1a46ee2a6c99722b799acb66de30ad714e848d72fdf59a9cd23a126013e156bd

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-29_37540e51fdff1871ccb032a0bdffd3fa_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop.exe
Size 2.9MB
Sample260930-dmfjlsdc93
SHA256 1a46ee2a6c99722b799acb66de30ad714e848d72fdf59a9cd23a126013e156bd
MD5 37540e51fdff1871ccb032a0bdffd3fa
SHA1 846051d8e4768277b23014e06dfd7884b492a50f
SHA512 52a69288c91e086ae9779c19af69cce75fe035ac75b209df21d987f55dba8f7ff3049093d2162f89dcdfbbe64e2fd4d4650f0e4619674ec237fcad160648a817
SSDEEP 49152:jQIQhxSMmT8oWgBCaXjZt5TkFyAnh1EVRkhxSMmT8oWgBCaX:jc+M4FHXf5Tk0AnMA+M4FHX
TLSH
T115E5222177868471E71B4334C9A1EA91095BEC7C83D0A96FE66C7E782A315D31A3B34F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3996	elevation_service.exe
4924	elevation_service.exe
5068	maintenanceservice.exe
1524	OSE.EXE
2992	PerceptionSimulationService.exe
1856	perfhost.exe
2068	ReFsDedupSvc.exe
3488	SensorDataService.exe
3140	ssh-agent.exe
2296	AgentService.exe
720	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
	\??\F:\	elevation_service.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	2026-09-29_37540e51fdff1871ccb032a0bdffd3fa_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-09-29_37540e51fdff1871ccb032a0bdffd3fa_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-09-29_37540e51fdff1871ccb032a0bdffd3fa_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-29_37540e51fdff1871ccb032a0bdffd3fa_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-29_37540e51fdff1871ccb032a0bdffd3fa_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-29_37540e51fdff1871ccb032a0bdffd3fa_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-29_37540e51fdff1871ccb032a0bdffd3fa_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-29_37540e51fdff1871ccb032a0bdffd3fa_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-29_37540e51fdff1871ccb032a0bdffd3fa_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-09-29_37540e51fdff1871ccb032a0bdffd3fa_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-09-29_37540e51fdff1871ccb032a0bdffd3fa_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-09-29_37540e51fdff1871ccb032a0bdffd3fa_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-29_37540e51fdff1871ccb032a0bdffd3fa_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-29_37540e51fdff1871ccb032a0bdffd3fa_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-09-29_37540e51fdff1871ccb032a0bdffd3fa_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-09-29_37540e51fdff1871ccb032a0bdffd3fa_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-09-29_37540e51fdff1871ccb032a0bdffd3fa_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-09-29_37540e51fdff1871ccb032a0bdffd3fa_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-09-29_37540e51fdff1871ccb032a0bdffd3fa_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-29_37540e51fdff1871ccb032a0bdffd3fa_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-09-29_37540e51fdff1871ccb032a0bdffd3fa_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\332a50fd3a35217a.bin	elevation_service.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5632-0-0x0000000000400000-0x00000000006E8000-memory.dmp	upx
behavioral2/memory/5632-72-0x0000000000400000-0x00000000006E8000-memory.dmp	upx
behavioral2/memory/5632-175-0x0000000000400000-0x00000000006E8000-memory.dmp	upx
behavioral2/files/0x000100000000934f-168.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-09-29_37540e51fdff1871ccb032a0bdffd3fa_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-09-29_37540e51fdff1871ccb032a0bdffd3fa_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-29_37540e51fdff1871ccb032a0bdffd3fa_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_37540e51fdff1871ccb032a0bdffd3fa_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000b8db5d88850dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000e452d1b8950dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007cbaffd68850dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000051b8bcd88850dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3996	elevation_service.exe
3996	elevation_service.exe
3996	elevation_service.exe
3996	elevation_service.exe
3996	elevation_service.exe
3996	elevation_service.exe
3996	elevation_service.exe
4924	elevation_service.exe
4924	elevation_service.exe
4924	elevation_service.exe
4924	elevation_service.exe
4924	elevation_service.exe
4924	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5632	2026-09-29_37540e51fdff1871ccb032a0bdffd3fa_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop.exe
Token: SeBackupPrivilege	2068	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2068	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2068	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2068	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2068	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2068	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2068	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2068	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2068	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2068	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2296	AgentService.exe
Token: 33	720	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	720	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	720	SearchIndexer.exe
Token: SeDebugPrivilege	3996	elevation_service.exe
Token: SeDebugPrivilege	4924	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 720 wrote to memory of 3448	720	SearchIndexer.exe	99
PID 720 wrote to memory of 5932	720	SearchIndexer.exe	100
PID 720 wrote to memory of 5304	720	SearchIndexer.exe	101
PID 720 wrote to memory of 1280	720	SearchIndexer.exe	102
PID 720 wrote to memory of 2288	720	SearchIndexer.exe	104
PID 720 wrote to memory of 5096	720	SearchIndexer.exe	105
PID 720 wrote to memory of 1684	720	SearchIndexer.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-09-29_37540e51fdff1871ccb032a0bdffd3fa_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_37540e51fdff1871ccb032a0bdffd3fa_darkgate_elex_karagany_manuscrypt_maze_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5632

