1264bffe2390eb24ff5dbc65f2f8a96e3616c77c596bb9b96178317d84168873

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 00:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
Size 3.0MB
Sample261030-a1pgwsch65
SHA256 1264bffe2390eb24ff5dbc65f2f8a96e3616c77c596bb9b96178317d84168873
MD5 848a878a7a933ffa3fa67ec77ead95fc
SHA1 8792ad42ef0be073add6ba60f1c4c19beb39984b
SHA512 89593cd867708e3078141ff5ed03c8cf82ba86f8f005423a080d3fb7c99dcbfef6da21175516a92cfb1bf9da6f6da934de6d4ed416a600559666d78fe147a16f
SSDEEP 49152:ZQv8Wxr7u2guTjfmF6JYTiGDmXarSj8RoTCC6TjfmF6JYTiGDm:9Wxr7uSjS6J0i6mXJTIjS6J0i6m
TLSH
T147E51211FB84E032C26331741B66EBB9296DBDB05B26968377D43E7E2D301C05A3DB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer upx

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1348	elevation_service.exe
3580	elevation_service.exe
4964	maintenanceservice.exe
3776	OSE.EXE
1400	PerceptionSimulationService.exe
2848	perfhost.exe
1760	ReFsDedupSvc.exe
1676	SensorDataService.exe
4120	ssh-agent.exe
5848	AgentService.exe
4512	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\8b0f50d7c17a6531.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00010000000093ab-128.dat	upx
behavioral2/files/0x0001000000009952-129.dat	upx
behavioral2/files/0x000100000000932b-127.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10560 = "Compressed Archive Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a5cadd5e0768dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001bd9d15e0768dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000a35da85f0768dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000776629600768dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cd84d15f0768dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ffdaa35f0768dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006f6f75a00768dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004e1cf05e0768dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1348	elevation_service.exe
1348	elevation_service.exe
1348	elevation_service.exe
1348	elevation_service.exe
1348	elevation_service.exe
1348	elevation_service.exe
1348	elevation_service.exe
3580	elevation_service.exe
3580	elevation_service.exe
3580	elevation_service.exe
3580	elevation_service.exe
3580	elevation_service.exe
3580	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5332	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
Token: SeTakeOwnershipPrivilege	1348	elevation_service.exe
Token: SeAssignPrimaryTokenPrivilege	5848	AgentService.exe
Token: 33	4512	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4512	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4512	SearchIndexer.exe
Token: SeBackupPrivilege	1760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1760	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1760	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1760	ReFsDedupSvc.exe
Token: SeDebugPrivilege	1348	elevation_service.exe
Token: SeDebugPrivilege	3580	elevation_service.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5332	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
5332	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
5332	2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 4724	4512	SearchIndexer.exe	99
PID 4512 wrote to memory of 4756	4512	SearchIndexer.exe	100
PID 4512 wrote to memory of 5372	4512	SearchIndexer.exe	101
PID 4512 wrote to memory of 6100	4512	SearchIndexer.exe	102
PID 4512 wrote to memory of 4708	4512	SearchIndexer.exe	106
PID 4512 wrote to memory of 2360	4512	SearchIndexer.exe	107
PID 4512 wrote to memory of 5464	4512	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_848a878a7a933ffa3fa67ec77ead95fc_amadey_darkgate_elex_remcos_smoke-loader_stealc_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5332

