stealc | f0518f13d36ebb67b5d5c292303bc14d464973f2f1582d4c5fb7500988bcccf0

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-28_6141f5935f5befb6b885adc928e49389_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stealc_stop.exe
Size 2.7MB
Sample260928-sshngsxzft
SHA256 f0518f13d36ebb67b5d5c292303bc14d464973f2f1582d4c5fb7500988bcccf0
MD5 6141f5935f5befb6b885adc928e49389
SHA1 dde59b723da29fa725d1e3b1142cbc3de52cc372
SHA512 28c6b592cbe0d6d3354902a3829557fef3d773d0294d896b4f621cf43882251c6fb602d8d49016c97c7dcee5238f621b246ebeaf15ca60987a568b26d3c0d5f7
SSDEEP 49152:2/sGlzKzjGfA9n/TDbXNKd/qm8A19xZpM+wEN0A9n/TDbXNKd:pGlWzRfb9sB9q+wEzfb9s
TLSH
T11CD5D00267F54129F1F33BB09ABD92645A6BBD715F3AC28F1380125E19B4AD09A33737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stealc spyware stealer upx

Malware Config

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
behavioral2/memory/5304-139-0x0000000000400000-0x00000000006C3000-memory.dmp	family_stealc_v3

Executes dropped EXE 10 IoCs

pid	Process
5844	elevation_service.exe
5684	elevation_service.exe
3736	maintenanceservice.exe
4696	OSE.EXE
1288	PerceptionSimulationService.exe
3520	perfhost.exe
2896	ReFsDedupSvc.exe
5580	SensorDataService.exe
2008	AgentService.exe
3108	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe

Drops file in System32 directory 52 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-28_6141f5935f5befb6b885adc928e49389_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-28_6141f5935f5befb6b885adc928e49389_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-28_6141f5935f5befb6b885adc928e49389_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-28_6141f5935f5befb6b885adc928e49389_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\126b34c33a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-28_6141f5935f5befb6b885adc928e49389_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-28_6141f5935f5befb6b885adc928e49389_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-28_6141f5935f5befb6b885adc928e49389_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-28_6141f5935f5befb6b885adc928e49389_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-28_6141f5935f5befb6b885adc928e49389_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-28_6141f5935f5befb6b885adc928e49389_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-28_6141f5935f5befb6b885adc928e49389_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-28_6141f5935f5befb6b885adc928e49389_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-28_6141f5935f5befb6b885adc928e49389_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-28_6141f5935f5befb6b885adc928e49389_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000100000000934f-130.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-09-28_6141f5935f5befb6b885adc928e49389_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-28_6141f5935f5befb6b885adc928e49389_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-28_6141f5935f5befb6b885adc928e49389_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stealc_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005146ff4e5d4fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001c23794f5d4fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c20cda4f5d4fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e622d24e5d4fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5844	elevation_service.exe
5844	elevation_service.exe
5844	elevation_service.exe
5844	elevation_service.exe
5844	elevation_service.exe
5844	elevation_service.exe
5844	elevation_service.exe
5684	elevation_service.exe
5684	elevation_service.exe
5684	elevation_service.exe
5684	elevation_service.exe
5684	elevation_service.exe
5684	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5304	2026-09-28_6141f5935f5befb6b885adc928e49389_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stealc_stop.exe
Token: SeTakeOwnershipPrivilege	5844	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	2008	AgentService.exe
Token: SeBackupPrivilege	2896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2896	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2896	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2896	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2896	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2896	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2896	ReFsDedupSvc.exe
Token: 33	3108	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3108	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3108	SearchIndexer.exe
Token: SeDebugPrivilege	5844	elevation_service.exe
Token: SeDebugPrivilege	5684	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5304	2026-09-28_6141f5935f5befb6b885adc928e49389_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stealc_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 4060	3108	SearchIndexer.exe	99
PID 3108 wrote to memory of 4088	3108	SearchIndexer.exe	100
PID 3108 wrote to memory of 4292	3108	SearchIndexer.exe	101
PID 3108 wrote to memory of 1484	3108	SearchIndexer.exe	102
PID 3108 wrote to memory of 4648	3108	SearchIndexer.exe	106
PID 3108 wrote to memory of 2920	3108	SearchIndexer.exe	107
PID 3108 wrote to memory of 5740	3108	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-28_6141f5935f5befb6b885adc928e49389_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-28_6141f5935f5befb6b885adc928e49389_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5304