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3996

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4924

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5068

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1524

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2992

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:1856

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2068

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3488

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3140

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2296

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:720
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3448
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5932
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5304
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2964 2968 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1280
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2288
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2964 2968 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5096
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2916 2920 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 8aefcf12e854b40ce5518b9ce5e8fa0c24e703b86c79ebd66bf592811addc90a
MD5 936115bcf6bc0683cea53d64edca8292
SHA1 a65473990e6c186b392d9c2c3bc363de7de728f3
SHA512 ad3f9837b3789d2c88b8bddc527da111814942fc0f8a8dcad6d3af74e8bf00ebabb6405ce9993bed9fe466d4c1b3567d80cd3b45f9c14ef58ca88761452c72ea
SSDEEP 49152:Fb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnvhxSMmT8oWgBCaX:b3q6HjB6+M4FHX
TLSH
T131D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 eeddb30e76aeba750211e9cac91e770847ed78e91bf91377d8c82f2600426ada
MD5 d422efad3f0dea532b88a8863113f740
SHA1 1e55fd94eda77c1e0d9b8599eb4e1234ee10c32b
SHA512 6aacbbb7cb66a9d42495b97f9e064e3b8fe39fa47878bf2c480b13fcee5710531978fa11ba318be23cda579d00882d4be69622372f64729440fc584ed20daa80
SSDEEP 24576:FXYfDtczAXrKhxr+EHNmT8oW4ll1JCrLKXI:Qtc5hxSMmT8oWgBCaX
TLSH
T19985F12877D508F9EC67823CCCA28512EA737C954360E79B03B49A691F336D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.6MB
SHA256 9688edb1b1b164d6cdb524ec32feab14e70f2bf9e2505fd38dd6d42a4f2a5560
MD5 df6c8100e96219d4be693f8cc00beabf
SHA1 b3512c8ab41d40c37b4e2d714ad57a71b052a1c4
SHA512 1d40f3542859ae1e9b42b55de5bcbfbcf0d5d8628aa82babedcd9c2afc5e34906d291366fc6d3cef7f2a8889830dd2063856774e0ca4c60734bde78a030a8c51
SSDEEP 49152:XPji0A3shxSMmT8oWgBCaXuhxSMmT8oWgBCaX:fjo8+M4FHXu+M4FHX
TLSH
T17785D026F6788335D073C079C5D2A68AED71348657308ACB4296D77C3F27AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 e2cb2481e6ccbbc66c41e746cc194ee4801e4c9cfb46778ac472a14585e638f8
MD5 de1aba629085afeaba557d49e7b575bc
SHA1 dec6fc419ee8514222cc80b647765a65e6313398
SHA512 b920e6f47883d2ab9e4a3c52332c4186db13e2561281b35739805eac2c07ed0afd0d273383044a7d91b941e244ba12f436fad521146e2b82cc2c9d8a680cb4af
SSDEEP 24576:Fa7/ezSC6vUyD/aqgrvWE6q8wyusrKhxr+EHNmT8oW4ll1JCrLKXI:M/ezSC6vUzPvxHjy+hxSMmT8oWgBCaX
TLSH
T1BC756C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 e8991f02d641adc566f83f1a73ca356ee586a52e963d40305e3b2d1b70fa6936
MD5 c0bab4280ed9f614e75812f44ed0400a
SHA1 0bc1b29ca22f4cbdfd7cb910956b55879da8f98a
SHA512 36aed2aa175a9557a5d4103c2db4389a4b95eaffc1030a49c874d6250cef5a331961cbea6f17f02379d7f36e56b23d1e22ae72fcfc663d588409b30ec227e98c
SSDEEP 24576:4VbqPb88hv/l+6NrKhxr+EHNmT8oW4ll1JCrLKXI:4VO88hXl+9hxSMmT8oWgBCaX
TLSH
T135559E66F6748331D073C07AC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 3a81438da451f8532881cfb1817dc8b63dc5e64dc39d38670e6fa072d149c2f7
MD5 022519f7d3cf18e035dd2f400536899e
SHA1 73120c7e2e1fcf35aa3cd4ed1da38192d8f7c366
SHA512 3a9bbcb3e00221e494cc6d75d72f18ad92063b0480a37c1fe7b4665294ed9dd15509e002bccc0f92c521d78f57f95bb1aa489928a90bba46266fde9cd8a339bd
SSDEEP 12288:kHiJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:kHyrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1096523759F0D64ABEE3B8335F872571699990DDCD1412E3B8F3A3FAC3934C1A9052212
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 e95ce8b1c8e3fcf3acd1fdc1f4a4f9ce39df29108130206ec4cf6e0b273342e7
MD5 698dfc63fc8bedd54441803c4c3ebd3b
SHA1 6bebb27480c2e51e7ea937c631d9d37045eabc8a
SHA512 bb41aece658372e2dcbf111f9c1b33812d072454fac3dcdcc608a8b6ad3a08bb8da533bb0c6c44633dda18a7a22687ecac79f4768620386332e5c5ac83671c31
SSDEEP 12288:5eBNUbTVO86UjJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:5JIUlrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T17885CF3BEE28FCD2C67A8D785A918700D7B278704B52A3CBD175830D9E235E15E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 64f8c8e04d2690a1486a500ea4d1642f43c760fb8925d875f75bed14fd9b1b41
MD5 63cee49d9934db22719b4cfb9b56fb7c
SHA1 b0c48c593e881afc5ada87970187779d5c28b8e0
SHA512 d9bdd1dbc32ade1666706eea8cc721efb56a3266505587890d746d423bd8cd89b49c1bd417a2d79e2f7928aad15e483874537205615dcdc58c1d9f9a8475b8ec
SSDEEP 49152:bQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THB:bQvGAdlCEL8c/yRNw5Cv+M4FHX
TLSH
T182266C656BF880F5E0A7E138897AC672F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 92cc03a5cc89d6041ffd503da19763588010f428ba2fbe35ad997c0b5a07a460