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1348

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3580

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4964

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3776

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1400

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2848

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1760

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1676

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4120

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5848

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4724
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4756
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5372
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2988 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6100
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4708
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2360
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2988 3020 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 00a2c38d3efa0715baa96ad7ade9cb7fa22fc5c9db08d0e8b3e17e62bace9bc4
MD5 2ee71c8e93a4c8ba3f4e00305cfc8e45
SHA1 afc9fb64ffc67f6dfecf5439c1dcc9ab4ca8fc35
SHA512 c45715eb0f2d4f65d06ebfa8717b834f35eea3c9d71eeafac2498f6c29875fe79ddcfa587b40aaf98e891340aa22b3a0808f982550dbaad7c21d2b83df3ace42
SSDEEP 49152:yb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnJTjfmF6JYTiGDm:U3q6HjBojS6J0i6m
TLSH
T180D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 1154e5fd0afdc4d39fada465138c5ec5d7368f844827aa1a8a9eeea881fd78ea
MD5 4857e174dcb3e35fba1cf82fc1377b65
SHA1 8c1c662859e9cf9fb5ab8e26d47aff2d87d17cf1
SHA512 6cbbfc2051cff370546f3330ab908ed3b83d7873d3fe87902fc52ebc39f3f7c00c68d3d970f68a167d04e10c72d2230b0849c01946dcc131eed25b9bb522def4
SSDEEP 24576:5XYfDtczAavrjfnmUWpEJcvTiGdtmOyggm:8tcLTjfmF6JYTiGDm
TLSH
T16065F124B7E548F9ED67813DC8A28511EA3378904760E7CB03E4996A5F333C85E3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 63b3b8744fc7acc78f9af12ef038451130b98dd1626d9047bc85724307e4f13e
MD5 a734241793d82762995df2a78822486c
SHA1 5c8ae9e15de13fab613c43cdf3870717779e22f8
SHA512 ad9bab848918d195a6f62f391242337654be5c6d49b8edf844c8548b33a492f3ba914ce1406a5acaf3c9b732d700580edfc7e1e51ea0c65e986bfc3ce08c4384
SSDEEP 24576:J0Le5ji0hmxirMevrjfnmUWpEJcvTiGdtmOyggm:JPji0AcjTjfmF6JYTiGDm
TLSH
T135859E16F6748331D073C0B9C5D2A69AED7230815B308ACB4296D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b8ad9b06ea9c940c03ab98629ab99309f0398a89e465552ab8724cb3259d2193
MD5 3ea7162efe86131ae76d3ac4ba2e7727
SHA1 29e4c0b92d1aa1d635994b4576e992e12442d993
SHA512 45855ec11c1afd06603945a3bed8419faca96994a42dbe73e5da57e38d20301dd51ecbf455d3ff73516b1fafe75fd5fe1b6e029da0c0ce45a51073ea3b565198
SSDEEP 24576:Da7/ezSC6vUyD/aqgrvWE6q8wyuIvrjfnmUWpEJcvTiGdtmOygg0:u/ezSC6vUzPvxHjy3TjfmF6JYTiGDm
TLSH
T13F755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 fcc2f78b934682453a717e79da8959e9523977a60f1b36b95ec94f2fefffd380
MD5 7badb1e63c188c2afc985044c7498bb3
SHA1 758cc03035b01609828f982afbdb5ae08d7c4e35
SHA512 1153b15b78d05b17de7758603081333c859edc87001650a7ef351cd8c4ee6ce904c24f8bb1ac038692fa0865c45d03083ab1c4563d4e69b13fc6396efdb4ba26
SSDEEP 24576:YVbqPb88hv/l+6pvrjfnmUWpEJcvTiGdtmOygg6:YVO88hXl+STjfmF6JYTiGDm
TLSH
T1EA559E66F5B48331D073C0BAC5D2AA9AEE3234414B31CACB1246D76C2E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 7fdb3051830b426252dd91ce771015da226d369f86f2dc239ea1ebc0c50c2665
MD5 71845d887d3e377f4c0e21095a2e430f
SHA1 ae8c274088686c8db010af92a6886280366ee94e
SHA512 df1dc76793551a9265ccea9e19872ae35448fb04c08418f11a893a9bdad96a29840ab10c215ee3856da7ffcbef935f1d4df52651431cf87af6795f9eb6b5d9fb
SSDEEP 12288:hRaFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hci:hRavrjfnmUWpEJcvTiGdtmOyggF
TLSH
T1E2452341DCAAF512D7A720353992AD451D699CE04963D9C02AE83E6E943C2C8C7DFECF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 584949be73e0e7de33031efbca79fbcb905bd39a3e45995e679f80d8b332e0f5
MD5 a14ec1c375a47f067aff8a2c75f4ae2b
SHA1 76e0386f4a23179054cbb44db90488d754f922fa
SHA512 ae09e9d72eb00b1dbf1931830ebfcafd0124f84da913df635b99b9abc75355056e018d0e69aee4bbdcb7e2a815977b518377f001fd97ac45b1ee0c6a8a61c533
SSDEEP 12288:veBNUbTVO86UhFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5ht:vJIUhvrjfnmUWpEJcvTiGdtmOyggV
TLSH
T11765CF3BEE28FCD2C27A9D795A91C600977278704F62A3CBD174820EDE235D45E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e87155c4e69b68fe4ef3639b23b2625dcc599afcb22f9f4e9100042ec7c7ba73
MD5 cfd9ce48e81da83ab01ee205fa40209d
SHA1 e89387eae58e37a745c5372ebe50d2909898f20a
SHA512 6e66df5b32bbfc43b7428c154108e62517ccecb3b762327cc4441945e7c782bd1a9797fdbd7222f7dabb8f0471c1af2d7983d0c4522994ba23b6d9514ce87783
SSDEEP 49152:hQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH9:hQvGAdlCEL8c/yRNw5CSjS6J0i6m
TLSH
T172267C656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 d9d57895e7fbb122a7eb5cc9eaaf59a2b393201081fe90e875f18b8a8f1536b3
MD5 a034a8323d38ee2c34a660c30eccec58
SHA1 8e6a6dc23cf1cac8bec15c72e84888cad7d464c8
SHA512 9d79fac358109f34e8d4f6717f9b367695e9c1261dc705d2b8c3d1f8603e736891fc26f4ae548d06cb092e7c2c56f0637b51cebec0ffac2ef3a1dfbcb535f1f5
SSDEEP 24576:mdewsAjTvrjfnmUWpEJcvTiGdtmOyggk:OljTTjfmF6JYTiGDm
TLSH
T1B575E031FE75E032C3BB0DB61B26C716182D79604B6219C3E3E85E9E59342D22776E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f9a762716547d654b0d14d0a6b00b7d44beafdcab682475c3d2af5c0003bf7eb
