA512 dcaf20e6303814b24eae13267d5320445623f21f1960fee37c992b6f434340a324a1146828d0840226e6dd85738f3917c97d16340a2f93c71826fd61767cefd9
SSDEEP 49152:f1hpsNoJpF1A67U44CwH7R4xIx4x8EVep:fmifPqR5ix8EVy
TLSH
T128B5BE13F2D900E8D05ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 11c0645ab8f456fbeea1c064ae54ab4041ed3d5d32f6bd7af4e4532f56849335
MD5 7f1dc8f84991f1fc366d82d68c202b2f
SHA1 33025e331f924824b06e45dda6efa4798cc313ac
SHA512 e0e9eb9dd3707a4110aa98fdaf418179de4dcf8dfad265832e9d02f216ce0958f1c659f8dd89fdb1ef2835245ac4db3de2eac22628dafda19efa02316430e899
SSDEEP 49152:lSuZQIY0Be2KkRVtOnks6NMHqjx4x8EVep:r5dKqi61jix8EVy
TLSH
T198C5BE13F2E940E8E0BED67487769232EA72BC464B34A6DF064072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 fcf1ca44e358cfd91586448e4bee8a7a8ea01d372fd919b29f8a48811873f7c3
MD5 82399ee744bea9f1daf0a34d237a35ac
SHA1 be8f4d8678cbb605b8c7550472779decbe6ba8d9
SHA512 40110f33a6b34793ca65f2281c586ad194757118043d44f4489db38246d184627300a08112d2b740738927131a27e3dc1843ce4a9ac8efa476dde44709fb8cdb
SSDEEP 49152:nhtSn8EApI0figjgiDn0AP5w0x4x8EVep:2X2iWphtix8EVy
TLSH
T10695BE13F2D900E8D05ED179C7568632EA62BC160B34A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 6526da316ee0e9fd3328607ce43ad3c913baf0a3c2264f9f348fe20351723791
MD5 85e59aadcd11a4912c37dfa823d7a1e9
SHA1 2655b9098a952c59567264d90f96d8cfcf6f6967
SHA512 8bd27992f6aa487b01604f5bbfc9e5dd3f7acf2ce440b74707ce44635c8aa830b8189cf86293a6a4f2e8627a09edba7557e1486ff1914961a3b3ba4fda45dc1a
SSDEEP 12288:sE/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:sE/yxknw4FYnshx8OfVe247
TLSH
T1A565237CBBDEE5E2F50D11734A7133566609B5A5EAB1811BCB7CB00EF0B0C90A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 41f7770083c8cc141087df4d4aefafe910721ef23b8cfa2bdb10f01b29801b59
MD5 7657225c30c7a7da650f80f46dc4b8b0
SHA1 be3dbd7ce3563ef0812eb4c096a52e5ae93e2b31
SHA512 73b294dc40b1a90976128c4e6890139a9a1a85a179943a4bc190a99cd0656d932bcb1f40721916b636a71778aedd8e0b180cd54ea0d39d9cf655dae0b66f68a3
SSDEEP 12288:Br/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Br/yxknw4FYnshx8OfVe247
TLSH
T11D65237CBBDEE5E2F50D10734B7172666609B5A5EA71811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 19cdfb71d562b13835ae74698eea5d67acc70eb9210ddf9220147096b3a84755
MD5 c4a378628500db48ea7af639e294341f
SHA1 c76d296443a4f73bc3228b978dc57fe08e0b0c02
SHA512 062347a8341ccdf7a003b0c4fe523aa1d42892ead24b6b044cb764c1f0ab38cec4f0c816e439abc6b3abc58390dd83c4d0bef0083ada02e0e06fba7394eb432b
SSDEEP 12288:uh/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:uh/yxknw4FYnshx8OfVe247
TLSH
T13765237CBBDEE5E2E54D11730A7133666609B5A5EAB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.4MB
SHA256 9c612b26507ec0a07c6253d8fe9927bc6f85aac96be95e734d6da7e02268807e
MD5 4598d13cbe5bf248776da7dcee8a2ca6
SHA1 3c7f2ddc4f592f78787c131dd88e20288e25f369
SHA512 1800172fea6f12a19a7409ae727251937e21080b94327bc9aba973ad943213f145c38a3bd301a8534c31325dca7eabb8451bdb04c8cd9fb4919717e4f27ae562
SSDEEP 12288:xVy/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:u/yxknw4FYnshx8OfVe247
TLSH
T1D065237C7BEE90D1E45A51738A716222B365B8E4E731825FCB24750EEDB0890A43DF63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 c89952cc9f44ca56dd96899e6cef69befce8383e439fc0989cdd18c5e31d9201
MD5 c79c19fda31341834c6828b910089406
SHA1 46def525d1250c60e4ae8dbae997fcada69a31d9
SHA512 6971a4729c5299cbb691e670b16c752a4cfde4fd3a1e2250ba70f0a8848da273424e4acf836e3cb373e2a0fb817558bd07aeebd28b0811b35ca96c1b96e59ac3