MD5 d6c57f4a3124f54281b40c3dc1d506cb
SHA1 93e3f58172d7777337101608cc6c4d01be22a048
SHA512 0214ee9840f566e24c1ddc83b31f433e68452e1a2075fb640584c03a8b50a79427b77e007081d3d8c88dabba693a368a6b487298e4aa4bc491e4e836dd606687
SSDEEP 24576:v7ewsAjDrKhxr+EHNmT8oW4ll1JCrLKXI:zljyhxSMmT8oWgBCaX
TLSH
T1C285E031FF74E036C67F0D766B36C716586C6A604B522AC3E3B88E9D59302D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 26035118efdb6286192c9124e89c3527490bbd89e408f18ca8f8f612e5252905
MD5 a0eba3ae2b15608a6ae913c245d0e4bd
SHA1 eb676140cae6bd7d0b2136010b16b3e234fe50b8
SHA512 2340827f407927dfeb460203564279d088cec8fda4a92b620e3ab5422330758847d0e07419c98ff914429b5d108fd8ce03329c6782a0db60d35f152e5039d291
SSDEEP 196608:OUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHa4:OUEtQevvqc2W1cpV2EI32a4
TLSH
T1F3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a3e86e2cc5a9a7c727e4801ca83d83e0a7375f314c13b276a3215ec141283034
MD5 e0867be1721806960bce29d94d41bf79
SHA1 7f2ea67c73247b4ce2ccbf481d89fdc06b7220b2
SHA512 4f0a877cb3c5cb2a7099a258eb54f6757e7adbe51dc7663e5fc9b54a378b8d41a5dfc59165ba991d46f38f2e19b14243f7b1ed84fe0c5a4ac11c7809b1621a1f
SSDEEP 49152:ACbRquA/m2yL5zTfFiV+XenmE3/zShxSMmT8oWgBCaX:JoquVjnm7+M4FHX
TLSH
T119D58D1976B8C1E4D1F6C37886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 26c415880384716ed931d247b4af92a60cd8d5ead0a57c5a49acb1a2c7a57cee
MD5 e2df5166f3f00502dcc0d9bd444c91fa
SHA1 b20672b48d22b96f45d6a01626cf37443162ab25
SHA512 71ddc80257aca67d500daa9a83219a3784dfcbb39bfa5e1c8143aca42e292fe6de431e2cbab85803666623e1c16b5221badffed0bfe01f1c47c9f6147ee651bf
SSDEEP 24576:XAhGLJIFoiwtA5l7S53orKhxr+EHNmT8oW4ll1JCrLKXI:XAMyFoiq5LhxSMmT8oWgBCaX
TLSH
T12135AE80EBF955D4F5B3AA7899B68171EA76BCA95E31C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 c3f5bc9589b6ee8f182e74b7e87018a168a559dab30cddfd18dcecb373f5fcc2
MD5 af6e59d9b634efa9a1ad2e52a6f2ee51
SHA1 c8e1c1c774231834528e234095f6bd6cb146ce57
SHA512 0fda8bde7ef08ea675571699dbad5cb1388dfb6f1b1a278c639eafe12036eb80fa2c880a0787551be669bbbb47ef27960f102efc5633a3e6354d58f5e91d4509
SSDEEP 24576:XwuSOWhrKhxr+EHNmT8oW4ll1JCrLKXI:Xw9OBhxSMmT8oWgBCaX
TLSH
T1E385F14677A91CF9E9678239C557C136F7F2BC052621DB2F0770C65A6F33221AD2AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 2d93f89513dc29b5836d68f30946350146b494322d0585f36f37ed10cf503542
MD5 33a8d18ab4c412ab1ac8a400182816ae
SHA1 a71c5cc240d66adb169b7ef5b7df80b7da28bee2
SHA512 e14cedaf06869fe75f16329d4f829edd6c54011c82199d3d7b6bf2b1183ce35bef70aca8efca1d0b46bf60e31e8b7259c23018d75045e4403f53eb8c99583178
SSDEEP 12288:PjZ1IydJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:7ZuWrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1B675126A279870FAE967823CDCE14605D7B23899633143DF1A3547A92F33EC65D36322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9d8fb4c6338238bc7783d25f31b3a7f89c5cfd4ac429355575318c4053d6666b
MD5 d71c0a9c2d8eba547db7e9e4549beac7
SHA1 22109dd62b04c6046418fa089c684e8a3b2f1679
SHA512 4789111f47ddab39049028d6aa6553d7ac76ca0434470c268c2c1cf18c965592fc0ff3f5378fe35a0c942ca9348c69e4c84ec9be6dd7ae17995230b54d7183d5
SSDEEP 49152:1j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UF:sQRQyi36YOcPQLvw2gAf+PN3o+M4FHX
TLSH
T1B0667B13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 03375f1f069ec9f45af6ab49e60715a9d711c91a443a62ef27e501a11f7cc222
MD5 ce1b48d364bc8f170db64c93e24faad6
SHA1 94d8a3956e9133e02e22b18d6ee376a6af90720b
SHA512 d2bbb96eccd2998fa3921f617e4a5420914876169c1315c377c50ada3315c380b0d32188c51ef6f0a1d970d3f1bf32282487541960d233b26bf98ca48e02797b
SSDEEP 49152:Mj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UF:DQRQyi36YOcPQLvw2gAf+PN3o+M4FHX
TLSH
T1DA667B13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 4876f312d1ce4a8e9ff865f8345ca881756f7d404a1ac461f3add7e6add029a2
MD5 1523b58414b16791ab584046728d56ed
SHA1 ac389ca019fe22bee7111e7951edba767b0b42c8
SHA512 6b76d1173b15719f83a156afe3dffb606487a76bf8e5e4ee989b69c460dbbddbda408b4ad9f6ebba32ad6a79de057da1e850c9a419ff6820b23f38d5f42a7436
SSDEEP 49152:G68Qg55nhheWu7PNU3/ihxSMmT8oWgBCaX:kthWRc/i+M4FHX
TLSH
T116B55933B2F600A9C44DE1769F4A873196D17C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4c29f6c9b118c13ea0d9e5bc36e057fe4c5e416bf927bff1671794f0b7e1dddf
MD5 50fe9cfd47c270835c5514cc27d7baf4
SHA1 2d8abb596ba8b6cdd027a0b0a7b0626e3746d5dd
SHA512 fba73a1e8da063c0cc0b13032a78832c9037860f8bcfc35b3bc6ec2b09abb6ba836af6f2d8105eebd45c7452a492aedbf60c966b84ceb84ca8f36fa90efca19e
SSDEEP 49152:63aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99n:ry5112gYy5azzVvL69nLKnhZF+M4FHX
TLSH
T1B7167B13F29900E8D05DD179878A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 3bb98465ad64423e9c218f46eb894d0691ac0573011e10a8b6d64283bbf7b49b
MD5 d7eb791f3aaf63de257e4116a936450c
SHA1 659446f5df2cae3223b7950fdddcc1b90a296125
SHA512 70c2fbe09a8d1460daefdad3f95098bc007f2ac20ae500d54124f32d4d0b5b1dae02c967852053c3a322c64bcc20ae9f3db02ce2073626bd951a19b2f9193f7b
SSDEEP 49152:vB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glGhxSMmT8oWgBCaX:Ru6JmVxd2dG+M4FHX
TLSH
T150D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6EF0A9073552E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 57d4385977da2589a6b5007fe6fb4469968f8fc7c094ba12a210097b5feaf859
