eec274a85ccfa1f4bc8e3a963caf9a1d349e9ac215ed21f4d284ddf13d2fc99f

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/11/2026, 22:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
Size 3.0MB
Sample261101-2n14psywat
SHA256 eec274a85ccfa1f4bc8e3a963caf9a1d349e9ac215ed21f4d284ddf13d2fc99f
MD5 94487df510e963599528effd408be4ff
SHA1 326f0a8b04212677ddac09fdad1d6bc246d84cb0
SHA512 f9e4a696ee84b3768b422f66e025c29b94e112588b991be93b02a522d382924d5da7d296650bcb90afb0f9ccd97f11a899228ae1438d841dc6d15ba4270fec0e
SSDEEP 49152:jYdmaMVt3CS4g0djtLhVR5HL/iiLONqkUuCS4g0djtLhVR:VaMVt3L4/dxL/R9LfO3L4/dxL/R
TLSH
T135E512217390D43AD2A231B58EA7E3B5A5EEBCB0AD21934777C03B3D9E34591C938716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery macro spyware stealer upx

Malware Config

Signatures

Suspicious Office macro 3 IoCs

Office document equipped with macros.

macro

resource
behavioral2/files/0x000300000001a332-433.dat
behavioral2/files/0x00040000000170c6-434.dat
behavioral2/files/0x000300000001a331-435.dat

Executes dropped EXE 11 IoCs

pid	Process
3416	elevation_service.exe
5800	elevation_service.exe
1236	maintenanceservice.exe
1276	OSE.EXE
3752	PerceptionSimulationService.exe
2604	perfhost.exe
4600	ReFsDedupSvc.exe
5020	SensorDataService.exe
2712	ssh-agent.exe
3020	AgentService.exe
5868	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1d6997c4b68fd3f0.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000100000000ba3b-196.dat	upx
behavioral2/files/0x0001000000009323-388.dat	upx
behavioral2/files/0x00010000000093b2-389.dat	upx
behavioral2/files/0x000100000000a0ca-399.dat	upx
behavioral2/files/0x0001000000006276-407.dat	upx
behavioral2/files/0x000100000000bd4b-406.dat	upx
behavioral2/files/0x000100000000621f-405.dat	upx
behavioral2/files/0x000100000000a315-404.dat	upx
behavioral2/files/0x000100000000a300-403.dat	upx
behavioral2/files/0x000100000000a2bd-402.dat	upx
behavioral2/files/0x0001000000009369-401.dat	upx
behavioral2/files/0x000100000000a1d0-400.dat	upx
behavioral2/files/0x0001000000006211-396.dat	upx
behavioral2/files/0x0001000000009b8e-395.dat	upx
behavioral2/files/0x0001000000009cd2-392.dat	upx
behavioral2/files/0x000100000001b987-391.dat	upx
behavioral2/files/0x0001000000009cfa-393.dat	upx
behavioral2/files/0x000100000000994e-390.dat	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\java.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\javaw.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb3a8edd526add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ac2414a5526add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000702248dd526add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 01000000000000000dd6eda4526add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a8869da1526add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000185e4da6526add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f4c6a8dd526add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3416	elevation_service.exe
3416	elevation_service.exe
3416	elevation_service.exe
3416	elevation_service.exe
3416	elevation_service.exe
3416	elevation_service.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
Token: SeAssignPrimaryTokenPrivilege	3020	AgentService.exe
Token: SeBackupPrivilege	4600	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4600	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4600	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4600	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4600	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4600	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4600	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4600	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4600	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4600	ReFsDedupSvc.exe
Token: 33	5868	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5868	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5868	SearchIndexer.exe
Token: SeDebugPrivilege	3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
Token: SeDebugPrivilege	3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
Token: SeDebugPrivilege	3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
Token: SeDebugPrivilege	3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
Token: SeDebugPrivilege	3416	elevation_service.exe
Token: SeDebugPrivilege	3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
Token: SeDebugPrivilege	3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
Token: SeDebugPrivilege	3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
Token: SeDebugPrivilege	3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
3316	2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5868 wrote to memory of 4112	5868	SearchIndexer.exe	100
PID 5868 wrote to memory of 3836	5868	SearchIndexer.exe	101
PID 5868 wrote to memory of 5948	5868	SearchIndexer.exe	102
PID 5868 wrote to memory of 1396	5868	SearchIndexer.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-31_94487df510e963599528effd408be4ff_amadey_darkgate_elex_remcos_stop.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3316