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5684

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3736

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4696

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1288

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3520

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2896

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5580

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2008

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4060
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4088
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2832 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4292
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2720 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1484
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4648
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2852 2832 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2920
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2720 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 646023c53b97db7f434c2f2a80ec2e990f4dff1f206573e63383c1416005e964
MD5 22ec7e96f92bf307a23dc291c74fa186
SHA1 1b428f1ea545b66f59fb90ab13196f0099b97a84
SHA512 ad756cbfc18ade4b4257830a523aa6c74098ba8990be0328ac642d1dd2b74eff57b4515665bbfd4d1461bb2cd7610e6938220ffc57580892c76f3b27596e60b2
SSDEEP 49152:3b+632BuPkFKRrdE6ohmstBhuXjfS4LWxnIA9n/TDbXNKd:l3q6HjBgfb9s
TLSH
T12FD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 a331973435500f1a6d291e0a7b7c3fe07fb595e52b9dd63a7c7ce7a82bad2cbe
MD5 a0b5705c3a9dfa8a3a7382887b9a1e6a
SHA1 8ebedcae7b8bfcb685d17d24c5ac0999ca0af50c
SHA512 7e6c715ba973af2e1877bb6eb0ba4cf2c0bcadd95d835af6d39af59d757212c00e8eb0c4ff7ef4a64ddb170e31a688c7ff26139cd0e3b4b8f757623fc5ba1ad9
SSDEEP 24576:3XYfDtczATUeA9n/TM4NZYeNm+9MhUwd:itc2A9n/TDbXNKd
TLSH
T13685022967E408F9DD67827CC8A28505EA73BC454760E7DF03A499291F333D85E3EB86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 eaed91117c0e5f63e41f16bef6c484043a6ee35fab4c305acbb9ead66538c3d7
MD5 f7368e3c347c72dbfeaa5083fb33a5d1
SHA1 ca1709bc386a3d6be3dae3a1efed2518f3416400
SHA512 5220eff03e620e632984fe23b21f8e49b28b3618d4b4edf1c3b0cce096a4777b325427c8b61b023f0af47c04de3432f546a19fb9dd676ef8249d1be4ae8396ea
SSDEEP 24576:V0Le5ji0hmxYrMnUeA9n/TM4NZYeNm+9MhUwd:VPji0A2KA9n/TDbXNKd
TLSH
T1D3959E16F6748731D073C0B9C5D2A68EED72308657308ACB4286D77C7E27AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 865f2520abcea1e1890557b26374cc7842bc8ef752b74da348365ab3c24e5252
MD5 18ee62a6e6aa609e94843d2bdcfd46da
SHA1 e1b8c6b2f6a597ec2f1dcaac35f2a539297476c0
SHA512 e475d4f4075bdef012dbac169dd08422652ac99572a4c46d7b3cd33abb65c3f23ea5db62f89a34b4970b6738994950626f67e56908dc40a1e3ae988c927dae1e
SSDEEP 24576:7a7/ezSC6vUyD/aqgrvWE6q8wyuVUeA9n/TM4NZYeNm+9MhUwd:W/ezSC6vUzPvxHjyeA9n/TDbXNKd
TLSH
T19D755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 32b70dfdb3e6f034ef6e0c646d973c6405470e915fb04d0d0865e7cdcc99fc9d
MD5 a1e2e0050c71855d312482464a490913
SHA1 09fff3e9e2bb7c85a066168cf1d03530b8a21c8c
SHA512 35a693c6263e9d6d8e8db7ee62d018c9c92f3c8b13e572de5a0e911139f5ad8c93f4e6e759fec40bb7437b8b27b8b5eacfcc2428b297d50776e39209970fa576
SSDEEP 24576:GVbqPb88hv/l+6KUeA9n/TM4NZYeNm+9MhUwd:GVO88hXl+fA9n/TDbXNKd
TLSH
T1C6559E66F6748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E677D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 9f77175d51d5a9a29677238b7b1c5c6d9d78fafa255347d33f035db3b8e0f4e4
MD5 928fcf0663684a7656ada539a366fdbe
SHA1 54a32bab97d08e459c608b9515a1dc67e8060815
SHA512 3f4a63c4fdc83e84fc64bbcbf8f1ba099f00a1841befdc3421231e458a2e61b7110308d4a909ddbca1dfad31a07b0689b6097194bf27073e4dc747d0052485d5
SSDEEP 12288:VHDBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dGZ:VHDUeA9n/TM4NZYeNm+9MhUwdM
TLSH
T1BA6523824FFC08F1C78E0A7544AABF0C8DA2FD4DE585879D4319762E5E385C6C96648F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 4a9c3a1082461f126c3591966547b9c9db0270596459bbcbfb3dd0a554683a85
MD5 f6c81d8391681a2a7869648297c9f645
SHA1 cddc6757a232e600204c573aa80ba89633fda85b
SHA512 2f97b14673118a7594f5d96b7bca6aba001cad18a40498209d6a37b931ca40ce0b2031dcb739be506a82b97d9d4ad47620048169b36ce6a16ab0c5563fa9d645
SSDEEP 12288:NeBNUbTVO86UCBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dO:NJIUCUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1CF85CF7BAE38ECE2C27E4DB956918700D77278304B6293CBD165830EDE235E15E7AC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 ace28d7e430d244c73a2e2b62dec9eee5f6fe6a59c68f18373cb1dd99df8ac1f
MD5 819395aa843d5fa2dbf0797c38e4435f
SHA1 ed2e577da11943d428c8db823f32f8055a154800
SHA512 39bae67cffd14d552ac6446b91110a0f891682cf1cd184ec90e197ddf7d5b62c2f9b33049beed0a9a94d33979ac52f633bb68b71791673e40b7c9af26bf89ace
SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THI:eQvGAdlCEL8c/yRNw5Cqfb9s
TLSH
T195267D656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 a9f1c983d6240a0317655416e95c458148e2d80924514ba9688986c94b417c69
MD5 d0ec6e042e7d55fc3c296e2e8207cd2f
SHA1 e23d3185acfd5092ff7cb6a4127cae796619d9a7
SHA512 4e33ab57e86c4b05a1f6c9f1e98e9989c44cb0ec0a15417b9b1571853c211f92f86bc266eac73d13e8b5e648b3f9197937eed8aadea5da66c6395e67ca0579b4
SSDEEP 12288:2AwSfxL/2Dc3SDLLmt0LDQewsAjYBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9G:L7ewsAjYUeA9n/TM4NZYeNm+9MhUwdC
TLSH