MD5 a3f8555b8b3c2a4a5522922119cc5ec8
SHA1 a753a013ba05a7357c500b6b3e729e58b64c10d9
SHA512 2d86d0d1968a49079b2ace9e06c5751dfd5c023ad44e204d9b26538cb9092be5539088eeff527d103536cd5d31a24c15ee3a2fefb0627da20123bbb211bb453b
SSDEEP 49152:h1hpsNoJpF1A6UU44CwH7R4xMhxSMmT8oWgBCaXK:hmifPbR7+M4FHX
TLSH
T1ACB5BE13F2D900E8D06ED17887569632EA62BC450B34B6DF0A90B7962F7BEE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 8c0e1c4a808b6a6f8e356d6568f86c1f699b1f0b0f6b36c83e1368a95b673642
MD5 00ed7654f73ffb32b2c824fae54fd705
SHA1 979dda46713dce44fb0661af8851c4f7b6fb2eb1
SHA512 be7df80f119b7716a2a716847a7cbb34b0bb88abc51499dc952157114ad19e792ecf3b06e2ec6e1fddba0241f3444a1157dbcaf3069de0f77392578ba3eef5e2
SSDEEP 49152:HSuZQIY0Be2KRRVtOnks6NMHq5hxSMmT8oWgBCaX:d5dKTi615+M4FHX
TLSH
T1A1C5AE13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3da46026ce62df323e5e373f8a049ed4f0658a8da3c74b7b46145e7c4daaf129
MD5 b0077765d5de36c160dda3ab2d6c8e8e
SHA1 8ac87e58cbb4d3828e8421815a26755c6e9449b2
SHA512 8ff330df921d3abd8fe768e2b40b7733f1d7c485efec2de7a17e5cc8935f27a039c4b55417c346a079d2d7373ddd0dcd9812c372b6e6552d06c704653b635fae
SSDEEP 49152:GhtSn8EApI0figngiDn0AP5wQhxSMmT8oWgBCaX:HX2iyphX+M4FHX
TLSH
T19F95BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 79c6717b844bc4d415bb54951268bcd283be278abdb0031688083ad601dfc952
MD5 dce2340353a0f66530216fd5d8b1b308
SHA1 52267a7726767315942c2e37f8a4f7100c2142f2
SHA512 7d69ff7c742177f0a1584887f79b092260c1777df400556b116c251c6849132a5444d85e9a9ddabf2191f08e44fbcfc096d0a05e63c6265fc3ae1d34fb2414d8
SSDEEP 12288:3aJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:3qrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1DE652375AF0F94EBED2AC335E862071699DC0DDDF242163BAF3E2E683B31C5A1152611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 c2d9d04f7dc07f13bc2b71c02bd6f30edbcf20470c497965622f3ed9c0ae87ae
MD5 0f8bb8dac7e0ef65bef2855f24a0e6c7
SHA1 95491e84410a6f706bf2f709fcd300b364ad7f07
SHA512 a50f63cf539354723dadff5e09c0cdf3ee6b6009d3a9be1ae0d4f074b30dfb02e0ea168603fd06fa1b6ee3742fa4081121cf398a0653a59e9360c661d7a3921e
SSDEEP 12288:rRJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:rnrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1EB652375AF0F94EBED2AC335E8620716D99C0DDDF202163BAF3E2E683B31C5A1552611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 9b570667416be471a7fa1f463e5b82c72d7a84b7a53566d11ded8f0412be781f
MD5 d082f1386989fdb2ea4e58d8d48720a4
SHA1 73da034acbad362ddd57fd962fbb17a47835d816
SHA512 1d7670fb239a9f0b7995ecd5de7294bd1ab0614c24cce64b9db04eb8ca6959e6a97cf46f1f7b633af38220a0e56869b6c80b02ed06b4537bf2c5e404cb3aa946
SSDEEP 12288:HbJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:HdrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T18B652375AF0F94DBED2AC339E8620716D9DC0DDDF241263BAF3E2E683A31C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 ed8c437d218b355b77dfac74857d67a0dd7f122360bd9587898b3d85e4978e2c
MD5 51b8da561e30bda24cda2bf831912506
SHA1 2d9da3406feb942ee521ea3a36e58aae11e10821
SHA512 3b4bbaa8cbe2eb26185c655f1d815a9aa8bbfa914b30f83ad142640dc971d460739f8e0484946fe56cc8a0949ffbc8623934f8068f30a0a9e880182ee08871f6
SSDEEP 12288:0VcJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:hrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1536523656B0E50DBEC26C338D8724316D6F93CDCE322277F9F251E682E31A996931B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 b239924c6be8ffa244ed6aa39a1062aea8e81446e795b806c9bcd91b09054afd
MD5 6d48a7735bda7c0386d45bf85dc6ae07
SHA1 ccbd154e26a5670c4783adf9bf5dbf6bb966c3ac
SHA512 235cb129c5ccbc86ae7a2c4a95cb8ffbf5c8fa45b95b1c16da223b3f27135c0c2ced689aef9857f1cf0f2e8193e4220b0f079c1455da7827bc5c4d76d84a7450
SSDEEP 12288:8EJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:8wrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1FE652375AF0F949BED2AC335E8620716D9DC0DDDF202263BAF3E2E683B31C5A1152651
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 a82db55ad6f9e351cbfb8ec9e3d94baca4e4a3537662fbece1f080c0d6e6e397
MD5 772292d93f668807fc7cc86ea12f3c24
SHA1 2179e11e68f38c5b5d5beb411b21f610f03b1bc1
SHA512 a2379bb827aee72d6664a1f36168f71b9a5aa11c7e70e41963f68a870b9e728b1b61b40fe6d520c80fdc1e0c60cafa5745f5b11519948c1c21de4fabe2acb981
SSDEEP 12288:PlJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:P7rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1BF652375AF0F54EBED2AC335E8620716D99C0DDDF202163BAF3E2E683B31C5A1552621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 5b0fc689ac4946feb82718d9f4030e429592e91bbb0260ef0219621c98f8c7fa
MD5 bf903586e1638c14ed476fbc41b8c4bd
SHA1 ac1b82abaa300cad53cc44ef0f0c6105ebfcd223
SHA512 cc54f81658c06e3ae4724183b857886aac41ced4813ae50dfddfa0c22a2fd846ad98d78f0333ec925937fe3b37cf70a9847d638c0b2e1a3a75c83ecd7568deaa
SSDEEP 12288:k5JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:kvrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T160652375AF0F549BED2AC335E9620725D9DC0DDDF241163BAF3E2E683B35C1A2052621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 ed3bfdcc8a9fbb468ba56cf4b0fe5af5b79fdd0dda54991d6efc7a12b44cedde
MD5 77390f71bae5c44f7b57cc893f2b8836
SHA1 22c03f774cdc41b2f3b681ec1dbc3b62a5759bdb