SSDEEP 12288:w6/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:w6/yxknw4FYnshx8OfVe247
TLSH
T15165237CBBDFE5E2E50D10734A7133666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 c54aaf7c5c17cfb83624a8cbb4d96d917eac68bef891d7e3004a0427f385d66b
MD5 e1a5901382f25df54877b65d5eb56470
SHA1 4756516bd46941f525e62ad0f2d62f8275e6c5ea
SHA512 6847c229fef1c48883bd33c3b2bcdaf1ab8f194127c412476b1060b48af6f29f0314bc3625f818ee5299e221759ff29bc30f2e3699b9e48685cfe8023be509eb
SSDEEP 12288:33/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:33/yxknw4FYnshx8OfVe247
TLSH
T11C65237CBBDED5E2E50D10734B7173666609B5A5EAB1811BCB7DB00EF0B0C64A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 3a5c6a99335664cffda27eba819e7f4702c91474dec02826e3c139994608902f
MD5 cf4777f1b7bf7d65103e9e251373ec79
SHA1 d1da37696847627b2e321497b91e125548cfc34b
SHA512 82f8e307f50d1bedf3f58cc4145a6e861eb6eb3e03578cc068a368bd787a4f8e4a2881f50da1646b96edf30ed933d4b8ccfe2521db2be859d57fabf5c4a27608
SSDEEP 12288:8z/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:8z/yxknw4FYnshx8OfVe247
TLSH
T14765237CBBDBD5E2E50D10730B7173666609B5A5EAB1811BCB7DB00EF1B0C64A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.6MB
SHA256 5bdfe82a5a7930ef8f873c389e4a0b59f162e76296cb49cbf02c9fd45e52a137
MD5 d9b3710da0c8327b4bed7904d0e2fa98
SHA1 4cc78acf5eb192ff05bf4f91c25104c0ce0878d3
SHA512 4772b11ce0426c3a8590b25cfb1c8b94d7c2eba8323fb97eb784d1333d1709336ab0fb8631f1b3255bf51bfdbdcf1cfa90ffa4ad63783c664fa310d6ea3725fb
SSDEEP 12288:niZwbyzzFEoS2cPvyL/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpm:iZMqzFVSOL/yxknw4FYnshx8OfVe247
TLSH
T1B67502A8B39018F4EC67413ECD259916D6B27C694B70C21F43B8362B5F736A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 69cfc2cb04b70d528cfa2bfbe2450770bfac420769acc9d97d52d02052e4bbc3
MD5 c988a368d1f5a07542248f129216fe99
SHA1 321a5a47d775d77668063a39cd26127b3c185302
SHA512 f713b13fa8f33d32092dc86206a6112059d0eff47b8541c703b7cb381aa494c3c546b53465da9e3f5bdd02353be55464a1b1d41e6ccd69940fed967b1aad2d81
SSDEEP 12288:pI/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:pI/yxknw4FYnshx8OfVe247
TLSH
T13A65237CBBDAE4E2F50D10734B7173666609B5A5EAB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 c86aa59fcac60d8301ead1b170779a1a42eb8d49855e0d96e741872fa14397c1
MD5 51f6e79eaed4243c2e09e6a475e1d228
SHA1 4bb39a92fa3fa56febc64102457a080f4894efd5
SHA512 608b41678973c62d7587bce69061587835e67d0f7bf9b8cf5a577c941b3f96d5624d26b9fbe7482dfd812a0130efb48f01468c0065a8fd352eed7baa6ec8fbd6
SSDEEP 12288:c8/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:c8/yxknw4FYnshx8OfVe247
TLSH
T1E565237CBBDAE5E2F50D10734B7173666609B6A5EAB1811BCB7DB00EF0B0C54A01E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.5MB
SHA256 099fe93aaf0ced8bc433241d11604b47d4e0d1cdea9bb803af6b13b13ef52a5a
MD5 061564868d5fdcd10b5b425392e7a804
SHA1 3de2ce967cec3b5a205f8d725a221f4a96845b58
SHA512 d6e36362e6c93a4809faf37ed5b1b6fa22a00d7401b150d0a3377d23f1cbea58720bebd9fbcfdd2db726fdc653bb4b1448ce66dbf51093440d3e77e63f205d80
SSDEEP 12288:YyPz5L8v/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:5zyv/yxknw4FYnshx8OfVe247
TLSH
T1D375125B73E630F5E13A523689621602F772B8724B3086AF47A4537E6E325D09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 e08ca703a929222b8998d78536293915c3aa3ad75bbb563b638f4581bba6828d
MD5 9aa208ef5f06098832867da5c1c58352
SHA1 3a9e094f983a152561e3ebf407ba1f336f5a09cd
SHA512 6eb48dfa017c954809cb0070a4b6724e431a57486d09d5c59b0ef01a50e0bfa8a8f5cb42009d5c8ebf75709c4bfd232d57f485b7197a2b29d36f2a658670d630