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3416

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5800

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1236

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1276

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3752

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2604

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4600

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5020

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2712

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3020

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5868
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4112
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3836
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2764 2760 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5948
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2768 2732 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FullTrustNotifier.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
Size 2.3MB
SHA256 ab8416680ea0979e1f25a8c53f94861cded4ec8e9ba82483d9199f01c9cdfa60
MD5 0473ce7f9a8138f0fb493f497d09b68b
SHA1 fc1a54a6145273f2bbdb6991c660a290c30af86e
SHA512 b10dfa6f530fc54abc0fe38e63909b908e723065ebe579619ffb536d7d61ee0948417250f994bc22e346c96d7b47f172f803df1ef90a2d3f20a33fc47b32834d
SSDEEP 24576:EL+qBWqAC/PT+S1g0xHnxC4bZtxoEgmK0DnLyHb0iB+6pQ7ZqfhRVKyaEynnUFB:u+LCS4g0djtLhVRDLyAMLOqfhRRQ+B
TLSH
T1F1B512307746C63BEA9701B18CF8AFBF9459BE941F69A1C7F3884B1E1E701D26A31416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LogTransport2.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe
Size 2.4MB
SHA256 ec5fc0871e37b98c572154a23647712096a59c488a8c83c80ee0400d1dd3ef01
MD5 d0aeaccf479e8a585ee4a0cc5938728a
SHA1 66a5aabf7a8bf96b1b67fa5fd2b3ad7df6753cc6
SHA512 b2bcd1891f07054d83219129b7ca3cecd5718c0f3c1908a825a66ded4c568b517f8932e27a655654801749fab88f1cfd8786761894b2bdab1a3ea251c498c361
SSDEEP 49152:9KKDZT88foCS4g0djtLhVRRLyAMLOqfhRRQ+B:9KjL4/dxL/RR+Ai7HRQ+
TLSH
T1C5C51210F786C276DD9601718AAA635CC4ADA9B05F3297D3E3C87F0E5E701D2D932B86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe
Size 2.2MB
SHA256 eae12e2e794112428a0fabfebe868947227ff9674089e63a390912bb126a6a14
MD5 98d7d2e23850b1eb2ef55787af09bf22
SHA1 bbf5a6bfd8dd1b2a7ff9753062b3ce301165e41e
SHA512 4d53857d03b32036d7db851f9ac67dc053598189fc7c4d0a86cdc84a32362df23376d4b88472787fbc7740f299963eb537f136e610602591b9f29d900eba9f98
SSDEEP 24576:yOqAC/PT+S1g0xHnxC4bZtxoEgmK07KnLyHb0iB+6pQ7ZqfhRVKyaEynnUFB:y2CS4g0djtLhVR7KLyAMLOqfhRRQ+B
TLSH
T149B52320F1C28677DE5A01F1899B6B89E458AEF01B31E5D3F3C46A2E99381C2C777562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

64BitMAPIBroker.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe
Size 2.3MB
SHA256 76d22b3fa4486320d89ad97f86ae599ed311591e262ce4d497bf68a129d6f606
MD5 c1578f53b6abb769187f1e2923f151c7
SHA1 ab18e3175b8ecd5ecb79cbc2239ab0f35cb5de4e
SHA512 ede6fdbaea65025d079534f94e7e8f21a128d936e724c0f82ca01f8c6e13bc5ef2e713cd710f20678fe4cd147b6e51ebf9083c8136984a5ba0a5d538d9a8e76b
SSDEEP 24576:hZKxqAC/PT+S1g0xHnxC4bZtxoEgmK0FnLyHb0iB+6pQ7ZqfhRVKyaEynnUFB:cCS4g0djtLhVRFLyAMLOqfhRRQ+B
TLSH
T1EFB5121E73D88CE9E45BC179C9924542E2B13C901735E7CBA790522BAF376E0AE3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
Size 2.1MB
SHA256 15715677764184d926845ebd51318fdf9479611507900ec29da778a3d1d428db
MD5 104fb73fca7954fae1300dd980cb9066
SHA1 2fa6466387dc6813320662a8b02f1a3010e97a92
SHA512 14e336e09f643dbd5c9d5b4625fd9aa214ccfb9391e07f721b707de965628131fc74278cd178fb7508860e0ff948ad1c350962375b9a31a046c27e1e416932e3
SSDEEP 24576:w6EqAC/PT+S1g0xHnxC4bZtxoEgmK09nLyHb0iB+6pQ7ZqfhRVKyaEynnUFB:XICS4g0djtLhVR9LyAMLOqfhRRQ+B
TLSH
T16FA5334BB647CB1BDC4900F5449A1BA4E4A59EF07F25F7E3EB80760B497C2C1863A12E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wow_helper.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
Size 2.2MB
SHA256 7179d9dc5feaa98912936fa2b37abbe5d871ff34b8f30439b3eb2f9882aac778
MD5 fd4ecb4a0a29d3977dbe7b244a539b4d
SHA1 957dc46bb5a1a2a881f4103f08ace8a882d5a0ce
SHA512 aff4a58341cca60bdfd735a3bb75ea07a7c3d928d46b1a9b01e6c64f29202b74d31f6e7f049a03fed586e0b75cedd70368fce0cf3fbd2ff321f6e913a5302b7d
SSDEEP 24576:rhcqAC/PT+S1g0xHnxC4bZtxoEgmK0TynLyHb0iB+6pQ7ZqfhRVKyaEynnUFB:rSCS4g0djtLhVRTyLyAMLOqfhRRQ+B
TLSH
T10AB5235BB29572FED9AA41F8C4911944E7717CF02631E79F8B80225B5F3A350CE3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
Size 2.4MB
SHA256 bf99836051e5e7db2d192651a26390d6f8a22fda4801ac0e65d677a439c55c83
MD5 74a22cbd3c5efa0ab3d1ffa81285c2ea
SHA1 7e3ec9d7329d6066fd134d15851252e32fd28ce5
SHA512 2305ed9ce0142c0daff6ebca6aa5eb6667c933ec257b505e1059e5af6da53c5b3b508565ab1bcd6477161d0ffe15ddf4d88d75530336b0c3721787404971caf3
SSDEEP 49152:XSgouvAeFfenxyQTXS7uQ0NImCS4g0djtLhVRQLyAMLOqfhRRQ+B:XS1uxaxnS7uPL4/dxL/RQ+Ai7HRQ+
TLSH
T130C5AD0267F94129F1F37B71EEB993645A777CB1AE39C50E5280125E0DB4A90DA32B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARMHelper.exe