SHA512 e474d9aeaa79db0e5a3174104230ae97c3710d43b5af4877a8d5c68f04662d96cca3b3a46a2880fc95639f9d3b404c123bb8a299c4c9288242cb879a0a4e8158
SSDEEP 24576:qZMEzFVSOHrKhxr+EHNmT8oW4ll1JCrLKXI:qZMEzf6hxSMmT8oWgBCaX
TLSH
T1688502A5B35018F9EC67823ECD618906D6F27C594760C61F07B8366A2F337A11C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 da261c49220da5bb97557cbbc5b17507a20493e744c1a6bca617382ae8485d43
MD5 1087c19dd60c02df9a853cf1a79e9541
SHA1 cff5f5dd9b359451327d35a9eedc9b3ad5f7666c
SHA512 dcc98c10d15df1b5d86dc97cf8aa70a5b522f8edff347f4b0a34fc37ec8a035f10e0cabbe5d83367920d767127073353a8f03fed09461e65492e8bb63b63bfcd
SSDEEP 12288:7mJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:7GrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T15C652375AF0F54DBED2A8339E8620716D9DC0DDDF242263BAF3E2E683B35C1A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 b2cece89f526f116aa287727b3e01f4583d7962e767cbe990b8a1c56e45cd942
MD5 e7614d3164f5361d8fd90874ac6f4e27
SHA1 19ae9d99fae213d1dc7dd481b5a014a27ab54e56
SHA512 4f799a48f5a5d273fc0a0264600bafda754575334fc7165f6f7f4e87c378708e87bf14936b76afab8aaedb7d468f4b3be76c790acc913b331e6d93b5f1c82a75
SSDEEP 12288:LyJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:LirKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1D5652375AF0F54DBED2AC335E9620716D99C0DDDF202263BAF3E2E683B35C1A1152221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 62ae6ab6c11031303e24e71c81944fdc5df184c0b89bba41893c46e840bba917
MD5 4815d5531938bc8d772296ed6d2de7d6
SHA1 ce32cdcc512c767a34e1c53d6814b8285c007c9c
SHA512 07bd9ba623d1ed1d8d386c518e3447724af2b03f61df0e6730f91d8c2cd9a2b747d510f15d3579361892a8dfc7acc098bb37963e1ea6521a6d0ab191b51a7edc
SSDEEP 12288:TyPz5L8dJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:ezyzrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1FD751217779630F9D5378238C8621A02F7B57C7953209BAF5B640B7A2F336915E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 0d451f4a291c30d64b74de737b23c4dae3768ba20aede965321ba8bfd6c37ea7
MD5 1faba48fb3f097942ddd97fa4c649aea
SHA1 27160d688f497f1f5064ad3e32358246a1d77efc
SHA512 f8ac0643e73b6455f3bbf308122fcbcfb7d9e42a8784a2427bbd1a1034740dbc2255aa4fcdb3653c1e0c0b645c860c6d5d46b4c122586f8938e16715abc175d1
SSDEEP 12288:xmJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:xGrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T14B652375AF0F54DBED2A8339E8620716D9DC0DDDF242263BAF3E2E683B35C1A1156211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 cfc46a5213ffc9a1e94eb1237b4eba52d23aa200601b8ac156d384c2658b1a53
MD5 284f2c56d54400e7bbcc0a9e65162749
SHA1 d82ec0619684ab9ecedb34f98e9b56aeafaf3631
SHA512 814064b07175844ee9a3aa8559d1e7e31746ea111c480807b4f0515be0fe667439a691c2618cfe84cd3ef9f64db6fc6b543827c6f4d2b93c0fec79669aaa7baa
SSDEEP 12288:UmJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:UGrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T104652375AF0F54DBED2A8339E9620716D9DC0DDDF242263BAF3E2E683B35C1A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 9a097ca4bde446140370964df01becb42f0a2ec40469ad394d0fc699aaa1a361
MD5 1b752804310fe12617ee87d1382c4a5d
SHA1 e2243cf5d59856d04306a2122c99cd857eba5f5f
SHA512 1efa904beded44df8840738d45dc56a40e7409fd9c1b0aa177f3f9429caa3b239a21c81edbb6e14f6a9ab1a3c37519b4dc2e1e3183cfbf4f9dd775a719d813da
SSDEEP 12288:7yPz5L8dJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:2zyzrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T139751217779630F9D5378238C8621A02F7B57C7953209BAF5B640B7A2F336915E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 e60e62b7fc38ef88adcd75b74f8e6a991b0b7a10026c074666d64af82b339216
MD5 1b53ff75e709d10a3476e5b64ccd60a6
SHA1 343a7a7630ecf49ab56e3cbf38036b69d44d5118
SHA512 1c689bfc17849514dd006eb09c08d5e35a7d898ec781f79fe2e233186f29713fda1a75cf6c1ee710b48e008c810ac98c62bafa291a81eb6021972280fc8767f6
SSDEEP 24576:RTdaLl3z0zDtrKhxr+EHNmT8oW4ll1JCrLKXI:RTwLljfhxSMmT8oWgBCaX
TLSH
T1228502A5B35018F9EC67823ECC628916D6F27C5A4760C61F07B8366A5F333A11C3EB56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 2641fe48a790de79334d301802bf07a5d18399697f37891ed93a21c6a95539ea
MD5 d810bbf27266d203dc25e2456019c191
SHA1 2523b3beaff1f619e78ac9498bb3e5fa6d11f29b
SHA512 880674e4d6304d99eb66c286766663298105033f52cbb1b8706322146c02d5058e35087d9e043e8e47bf44b70c5a9d7b824813ad97efb80d85875adbe2aa0cb4
SSDEEP 24576:Y35d9CHKy7GZBrKhxr+EHNmT8oW4ll1JCrLKXI:i5d9CHKya6hxSMmT8oWgBCaX
TLSH
T1E395CF90F3E414E9F0B78A35CD724511DAB67C995B21DE8F03A8265A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 68e9bee04d643f040a2e3e38da00936d22ed6fc598e1a9bf31ebe63b75736c30
MD5 df3a5ac05f372876f1c863c6a38b9d8e
SHA1 58fa779ddec43c287d2e7c54859b2d2d64d84157
SHA512 d318b3e9192028e3305fabafc591cb9a0071320f7140e4e3edcbca71fcf4708aaa96515b1c5f6d0ce0b0571f403fe5bf1933e26afcf28b9a2c3cca7ef26edc67
SSDEEP 12288:w7JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:w9rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1B0652375AF0F949BED2A8339E8620716D9DC0DDDF241263BAF3E2E683B31C5A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 0b9b922dcd5f8b98a009650eaf10ab23cf6c02840ba4464c61103e302aee14c5
MD5 6776d0837b887e7e7abf671430732efd
SHA1 8f0ef8a745f8bf8ac7352b303cc658631468a6c4