T15485E031FE74D432C3BF0DB21B36D706586DB9204B511AC3E3A89E9E59302D26776A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 373c1dda93b4968f80c87bffdc59a77588148be76f46f1c2f95d5e7ae213ec60
MD5 8ac8858e5adea84e8ec32ff56ed6c17c
SHA1 b4529024b420cd712101ad761f9d8ccb3cec96f1
SHA512 745bf75b36fd806faa58f237d4edb65283de18337f17576dabe24fb2af6902a823643edfe7c0d0c4241f5753c4c378166caade4829508cfbd2b9d52e939303a8
SSDEEP 196608:MUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHf9:MUEtQevvqc2W1cpV2EI32
TLSH
T180474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f9f5ab47959ad8d73ebc341060f47226ef1f7222ef3528a302f5aae69124a579
MD5 20c065f0e82ad3287852427aebc68cfb
SHA1 cd46ce73163aa833c248ec1c3a0089d56a01e91a
SHA512 a472b55c624edee7769f043d1a0002ec7513b0e2edfb67039e30aa9726076c269c5c813a745edfb38b6ac5ce0a98514e69f7c06807dbcd39b9ef2e0fd3a66abe
SSDEEP 49152:NCbRquA/m2yL5zTfFiV+XenmE3/zaA9n/TDbXNKd:qoquVjnm2fb9s
TLSH
T1F5D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 6aca41c1fa9cb7109b8201cd0149eb536750ac3d3fa0300aa9b13445d0f311d1
MD5 1a23d9cb9b814ea5a18230654ce56735
SHA1 a4f09964cf8f0176c708d4cc024f27050cd1c0a6
SHA512 d1f4a9cababb9f371f6482106cc77490aecfc37c1da12af243d9ca9eaf2f5f71d13883f8df3a3d77e517a3e3117825a546c76d1f8f319919201b594cd11c2411
SSDEEP 24576:SAhGLJIFoiwtA5l7S53JUeA9n/TM4NZYeNm+9MhUwd:SAMyFoiq5lA9n/TDbXNKd
TLSH
T136359D81EBF945D4F5B3AAB899B69570EA76BCAA5E31C20F1150D11F0E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 e177ce5946b99a57bba9056b3de1a26da5b0fe5247ae21c4b8a68408238fdea7
MD5 519205349a2d5dd0465b5eb7b3630f51
SHA1 81a5a9812b05de744c7a2cdf144857a17e67466d
SHA512 b733ff7927a2a625a38c1a0964be051b4e8c6044210fc8b07a49022e6ff1d204f278642bb64663b16d4da0e3e489a38ea55750ff636155310f32fb080caddce9
SSDEEP 12288:2mw5HEjsChNzBFgl0WDm+CkBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d6:vwuSOWxUeA9n/TM4NZYeNm+9MhUwd
TLSH
T17C85F14637E80CF9DAA742398597D535EBF2BC062A25C71F0760C61B5F37261AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 ecf3051b44ca00da295de052eb47cc145adc1763a904ccf1356acf836e7e05e8
MD5 c0362a8e36b3f0d4083db62e6d99c670
SHA1 d55ef0def842de7034493d355550b981571110b3
SHA512 1906b1dcdba1eb288260e66344708c93660a151212bdc314a0391e341f0658c691997864081b310e9af4864ff93a3276e66127d19cda9a1657f5a5afa82009e8
SSDEEP 12288:RjZ1IyIBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2de:tZufUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1C575128627F810F5C397527DC8E56B08DBB27C5A637543CF0225526A1F32AC68E3A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 795a74f9744ac540d4e375ed6f45101c4ac895ce8da2d36b3c01e31249cac78e
MD5 95ed9aa4bcc07a97563110fc05b6bf41
SHA1 141dea498b27d6e6dceffaaa661a25d983a0de66
SHA512 70fae24bf7acc147ab32246b692e3d691df8a9f4c65661203cd7700e48b9f834f384aa22ad836acefd2089c60f1b3c4d1067d8401fd7b3a335769564296504a4
SSDEEP 49152:Qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Us:3QRQyi36YOcPQLvw2gAf+PN3Vfb9s
TLSH
T138666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 66f4025b78dde72826317ec7cb41d3f8cae7f3503d7cf55608d64160f87fdefc
MD5 cda538df9f3f69f742ffad855302e4e4
SHA1 1aff1308f4ac768264b740acbf7f70e9358d6152
SHA512 afece1e7ac2428a29c8f6e957685f5d93b1ad04934f9728bb2ee4d12447c3979e692dd9781cdf03ed1818718b048274ae59589b9ec8724ae3171dd9e8af23be9
SSDEEP 49152:wj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23Us:XQRQyi36YOcPQLvw2gAf+PN3Vfb9s
TLSH
T111666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 d2bbe62bf7dbfee834ee55965d4158fe12f2164020f7d8cba268e229040554db
MD5 5fb6537ad2a2bc423e58210517e4d3f3
SHA1 3e42ec99a22966a27c026875c4d45cdde98d256b
SHA512 4351662cb156cda688209d0fda3a6d27f7dbfaf760ce96d861fff0dd94844586dd6c770b06ee6254e13b01e40e11e413f9f83f4eaa08771e93a72c2d09ddd693
SSDEEP 24576:AwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0vUeA9n/TM4NZYeq:m68Qg55nhheWu7PNU3/KA9n/TDbXNKd
TLSH
T16FB55A33B2F600A9C44DE1769F4A972196D27C758FE0E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 0a1ea4a0a75e872f7f0c73ab845786a480089f0539c5dd14810b5deecf139f16
MD5 baeea16bad37df2110eb4eecc55a6a9c
SHA1 74dc49f61267674d30d1c01b54d572f1a246563a
SHA512 2e2f9bb79d8625d7a43b4f292bea4338384b87cc8e03787b21b01361f0c422582be957d765160ed98e72f6cf839498bfa69289aa90e60c5a11a33f0302d2701a
SSDEEP 49152:X3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99K:ay5112gYy5azzVvL69nLKnhZ0fb9s
TLSH
T19C167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 63a2d7e78775c304017dc1bf4afecf3a6cbd38308f179edccecafef79a188d51
MD5 46d8d1f5aa1be7d5ec309e23a807942b
SHA1 b62aed950270fdf940a112606489a1f2983f7bb9
SHA512 87f45b5273ec7f3094afab5b13bc81bc35e382211091cae8724b1c28ffe2c31e15733e2e1f0e9a117236c4664703d079258fb2b55a18f7f2f057e3d66edeec73
SSDEEP 49152:pB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glnA9n/TDbXNKd:/u6JmVxd2dUfb9s
TLSH
T143D59D13F1D901E8D05ED478974A9233EA62BC490B35B6EF0A9073562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 f79a26f5ae153415a710dabeeeadb0229d52d5254e3cd4254bbcb43350ed3d8f
MD5 35ff18fc040664e448cd2fe2dde755d9
SHA1 8488e5bff01a824389f8da6879ff3e7e59026448
SHA512 ef9b940a49fdbdc6876f9da4801ca42769897571fea75866284add4135e1f176cae568b994994fc16e26e7666644e12fa64eb73a1a910d3ea1b7a9df475c059d
SSDEEP 49152:A1hpsNoJpF1A6UU44CwH7R4xcA9n/TDbXNKd:AmifPbR2fb9s
TLSH
T1EBB5BE13F2D800E8D05ED17887569632EA62BC460B34B6DF0A90B7961F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4930a19d0edf8bdbfa2f21b771a4b8ca2dddbef4271725c926035f9c03612e3d