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
Size 1.7MB
SHA256 0f202c7fcf76d2ebd8ab1536fcb97c303e47148d75ac26f1fe0cc12479337c60
MD5 30a50451457c085facf8a503ac408ace
SHA1 ce67ecd193d0786a9dd6e2eef7ca17bbf56b485e
SHA512 b2ea004000e08a47adc369b3786423d19e78b6c5a3c6c5988c57eb66d3a224d9db305ad6cd494c6841dbc8ae14897d92c71ead32ca4c01be88b7edcf0425dd1d
SSDEEP 24576:NpTAbD+OmeoqAC/PT+S1g0xHnxC4bZtxoEgmK0:rTAGOmeUCS4g0djtLhVR
TLSH
T1D585E0107790C139F1B329768ABFD724646DBDB15F6882CFE388262E4D706E0AA35717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaureg.exe

Path C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe
Size 1.8MB
SHA256 8645c3b68c47aa50d26c2e9056bf5c1aaba014eb7a038dd6d828840c4463fafa
MD5 e849b33ddb2ecb9fd6c9e05e7b80fa87
SHA1 a4148e04afbd1e09e6aac8c0eb8766c3b7e54ad2
SHA512 8b1fb3b834b17a08b644b2ddc35f9a221b61aae3b243bcb11f0092c9af3c65e15e5c5a355877c871abf1b56fae2202927026ae789cceadb37ee89b2a33ea317a
SSDEEP 24576:nJ7RKfjjg/PzNWyrCqAC/PT+S1g0xHnxC4bZtxoEgmK0:tAjiPDriCS4g0djtLhVR
TLSH
T18195F22475A0C032D27701304D6AD794A67EF9B04A3385D777C4BEBE3E345C1EB29AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
Size 1.6MB
SHA256 4ddadb61ff1fe4b79042ac16e405215ccb891b39ed66320e0daa1df6649a358f
MD5 b9f2fe659d4164613fddc90d7f31e7de
SHA1 13fb1be3726df8f15bc2b61b0fb948c79ef8fb88
SHA512 274c884cbb80bb1bcef897ea0b7b650d1e86e96a425c5dd1b362cea8afddbd187423dae7d131fa40fd8bced2460e72c648f29c0a1bad256887d7b69cb87b3a6b
SSDEEP 24576:aZMdzFVSOHqAC/PT+S1g0xHnxC4bZtxoEgmK0:aZMdzf5CS4g0djtLhVR
TLSH
T18C7501A9B35018F8ED67827DCD558902E6F27CA64760C65F03A4362B5F333A14C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
Size 1.6MB
SHA256 8dcce3c4d53c0da1f219adfaac7b65dfbdf6b3bfea479a007d50fbcbeefd2176
MD5 86e0ea1287ee7297f9ac5683869ac4e5
SHA1 cf9bb86fda10699d4b5ecefe4246121fac181353
SHA512 5faff1d804df317159a672ce4657fb6a69bc10b9ee7bcd94d597a139f0314679b2777b5b05bd16d3916f6d2d73420c814b14ed21786bd36d78243f52bc3329a2
SSDEEP 24576:BTGaLl3z0zD5qAC/PT+S1g0xHnxC4bZtxoEgmK0:BTFLljcCS4g0djtLhVR
TLSH
T1B67501A9B35018F8ED67827DCD568906E2F27CA64760C65F03A4361B5F333A14C3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe
Size 1.8MB
SHA256 c5803d1def0e62cee37930dd62fa99cdceffd097f6b0f87463252d5c18df2d42
MD5 2208dc11a9469e7b37fda2863cfdd1ce
SHA1 733c809ad3157cdaa7b2babe441302e373c56329
SHA512 397b7b8c703c534ba2331abea2bebbd42c8e3d998ad477fb3c693f6bb854782940d81f2590c75a1629ef4e1e04fee74340a3a0cb2935a58da109277550b4ab2c
SSDEEP 24576:h3nd9CHKy7GZNqAC/PT+S1g0xHnxC4bZtxoEgmK0:Rnd9CHKya5CS4g0djtLhVR
TLSH
T1D995CF90F3E410E8F1B78A75CD768511DAB67CA95B31DA8F03A4251A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