MD5 7936dd94c3ae1d2f32dee1c7d08ebc8d
SHA1 b51f21321e123ce2ecfb7ad6028afe3ef1ca13ac
SHA512 1f477eb5b2d735e6926ffe5a58b2dc0997922a4e589638d6132dc95aff55dcc66718612b39aca46881111308d2db43d7651e63e9ab18b50e8179e99a53c37e91
SSDEEP 196608:oUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHKdm:oUEtQevvqc2W1cpV2EI32G
TLSH
T127474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 994231e71d7645f558f38ea57da166c1a97333617e6f4a17ca2609f36b5d2919
MD5 7cd6ed2e57584318c92b34dc07c7d128
SHA1 b16cd8763ca07f0aa1897257ca551ba19857e6e4
SHA512 86a58440642805d6efab8b76458cffd56252fbb7df0820dfb86fb78e9bf5cd5d8c8b4eef211bf1f9f5467f68159f6b5de51055366d7c51f5540974dd4674af4f
SSDEEP 49152:UCbRquA/m2yL5zQfFiV+XenmE3/zzTjfmF6JYTiGDm:9oqtVjnmejS6J0i6m
TLSH
T15AD58D0976B8C2E4D1F6C37896A2C647F37178154B31ABEF4265461E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 bb9d2d33449a23d2a05bc1cbedf4df0c68673e1cdb0c1a22473368b8bc22bee0
MD5 003b9a18de5425eb1fddfe597b2e6613
SHA1 6dde98ae884ac9cac4e97b1a43d158005340fcf5
SHA512 bd06486134a0309f192497bf7a6cff9999078914fc5adf04e56066100c1f7d0308d7e508095bd3e1d2123f7e62008283e66ba232dd3dfbf8bbc09a938ec0c8e9
SSDEEP 24576:vAhGLJIFoiwtA5l7S538vrjfnmUWpEJcvTiGdtmOyggk:vAMyFoiq5MTjfmF6JYTiGDm
TLSH
T14035AD80EBF955D4F5B3AA7899B69570EA76BCA55E31C20F2160D11F0E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 2db2d03091bb8fe7a5061e9a11daaf5267a119dd3c5174124ac6de54c5ee6563
MD5 194eb60aa9c1987584bc60cc6d736068
SHA1 f2de58db8534553397239742e6a45ce837e9adb5
SHA512 a530053c857a53f38c28860ff2ca9ccf3bab3c774aa3d28b133c9cefd27652dee060ecdc0d9e2ca086516404a8c5da3b640bf888179fe7f7139507d8d096321a
SSDEEP 12288:Gmw5HEjsChNVBFgl0WDm+C7FFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWE:fwuoOWMvrjfnmUWpEJcvTiGdtmOyggq
TLSH
T14B65F14676A81CF9EAA741388553C536F7B2BC112A21DB1F17A0C65F5F37350AE2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 62f1e356a14d1642656d6b60a5cfef0fa41f505ddba075d832bd5795cacb2901
MD5 669d258d8611f79d96fa30742201172b
SHA1 252e531446a796986c1e906c835a1e5b60047a37
SHA512 c71e4b7e709fe086638a9a7dc0f9bae69d44baef6e7a98b31d570af382b48c98059a62ea20ea07565973d011318be07f3ceb82d0419089aa638d0e10d18cac41
SSDEEP 12288:uBZ1IyDFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hcQ:oZuWvrjfnmUWpEJcvTiGdtmOyggf
TLSH
T1BA5512453AE870B6D3A3513C9DE15A05DB7278A01732C3CF16A4266E5F36AC54F3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 a2e9f8ce2d1537db799bc292179eccaf893814bee7139625c38739d1f89a1fda
MD5 9d1d33b2a924ff8c70090a7bdd7bc32c
SHA1 ec1d2cffb22676ba03c7c6e0a08c6daa49022a59
SHA512 acedc21828e31f4337b58786c649df378aae4d2d60c87d717125b26502dbd2bae1b4158732734d987d2aa8891b02840e9fec9ab002f56d64c2708b0e3d48525d
SSDEEP 98304:NQRQyi36YOcPQLvw2gAf+PN3pjS6J0i6m:kQyiKayX+PN4dm
TLSH
T172667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 895acc4172ba39f95f16cea1dcf95ac0c8f8beb3c210a4475c66a9155be12c1f
MD5 6e7f8a60a32ae2cf17f521a04e064a72
SHA1 20a430f362a66850591dab7876f18e7f21972048
SHA512 b584567f828e3ee6c1bd3f7e7b9ad63a0b2907bf3e443e40f3339574a40e48e790e14519257aaece7b81b5de49e53e532d99e4d96ce835034de9b68fc49338f4
SSDEEP 98304:9QRQyi36YOcPQLvw2gAf+PN3pjS6J0i6m:0QyiKayX+PN4dm
TLSH
T18D667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 818fce039898567e887fb649787ca4eaae76c14a49df381ebd2abc2e99c39c34
MD5 205af231b5bb67171d973466b1673535
SHA1 2c0c62d1374271f5b539a68fc03651197bd480a8
SHA512 d0373129d3f53516f1a867266b14ee5decf2f8aa73552bf5d5871f4f958bab68666753458c557118eb94ddb8d248238f1d8710e5b14c7fe8a92c3d7607780978
SSDEEP 49152:R68Qg55nhheWu7PNU3/jTjfmF6JYTiGDm:PthWRc/HjS6J0i6m
TLSH
T175B55A33B2F600A9C44DE1769F46873196D27C718FE1E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 6cf9d049a0d5358901bceda5a451c9d95bd6f465d1b3a0db379c10dac8da1e49
MD5 465a68b3864014107282efd1dc9c42a0
SHA1 b3deb0d30c9d072cdf9672e4ec9d040d8895cda1
SHA512 68cf6510afaae97b64f43a683f378473e9cbddbcba73c034c65f1ca81b66d11106e1aa6109a6d3568ac9119f654df7d6a9ad20316916e0f297521db776b098bc
SSDEEP 98304:Jy5112gYy5azzVvL69nLKnhZcjS6J0i6m:kLIHmWhpdm
TLSH
T1EF167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 1fcbcff4d2a5399d9472740f96e141089a94144717316d3e4e858711949c1c2b
MD5 f4be54ad354d229f3dee4e0b741c0599
SHA1 de2cece52f81f85f5d8f2ccd40c57707d91ddb6a
SHA512 133fcb7c1f6d9456bd7ea6abbbe9605f3c6686ed3f260e2171386f0a984ebcbb5c7ec8c1ab1d0421a4f4f13f3c3eff99e9b0fb9b11b4d8b91fea3205e29c4219
SSDEEP 49152:uB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glKTjfmF6JYTiGDm:8u6JmVxd2dMjS6J0i6m
TLSH
T10BD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 82c79bedc962a1c5e8bd0407a4ebd84b0df99c843f84eb3f1977f543532a5627
MD5 68237c922ce5afcc451396f749fa2890
SHA1 da298cbcbb924925409585ae37787f7b81c19ede
SHA512 d47296dbbc9db34b4d5e0172893cf2ef2f57a684867458c966187fa877bd63d99a57144cca2ecaf4834f1b6261a95c542604c1daf85dcb068a977d23f8de1ee3
SSDEEP 49152:w1hpsNoJpF1A6UU44CwH7R4xBTjfmF6JYTiGDm:wmifPbRejS6J0i6m
TLSH
T191B5BE13F2D900E8D06ED17887569632EA62BC450B31B6DF0A90B7961F7BBE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e090a2170b514984ba5f0d4e397894885e285a45f78c121703651a59ba5226a0
MD5 111dff1db9161209149d01515ea2d9eb
SHA1 0b7847a09aa437c5eded7233a318fbddcf0d6784
SHA512 907ca334e7a63bfec3507f96e54e5eede041fca046492489b29af69f0cc92f1f54ffb4e250a5f94296d70832476cfe65c82dd3653f3b1fca42573d0affc03ec2
SSDEEP 49152:mSuZQIY0Be2KRRVtOnks6NMHqWTjfmF6JYTiGDm:o5dKTi61AjS6J0i6m