MD5 fb8cca0b4440280528bcc8aa01a4692d
SHA1 07cf1967a8ede2fa9ae341e779489f4fcd6eaf61
SHA512 e2ef66e8f07293a26ded1f76344f0978f354fabe67aebff15657ac569d272c522cb340120542d7c83154e429ad27add3b72f34548cfa44bf7746f32743741d1e
SSDEEP 49152:eSuZQIY0Be2KRRVtOnks6NMHqTA9n/TDbXNKd:w5dKTi61Yfb9s
TLSH
T1D8C5BF03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 48103238adc466d184779961ba0181eeb8375f4b30fca5f14a030c71885223c1
MD5 cbab6d2de4bfd2fee81c113d3860b750
SHA1 9bd2b0dae9901fe5835fc518830180f1aacdb767
SHA512 ac533cd39abaae08d67fe192f69dea43da91cc3122a0bc1376a99f2c430eade56ebb073a0660daeb4064f7b2c597415d5ebda608b2b2e9950dd16f1347849f2b
SSDEEP 49152:qhtSn8EApI0figngiDn0AP5w4A9n/TDbXNKd:LX2iyphCfb9s
TLSH
T17395BE13F2D900E8D05ED178C7568632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 52ba1b09026e18b66c342bb0dcdc5a64720936478f56a2825fca5ccd57f36005
MD5 b6f797bc43d81fb75bb30276c0b017a8
SHA1 f55f6baa521feb6c34fe6d5106e63b510270bbbe
SHA512 a8e09eaada49afad902307cf576b5c304a591a3ca0e016642233728fa11e91231ff71c2a00cdf15515e753f151b272bd8d916e483d82f6337fc74ba3e57a8f18
SSDEEP 12288:CbBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d8:CbUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1E86523824FFC09F5C74A0AB580A67B0CCD92BD4FF685439E471D722A5B385C6CA664CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 d5231416ac3be1919b95e76a00a7f6d0255ead051f770a5e103e23b3388171a3
MD5 d9a2b9c7fec5d1ea10d77af0e7c909eb
SHA1 e1da27c6494f9bb096ac43da9d246cda77da0a0d
SHA512 e5a1b9ee23e452e2b104d4bd6032972ee40df9720e1e2cb7871add5682860bfed0ac493885f6fe9ec678149912a70f8ab735bae3bb5acf176e1dc330ba147903
SSDEEP 12288:wEBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dh:wEUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1B26523824FFC09F5C74906B581A57B0CCD92BE4FF685439E470D712A5B386C6CA568CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 f024c8f707d9a10be4cb3c5eada49c052be95d5b994dc4b7cab314fad7f03f75
MD5 00bfbe2727255b9f224abae6a02d44d6
SHA1 3c41dbc474bab710f5777e59d2bc20e43e2c12dd
SHA512 7a225d654a2ace304c0c0a0105d9b2c9869f83b7c327e031d8ae4d94969d407c618db6d4a16d17c75653ddaa8014d6e0b6167427cb67448f949318ecfd37c88a
SSDEEP 12288:CaBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dh:CaUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1E26523824FFC09F5C74A0AB581A67B0CCDA2BD4FF685439E470D712A5B385C6CA664CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 1eea0d444cbbb26b55716455f07c814400cf3655a3367e8d305827502ea10428
MD5 27579fdc63c8add23870244f5fd9a79d
SHA1 950d6e8278e21c1fc24185caf464a393f36a9eae
SHA512 bc97be2bb8d5ef758db87f541819f232cf73a218c56241600373af4cbcb6d85f28fa8458ee9bab42f72174800ae798b15630f14513ef5c1912d7b904c33d2e85
SSDEEP 12288:oVpBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dK:aUeA9n/TM4NZYeNm+9MhUwd
TLSH
T14B6523821BFC04F1C74A5679C5A6AB08DAB2BD8EF76283DF4705251A1F302C5DD35A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 8fe72218e281f2434dec578e157d93a92ffb32e01d8f8ad250338f132027f1d6
MD5 d8b7c67c2e4ff2dbba530ee1ee11c7a9
SHA1 998c2e1acfddb6652787511b1ce5c4c29910c4dd
SHA512 62bd2aebf20e2dfdb9a0fb0e9fbe7f842219ca4a8080e3b421e807b772c70ac1c52706954008e6b7867b511a3b3beb8f505d657944c7b0f12f8972bb3e914a08
SSDEEP 12288:gRBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dB:gRUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1726523824FFC09F5C7490AB580A67B0CCDA2BD4FF685439E470D712A5B386C6CA664CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 44f73ecc4eb3c435965d35ffb241a9eacb0ab488f4f8c75b3ff843289151d18a
MD5 65b69bc12997983902523af95275e186
SHA1 6358b46ba2534207ad59ad751ed54f3220ce08ad
SHA512 b9c8b44cb0c6b01fea449732a79cbaa28549c75de8711c23ab3cd202bcce48c218c0a3dccdcf6f85e29d7df1bd77dac84c428c8f68ee996ec3f0087aba76a6c9
SSDEEP 12288:qQBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2du:qQUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1266523824FFC09F5C74A06B584A57B0CCDA2BE4FF685439E470D712A5B385C6CA564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 d0bde0121258770dedbd5c346bcdbdfac0bf9cca3ce708d291a32cab7474f169
MD5 d2a38ce4204f138a106c5e99a465808b
SHA1 1efb49e8e872a0f02c786615b5f5fe4e26d14ab8
SHA512 aec06305a7316b96f75e15af4468242b0f2c485bf700ec8cfacd1c29024a0944030c1b9f4e22df9df5dc7e0d679fea21adee32a1a519188ef67669d5881c8ad2
SSDEEP 12288:jMBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dR:jMUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1CA6523824FFC09F5C74A06B581A57B0CCD92BE4FF685839E471D712A6B385C6CA168CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 c69aeedf4475579ded8ed196e4fecdd9e513a92119468cfbeccb7d913e49c91b
MD5 786089a9dffe75caa0269cdad45d654e
SHA1 d89510af623182999f63eaf583bd20e079656e5c
SHA512 8e6b96645dfc536f86d5f32fdd010ddfb6d30a29382f5c1c767f1637fe7314f05ba45165116c58dfcc59e1ce00189e4dd373fa8246ce297f6241b43c243b7d9e
SSDEEP 24576:fZMEzFVSOkUeA9n/TM4NZYeNm+9MhUwd:fZMEzfCA9n/TDbXNKd
TLSH
T17F850295B3A00CF4DD67423EC8659A05D6B2BC1A5760C75F03A8362B5F333A14D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 19ca623420aa74d44407638c4fbb9c0f2720612e3295b148e5cca5c9d3fdcdb3
MD5 8136db58b0f6f09ba168930ebf0d8ea9
SHA1 3dd6b90a0b64c94e9abaa8ee23444a1bc37b916a
SHA512 3becad07b831c7edc4262927a1efbc499dd67e098ed86f7d7e425c3a64e0e9c53ffabf83414abdea6372e4ac7c9f273da56092c7a49328380004c36e8fe7d698