disabledupdater.exe

Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe
Size 6.2MB
SHA256 5649f7bfc36b81a494b06ca3631f759fc7cd8cf8a7cd81c1efe419218bfd2b74
MD5 a6e88d1f8379d809abc00e224b6dd0a5
SHA1 dd07cc25aad65d77c2b189cc5c78098eb46d87ce
SHA512 9cb55f7f460afeef509ca5642bc8df2b67f03f10942442b3d6f985eb45e877e5a4060ccad9d7adf46f284e1a01c04e0eef11efadc7d45188a4bc6a346419b106
SSDEEP 196608:yog1P9fIlOub6IgF+I3m2MXP6HG8QzX41pR:yognqOI6IgF+qbM/6HG8Qs1r
TLSH
T16B668C23A4E04035E5F733756D2CA7395A327BA29F3145CB86906C946FB83D3293936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisabledGoogleUpdate.exe

Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
Size 6.2MB
SHA256 070584c85aa204563ad2f947eec9c81d2058a9cc6c045f13f35ae48e9e566475
MD5 733c7ce975a71a29ca267e8a78cbf51e
SHA1 3f53ba9d1c57eab5343dd1e75396acb7d8b028b0
SHA512 8c67f07aa4c2938409f27a7670efe47ef0b687acabdfddd1f63f48dc5c0655a2e7712375ef4d147c85fe02e975f8d3c844bf82d0175c3273de2caa3a1c6f3384
SSDEEP 196608:log1P9fIlOub6IgF+I3m2MXP6HG8QzX41pR:lognqOI6IgF+qbM/6HG8Qs1r
TLSH
T1FA668C23A4E04035E5F733756D2CA7395A327BA29F3145CB86906C946FB83D3293936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 9e9247f443a08c9b17a5032d94370816031ac03d4c5cc35b2b3d972dfdbd2a63
MD5 55741702da093ac95508702686f972d3
SHA1 250d06416fd99d4f2d1f34052854bb7299f9d527
SHA512 539e86e4c14fe801925d73ce5fa7b85f6d05ca5c0d52a41ac1e5b4751df7ac3e9f8296fd9e1582e9560355cae55469c3176444a06bad91fc058229499d1ae723
SSDEEP 49152:Ob+632BuPkFKRrdE6ohmstBhuXjfS4LWxn/CS4g0djtLhVR:Q3q6HjBaL4/dxL/R
TLSH
T1D8D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 2.3MB
SHA256 9139016d18429097e419fb880cc92ae277354aad9a4283a804f3f2c9aa74e3b8
MD5 49d12e95f17fdf1359db15e169bbf24c
SHA1 443d1150d380437a1222f293dd6304c0cfd82a12
SHA512 b1d3b459ebfdf45ec5f659cbe45e64fde52dc1d3d6d5bd8322888a6a8d6f5b2822e0fed4f5347f5e3a1a9693b871d7aa253fa249bab55736b1c99f53e58af096
SSDEEP 24576:+XYT/tczAOqAC/PT+S1g0xHnxC4bZtxoEgmK0aeSL/Wvee9jYFNZ+rSrpUqkLsxJ:htc9CS4g0djtLhVRaHL/iiLONqkUJ
TLSH
T1BEB51228B3D409FDEDA782BDCCA29216E6F37C958790E79B039099350F33684593EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 d4c11176ac4920daa91e1ad657e2ab3a7e81e7ecc3db03e84f344f5413094edd
MD5 135540416553524eecdf30ba205d5541
SHA1 558e063aff81cb72d584876b0a16702fbef7daab
SHA512 f69394053601ab7bd73c9e69ca63a9c46b2dab8887ff048a792b8a2d4e5c718bdba68ff2fb160741f7899fa87d668ce66930b1be140fd466861f60267578cee7
SSDEEP 24576:FXYfDtczAOqAC/PT+S1g0xHnxC4bZtxoEgmK0:Qtc9CS4g0djtLhVR
TLSH
T18675F128779409F9ED6B827CCDA28501E6737CA14760E7DB03A4A52A1F333D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 2c52ec26b456e2c77d910aa7323d837a377771bada24194c098942f1a63322a1
MD5 ef6595c7d0bf7f8e7930a37b0241d903
SHA1 65d27187ec5a3cb0218e43dcae571ceb2837979a
SHA512 b70f4d07832ec549af3e9bf08bc046cc410aea7a4bbf5844aa83e79b6e0019d9421d5fadab031aab004053f708de8f53d88b50c22ff71407b2e7b94c243112cf
SSDEEP 24576:zwuFOWwqAC/PT+S1g0xHnxC4bZtxoEgmK0:zwKOVCS4g0djtLhVR
TLSH
T12275F14A76A40CF9E9674278C997C132F7F2BC512A21DB1F0760C65B5F37261AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 19f94b1f1e1e40165eef801de1f09dfc35905f08b8dc78e686ef489bb3cf04bf
MD5 4af0430a941888acc56544120ed8a84e
SHA1 f2cc8f704748ea9f81c373fd6947a7754ccf20e5
SHA512 6ba9d80711b3555b0c7f0f8763e4881341b0fa96d673b7488015aadb6245650734196e2e848cce3cc1cd9c9114e6c534a1a255899454d03f0a7cabdf28403550
SSDEEP 49152:bB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glmCS4g0djtLhVR:Nu6JmVxd2dmL4/dxL/R
TLSH
T1E6D59D13F1DA01E8D05ED478974A9233F962BC490B35B6EF0A9072562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.6MB
SHA256 dff83bd97e81ee1516be9677ba46f9062275aac98b82f19e16bd33def0475d27
MD5 b9081ffc0fc5291eda1dd1c387f3361d
SHA1 4e5552c91918a6abf2a1167f4da4007e3fd6a2b3
SHA512 546223721f476856d28a96dd41f19600f145b6fb9a3028238162ec400155bba63fa982e4e3b63dfba96421f231cdfa54ad5564f061b23c50023d64298b96acb2