TLSH
T182C5BF03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 d9e1586335c9d4007864ba84a002a2d78e6df3f2b76880a6b85731a993dfd823
MD5 6cae289e71f75d18124a6848c6502e08
SHA1 567e03602f8b661c111271903f22a6e1ce1e1446
SHA512 2ac7e90ff886f9cf8bedb1ccf6715eea7b177dcc421e1c65711d526508c510c694250283fafdf8e09ae6d9057cb1e377d14e973d5ca873ad935c8883748c4d0c
SSDEEP 49152:jhtSn8EApI0figngiDn0AP5wdTjfmF6JYTiGDm:CX2iyph6jS6J0i6m
TLSH
T10695BE13F2D900E8D05ED178C7468632EA62BC150B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b27dd96615ab5cd092803953ef04630164e2233d9ef95a41c30c6669937431b4
MD5 3bd46c01f2b7958595a16f946871c9ec
SHA1 f10b9b5a45ab29f7b4a7bb76f9f5465b12a80a22
SHA512 202242509e92e8a3b2d18973e9cb3b9abf69e64fcd3a494b02cbdb5b2db2ec40e280899d0c8e4d8e2a712ad27a6c4947309598d1c4e49825b7b90c8ccbacdd1b
SSDEEP 12288:mSFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hcN:mSvrjfnmUWpEJcvTiGdtmOygge
TLSH
T104452341ECAAE513D35360757952AE451C6C9CE09A63D9C03AEC392FA5382C847DFECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 079f6f612547dcd6752dcb2261811c499dc3d38bea24cfddffd9529111d85ad3
MD5 bc8a0b814b5e0bec8965a1c56abf1b8d
SHA1 d669af7e826126662ed79e7409cf8e1c2594dabd
SHA512 1f62fb66da69309525934ac8615a43c57fc8771479953039c19c4c2a18910e74c2ade49a1cea15353b63e7cf3260020c2072dff22bb119244bc391e8a6aa2f23
SSDEEP 12288:1/FFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hc6:1/vrjfnmUWpEJcvTiGdtmOyggR
TLSH
T1C9452341ECAAE513D35360757A52AE451C6C9CE09963D9D03AE83C2FA5382C847DFECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 37e0b162a1d6ecbe871e558af2a43869969401ceccb2125dced665c40ab5aa68
MD5 e6652194ddc8020d568ff5749a515ea3
SHA1 2000905b4e54ea42a5dcbbe9c6794fdb9c6154ad
SHA512 7719d7be7ea66435481ac1a3120aca92d7aeed0b923437470317c19465da2cd8e9cd943e65576714dae3888f0c22690a3ba4c234b0d495f2a2854cb47cbe8ff4
SSDEEP 12288:g5FFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hc6:g5vrjfnmUWpEJcvTiGdtmOyggR
TLSH
T117452341ECAAE513D35360757A52AA451C6C9CE09963D9D03AEC3C2FA5382C847DFECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 fd90d977b31b660c55f28991d3c42b6d4bdb8983e3cf76b5f16ab7f843305017
MD5 73aa30a111200f43befbe0bad8ef0947
SHA1 ab846df657fdae3b529118a2986c168be3645c0a
SHA512 d6ef7777ab97c799e7ff9a2f9ef818f3af190e7b301e2e0e1662d6a7ff4aaf4bba0dc88141f8d30e49a53cb26240ce3ce5d118e2dd97710fb763718de16ce655
SSDEEP 12288:tVcFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hc/:EvrjfnmUWpEJcvTiGdtmOyggQ
TLSH
T1C7452301ADAED082D7639134A95299059979BCE08B33D6CB2B943C1F5D343C45BBEFCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 84bdee348ec115ec0181c4a405270dbc2757a9cebd0d7919f6798a4da51a92af
MD5 f231886e7842fbfd93567ee877241ba2
SHA1 66a04a0e89985f05564a78dfc857b07489976f20
SHA512 0e405633db0977befded9a6a83416134397267c96869f543e331696a1ef9bef8e5d502ad2564b8bdd3fb2b220e98eb1db2b09bf59d3353420de02bba3ebee2e7
SSDEEP 12288:okFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hci:okvrjfnmUWpEJcvTiGdtmOygg1
TLSH
T1B9452341ECAAE513D35360757A52AE451C6C9CE09963D9D03AEC3C2EA5382C847DFECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 4fd2bc52129d8bcc14d1159bea3a3997e8478a0a16fcd9d375709e5188adce73
MD5 5bdac7d1718cb485e26aaaa83497cc59
SHA1 da3c7d28b4544571075834f470d9e9054269f516
SHA512 c7cc2a807acf179ff97f2fcf9cb6abf0e31d8fcee588ad90001207b2636e676a305be3e167eb8a9d934f441d31c3afc25029c9af3810c64b70355c8010dafb7c
SSDEEP 12288:KLFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hcM:KLvrjfnmUWpEJcvTiGdtmOyggf
TLSH
T1DB452341ECAAE513D35360757A52AE451C6C9CE09963D9D03AE83C2FA5382C847DFECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 987de6fc5304c38d83f1f09a10f31c2c5b7ce6a5b8f1f4474e5b6d57d1bc2186
MD5 f4852502465daf42988a6a650bd3c1d8
SHA1 a3cb990dfea1820da9ad4f940323f2baef4a7318
SHA512 1a6595649fd6e5620947dfebfe395453aefaa2e2ef6f413447b4f5a658ded5f84fd575963e0a154ec5f3c4fdf8263352bab3bcc6b4f4ba6f8c9dce58cdee5b62
SSDEEP 12288:EnFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hch:EnvrjfnmUWpEJcvTiGdtmOyggG
TLSH
T19F452341ECAAE513D35360757A52AE451C6C9CE09963D9D03AE83C2FA5382C847DFECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 65cc2b0f6e7cc458621324c34e57fec615ceb9892208876129c0726eb95446f6
MD5 26552a9ba36c74cc4fd7a15e0c7cdbd0
SHA1 4ad3328a66344a7968d9dc4fd03a71c8739d385c
SHA512 c312808ecadbac7e53a23dd3fe12b1ca82b6a3cdc218fc742435a16439c548eeeda4b629ff1b2b304807a49535483bedbdde063ecea8b2e1a3aed363257e94ed
SSDEEP 24576:GZMSzFVSOfvrjfnmUWpEJcvTiGdtmOyggs:GZMSzf7TjfmF6JYTiGDm
TLSH
T13A650195B6A058F5ED63813EC9128906D6B2BC650B70C65F13E8362B5F333901D3EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 d07addae9f98a08fe40881c2e6c338456a2b383a05909f51ef347ba07452492e
MD5 66ddb91f2e044a2063ab0904785bf782
SHA1 2bf453c91ae2d277268db88d4b9183ca42b0ae11
SHA512 cdaa61005ea323fdd04a12f940da89e1a9df8ffef90c5f7afd4f1e8df1f1ec1c2a161c2304db9e093abc56edeea6709df4d8c8939b95894f199c0ef45b645607
SSDEEP 12288:hGFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hce:hGvrjfnmUWpEJcvTiGdtmOyggR
TLSH
T1B6452341ECAAE513D75320797A52AE451C6C9CE05963D9C03AEC3D2EA5382C847DFECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 c0aa101c7120e245748eeef284bfafa1abfb417b4dd6dd3ac55f10a43615a489
MD5 55193b2caeb96367921d91848c2b4440
SHA1 9482a4537246aa574e933b51d25d65ce2c1f0474
SHA512 bf062d49f718ad836e994cba4f7be69deaf60807929b0d7e443666053070bc0a95cfcd7dca050b2531743a5605125b7061bf4738e12081d405b510f45c107acb