SSDEEP 12288:PPBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dI:PPUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1856523824FFC09F5C74A0AB581A67B0CCDA2BE4FF685439E471D712A5B385C6CA164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 9a463c419628d4a96606e44a3e39abb464d0de361be3f1ec711117cabc80f7ea
MD5 fda5e8448f75732ac0ced8fd474439dc
SHA1 24b4450881e4d49b491452c3575c67b27b1c120b
SHA512 3a10fc4b8f71d25739193483b9069a5a2234e7b6ea22fbb33ae4f7797a779fa1517fe044f5e036a7e776a009b12f8ae276bba71772ad494e16e0f746b09630bc
SSDEEP 12288:wzBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dU:wzUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1B06523824FFC09F5C74A06B581A57B0CCDA1BE4FF686439E470D722A6B385C6CA564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 ef0358158256e364d4d425fd9f30c0ada03006ecfe72e7958ea16de96ff5d39e
MD5 a63f1e330bed3443391895192c7385eb
SHA1 f0a757b17c662485ed672f5f546ac4dfde6a323f
SHA512 79047e64a216fd1aaa03a2a6f33bccbcbfb05325e4ec87981ba1347007d4f4ef3486fd46d0dcd51c4b043f44f0aa2b525f645347b3a10be054bd6b231fb4cca1
SSDEEP 12288:cyPz5L8IBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dS:FzyIUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1D775024777B420F9C2674239C8A21A05F772BC3A57208BAF036417762F376D19E3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 cd926ad9fbfac92f79ea5f46f1393f9cae8bb4032e06dcfd8e333e1d41f02e93
MD5 8b79e11b8e7a2effa15ea7889a4a53e5
SHA1 a180d42e8889ae49471b706a047f9a039af8be09
SHA512 a7a416157038e8e4680f2e1d510f423d568e03f3b4a96f29da98f87a3ce6cdc6d3717983cdaeb867280edfb47e667a361e5cdaa7ea8f2a7aef3d81ebdd3389de
SSDEEP 12288:fPBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dB:fPUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1776523824FFC09F5C74A06B581A67B0CCDA2BE4FF686439E470D712A5B385C6CA164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 79b6060acdc10903d0583fa7f93241c470513c6a1ceb705ba84deb4fccc44425
MD5 21c98d4a49d36b2e60f12ee193d227db
SHA1 0bcbfebcefd8ce46be6491529e7a9cfa3d8f59a6
SHA512 68fff66a06fc993b75f33eaea08c355ecca64b2917734bf5cd706660e4e835016a1916b1c79c9cfca21faa8a9d3ba199558b7db58ac5260614aae551b539b4f5
SSDEEP 12288:LPBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dO:LPUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1F26523824FFC09F5C74A0AB581A57B0CCDA2BE4FF685439E471D712A5B385C6CA264CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 dccc3bea4e2226a50c134f5bf341f8e278df7c761b1868af7cad75865f348324
MD5 583602f0d613a14e4e433403489722e2
SHA1 34780d6476a3d0f780431699dfb8ebd12f77e029
SHA512 03d62bb4aaaa7d1cca01050788b9a6c04c5417dc8282a9c99c6bb0324ce7c7c7bf212c20d13ff90c5d6b20e7027c52451329ec3d21bb97f2e3096bbeaab418e5
SSDEEP 12288:myPz5L8IBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dV:bzyIUeA9n/TM4NZYeNm+9MhUwd
TLSH
T13875024777B420F9C2664239C8A21B05F772BC3A57208BAF036417762F376D19E3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 9d8178bcd5187ef1d0eb4d2146cc34e0710b9cd503bd702de6832c3734fb08e6
MD5 58d9884516da425c3b03a9bc9b1dcdde
SHA1 85a715c11f08bbf5f49d260bb5f2da1629143de8
SHA512 e6e6466440f919b6ead15cf7095c01bc85f5e3e4ecadbab1e212e59019f1f502bc4dbcbf3469822e96cbb32155b1c183c013acc16c83d73219d1cc7f3be31ca3
SSDEEP 24576:DTdaLl3z0zDqUeA9n/TM4NZYeNm+9MhUwd:DTwLljRA9n/TDbXNKd
TLSH
T16B850295B3A00CF8DD67423EC8659A05D6B27C5A4760C75F03A8362B5F333A14D3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 5596522fec57be8951c898146196c0117b630c070492b1065c32a3b851067712
MD5 f9d4afa3b69e059a9ff841f9ed62598c
SHA1 191c86d3b2425bddaace47fe2fcd54c1540e7594
SHA512 07fdbeb6b807acb4ccef078fb9f2d56e3d2618eaa5eba6103ba2c4dfffba1cd49a355393249c29c71f99bf337647ceb35eb54f574edb0b4630b7f8f85b48267f
SSDEEP 24576:o35d9CHKy7GZmUeA9n/TM4NZYeNm+9MhUwd:y5d9CHKyaCA9n/TDbXNKd
TLSH
T11C95CF90F3E814E8F1B79A35C9765501DAB67C5A5B31CA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 63550301376c1f38dc664930af7c5d71591f8b22f2f6e78146fd99f4a29c04d3
MD5 339a16bbf45e4faf47e2c333b2ef3e0d
SHA1 8ea23c00c2a2283b750a996068bc510ab653d849
SHA512 3ec6fbb652fa0ffca44315a23ece59cac9c392d77f6243ba0c009cd36c50c9bcbb716c092e953f194151d78776dfdb65f8421daee4abaa907d85a7b39240d6b5
SSDEEP 12288:H6BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dq:H6UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1E36523824FFC09F5C7490AB581AA7B0CCDA2BD4FF685439E470D712A5B385C6CA664CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 2ac1aa861925836def034c58b6353c26fcebd4b5687303e2c2d47d807b38aa0c
MD5 35fc176bd99382905d877e669faf40d6
SHA1 863d8cc14c09366654fce87c2a6319fa7a12c583
SHA512 df021f6a3773c7886ebc822aacdd84c4a103a323d18989eb8a0e62d740b3a7f80ec3f3dfb88d4fea139baaddf960a7e86b3c2391a2b02f7f05ba692410a8b2e7
SSDEEP 12288:+oBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dl:+oUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1AC6523824FFC09F5C74A06B580AABB0CCD92BE4FF695439E470D712A5B385C6CA164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 191f428aeb8456320f765ee5d220af10b361802c06a3fa0ffde5c9175bfcb4d5
MD5 2ef9d5f4e1cc4b1323f5035623e168e8
SHA1 a3e4c3115b0dfffc98cf9499b42cbc943d473f63
SHA512 4cc195e761bcf37e0c44e18f96524bcb14c2b3e593b2f371a07c8c27afd49beb3ac6145325393c8569a011d4ddc659e5c6dff369415681ea73d635dbe865666d
SSDEEP 12288:ldBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dR:ldUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1DF6523824FFC09F5C74906B581A67B0CCDA2BE4FF686439E470E712A5B385C6CA564CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 7c21cdd496465a9893da49cb53f4e365de3eedb3ed2210d6cfde6caa5cc80818