SHA512 69fa7504f9f961e1891d810814ae5cde1ff661b8548a6edfbe0b5a439e92bac8fc44d7a0f20b419505deb74c43627cc00a5eff5c0bceec4e613cac28a00bcff2
SSDEEP 12288:e9JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:eTrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1B3652375AF0F54EBED2AC339E862471699DC0DDCF142163BAF3E2E683B35C1A1552221
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 a9e7a0129790c96312d55c763db85871db00cce6deed879351886d471cc2d1c4
MD5 94d52122bfd2bbbcc5f6debdf863676c
SHA1 3090ca86132b68e1a485fe1dd48d7085114436be
SHA512 99bb4b77d3a093fb0f769bf209e7595a2fbbd274095cc77dec92846abf8ac07f68a4908c85633d3940b96d93c5aa5325a08b332cc7ef4923a368f152ac525753
SSDEEP 12288:l4JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:lUrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T143652375AF0F549BED2A8339E9620716D9DC0DDDF242263BAF3E2E683B35C1A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 dbe76901dd13ee1b63a07eed771d06c7abb2c108f8590b490c195ea690667356
MD5 fb728d20d10d4cc69807480502829985
SHA1 c351a6c9be96b4d4fe4b0d7823f3037138965a40
SHA512 1f0728b9dcc2c750f172d77b6705925f6df659823ebd55701d6eb09b7501d222311b5870be88a2726fc4e453d3b4ce5c7aa41e7f655dd4d8c9a6d4c3b381aa7b
SSDEEP 12288:jmJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:jGrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1BB652375AF0F54DBED2A8339E862071699DC0DDDF242263BEF3E2E683B35C1A1152211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 e84a205f1c82ca7bbe949fb3aa335d47e3678346d78749a5b46d9e608778e6ab
MD5 c22827a4452145ada9ca83303c87c1b7
SHA1 9c1a2a0c2c4ceb0adf1ee8ec0c38347e42a0034d
SHA512 9cbc6bf053d68884c76709a6bb3effe5dbba342ec6d79741b2e0b956cd8011fca540aaf34ef35dbf7ef36e9edb36beb86f44a894eaadf136c0e3d26d9df75692
SSDEEP 12288:y7JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:y9rKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T107652375AF0F94DBED2A8335E8620716D9DC0DDDF241263BAF3E2E683B31C5A1152251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 53db7f9bbfbdee9305c8196621a45539098a92869b953900a0db7c0e45651299
MD5 611c0f3d3a4eadf047ef33934c70478c
SHA1 27be77446c461db63f847783c92b24f6be50115e
SHA512 3eb72faec0969bd0ea4943440682714005e1c1b7d72681e709eb6cbc8346158b11da6bb6fd6fa45032ff16ac2ec0435e2a76c371cdaeff8a4429cbea6e3b522c
SSDEEP 24576:xfwv+k9RX6wkyAIorKhxr+EHNmT8oW4ll1JCrLKXI:BMnYIbhxSMmT8oWgBCaX
TLSH
T11A95DF29EBDC44E5E177923C99B3460AF6B178691B31C6CF026A53AD0E33ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1ffcbe5df4e94f41c50a48f7bb31b62cd33109faa4c3e1f8009ea8d19808190c
MD5 06953f043075fce4e3a0dde9f9b2d29d
SHA1 e6c53a331be3e9eb458c62dcecb87104b5688a9a
SHA512 01b4387fc975c8252af729e409b473f7e7b0713cf31157a217f64467a24b851fbf94c02629d6cc6e80a83a31241a084fdd21a0a9febabfa6e23763a56e02489c
SSDEEP 49152:cYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK02hxSMmT8oWgB3:CySzPu+M4FHX
TLSH
T1F1066C96A16801D5C1B9C1B98F1BCC1BFAB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 6c0bcf3288be6c41e37d6c2d472fb91f9060628703a93e87e431e1d896114d29
MD5 4a9a4c42442917c611e4274d336fc5ca
SHA1 e37d2ead750f8380e6fe2c4b671d16aee8e9eef1
SHA512 b4b14f03a982348da146533778cb8cdcc57587c45a2fa3474741b66b3aea0e87311944e239e11294716b5cc101a9efb6a288aec64a78dbb5d7c6f1bba8e0b3fd
SSDEEP 24576:T47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY5rKhxr+EHNmT8oW4ll1JCrLKXI:T47JUQj1irIhCnDHUPfF/GhxSMmT8oWM
TLSH
T15E65AE1EA3EC01E5E1BAD23885154A1AEA71782E5B31DACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 7888beffe7774413831b7e2e4e39cbdc2510857ea97b1dc0ca40b5a9728dfb39
MD5 d4905c4bf0e3a558d8a6c9315bf010fe
SHA1 cd3aefe74b88fd00f56bbb3eee192c2d4f13f1f4
SHA512 1f89192547ffc51258bb485cc6bbae45452e55ba1fada607e723437eb49afe19b6f6e15b4d6145507caf65cb27702b775c29a092f8435d76ba3a578d098e1cc1
SSDEEP 12288:FzsfWJuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:cWrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T16675F119D24801E9C46E9239CB524A01F7773C6993E193CB5BE0FA3D2F36A945DEA703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 2fcddac7e7408821ce190eba45d4cb125e99ba4f342286b9a512581395e1cfcb
MD5 9d4b39eeb6e909ae92d1411f9046afc4
SHA1 416cb192ea3d52fee34f3139be6d7bc7ef23f1d7
SHA512 1ed9383e073b95001cee2f05b47203379cfe09b84f3d12b38cd9d83f4184aef83288969c2deeaadb3b2cf79fe10e516b24f11e8f9ee6bf1310af64536c880dec
SSDEEP 12288:EcoCpBqd9kt56FMeXYgT7IOfP/aRMNUjJnX8:E0pu9kqXYg7IOX/aRMN4JnX
TLSH
T1944517507666CB4FC66940325E32D2CCAB707D41EE446F0373C98B3F9576A59BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 713c5fe89f4d9b44816c7cc5a8afcd5111aa062831793fb21da8ddafd935e549
MD5 fae6f33a953d465b64e3077bf3fdfa2f
SHA1 5f30b154a695fa4281720b00e8bcbd46841fdc65
SHA512 9fa2d4752ed97403463c3288d156cc3d1e2ed4405b602f9b6ba3c92714fd934c160e862f58e3b92d6335a86a8f25cd16c5d812e5a5a1146abeba1047b9490b54
SSDEEP 12288:9Vq2b4ZnnvYZWvzxp4XMhZgW76+G8Ib3rg6fc1C8pBNHWTrWmWVcG:SnvYPYZfs8dHWTrlWiG
TLSH
T1A57519416537A78FD1BB603203365B8DBB64EC03B70A5F267389057AD86AB45B0F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 1b506046deead7d884ed414c90e9a169aa2065fbabc41257b9a8c4b31dd1c3c3
MD5 0a843d1c7dff3e524a512ad9cb4466e9
SHA1 e87d31cb242fd5942856cc3357be501984cb520b
SHA512 9d2d04dab3bc7d5ed5a589f83e44be969c51302c3ca902d5a963d0a6fba50ac1a5640ad206be70178111a7577e0c74ae17fc12cb692e88a1436d6f9cf7d1d885