SSDEEP 12288:0I/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:0I/yxknw4FYnshx8OfVe247
TLSH
T1D065237CBBDAE4E2F50D10734B7173666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 e4824ef436f16002988b7399b86de6060626efda304aed0d540c19e0411da596
MD5 329014cc9afeaf82cef2e8a77d549e13
SHA1 1b770fd5a35e47a3c87fdf2e86d023201e393e0a
SHA512 676bfb928f6fa9591025152808d652863279c32bc13bd4b81e82409d48a9732152d0f8d4624eeed4db98799f5ca4a0b40e9c0b12a0e9fc80b01e3083c193a5e2
SSDEEP 12288:PI/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:PI/yxknw4FYnshx8OfVe247
TLSH
T19365237CBBDEE4E2E54D10730A7173666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.5MB
SHA256 2dc26e40b23bc285c41fde350b5d37051da3b45162db7c3b4f647b568af29913
MD5 f56d1eca9aef69f97017e2821403a36f
SHA1 dbd908f2b67b54c1a86d1ed3ccc12d4ab3618283
SHA512 3ec418c669c1352881618c941a2b3723019ae7601f90c8d56a7ea24c8c42d0caa2b60ef5895f1c4c9a09304688f9e3addf5f7193e4f69f377841b8b05516e9c3
SSDEEP 12288:ZyPz5L8v/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Yzyv/yxknw4FYnshx8OfVe247
TLSH
T14D75125B73E530F5E13A523689621602F772B8724B3086AF47A4537E6E325E09D3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.6MB
SHA256 2f738a3a46733c56a40be91f9270a10a889d8aedbf2ffd008ed5c9777c025eb4
MD5 f31d799c24bea16be43cbbb494b4f3e5
SHA1 c155aae068499d32ebb0baa2344af12e196f50a1
SHA512 45d4e9506c12c63dc9f21c7063ee8ad8f2a5c063ed19b432003e9e96064717ae05e8d0aa434b7d50c474c75b787403c22d26b72458bc3381cb1ee21d91bae77f
SSDEEP 24576:GTPaLl3z0zDx/yxknw4FYnshx8OfVe247:GTSLljFx4x8EVep
TLSH
T1547501A8B39058F4EC67413BCD659516D2B27C6A4770C21F43B8362B9F336A05C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.8MB
SHA256 93e121cde02452adcdbe4071c30366ceb829821e681faf3a9a8f94150ad61cd3
MD5 69bad9cb46c9678b6b8a12ace5fce25a
SHA1 a0f99f58b38a712d24b32e57035ef5d0dc42737d
SHA512 99228b8c86fd84531903902da5d4c5ddcd9dd11b53130ad5e77aafdfd4d0e3af5f2f81444f18257438038c671c683cc9b38be3189069bad5fce95e732eed7957
SSDEEP 24576:G30d9CHKy7GZd/yxknw4FYnshx8OfVe247:o0d9CHKyaqx4x8EVep
TLSH
T1AC95CF90F3E410E4F0B79A35CD765512DA767C9A5B31CA8F03A8661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 c67738e486457989c2ff7b1f670e9536df36eb71788f6bdf91db1751d4d2dace
MD5 84e1d6272dfbf802d777744ce999eb76
SHA1 207a4f720205ce8131fdae1193740e1261c0a5d3
SHA512 032d6337cd7881d9e684bad6e79f8bebcab35a9ee4e351758f59616704ecb3f9efe43a68c3a5fcd0b9494db8efd9785ad2e4da232f2083195e915f6582ad10e7
SSDEEP 12288:0B/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:0B/yxknw4FYnshx8OfVe247
TLSH
T10F65237CBBDEE5E2F50D10734A7173666609B5A5EAB1811BCB7DB00EF0B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 804fdd6199ab47955372f9c2d1c8b764c76827cab698c69d2afaa0910f93bd7e
MD5 72ff074c4d87e109bdf1f519230e60eb
SHA1 55ea0cd491f471594dda62994daf0d3355bd1590
SHA512 062943494b55f93c1542f686ac60bfce7e61a45221653de43fa1bd7acfc53ee4d0adc4523340798a7672a036a131b9192bc7e45c940fe3dfffc05f902abc1722
SSDEEP 12288:aP/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:aP/yxknw4FYnshx8OfVe247
TLSH
T19865237CBBDEE5E2F50D10730A7163627609B5A5EAB1811BCBBDB00EF0B0C54902E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 4673d95188e82713788efdd2cc94d5e49bca20b4e0d49eb683266fe6dfa78162
MD5 5a5908bda68bac2d75afa390cdf2a514
SHA1 79881d04dcd6df522e0ce3ec248359db8cd85e27
SHA512 ea574e9c4aa3a0861aaf8b5e330b2c1e037c21bc3ada7cb4870587c24367392575a8d3c6e7a061ce93383a84acc5c00b7fe1757a096383e5feddb61eea8ef026
SSDEEP 12288:22/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:22/yxknw4FYnshx8OfVe247