MD5 6b2182b5ac931a42863c388f28768cb2
SHA1 23e0cfa6cb2c5da2c1b0ea51c91dba34da68b958
SHA512 4646e6bea444ff3e951372b0dad9ca3ee157946f387f54922682f595999c46f83bed30289260e056455205e081c72d436b154ba1cd8179b0368d18de9f7c2d7c
SSDEEP 12288:SPBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dN:SPUeA9n/TM4NZYeNm+9MhUwd
TLSH
T10D6523824FFC09F5C74A0AB581A57B0CCDA2BE4FF686439E471D712A5B385C6CA164CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 eee794cd3e9ef9b34a48aee302dc25494a8f9b887b60b91571607bb7b26e0935
MD5 5809af9d46f54fc5f15f3dc588b797fc
SHA1 1edc040b5205b8242fb9ea7a30db85b1dcb8ea51
SHA512 ea318a61a5e0c3feac630d9c9b135a8c09ffd5a63e31968d21651926a3fd308cb2884fc472863d2454a72630f1fc44e37180ff647c7a5f8a28c428e8dd82155a
SSDEEP 12288:J6BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d1:J6UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1DF6523824FFC09F5C74A0AB581A67B0CCDA2BD4FF685439E470D712A5B385C6CA664CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 4446758ed46618950ab7dbd785d35307c295ea975ef91f64530e9c4ec092d045
MD5 24291429b4f48d42c66c3cf41b1f387a
SHA1 0f69460b5c3998005a8f3258d2f7211b655bedf7
SHA512 35e1a75e52b9f22407c36f6f22b251fc1442199d3240aab25f56c078312e561317414be7c852361804f44101edfa8a15d7d091f5ff83f204d77ccd5f5625725b
SSDEEP 12288:J3BqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dY:J3UeA9n/TM4NZYeNm+9MhUwd
TLSH
T1866523824FFC09F5C74906B581A67B0CCD91BE4FF686839E470D722A5B385C6C91648E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 c4dd5abefef63b98165d6b7ed1d4ee045b912798c6c2c4504907ae556559e0b6
MD5 17042cfe2e1a9f4f486c33a9bb698ca7
SHA1 cf550762de8da6d0c820c9b153a1e576b7362e69
SHA512 da1a2360c79f67ba1b004a16235a01661147a7d8f6b6fef986327f21a6fa2721ad553c90dff536c4716678518c4a0d1fdda5d384613eb869033ccf92fdcbe168
SSDEEP 12288:JRBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2d0:JRUeA9n/TM4NZYeNm+9MhUwd
TLSH
T1636523824FFC09F5C74A0AB581A67B0CCDA2BD4FF685439E470D712A5B385C6CA664CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 6591e674d8ff58d89d95a81dbf5a1ddcf561d03bda9a53e9fda584a798b13401
MD5 b10daccadd5af92de1e5350553ef8369
SHA1 50b70653f81eec73a97e4f918cfb33a687685cd7
SHA512 92ff34b6295ca796748678840fd23cb9e52dc20d7c17bd90c78fb759ced6a14bace0783d3e4f24c9c0cc07318112ac7da0b6904b2fca2bb59f0d459075b77624
SSDEEP 24576:Qfwv+k9RX6wkyAI6UeA9n/TM4NZYeNm+9MhUwd:OMnYI0A9n/TDbXNKd
TLSH
T13195CF29EBDC04E5E1B7923C89B7460AF6B178591B31C2CF025A536E0E37ED49E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b095adaadaa382d8ae2f91f12b19a6222bdd844d920938f0ae9d88293c45f71e
MD5 0ad79e48119591df24b2c08237ef4a88
SHA1 b3d6e0106df8f341c839b8bbad4d9e2d5c427310
SHA512 bbbd991e2b995467e17f4e39fcb2c21e08ae531070313dcd34f64b11d7830a8dfad4896a18346f33d765612167e8b9b0ca2a7aa8a14f10f9fc2c2dea50304444
SSDEEP 49152:mYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0YA9n/TDbXNKd:YySzP1fb9s
TLSH
T18F066C96A1A801D5C1B9C1B98B1BCC1BFB7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 42e544a69af19b470f399e8eea631f857630b75675a088908c3bfe49c49bd4aa
MD5 292e3ad1151a2c715e410f5c1f5fbcc1
SHA1 fff4eb213f46fcd020fcf388988d634f93edd410
SHA512 aded3ce54e0507beac21960231ba1a2a7a303b9da0062eba3f1609d60252340269ab58603c95a7ef1530c080415a86eaa358d5d85e9b90d3d47b9d255cdb2098
SSDEEP 24576:G47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYUUeA9n/TM4NZYeNm+9MhUwd:G47JUQj1irIhCnDHUPfF/IA9n/TDbXNs
TLSH
T18765AE1EA3EC01E5D1BA927885154A1AEA71782E5F31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 d7f9baa6a453660745e8f272baf20f8cfc56401b9b8b346b1385bcfb821a2a49
MD5 44a559cdb88c6cd8dd1ca451de87d834
SHA1 6f5d7fd23aad54e45917d1bd291c4ce6a125231e
SHA512 86ddcc864dcf8b5a8596be70d2c6c9ca801ca28d393c0c9b33c2172e5866d855346fe96cf58cc751c621463df881ab7e0d9b33303bbbcfe62ed0633dad2bd658
SSDEEP 12288:bzsffBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dj:2fUeA9n/TM4NZYeNm+9MhUwd
TLSH
T17F75F04AD2A802E8C15E6279C7965A04F7737C2993E1D3CB43C0F53E1F356909EEAA47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.3MB
SHA256 2a70103724cea2569b00bfbf537c38f5f084d41172a38a843701ebf2a2dd6d8e
MD5 426320041702103c8bf203a7328881bb
SHA1 55abe9102f5faca52f60bc38fc9768b1d8d31dd2
SHA512 2dda0af4e2d7fc917cc9ab87e37cbb7ebe525479e56f56f3ba115b8fc1df08c79f3b1f61dfe7b0acea087cd4ae1b00122c50bc702741b824f005debca94f6247
SSDEEP 12288:BcEWFBqL8vCUh7JqiRliFzU/9ONr20AaRM/rcZwE72qtLb:B0F60FH4lCONZAaRM/rs7Rt
TLSH
T17C5528107666CB4FC6A940321E72C5CCAB707D45FE056F0373C98B3F9576A58BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 d2c0d0f7a3fe62685bce0437d76b9599045c79c613344f09b170bd1ea0e706b3
MD5 ef8758009241a8e7027875bed92239a8
SHA1 fcfe50d1a970aa4b9236b1002828799aaebe91b9
SHA512 8660385443fcdba7a12784d1870e03911e5681ec33215c7d8a784f7054ec70eedd3ac2be192b1ec039081d65d436f883ae5abb371c91d21b6086a9d74a228594
SSDEEP 12288:4/OxV5QumFxinrAPLkTH1w363Um2ziRvCTPTm:4/OZvsL4L1w3Wr2msa
TLSH
T1EA751B406137E78FC1BA5032033A5A8DA7B4EC16B7096F26B3CD4539D82AB45B0F97D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 c9bd122e600d2fd0b0435e7e5c45308b4785770ba5af36a3c0bca2f0503e72d4
MD5 722259c11281a557412f7339be9df837
SHA1 a5cc3572e5343251dd5b71c5c11cbfe8c21f7bd3
SHA512 e7bea19b1593a25fa5f0b678a8fe475474b6ffa83f718f402054ffc2e86a5512bdb5232f51d3ca3dfc947fdc668a5147c353f76e767fa9f1291d904442390193
SSDEEP 12288:pO7mBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dGd:MmUeA9n/TM4NZYeNm+9MhUwdA