SSDEEP 12288:GKFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hcV:GKvrjfnmUWpEJcvTiGdtmOygg2
TLSH
T145452341ECAAE513D35360357A52AE451C6C9CE09963D9C03AEC3D2EA5382C847DFECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 d4606b941b21df73582a5d2b78bf1322799b7c151bae4729daa8ff7d931a8de3
MD5 42f1e4d0afdf6eb0d40a0d4960347cc0
SHA1 4342e7533af8708ba7633baea68cf900de9479ee
SHA512 80bcb4ef0ea71ffc9df7146aaaaedfd65d2569c10082857094d4efdc33c9fffc2e50cc3d4b670f12ebd9f9c809e7e9d242076aad667834213c8eb6b8dadeaf7e
SSDEEP 12288:wyPz5L8DFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hcX:BzyDvrjfnmUWpEJcvTiGdtmOyggU
TLSH
T1085502077AA530F9D277913888521A02F775B8710B21CAEF17A4167E2E372D09E7FB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 8d262e59371853b594572b6fee3a60da724a991c759dd4b057c2962874fdfaf1
MD5 907532da7a7263ca1e750e00083c38ff
SHA1 774c682f8c8ba5bc3d6ab59def71d2da39743342
SHA512 68c277cdda467b2fcd601e2815e7e0d733c9bedc32152969969bce7945b372f2ac66f1df7ff4a3c74fb0002232c3f1bf2017edb152920af4278e03e04d873b38
SSDEEP 12288:8GFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hcI:8GvrjfnmUWpEJcvTiGdtmOyggr
TLSH
T1FD452341ECAAE513D35320797A52AE451C6C9CE05963D9C03AEC3D2EA5382C847DFECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 90b191adb5eb2f2d557641bc8c287dc89a026cce74e2411072fed8b0ffcb745f
MD5 12da4d11614b0c73fb56200f88801bd9
SHA1 961713555d2202061dea766915c9c613c834717b
SHA512 c07891c89b022a7b08359088ca3cdb4a37b261fa3aed3fc2e41fc0b6fae26487f8e4beff54bbd0927bd6183e86ccae1c0050f12d6ffb4de6f77ffb55dcde1c23
SSDEEP 12288:nGFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hcg:nGvrjfnmUWpEJcvTiGdtmOyggb
TLSH
T1FC452341ECAAE513D75320797A52AE451C6C9CE05963D9C03AEC3D2EA5382C847DFECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 b3392f9cc929fb72d33d55ed622964403d3af45c77ea86141bfb7ca84ab393f1
MD5 5ae2bf5cab6c39f81e9179b6c42406f4
SHA1 152617c795439f546d891b86f123c6f554387343
SHA512 2fd22d0f9c2d0a721da72d734830376f6b79c6fb09cf85047775fe4233a298d9ef0f613e43bdd13e4a81337973aec1412fd2f8c79cc6184cce91c86793aaadcc
SSDEEP 12288:GyPz5L8DFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hcg:7zyDvrjfnmUWpEJcvTiGdtmOyggr
TLSH
T1B75502077AA530F9D277913888521A02F775B8710B21CAEF17A4167E2E372D09E7FB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 ae2da5a92f82e6e7664de1598e96b28bb04fb2288ad77b9d665a48e9e9d10d05
MD5 abb8fa50713c6305b63f9046eabdd52f
SHA1 a66cf253c11465ec6350e904193395f52ed9f18a
SHA512 7ea6e4a3c48468a401ee6762b3d4741fbf6e8254addabb2b9514f3a9ad3d22b5614506acea4f9a4b59f062843f0daa66fa8f97ab2e7bb42334a606ac379650c6
SSDEEP 24576:UTHaLl3z0zDJvrjfnmUWpEJcvTiGdtmOyggI:UT6LljITjfmF6JYTiGDm
TLSH
T150650194B7A058F4ED63813EC9528906D6B27C650B70CA5F13E8366B5F333901D2EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 4de4eea1a6c06c0ec6bbec4be34046e8c5aaf9b8be3e8fd5ad9e23e9b91d9ae4
MD5 13fe1493f33ec67b923e177d99fd33a4
SHA1 11ee52555d2de663243b3cb9ff33742974353c40
SHA512 be0648bfb666785b8367cd04f7ae6b577e36b5fea92fd31569c5038e5f15ba29f22a8ecbce81ba46ae0e591da81134c7bf485250bed851c2dea8cc81dc91b12b
SSDEEP 24576:W37d9CHKy7GZ1vrjfnmUWpEJcvTiGdtmOygg3:47d9CHKya7TjfmF6JYTiGDm
TLSH
T1B475CF90F7E810E4F1B79A3589725511DAB67C991B31DE8F03A8261A1F337D18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 c0b0557cc534b1fcef0a627ebc54ab8c0467899e314ec21f0f0bb0fd3debbb34
MD5 1c48e0fbe366d0151135dac01341f606
SHA1 9d8110a393d910def851be75d9f077fd46a98962
SHA512 d86c81ac7802d5149409f9366178c8c2ae5d2953b5b5d81bd07170ab146327af05d765d5ff530aff57a06782cdf7b9c66cfc3515ae2b0fdf30114d03e4655927
SSDEEP 12288:SZFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hcx:SZvrjfnmUWpEJcvTiGdtmOygge
TLSH
T104452341ECAEE513D35360757A52AA451C6C9CE09963D9D03AEC3C2EA5382C847DFECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 82fe841829642aece80b9f6a1eb7ca19370d34173ac150f6a9f0b183d08e1006
MD5 47550c0bff4d9e676b0aedcfaac9f92a
SHA1 0f8c65d3f7d499abcf6ae4baccf5aebf282b17e3
SHA512 a0d401c33157b3e528a9ae6d0506d33ec6afc635e0d1d8cddbfdb2113fa8828b6694efe587b1a4b9a0c4461f4b26d8f01d20f654d94c93777acea4bb717c59f1
SSDEEP 12288:5jFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hcp:5jvrjfnmUWpEJcvTiGdtmOyggm
TLSH
T14C452341ECAAE513D363607539529E451D6CACE09963D9D03AE83C2FA5382C847DFECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 171a723df676fc9f2a11c932f225edef9025ca8122e3b44ffc1b7744ebf0c62c
MD5 6c6115b86d379f31c5375196eab7da9b
SHA1 e1c48d4280847623e739326b12eeea7153ca409e
SHA512 d3495caa915e70f99c819b9191c4f1dc1f6682616ad5f30ad1726f8048348dae99cb7813960f7fc77caafd10bb56d2fece446cdc482a5133ab81d5052405392b
SSDEEP 12288:2QFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hcZ:2QvrjfnmUWpEJcvTiGdtmOyggm
TLSH
T1CC452341ECAAE513D35360397A52AE451C6C9CE05963D9C13AEC3D2EA5382C847DFECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 0b3a2f68afe872d244342bd7b0980e99a3bd848c2e1b031b337a7d87444c7ad7
MD5 95c8f9464938ee30c08893c3abb10c49
SHA1 2ba9a579881f07c645350343c17b8919477a5173
SHA512 d53a8bfbacc51438783065b8bb02feefd727fc41a849b7e679a23c59721c273dd7d01e5da5f9f678aba6e69fa5e2077c548f5fdff548e92d2142e1d37ea71e13
SSDEEP 12288:uGFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hcZ:uGvrjfnmUWpEJcvTiGdtmOyggm
TLSH
T181452341ECAAE513D35360797A52AE451C6C9CE05963D9C03AEC3D2EA5382C847DFECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 8e5ed78a4dd38372f0686e05571dd96b30e40e156fa3146ea5e3b25369526063