SSDEEP 24576:SfwvJk9RX6wkyAIpqAC/PT+S1g0xHnxC4bZtxoEgmK0PeSL/Wvee9jYFNZ+rSrpP:fMnYIbCS4g0djtLhVRPHL/iiLONqkUJ
TLSH
T19AC5F129EBD804E6E1B7927C89E7470AF2F178695B31C2CF1286526D0E37ED49D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.6MB
SHA256 fa1ecf5a72f874ff5604da9245422589f23c05b3e25501deaf61c0c13481e16f
MD5 1fa9ed251d7c14c9074bd35439be852d
SHA1 42689396bf200ea2f30df47c5d543fa609760e3d
SHA512 18a137bc52846f0e6b634a5d933f83fb0d0f3458210f10dce22b07697bf6782cac47c089a3559ab2c62a2285e0fd76560b63b47866baaec7e6d8277865b5b51a
SSDEEP 24576:YZwvJk9RX6wkyAIpqAC/PT+S1g0xHnxC4bZtxoEgmK0PeSL/Wvee9jYFNZ+rSrpP:bMnYIbCS4g0djtLhVRPHL/iiLONqkUJ
TLSH
T12CC5F129EBD805E6E1B7927C89B7470AF2F178695B31C2CF1286526D0E37ED09D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 118e80ccb8d4a31755344d35aab591052f3d232405a87133ca6b63b90ae05616
MD5 ea2ea0597c5b5a55813dec6c1402ead8
SHA1 8bdae67039ffd1c1b4d089e509190a09965d5945
SHA512 644a64bd586f31333d177911d357fcc5a8483e2edb392a048bfc5e58a1790a24263f8b06c9fc1411ed794441d5f739df781b12aa96d711cadbed862c8f99d6af
SSDEEP 49152:bYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0WCS4g0djtLhVR:/ySzP+L4/dxL/R
TLSH
T156066C96A16801D5C1B9C1B98F1BCC1BFAB134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 4.3MB
SHA256 614129da3bb1adc7b4ba063a7fee73d188109c9aec240d35b2c8834fb2dec124
MD5 d8074fe96b683a53c7720717090cdf21
SHA1 a347ebb28abe70c309f058169e4f679a1a1b65e2
SHA512 860cd88522d5f35843599e35d881c5fdbbeabef8656205a6ee2e5174a6e12a06ac6551ebc6a32cd3311eca18887267fad9dc84d72257f35594754e8433f4fabf
SSDEEP 49152:DYITNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0WCS4g0djtLhVI:JySzP+L4/dxL/RELfOq
TLSH
T18A269E56A16801D9C1B9C1B98F0BCD1BFBB134490335ABEB02E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 c036c89f1b92754b7e32393afd524a48b430e74c885e2217ce9eabad83d2a194
MD5 1c332a35a423e3169ba87b453b19cf57
SHA1 063004923b987f6d2ac0269b5b250e2780e0a4e5
SHA512 2ad29999259f0a393b9abb0e816ef53c72cd7bebd1927fbed319ae862f223d3b4996173e916a57d076e943ec2630de220845a08f94fb1f324aad6220e7210526
SSDEEP 24576:a47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYYqAC/PT+S1g0xHnxC4bZtxoEgmK0:a47JUQj1irIhCnDHUPfF/mCS4g0djtL5
TLSH
T11265AE1DA3EC01E5E1BA827885154A5AEA71782D1F31DACF1270937D6F23ED48F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 2.2MB
SHA256 d2fd6f234d8e547fbdaab96e1bfccd898cdefa5d5327d6a8eb8ea385305d79d2
MD5 0b23a538b4c150fb18c1dfa77eda8217
SHA1 8b447ceba2564fb2b03607a37e626b38125441a7
SHA512 170f64104f30219c2655da729f6b95d5b48b8ca70be04e8340e9b930a2bb0915f1c5bb71c5d8f4a7827621c82d4913fcb19e5042d27a6bef1195f0ed092a3638
SSDEEP 49152:Mc7JUQj7irIhCnDHUPfF/mCS4g0djtLhVRrHL/iiLONqkUJ:TJ5glD0PcL4/dxL/RrLfOq
TLSH
T1C5B5D01DA3EC02D5E1BA92788555471AEAB1782E5B32CACF1260437D6F23ED48F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 ea64780aff06cf6ac40d7e61f391ba21d385c572219cf211a795d27c189bdfe2
MD5 d46520a6867beeeb3712481a3f94f68e
SHA1 e29c93d5c4418a73cf51e9eded6a5ef3d6e42a6c
SHA512 956b96bd53604debb6b85477de852314e85861510ae58989b4e80253429e93cfcc0f72b8c323160a343bf550ab8d003a9463850917d361e582ba08cc2f88aaf6
SSDEEP 12288:8Ifs8p7BTqFA+f76ZrgASos0xGBnRy/ii/tNyM:8L8p7gFAbrA0xInRy/H//p
TLSH
T1353517117666DA4FC6A940321E37D1CCAB707D11EE44AF0773C9873F8576A58BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 374KB
SHA256 9ddc4e31775ce30362749b611672a7dcbb2737e7e49b1f5d7df0ffd5d00a6fbc
MD5 900f3c7486ca937c67658e40f9418e66
SHA1 487b597487d63dd692293da82a83ae0a4d299270
SHA512 efe6dc9eb8095e8260c92aee9cd618a029f23f7df70a66246b5b5f42ce302ad11a04886d59f65a3eaa2939c2f965061ee2ec170ca3faddf1291c11a3538da19f
SSDEEP 1536:N2TPzDPD3R8BD0R9IZWAjctIZwSrOpIsKswXEWj5S9okKYDMel5b:ADzrl8Bc3UcGXUK0
TLSH
T18884F701B7A5E31BC9B980379871A58F9B3DB8129F116E033BD84C74DCB215636B2BD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EditInstall.docm