TLSH
T1B165237CBBDEE4E2E50D10730B7173666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 1de64762ec5413d5ea2c5bcd1d3de9067bad39029df63b59de5f25955f3f4cd7
MD5 22a33544583bdd903dc160fce8e59ede
SHA1 009467199f7fa62947a0280582412f99a43d11ad
SHA512 d76f51e42e1f9f9f7b63fdf0ed97403303b8f03e971ae20600af9b11121e1407119b05f6ecbd4f6c911bd55ba6d8b42cbe7f0828080fe2baf4508d3144007f86
SSDEEP 12288:QI/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:QI/yxknw4FYnshx8OfVe247
TLSH
T10D65237CBBDAE5E2F50D10730B7173666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 1d7f5329e961c55db39138a896e3674c8134609205f42252b16064ea7e47401a
MD5 3567abf7bebc1eeb2144bbb1b7203973
SHA1 c18cf9c1b2981026212caa8acdd987655560014f
SHA512 fed894081a8950af03885262ab78dced2c8dbdc51a2abd06be672b399c425a0de23606df4460e053a1db76192053d826e2417acd6d7824103ed3761859fd6bd1
SSDEEP 12288:kB/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:kB/yxknw4FYnshx8OfVe247
TLSH
T11565237CBBDFE4E2E50D10734A7173666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 5e9dd228d2d07444a8c84d0eb45ac94a872ab3eea4216966306f2b0dd113a294
MD5 a2961d225fe7225ad991557e9a802209
SHA1 54d37fc221fe0365dc1932b05a2bf7e0321ca19e
SHA512 de9ff756dcfaab2647e29155d2b6bc9d6a9d7051a9eab4c38f1c50ecb0166d5296079648a1bc7b65a95fa2c16ddf462346615f928b65f9d16cd817a11719785b
SSDEEP 12288:VQ/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:VQ/yxknw4FYnshx8OfVe247
TLSH
T10A65237CBBDBE5E2E50D10734B7133626609B5A5EAB2811BCB7DB10EF4B0C54902E923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 25db4b12aa1cfe1333d2a0b1fc7ac225de4505d1a40268b099bfc1d1466de8c2
MD5 b60e00ba3d7b62a8e887c5df3b3510e4
SHA1 c8eb88c7a4c88174c899a8f82c4f93ea05157fd9
SHA512 95cd12f0f59a4322ba8a295369f72d1361498cae838c298aa2baec7a324a4e0897a9474495b8abea744fe7591e6137f068dce5a41625800a51f3e73ce4763a62
SSDEEP 12288:Z6/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:Z6/yxknw4FYnshx8OfVe247
TLSH
T12B65237CBBDEE4E2F50D10734A7133666609B5A5EAB1811BCB7DB00EF4B0C54A02E963
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.8MB
SHA256 19fc06b8f9b387e54af2513d2e96b31649329cb04c4273f3af9ca43eaf817c3a
MD5 4ddf260d1271ed53ce4aceed5ccfea2d
SHA1 c35275bdb5308505744ccc816708000d5336565e
SHA512 1f1ba086ea603741d89a8706ac3cdcb968c515c265439f232a4599218228f3fb5813875b7e749e631cc1c4cf0854d276eafe1a543a3e7867d63186a7e0a40f9b
SSDEEP 24576:2fwvgk9RX6wkyAIs/yxknw4FYnshx8OfVe247:iMnYI3x4x8EVep
TLSH
T12B95CF29EBDC44E1E1B7913D89B3460AF6B178695B31C2CF029A536D0E33ED49D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ec34520a56d44126b9728e76dbdaa228e9c94804e45ee962b236e3da2a7a6bbe
MD5 6c2d1c3bec3417efec425c77a02dc375
SHA1 092d6d4e2722c1e915cf42bcf3c9c7e4a482b06a
SHA512 73c79bbc4ddddb8b767984d30474f8b391d110063425f7d17eda396f5e4284924a974ab4c24f1435706659acd0b6abd6b7a1a5266b9b479f0a752845350f17ed
SSDEEP 49152:CYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0Ux4x8EVep:tySzP8ix8EVy
TLSH
T196066C96A1A841D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 ece26c863df9261a2c1c8c12325d50f241e28d1b69230a0b8041533abff76fd9
MD5 532896e6e83dc2355bfcb0331bb282ae
SHA1 a509992c678e264e4dee7738cb7305b7cf2b5d84
SHA512 21128c8b44b13e127d444b8c2e7b780d37702d7aabdf3d442734353e8643842d45c651ab2d8b4450c12c69b745e4ddaaa406d6efe002d4e10fe803005102ad0b
SSDEEP 24576:L47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AY7/yxknw4FYnshx8OfVe247:L47JUQjqirIhCnDHUPfF/Ex4x8EVep
TLSH
T19665AE1DA3EC01E5E1BA927885154A1AEA71742E5F31CACF1270837D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.5MB