TLSH
T1866523824BFC0CF5C75E16B440AAB7089E56FE5DEB4083DF8209722A5A345C6CE7658F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 1bb28d7fa2ebcb03ebbfc1dcc3b86be863d352e0335d55aa82dfc471514118b7
MD5 d8d39a3e7fc2b22fa36c5e855360f6b6
SHA1 f38c6dae344494f15601931097d0ffbeefd84116
SHA512 8299ce8f7392a42d323f3399ddae6f3bbaa0b20bcd0839c135e8bea08915730844fbbfdd49c755acb11475142ba86cdbc225cf34b7a83064cc6acf7c9c477823
SSDEEP 24576:6gb6bmBIi49WNNFpg1rSvFv7bYVUeA9n/TM4NZYeNm+9MhUwd:6gb4mBIBhGF2A9n/TDbXNKd
TLSH
T17C65AE1E22EC02F5E1F9D2B88DAA4417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 afcd529ce1fcfc24f53a54dec2f0db57b43aea7db5d986ef60d6af0476902388
MD5 536d5e2eb4698e7b78320df3bdbd4f38
SHA1 f0d0bcca8a48bbce853a90e9275b58f287efed95
SHA512 0771a52a0427b62a6126adf5d065741e1dbb8d9fbd61da3381fea7c17cdd4f1da4d501aefd266079e7cc79893dd52ce2780bee735563ce671e3a290a4bbbe9a4
SSDEEP 24576:9G88u8FpJqH1hzria7/mpUeA9n/TM4NZYeNm+9MhUwd:Q7ZFPqVoa7/eA9n/TDbXNKd
TLSH
T16895016567E401F0C47BD13889864663F6B2B8251364EBDF07AC8B561F23AE54B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 6011c845abce60c2b33a04a094497e3057556eb243676acbd22b0babd340032d
MD5 4f95604df09d64a3b65a372ec2f0270c
SHA1 f93a1fed74f897235f5d2f09eaeecafbc3f34c52
SHA512 6d0338613f4fd918233ea41d51244ea6d948e6f7d28350d97872ac8cbe8b3f0636678cbfb41a4a521893f10d86848c219c5706292c980e0d31c7d2eb4f475a46
SSDEEP 12288:eHvUrBFrEjwaQtBqgvA94z54/futEMyHNiiE9Bvw2qPm+9Mh9OBD2dt:ePUr+NQtUeA9n/TM4NZYeNm+9MhUwd
TLSH
T17785E11F26EC08E5E67AA17D8586870DE772B8561312D2CF0290817E4F37ED8AD3AB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 e204f3ee3ac3b75fb0bce7db5bdc44a681b0450e973b09a8d50df6420654df74
MD5 21dd108c2d4806fc66d90cc4f21209bf
SHA1 c904073eb3cba24a1ac1d9064a7ce8d9464d6dec
SHA512 f805f2ee107fe3e1cba843810ba873377c2670c27f712e00027632cac31b00a60ddd88dde953c3d652ff637a6881da02ea8d85ecd5f18779827c5e1e9a998d09
SSDEEP 49152:kBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj5A9n/TDbXNKd:HG05lO43bZfb9s
TLSH
T1EBD5C06A62EC01F9D1BBD17CD9C6460BEBB23815033556CF02A486A91F27FF4997E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b3290d16daed23bfa971af04514f4a4abbd54d1e25897271ef99c96c9d2efeda
MD5 b5a2095dba09e29af99f994621984c48
SHA1 2a47c44626b5417b0b6bd23ffbc0e8a01d2e9041
SHA512 f219a4fdbc63c342220c624afca8c0c0d4be8ddf5366d35eef4c6bfe8803a6ef45ce107b3eac0f3ef6174d7638863d4ffb7526d5e17347c6e0c7729ff375f22c
SSDEEP 24576:gfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnuUeA9n/TM4NZYeNm+9MhUwd:Ya5POZ3+Jt2pasx2+mKA9n/TDbXNKd
TLSH
T1F465AF5EA7FC01D5D5B9D17DC583860AE5B1342653319BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b913c1ac2908676c141f677d7ceed5ba054977262168f11ef2eb852aae50038d
MD5 0c4735444af3dd88e92109647927eb99
SHA1 5413d0341f4e5b85c0ba15096896f26a5ed4234b
SHA512 566ccf6eec02508f5368995ebd35d01e79a3fc1f48c8b5e8b14a93c30dcb6f941582cc594d45c03e2e0043995f1c94b2e4a66ca2fdd5624fce0e815c1c131529
SSDEEP 24576:9NcwHdjbyQ4nLC18lb/EOjowL7FkRUeA9n/TM4NZYeNm+9MhUwd:9Nc/zEOVHF+A9n/TDbXNKd
TLSH
T1F1858C1623E901E4E5BBE1BE89779646FA717869533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 824c2bb959d867203c407e8ba72a053d99f1b79f6a531f312be9ab0b09d1c9b9
MD5 5f97d12d5ebf13e201cc775c9e61f9a5
SHA1 f4bd3e1ce7432c69024fe75adbf0f305e86e32f1
SHA512 981b894dacc08537e909e34d50069c0bb40fd40a6bef57f2fda7b159a6e301309c7d0d2b9d0cc5dd80d90cc7e3caa5b23e04fda128d6df08f09e98c4642a2551
SSDEEP 24576:i6DIPmqBWqhdJsqm8A19u8PTNpM+QUyM+IlNZKf:i6DIUqm8A19xZpM+wEN8
TLSH
T10125020C237600F9D0ABD07DC2874502E2F2F5719B521ADF17A4C6B95EA2FD8B939E51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 1f304c31c3297a0c826e16eca0842d5b8973365695f10008521df2fe85973b65
MD5 8241d6b48c5b7055ebce9bf8d8249773
SHA1 5ec73a897e0b02cc32e08327c4a40ad8510b11cb
SHA512 2b05a60adc9f7257f65560206cfa1c759a551dd54cccb52dc649f90d0f61151b6bc03c4a9259dcacffe5bf2528dfb0da7b2c2a879d075889e2eb9a310f04f7d9
SSDEEP 24576:08kNvNnaFeYhJNtmZBm/UeA9n/TM4NZYeNm+9MhUwd:08MwBtOmzA9n/TDbXNKd
TLSH
T1E555AF6EAAF805E4D1FEC6B58D238516EA727851173293CB4390C13F0E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 8386ed7732c3a857e15b981089c34437f373693b57a44cfaa9ab518a9e8f19b6
MD5 e97434539281f9388f902928ff5e6501
SHA1 7e3d3c602a75d93e53c622dc0289a3821d9b91ed
SHA512 861f8f33e80dc676e8bc387a5160f7b7375ccea6525fec37646fa9bdf7a02c839cef279ab4c4776a2a2d39fb2f78071530d6ada2ac6a5d8ca723948f05e3b44f
SSDEEP 24576:GD3FHshBIYQgAiUeA9n/TM4NZYeNm+9MhUwd:GDVHeBIAAcA9n/TDbXNKd
TLSH
T1B995E17EE7AC04E4D57BD1BCC6638A06E77138AD032256DB0294917A1F2BEE46D39F40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1288-78-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/1288-326-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/1288-86-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/1288-80-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/2008-144-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2008-177-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2008-175-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2008-143-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2008-150-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2896-103-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2896-347-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2896-97-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2896-345-0x00000000004E0000-0x0000000000540000-memory.dmp