SSDEEP 12288:1O74JuGf0Dkutc0r+MLzHNnfgnFxbbyVPJGWqvll2yJ2btlLKX5CX:IUrKhxr+EHNmT8oW4ll1JCrLKXI
TLSH
T1DD6523719B0E989BFC3A8334E8674321565D2DACD30055FBEF292BA87931CC55D72712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ad6f4c049790cd999044b2efad525272627af5f16fe615a7be29478b73fa69cb
MD5 1b0d5c5c0b67973aacb5cef6edab7ccf
SHA1 120dd6cd7f7d6d863ec2774f73795ae6a63a6688
SHA512 86711051b0b759dc7c7728d4208a60212b0fddc95afbd4e6bb506cf3b60a3062b4cf09f4addd6e491036210e49ab38f9a048662ca868998e3767e16e32a935e5
SSDEEP 24576:Cgb6bmBIi49WNNFpg1rSvFv7bYGrKhxr+EHNmT8oW4ll1JCrLKXI:Cgb4mBIBhGFAhxSMmT8oWgBCaX
TLSH
T1F9659E1E22EC02F5E0FAD2B8DDA64417D6B278161331D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 45e130f7f6834306c34bd4b3991b330148a443728cfc8f3491d24a61d72816fb
MD5 28f96ada97098a2a2b9ab355da0353a9
SHA1 c0ae2eb4cf9f0b6c036cf5229028bc8137bba2f4
SHA512 226dcd5f439dc0619d4a8d09fef8c90efe59ae5d6467ebf2133f371d676c690e5f66f44747f90dfd32943023dea60b93fda85d57791fcca042a02130e134a2b4
SSDEEP 24576:lG88u8FpJqH1hzria7/mJrKhxr+EHNmT8oW4ll1JCrLKXI:I7ZFPqVoa7/RhxSMmT8oWgBCaX
TLSH
T19E95F16567E101F1D47BD138C9824663F6B2B8251360EBDF0BAC8B551F23AE50B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 f7a0bb387e3f0e96f934d913a532951c2f24610ac16724fd89916a769fa96b6b
MD5 2712bce1477a8398dd48a1691f5c2ac8
SHA1 34d15c6d69dd094d00baecaab652bc057977ea1e
SHA512 5760888414365b775774521792419dafd49bb7436b9259d875744b478f080727d2a0c4440c0c4d7b590f7aced699a4b62625f80dafb77ad1afe9ccb13a3482e8
SSDEEP 24576:8PUr+NQ9rKhxr+EHNmT8oW4ll1JCrLKXI:8JQEhxSMmT8oWgBCaX
TLSH
T10B85F12F269D18E5E67AE13DC9824719F7717866131292DF02A1817E5F33DE8BC3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c74fa0675c45aacbce91f247623a5cbdc5123778bc63c00c0fac4cc49ca4afbb
MD5 4f06949b5fc2757f1f8af7f8835e1a29
SHA1 0e9a30d144d0af5895dfa34d2b432e1323f814ed
SHA512 3c42d0896c1fad511813e7d24112e9374e3f6bafdad8e419dbb3be36b2b176afde93c1f88738e556e3633c67f4e1c039530d5b854c7e4d9d8d1a37a5dfe5be65
SSDEEP 49152:SBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj0hxSMmT8oWgBCaX:dG05lO43bD+M4FHX
TLSH
T1FED5CF6E62EC11F9D1BBC17CD9C64A0BEBB23815032556CF02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 e5eb0ef24c0c8344900759bf556d26be326e4e1025f33c985bcf3e42fa8cea35
MD5 4bceb041dac8993a164e5d1b84e0b96a
SHA1 750cd4f471959613f107e483ca4f0d103f586ab8
SHA512 49475702e2a58b4b73d03f4e5dd9f92a237d52f23e70ff1570dc3f4495994dd49000f5998b06369a6351d254d1a80271de969c0637a8adbc4f8f057ad50b9048
SSDEEP 24576:Ifa5POZ3dpFWVM50JicR2hG0lasx2+47eidn3rKhxr+EHNmT8oW4ll1JCrLKXI:wa5POZ3+Jt2pasx2+mshxSMmT8oWgBC8
TLSH
T18E65AE5EA7FC00D5D579D17DC583861AE5B1342653329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 746b970b73d012a8f726ba5d4f9a9f784e5572bda7cab1d73255d72c8b23851a
MD5 cff159e9077fce14f02472f7136ed171
SHA1 0ea9d5d0dc9ff03d1fe4602ec3a275d35b7dab5e
SHA512 073cf333a1b88a74a10ab670ebdd88c197de26dc9513beadfffeab6053677fa429802e3fbac7c7dade1088a229d94536356f198ab7714b5324830551741a746c
SSDEEP 24576:aNcwHdjbyQ4nLC18lb/EOjowL7FkBrKhxr+EHNmT8oW4ll1JCrLKXI:aNc/zEOVHFxhxSMmT8oWgBCaX
TLSH
T155858B2623E900E4F5BBE1BE89779546FA717869533086CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 9ce866a31996d28a4f776ca1b162561de58618daf42266aa5aa92176a4e6beba
MD5 7ebac07b2879f3da9bd2a64b7c11b910
SHA1 b1f01644f3180d5bab54f50c5b17f52ec646abd4
SHA512 410492de0f5eaf081911b9a52048ed132cfa83f723f9277b810c8b66b200288612af56d832debc3c6b733c6fcab1e4db999ebfcad9c34fd3478e2e3cec3bdd60
SSDEEP 24576:66DIVlZBr5p3CsztyXRsy/GAwA2MhZnEV71XLL/d:66DILZt5TkFyAnh1EVRh
TLSH
T1C925011D73BB10B5D16BD03DC6920546D1B3B03187926AEF0688C6B95F93ED9BA3CB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 d2e064ce512155e97c0163f4026e8d973fa1c300110b352b01773a7027113b67
MD5 7323c2cbd1ae4eb0ba5cb709623c491f
SHA1 cd5968ddb354a8bf590a2f7f7856d484a906020a
SHA512 50eaad4dc6700a2c5a88e3854db1a11867f29cd45414760e8c8508cfd1cca24bf19354225e488de1b0d4cfce1777ccd959e80d0a9d9a8ec981df462d05730459
SSDEEP 24576:+8kNvNnaFeYhJNtmZBmDrKhxr+EHNmT8oW4ll1JCrLKXI:+8MwBtOmyhxSMmT8oWgBCaX
TLSH
T15B55AF6EBAB845E4D1FEC674CD238512EA727861133293CB5390C13E1E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 e039f4912cc867c64eff61b2c1d272314a1af58939ad96c7d3e6bd13dc88efb2
MD5 b11620c6f0471f45100bb98712711c98
SHA1 3903e52aaf3a0396baf03902b296c11a43edc073
SHA512 c386fc87636fb2b503dd11b7bd617bfa16f7b3401397bbac15212cd5d123da4961e86c9c2149e8c0e2444d911f654327d660a21b94591956191fa93b9cbdf2df
SSDEEP 24576:hD3FHshBIYQgAgrKhxr+EHNmT8oW4ll1JCrLKXI:hDVHeBIAAThxSMmT8oWgBCaX
TLSH
T17895E17DEB5C04E4E57BC17CDA638A06E77138AD032266DB069481B91F6BEE42D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/720-151-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/720-150-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/720-157-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/720-347-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1524-62-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1524-68-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/1524-61-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/1524-325-0x0000000140000000-0x00000001401AF000-memory.dmp