MD5 6cc882fe60bf1a86652b60d150c4cb76
SHA1 bb8348b700961172ba30ca2babd696a4e76cf4d6
SHA512 6ecefe7e3ff457f87089a64867ce15635391cadc9c938de73b29c86e0683edbe95e7b5dcc93e492d10bc624ed492da9627644aaab3d8aff20f516e819a6eb6fd
SSDEEP 12288:UZFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hci:UZvrjfnmUWpEJcvTiGdtmOyggx
TLSH
T13D452341ECAAE513D35360757A52AE451C6C9CE09963D9D03AEC3C2EA5382C847DFECE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 b8cd336531fb7682763357d4e7f5fb5c186ccf33fb945139a54d0bcbc74d8f45
MD5 b5b44a90014ece24bc677e9271ca9edc
SHA1 a814ecc87c0253b0300e3cf5de09a79d1a51bcc9
SHA512 493a3b701bb6c6aa0a16e50a4b602843fe979914efb0e736d9fc15ae20179f7a0cdf3c83ff53604329db8c559a57c8dc526502dd3da6f332341bd74810815921
SSDEEP 24576:0fwvok9RX6wkyAI6vrjfnmUWpEJcvTiGdtmOyggE:UMnYI6TjfmF6JYTiGDm
TLSH
T1B585CF29EBDC44E1E1B7913C99B3460AF6B178681B31C6CF129A536E0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 fee279c059497f0a237c6934231fe6f35d4ba73f28c17562f87c79d5b41568e6
MD5 f5a9a2471d9bc54c7d051da684c1d103
SHA1 f4f8808c1dd6aba0412fbb29a77882253ada02c4
SHA512 023a77c9affd6e61b69610cc29fa8f4bda6dc893342fdd91550cb5678d9e0564529d8cc98aa1dd9d9b1ee55de5b2be2f074ec1ad1d4e1412a1a72b86d26863cb
SSDEEP 49152:1YZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK09TjfmF6JYTiGa:1ySzPJjS6J0i6m
TLSH
T1D8067C56A1A841D5C1B9C1B98F0BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 089acbe40f58d9087bb775d3d9849a35639d8ea5b4ab00d994d7bd4779010588
MD5 51ce40e5ddbd979eb3ec797c6846aaad
SHA1 5473b3e5ad9f0ac34d713dd77b9db3944ce89548
SHA512 c178964818acdc1db7e4a5e2392a7accc6b552a1e54f2ff46bfd24ea189867e70f36166212f71d48bfa202b16090a7c22115fb595b430e625db95a8ee5023830
SSDEEP 24576:k47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYPvrjfnmUWpEJcvTiGdtmOyggY:k47JUQj1irIhCnDHUPfF/tTjfmF6JYTU
TLSH
T1F065AE1DA3EC01E5E1BA927885154A5AEA71782D1F32CACF22B0437D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 a7793560f21ac127900e15c41b452401418362ea767d00e3aa2fc23864ad5e08
MD5 1a7840b1d3add8bdf9a3d7766d0e269f
SHA1 55f0666e17b15f27f8111dc7636691ff9ef182a9
SHA512 ec70e8bff449196604c459ceaa8b37d355efbe42259cfdf783a775dae11810648c7626b61a2d5bf8d8a7520ebcc21b57cc2653559b029a4a136d9006973d175d
SSDEEP 12288:gNsfWFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hc7:BWvrjfnmUWpEJcvTiGdtmOyggA
TLSH
T1BE550109D69852E9C16E6139CB524A41B7377C6087E2D3CB26D0F93E1F392C45EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 a1e29998df0580f9537450223d552f474fb04863ee218bda750fb89a52518c00
MD5 c471d2252bdf95c11f65c051dd5f5ac4
SHA1 f944d80b0d07057067954993413165a6b9e25bb3
SHA512 79f68cd8938a2e18436937ea860419489c2a45ded2801aaa382c10ef7146168375881644e97a63b1f1e3392e25a078afd9fb85bb01dd326b7dbba0f2d8c1c514
SSDEEP 12288:QWC+U3fcHR3jZjTZ0iOMgsPxxpLfknxUP2:QWxUPc/j2ilgExnL8nxUP2
TLSH
T15D3517017666CA4FC56950321E73D2CCAB707C11EE44AF0373C99B3FD576A59BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 329KB
SHA256 14c1c25aeec7227cf474e76c8bc41c67a138b5cb37766c6bf9aa87cc312e4a7a
MD5 97643dba94b82f09cbfbf2288cb4cae2
SHA1 21702935b5dbdb6d50e398144a1b17ee12786c54
SHA512 a649b5adae5fce86b8807e1eba206177da984b14faedfaf4fb46719bae5b8306be7a4e63066085e02f0a912251a011fb5bce0035781c9d0cdd53ed355e191f42
SSDEEP 768:G/TIalToOlTPBlTz2+EQM9T/T0PalToOlTPBlTz2+EQMCZAnd+xaWq2UVdTxDta/:5CtimUq2URXY6NqHRDJ5856
TLSH
T1F274B400B750F319C4B681B708B1E79BAB3AB513DF5353023BD51E48DCB22467B7AA99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 2ae05ffbad863de77834034d181c6a9ecea128553f03303c1feb9a4f71c38934
MD5 7199d2795b800d70357396fc055441fc
SHA1 610e09255fdc2ed1ecada23272e574530d685660
SHA512 915035bd2c27a754db3de38fe8855df521b7aabd3591112655668489d786adee8a8cfec743cca19ea078bbc06243324fbdf80a7683ed98c9319c98463877faf1
SSDEEP 12288:2M7hFFJZjkYnDSF7ebKDMalsv9JUDvb3zeCDdMDatmOWVsfGgG1r5hcfX:zhvrjfnmUWpEJcvTiGdtmOygg0X
TLSH
T190452301DDAEE903E777203429569914292DBCE04F12D5C37998395EA4386C88FFEE8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c089372631f4c37805387b8cb96633481a2c3aa619aaf4d83e2d7555e65f9fc3
MD5 471579bb0f225a295b844964ec6a84c2
SHA1 92dbeb826544082c1b53fc08953867fecb650e21
SHA512 1d979737e6f74d7fc2c217552e178610ea2f1547b681b5caad0f714c45da26f43082bd9c847c9c5e951d57479422e2ba0739bfa217baa4a51f739edcb847be40
SSDEEP 24576:Zgb6bmBIi49WNNFpg1rSvFv7bYIvrjfnmUWpEJcvTiGdtmOygg5:Zgb4mBIBhGFPTjfmF6JYTiGDm
TLSH
T1EF65AE1E22EC02F5E1F6E2B89DA64417D6B278160732D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 1.3MB
SHA256 4ea2f3c3c22c7a1ce2932ba1c03b7b0477d7eb316c886054ec33d75d07d242c7
MD5 e7da325c62378853caa84b66f499cad8
SHA1 9704510633654ac22524abfd2bf81e9bc183e45f
SHA512 d7804892175f05024eaaa67ecd58a0714e00adfb8f19af8a139b40fb49bec132dc04e6d54fa25775ffa6fc1c4e85e093b97941f2861aef3ac3e0172e06d94dc8
SSDEEP 24576:f8kNvNnaFeYhJNtmZBmWvrjfnmUWpEJcvTiGdtmOyggX:f8MwBtOmWTjfmF6JYTiGDm
TLSH
T1A455AF6EBAF845E4D1FAC6749D238512EA727461073293CB5390C13F0E279D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 6c4769a3531566c93c34310b9e3cf86d2b8aaf0afcc94a245f25fa05e47851e4
MD5 dff2628c543ce59e9e8e8f392c8e520b
SHA1 b2ab2529c71892a981c34ed54a5f5eeaf2a8a660
SHA512 62a338edc711d3a9a682fed4c2c290e4928009b8bbffc851c9a7cf44594fa9fa9eed1517fd54710ca91c236308ecdb2ff529f25aac4d36ed10cfddd243ae2fc0
SSDEEP 24576:sG3aKngL2jdshRTdG1YxITqvfPkbIcbjLm:sG3arSj8RoTCCW
TLSH
T11E05237EA7C566A4C53BA77429B6984A3CF33768870A46DF48E0957C5F6A7E0323CC40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 6f081ff9e260e98ca3cd5e9717f53e6277a7f5003b35ccf6c8dddb89882446cb