SHA256 0f1405dd2f310fd7e6e6855bd05f302f8ff13dce816272a2d7d1254a06e60cc9
MD5 cc826a75e6463fdc0443229a7f7fbabf
SHA1 66ed33f81bae52b5c7430e739fc0a9f35db7f592
SHA512 7e1252e2dd9678ba9d8f02b52081c567109940a71af9dd0d407a7d212f83bb2494a25fabfe8f6f7ea3ea216144538cfa7e7717e2d89b48086c3a125e831b1acd
SSDEEP 12288:h0sfY/+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:1Y/yxknw4FYnshx8OfVe247
TLSH
T1D2750128E29852E4D06E2276CB625641B3237C6597F1C3CB97E0F53E1F719909DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 b0c99d3ec56409f3731c7d80e53ffff8484ff215ed9725722c738791ca5ae8e6
MD5 7599cc1d55e1ae7c1c633ae57c28b144
SHA1 c9ceb40d37b37ac879f7ff0f4ccd7b215ad3145d
SHA512 0a35b7e99c5f19d345d626b34e9fb3643f7bab3367950863d4777d6da06f8187a3efed801aa1f7d2c9d3fa0d04601062e6e743dc589fa48a5ad16c46f10c2ab6
SSDEEP 12288:qOalMcqU3fyizjLKBTheV0cYg/GaRMS9xkfl4ib:qOyMnUPBjU9ncGaRMS7kfl4Q
TLSH
T1B9351841766ACB5FC6A940321E32D1CCAB707D45EE056F03B3C8973FD576668BAE1282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 00278c8c2268302f14c50907e80b68b2044535da6aa1aac84e1251137cceb7a8
MD5 6b346dc5d211df75b60e5bf314bf2110
SHA1 55177eecc8af82a223ed58893462aede7ed7bfab
SHA512 62f5376bf7a4c2f2b34e95e1c2f64ad45f20d6999d9db2e2e5034a2b636f997490fb006e7a893d02340c517fec9c6fd1660b2c05561638813db208d8048483cb
SSDEEP 6144:XQtSX2FgspozmsqF1uUUsbVtpath9j7uP6CCdS+4hPetMxL65z/DQFQDwW+i/Hol:XQtSXQHfruUUkL6zc4dRApcE
TLSH
T19D65FA815137A38FD5FB6072076A5B4CB7A4EC06B7056F27B388453AD82A725A0FD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 b61dbe61cc3e24889cf8c07b76a374dc2dbbeb0d2f47222b8436212c1f4cfbde
MD5 add9e8d2ac94e3fc92d1cccf9e9a7d40
SHA1 5f3a0fbd7419788f6447c339665ddb76336fabc2
SHA512 3c322d2c2678aa19318009656838888daa836140ae40aecbf3d1471fb9980cb37e34df571ae632fdaead92659a0951055a45e96489d6c2e95856ca5df8180223
SSDEEP 12288:QR7L+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:ILyxknw4FYnshx8OfVe247
TLSH
T19A65237CA7DEE8D2F46D11730676A221360AB5B49B70C1DBDB28B14EE4B0CD0987DA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 b56849a370f683a89833b1a3631c4cd4b32a08f5171b3272d7c60aaa53f0c819
MD5 46387d77ab91deda3071e3915262947a
SHA1 a8b2ff699c5483ca07e301bc27c37c4d0e048629
SHA512 e46abee75dae68ea95a325960d039cbffb49902235fdc3f7ef86a922696dd42f2f7b2a0df789ddb757e180a0db3fabc3fbc764263df70cc635806eaa53d6d4d3
SSDEEP 24576:Ggb6bmBIi49WNNFpg1rSvFv7bYu/yxknw4FYnshx8OfVe247:Ggb4mBIBhGF+x4x8EVep
TLSH
T1F265AE1E22EC02F5E0F9E2B8DDA64417D6B278161731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 566560c11fab55e0ec2abace6643cd1b9ca3d7e14d8a550144e50097a9aec289
MD5 c2e856ab007209efea3aecebf3a53e2c
SHA1 d878491461e9f1f0cde6eeacb6987cfc4987b53d
SHA512 869ed0fdc930e9e9256bbed5bcac56ff8bab31cfbd7028a5d02c5b3db4ffc8b428dc16a4d29073700a0d296a0c6c6b22881fcc0afb8d74c7b835016a72829d8e
SSDEEP 24576:yG88u8FpJqH1Izria7/mL/yxknw4FYnshx8OfVe247:p7ZFPqV3a7/9x4x8EVep
TLSH
T12A95F16577E101F0D47BD1388A924663F6B2B4250374EBDF07AC8A551F23AE44B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 39d418b976a80b05219a35c3ece39cfe25dd040cfff75ca04cfa68113361d7cd
MD5 52cffd170b5a6233f164d54c7b85f4dd
SHA1 9e0ac00248a935d70ee7d1e93b70f29894e2ac4f
SHA512 cabd69da663836d435f471386c083f38bb150e26148a0b63110ddba64e28343138d60dcccb5af868ea4220a38495560079b23fffe3004a5fc7235a0399655817
SSDEEP 12288:hHvUrBFrEjwaQo+hxfN6V7xjGDjWpbRYOypsu8xdaOv4GVvGr0ZJFXxogpG7:hPUr+NQoyxknw4FYnshx8OfVe247
TLSH