Path C:\Users\Admin\Desktop\EditInstall.docm
Size 775KB
SHA256 acf62449d30b900429be30725e4b6aac6335a6e6a5be778f5a703dfd9e3d6566
MD5 f43d8c9175fbb46ccbb8bfd26a86733f
SHA1 fc72f46c9fc0f1016d35e6c71d6b89c60ea7cf22
SHA512 db517331dcb2105e4ca90f880342e112cf7361e897de07ea8d1c15b0431ac76024eb06ecc8c65f227aece9a40390569d32d3c55455d3d420524832fbb3d0278f
SSDEEP 24576:x86Y4sKuZTOtaY0oP9Mxd4PCzdhGrigyrpAZO5:x86uOtabolcd4P0augyNA45
TLSH
T160F4335046CD64E8D3230C361EBA510B6EDFD61D0923C6FA29B3B2024EB89A77F5DC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RemoveSend.docm

Path C:\Users\Admin\Desktop\RemoveSend.docm
Size 773KB
SHA256 4820d9798c02b17fcf4a431f5dda91572e1300a8f8f2a6b15fbc23f03973630a
MD5 963dce953cea811063e18848afef3695
SHA1 92254d89d89dfcbb94e7508d76c45c61017f188a
SHA512 d9df608dcf3879a78d75c6ef14335564e50ae94d6803c52fffb97d8853c4e3d1ab625e5798408328bf46baef6f958a83154a4601bc15f9086c0aebf785a994cb
SSDEEP 24576:S7k2meSWNlFEm46zESR/XnVgUg1NbZ6mgEa:So2FlK6zEWfnVWb6m1a
TLSH
T189F433F283E7A657D6671F77A2C4D534E888905780FCB8D09AE15C9F1AC6C93FE02066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HideOptimize.docm