MD5 aa38aa77fa48fcacf6f80efabb7da5e3
SHA1 b4baf421e372c71e35a8541db19055d8a2416b44
SHA512 70aa573cd7ed8db1e9d389090f5b86aeef980a1dcf3835f579ccd28307d0c337eb0499c9f53b881b3e881c531d08f93bb711e07c995864aa9472b25a08bc756c
SSDEEP 24576:MG88u8FpJqH1bzria7/mfvrjfnmUWpEJcvTiGdtmOyggn:v7ZFPqVea7/wTjfmF6JYTiGDm
TLSH
T13185F165B6E501F1D477D1388A824663F6B2B8210361EFDF07A88A561F23AD44B7FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 b0fac024aea77b59ca13c64ffe362a295fbd1d21a5df70f99e4dbfba8f313084
MD5 0148493620b8f482729b66a2061344e6
SHA1 86066a9f666e99fb332bcca41b153f630eabdfac
SHA512 5508829cb84985ad0c1ea32d67413c9ad581ad20f9e8bf586b07227c7d97d24f37df654da08e2235bda8566607e8f3a635238bf529e9fb6394bd7add5cd89ee2
SSDEEP 24576:3PUr+NQYvrjfnmUWpEJcvTiGdtmOyggq:3JQYTjfmF6JYTiGDm
TLSH
T13565E11F66ED18E5E676A17D89828709E771B8610712D2CF02E0817E4E37ED8BD3EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 6a004b213b497433af8d869bdbaef044e690b7b732908ce78384bd6c8457a924
MD5 2ef97aa27b3c10a39d0f0798699c6289
SHA1 be938079385233a44e69c4c9df6896c2d94a629f
SHA512 6b9bbaa03eb13baa79db3baf345e86c637f0bf2335f3c0c902fac1ab28daccd8cc03c6382a1a33eab43953b4ba6d682740eecb7a4f37b91adf1867b3ed2b977e
SSDEEP 49152:BBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjITjfmF6JYTiGDm:iG05lO43bRjS6J0i6m
TLSH
T151D5C06A62EC11F9D1BBD07CD9C64A0BEBB23815033556CF02A486A91F27FF4567E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 0ba03cb8b9bb6665ec86f7e6a114694d4c1b9e91400cd4e9ead203897a5345bb
MD5 00cf4a8cda5f9af902eaf7264b463103
SHA1 d212471131ff81239231524a1ae99f97dba75824
SHA512 b9ed4cf1ba9156b6e46cf65129ceb6901a0d7b784d9ec3256b9a3e28e18afaac1c6780d9896aac882306981cc4015cea6a9f3dc04696ff470b794822863db230
SSDEEP 24576:Efa5POZ3dpFWVM50JicR2hG0lasx2+47eidn9vrjfnmUWpEJcvTiGdtmOygg3:ca5POZ3+Jt2pasx2+mjTjfmF6JYTiGDm
TLSH
T16365BF5EA6FC01D5D1B9D17DC583861AF5B1342153329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 0eef99783f9b31d95b624c6902f0a61efd46fc6f0cd1fcbda6201044117e743e
MD5 b98953dfe5d0ec3664a0611f3587656b
SHA1 fd9de89a7239fde78099442bcb958fd216ac5b14
SHA512 afa2289ae486559bccd80ec4b404dd6669421b17451024778e67086fd576fd36ed5cad8bde8eff5d088d7f5394fb13d7fea1475d04a4180e3833693e077a0360
SSDEEP 24576:GNcwHdjbyQ4nLC18lb/EOjowL7Fk3vrjfnmUWpEJcvTiGdtmOyggA:GNc/zEOVHFQTjfmF6JYTiGDm
TLSH
T189858B1622E901E4F1BBE1BE89779946FA71786517308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 be8646f1b6d47ed5f9eeb74033c5a4cc1db65068d2a7f1d3ab341b82ceeba59f
MD5 0b0de0608b698538d955a556a4807f13
SHA1 43e1a1e6c85b858bfd1eb8229d390e704c09c784
SHA512 41e62a2b6f514d198df92efbddbf0590585c3b3fbea6751e5e388b459534bbc27561c646dcbcc7517fcb5c0dfab38f4a6379cea1753f7d3e85c3a2ef90b12acc
SSDEEP 24576:D6DIgaKngL2jdshRTdG1YxITqvfPkbIcbjLm:D6DIgarSj8RoTCCW
TLSH
T1BF25126D63AA01F4D06BE13D96934506E5B2B1B4C7074ACF4AE4C5BD4EA3ED8B93CE40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 d1dbafc76317fa2757f18248300d67b49d3f7c67a97d664445a393b061cdc563
MD5 a9143ed9e74010fbc614e2527285271a
SHA1 dd65fd5fec52495b59c200b27ebff0547ddb2407
SHA512 864f4b58737b77b63675cbdcf6684b7020404eb50675cf1dc86c685ea1bcf40e38143397adee8f8140e5a0a01717c09cd370e0dd894ead3fa847d61f0d1c13fe
SSDEEP 49152:ODMwBtOmWTjfmF6JYTiGDmiarSj8RoTCCW:4FYjS6J0i6miJTy
TLSH
T15DA5E16EBAE846E4D1FEC6749D238512EA727461073293CF5290C13F0E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 aa2a510f3730d252373cc3f4ef3190e9657caebaa15f92eed9451b16e17756eb
MD5 d51184bad95ddb4f7fca35b1a264ec20
SHA1 c7f594a3adf5cf22f19478218fb84d35b77ec3ff
SHA512 b761f9fbb27c60b9edec568a3091ebac5924b51c5b6fcfeb5c78d40072a94bb11095434645d5928f785bebf80e826d904b5259622e495ce3a616b087972cb953
SSDEEP 24576:uD3FHshBIYQgAyvrjfnmUWpEJcvTiGdtmOyggj:uDVHeBIAAyTjfmF6JYTiGDm
TLSH
T17875E13DEA9C04E4D57BD1BCDA538A06E77138A8032255CB12D491BA5F2BEE46D3EF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1348-147-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1348-20-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1348-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1348-28-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1348-27-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/1400-80-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1400-342-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1400-86-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1400-75-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/1676-142-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1676-345-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1676-136-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1676-347-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/1676-349-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1676-135-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1760-118-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1760-112-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1760-372-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1760-374-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1760-344-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1760-108-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2848-343-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2848-91-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/2848-92-0x0000000000A10000-0x0000000000A77000-memory.dmp