Download

memory/1856-85-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/1856-340-0x0000000000400000-0x0000000000577000-memory.dmp

Download

memory/2068-341-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2068-95-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2068-361-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2068-363-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2068-89-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2068-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2296-144-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/2296-146-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2296-135-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/2296-141-0x0000000000B50000-0x0000000000BB0000-memory.dmp

Download

memory/2296-134-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2992-81-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2992-75-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/2992-74-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/2992-337-0x0000000140000000-0x00000001401AB000-memory.dmp

Download

memory/3140-118-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/3140-125-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3140-343-0x0000000140000000-0x000000014021E000-memory.dmp

Download

memory/3140-119-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/3488-342-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3488-344-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3488-346-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3488-107-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3488-109-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3488-101-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/3996-29-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/3996-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3996-21-0x0000000000E10000-0x0000000000E70000-memory.dmp

Download

memory/3996-100-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4924-42-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4924-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4924-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4924-133-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5068-52-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/5068-57-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/5068-59-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5068-53-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/5068-46-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/5068-45-0x0000000140000000-0x00000001401B5000-memory.dmp

Download

memory/5304-358-0x0000024304A40000-0x0000024304C0A000-memory.dmp

Download

memory/5632-164-0x0000000003F50000-0x0000000003FB7000-memory.dmp

Download

memory/5632-0-0x0000000000400000-0x00000000006E8000-memory.dmp

Download

memory/5632-72-0x0000000000400000-0x00000000006E8000-memory.dmp

Download

memory/5632-159-0x0000000003F50000-0x0000000003FB7000-memory.dmp

Download

memory/5632-175-0x0000000000400000-0x00000000006E8000-memory.dmp

Download

memory/5632-14-0x0000000002E20000-0x0000000002EA5000-memory.dmp

Download

memory/5632-7-0x00000000008F0000-0x0000000000957000-memory.dmp

Download

memory/5632-9-0x0000000002E20000-0x0000000002EA5000-memory.dmp

Download

memory/5632-1-0x00000000008F0000-0x0000000000957000-memory.dmp

Download

memory/5632-6-0x00000000008F0000-0x0000000000957000-memory.dmp

Download