Path C:\Users\Admin\Documents\HideOptimize.docm
Size 775KB
SHA256 676ae69c56bc2b34d7acb7a994161faa7ccf34fc87bdc2a2f1de6447f1ce18dd
MD5 e5ef5ccb8ffff3e39340ecb59b90fd2d
SHA1 9261cb66e6483ffb93f4a729c85aecb29b9f9f62
SHA512 fffa7557495a2d95672f55f703f0656669a335d5a6faf41f292ab10e7aad238cf37e51c86278fa9103877236ec3382e819fcf579e1203c1dd1ecbdc046ba7a7a
SSDEEP 12288:Ua1mWQMiEpdj/T/IY6Zf0NThLixKMDa395DZkttJPv7+lGykDLzD:Ua177jl6h0ZMDaXDZkVScDXzD
TLSH
T10CF4236D9CD65784FA3A4FF5D1F3A141C2F540722A02DCB1EA38A37C66C822729725F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Users\All Users\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 1.8MB
SHA256 9b646ec42c3dbdbc74e9251051049108a705a3315ceff4aee6fc21f1544cf889
MD5 1fe8f87496f53640fed71bb052a5f58d
SHA1 d7aa967a15a511fa39ba8ad9f302f310b513476b
SHA512 37049a6870a9d768f206d8424db1a781b9626c5a8c9decae5bd16c1421832816d5585eb561ccb4c1a1a7de3e5437e4a01d0f1318f80b87108c7cce631099c32a
SSDEEP 24576:r3nTi63isqAC/PT+S1g0xHnxC4bZtxoEgmK0:rXTiMVCS4g0djtLhVR
TLSH
T1FB85BF12B7E99135F6F31B30AEB592515ABABC719D35D20F23C42A0D0DB0990EA75B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 7b375f057cbfa1f24e222d7a211096dccd07e58810f1082603720942424d2861
MD5 e2881d2dcd414d026317589c76d3111c
SHA1 aa0b6d014e18464ccb67d56bb4192c5bbddd8203
SHA512 6b2716c80eb6f50da716e52a6e45b0e88c920eda06c09253a5d3674dc6900bb4cfea9d7021c469a180efbf30b08c69925da7527d4f9b1bf310f675075a4f387e
SSDEEP 12288:i47tRZ8XAFY/PT+SV3bg0x8QT66IBmxml3MxAGhLvm2H5tVLoTpXGgmK0:b9qAC/PT+S1g0xHnxC4bZtxoEgmK0
TLSH
T1F0652336971C1A4EFA6E06F0CD9AC210B599BEF09701E5DBE604B14F5C389E0CD7E522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 2.1MB
SHA256 95c59428c89f74048d83f726ad0bcf3fcd5b4aac9b4f77cc93be4a1f29bf698d
MD5 dc94fc7535d30c057223f59a8a12099f
SHA1 e35a9c556645e2ded1f106655251da7d9b8a269a
SHA512 445a27c43f67845cba7de925f3dc5cbd0dce097c9a247956e4a01c77053bf76791a248a39bfbb7f9eb328573c59120b240c1a788d84443bac35a83bee9b52d4c
SSDEEP 49152:3gb4mBIBhGFECS4g0djtLhVRCHL/iiLONqkUJ:3t1L4/dxL/RGLfOq
TLSH
T10BA5D01E22E802E5E0FAD2B8CDAB4517D6B278165332D2DF1151423D2F3BDE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\System32\AppVClient.exe
Size 1.3MB
SHA256 4456fbc911424dc57c6ead030d06ab65c96c09b26d150c2541860f0e406a3c33
MD5 ce49ce96e8ec60b4cdf1decb1d528c52
SHA1 141095552ffbad424953b3b9df36cf2e843abeed
SHA512 e08f944377d1117f716a038a680e3a9a8cb0b4eb09f1a5af3172032abc3d8b704b93142fca91a1ee9148bc27521ce3af904d5e55fd17c07653da755ccaa936e3
SSDEEP 24576:B8kNvNnaFeYhJNtmZBmCqAC/PT+S1g0xHnxC4bZtxoEgmK0:B8MwBtOmiCS4g0djtLhVR
TLSH
T17155AF6EA6B806E4D1FEC6B4CD238512F6727861173293CB5290C13F0E679D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 828KB
SHA256 5561c96d0db8540d8b5e8703a9a498d77ae7f32fff21b6286db50c8f17a134ef
MD5 d678a6e78ee2bb617981021c9cbc1f56
SHA1 03653f470b689327c2129ce324a88ffabf9c6c32
SHA512 883b9fbf143d7c44efb617d20f9a47250af6a551b759ba72c5e6e86f01b45cb30c9c7acdcacccd06e1c20bd43e3763509056bbc37a2d4aa80440cb2d39b5d9d3