Download

memory/2896-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2896-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3108-158-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3108-165-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3108-159-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3108-333-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3520-327-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3520-93-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/3736-53-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3736-47-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3736-59-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/3736-68-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/3736-55-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/4696-61-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4696-315-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/4696-69-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4696-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5304-139-0x0000000000400000-0x00000000006C3000-memory.dmp

Download

memory/5304-119-0x0000000004450000-0x00000000044B7000-memory.dmp

Download

memory/5304-6-0x00000000026D0000-0x0000000002737000-memory.dmp

Download

memory/5304-77-0x0000000000400000-0x00000000006C3000-memory.dmp

Download

memory/5304-7-0x00000000026D0000-0x0000000002737000-memory.dmp

Download

memory/5304-1-0x00000000026D0000-0x0000000002737000-memory.dmp

Download

memory/5304-10-0x00000000030A0000-0x0000000003125000-memory.dmp

Download

memory/5304-0-0x0000000000400000-0x00000000006C3000-memory.dmp

Download

memory/5304-9-0x0000000002DE0000-0x0000000002F18000-memory.dmp

Download

memory/5304-17-0x00000000030A0000-0x0000000003125000-memory.dmp

Download

memory/5304-124-0x0000000004450000-0x00000000044B7000-memory.dmp

Download

memory/5580-331-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5580-329-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5580-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5580-332-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5580-110-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5580-116-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5684-43-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5684-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5684-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5684-42-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5684-157-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5844-23-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5844-29-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5844-30-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5844-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5844-108-0x0000000140000000-0x00000001402E9000-memory.dmp

Download