Download

memory/2848-97-0x0000000000A10000-0x0000000000A77000-memory.dmp

Download

memory/3580-34-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3580-41-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3580-177-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3580-40-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/3580-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3776-60-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3776-67-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3776-61-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/3776-328-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/4120-148-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4120-346-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4120-150-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4120-156-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4512-350-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4512-185-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4512-179-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4512-178-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4964-56-0x0000000002350000-0x00000000023B0000-memory.dmp

Download

memory/4964-46-0x0000000002350000-0x00000000023B0000-memory.dmp

Download

memory/4964-45-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4964-58-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/4964-52-0x0000000002350000-0x00000000023B0000-memory.dmp

Download

memory/5332-6-0x00000000026B0000-0x0000000002717000-memory.dmp

Download

memory/5332-0-0x0000000000400000-0x00000000006FB000-memory.dmp

Download

memory/5332-106-0x0000000003F60000-0x0000000003FC7000-memory.dmp

Download

memory/5332-1-0x00000000026B0000-0x0000000002717000-memory.dmp

Download

memory/5332-15-0x00000000031C0000-0x0000000003245000-memory.dmp

Download

memory/5332-8-0x0000000002DF0000-0x0000000002EFD000-memory.dmp

Download

memory/5332-10-0x00000000031C0000-0x0000000003245000-memory.dmp

Download

memory/5332-90-0x0000000000400000-0x00000000006FB000-memory.dmp

Download

memory/5332-101-0x0000000003F60000-0x0000000003FC7000-memory.dmp

Download

memory/5332-132-0x0000000000400000-0x00000000006FB000-memory.dmp

Download

memory/5848-162-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5848-170-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5848-172-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5848-168-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/5848-160-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6100-369-0x000001B7FABA0000-0x000001B7FB220000-memory.dmp

Download

memory/6100-435-0x000001B7FABA0000-0x000001B7FB220000-memory.dmp

Download