T15675F12E22ED18E5E67AA17D89924319F771B4621712D2CF02E0817E5E73DE8BC3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b1e8e1f7520c960a339f0cad5f5def582d61dcd4c829dfc050b1304cbf808d49
MD5 5b17dbb2d33e07fa771d1582696bc2d3
SHA1 579a6ba5e382979b985248f10c9d49322059ddc0
SHA512 567bc6d5564c56550b09ec68356d6c73b6a0939cd202c3a2a59706073984f1681fedcd91091aa6d243396cb194647e90bdf846ddfb704448711ae177111687d6
SSDEEP 49152:gBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj6x4x8EVep:bG05lO43bvix8EVy
TLSH
T194D5CF6E62EC11F9D0BBD17CDAC6460BEBB23425033556CB02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 99e01b25f29e8c3347b61ddb93f7c63212b14d0c7c851069c1f19b18fd5847be
MD5 4d66a3ec8f449bf6f8d7420d9fb82c68
SHA1 d7c630ca64974f97d0240e1c2492d6839d1b7903
SHA512 d9b6c4aa3a09b619b554f8d1386208e09c7c4a5d485784d2c6f2067fa52fbec1abfca64d9ffd05ddca824c926fdb61d2cf0b00c989438e2e45ebca739fd6004a
SSDEEP 24576:xfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnl/yxknw4FYnshx8OfVe247:Ra5POZ3lJt2pasx2+mix4x8EVep
TLSH
T19D65AF5DA6FC01D5E5B9D17DC583861AF5B1342153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b43a578a4485dd946f891d2aff988f29c29b2474dc9c8351e9b0cbc40b60464d
MD5 19a872f21f46f4e7a623adc4ede3187d
SHA1 86d5791da3f326de59365adf00ba9b7e8cb4025c
SHA512 e6520b42faaa518e7b6a3673dc2385445562032635b566682b1673dfa2ceed43eb25cab242d6e52278e8b8bdd817ec6dd55593916690f1ef7763087fb0fb9ea8
SSDEEP 24576:WNcwHdjbyQ4nLC18lb/EOjowL7FkD/yxknw4FYnshx8OfVe247:WNc/zEOVHFdx4x8EVep
TLSH
T157857B2A23E901E4E5BBE1BE89779546FA717865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 6f39ae7a1cce8a6f2183d90be875a1faf24718e1bfcf2411275c47c6493af776
MD5 3ae5d17961c5953bfd85141c13578dd2
SHA1 eeef998b4c233b46cd6e7e14299f40636f21a340
SHA512 5b70d1802ac8933857f9cdf05ef1900f3ba1802f3d95f9a9a838d0ad8b25eaded0252fc20d694d42fea738762b8fe832506995b9f9c6613fe2a9c9a4fe45b068
SSDEEP 24576:uzkNvNnaFeYhJNtmZBmKyxknw4FYnshx8OfVe247:uzMwBtOmlx4x8EVep
TLSH
T13055AF6EBAF846E4D1FEC6B58D238512E6727461073293CB8390C13E4E679D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.7MB
SHA256 ab7796247c5669537554fc17ce781b6535ee6f9926e871d630f7f6420c64b0da
MD5 16f22520873775f3d7cf4798071e8a2d
SHA1 80c1186b95fba39202e36268075aa8873b7c3532
SHA512 c542ca36865a0e3fe22105c7f264de7227c8ac4b24283579a38907cb97be9ab60248347bf0759019c3e7776d88bb156e67a1bdb0f8b6e3855047ce85613bb24b
SSDEEP 24576:4D3FHshBIYQgAk/yxknw4FYnshx8OfVe247:4DVHeBIAAfx4x8EVep
TLSH
T14F85E17DEB9C04E4E47AD1BC8A638606E77138A9033256CB02D491BA5F67EE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/696-64-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/696-310-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/696-72-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/696-67-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/796-333-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/796-331-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/796-99-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/796-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/796-93-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/796-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1152-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1152-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1152-146-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1152-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1896-76-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1896-0-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/1896-1-0x00000000022B0000-0x0000000002316000-memory.dmp

Download

memory/1896-6-0x00000000022B0000-0x0000000002316000-memory.dmp

Download

memory/1896-7-0x00000000022B0000-0x0000000002316000-memory.dmp

Download

memory/1896-89-0x0000000000400000-0x00000000005D3000-memory.dmp

Download

memory/2776-38-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/2776-45-0x00000000017C0000-0x0000000001820000-memory.dmp

Download

memory/2776-49-0x00000000017C0000-0x0000000001820000-memory.dmp

Download

memory/2776-51-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/2776-39-0x00000000017C0000-0x0000000001820000-memory.dmp

Download

memory/3796-319-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3796-147-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3796-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3796-154-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4076-86-0x00000000006B0000-0x0000000000716000-memory.dmp

Download

memory/4076-77-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/4076-78-0x00000000006B0000-0x0000000000716000-memory.dmp

Download

memory/4076-312-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/4468-105-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4468-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4468-318-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4468-112-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4468-316-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4632-137-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4632-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4632-139-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4632-131-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/4632-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4756-119-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4756-125-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4756-117-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/4756-315-0x0000000140000000-0x000000014020B000-memory.dmp

Download

memory/5304-104-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5304-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5304-20-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5304-21-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5304-14-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/5952-53-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/5952-297-0x0000000140000000-0x000000014019C000-memory.dmp

Download

memory/5952-54-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/5952-60-0x00000000007C0000-0x0000000000820000-memory.dmp

Download