SSDEEP 12288:nIGxcR4uS7v/Xf6Lv/tIuR9jM7U0N1FNZYQZ6k4rSzXpUqkLMtxv7Ya:IGxeSL/Wvee9jYFNZ+rSrpUqkLsxJ
TLSH
T17E05226C72E6298EECB696BE94F723BB71F63455E78596EF40C188744F22CC06130E49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.9MB
SHA256 ae1f69b16ca70d8a4f83ad1cd2599c01ccac93859a2a54fc905ca68243fb2b5e
MD5 37d28147c38ea076c2016f92c3612df2
SHA1 519d4563f626a9c9064ece25fe812bd58eac42f3
SHA512 0cdfb047948561f90de0f6ccf646720f9719d98c455466dbeffe72c73f4f8c39e9d3f04bd36d214a3450c8b5ff1461775524993098f0233d2ea8ac846f07472a
SSDEEP 24576:aG88u8FpJqH1Kzria7/mIqAC/PT+S1g0xHnxC4bZtxoEgmK0:h7ZFPqVVa7/lCS4g0djtLhVR
TLSH
T12895F16576E101F5D47BD138C9864663F6B2B8210320EBDF07A89A561F33AE14B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.6MB
SHA256 d444dbf4dae3c92add26aac6dfa69ac07d504754ba20428c6f46156d5739675d
MD5 4a231c7cd95455facced0a82da7fca37
SHA1 7851730ba9064cca53d91adb28f8a839a5b6e9ee
SHA512 ce2fb4c2c23d6e0ed18147078c24f7429a173462959b665c9c348f328e3ccfdc09055816756923c1e0f1f9f9ecf260b43c91404f3f908f5c5f8d2289f2e9aa7b
SSDEEP 24576:MPUr+NQkqAC/PT+S1g0xHnxC4bZtxoEgmK0:MJQoCS4g0djtLhVR
TLSH
T1E875E22F62AC18E5E67AA17CC9868709F77178621311D2DF02D0917E4E77DE8AD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 b56a6e7b21646b403e7e73aed72f87b846079d9d70c3c9ddb6b76424b4251681
MD5 d947ac98735da823846df3f27293855e
SHA1 808b9d884a83cd8cca7ad03e073e0c260c5aed68
SHA512 3a9ede122860d0e21ff2728d2d3cd4871eb8bf3c01717da18780f5b8f8fd3e994f8867e3a75a4d4a60587d1b03f4853a5f9b17ad0863ebc83cede5f05077061a
SSDEEP 49152:gBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjYCS4g0djtLhVR:bG05lO43bzL4/dxL/R
TLSH
T14BD5BF6E62EC11F9D1BBD17CC9C6460BEBB23825032556CF02A486A91F27FF4997E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 b6eb25a3037b1e28dcc8e9438302f171d08bbb1665e5e2f87393ad4d891c44fa
MD5 50544adf3dcdedb1a15501002b6c1252
SHA1 e55d4c5058b617e3b1eee85437ef0f1eec43fd55
SHA512 9a0ecc57f3be6db6ff97cdc345cf4b2db99a2277a28b425e84bebd68ce21d17bf8660f704e7f8da2483afad341b60947145c8b28067cdb788c5aeb9b99c233c3
SSDEEP 24576:9fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnuqAC/PT+S1g0xHnxC4bZtxoEgmK0:Na5POZ3+Jt2pasx2+mACS4g0djtLhVR
TLSH
T15865AE5EA6F801D5D5B9D17CC583861AF5B1346153329BCB022182BE3F37EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 f02727ca18d1dae0e13fa30e46337c6cde68538aaa56868c61a852af6b11583b
MD5 f00e483ad376cafceb5af3a82f15b82b
SHA1 17094596a67ffffd211330ab4891043a3a5e751e
SHA512 e0c5d0c4b2cf822dd0f0e5f0748557a8ef15ce45bb6555c3d57cb80a64d78c80220daf2fdefe1ab5f265e7ba84906a01622b45696a84d8f4a4a2733c52727842
SSDEEP 24576:HNcwHdjbyQ4nLC18lb/EOjowL7FkQqAC/PT+S1g0xHnxC4bZtxoEgmK0:HNc/zEOVHFFCS4g0djtLhVR
TLSH
T16B857B2623E901E4F5BBE1BE89679546FAB17865533086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\System32\Sgrm\SgrmBroker.exe
Size 2.5MB
SHA256 b50b821b75082ed25906eb8c66f5fff23e5b44bd8d56c8a02fc1c5da0ea7cc4b
MD5 9e1604c5a421c16e30d883b196efecf8
SHA1 2d3a71cf9aa6b6b64422edb6d3ab3540a28386f7
SHA512 96b4ef5bcadb04222805c2fe7e6b95479d75aa5e41ea7a0dd6e54f1d2c61c32ce47ea16a13a6bf46294b1476d4e0c8080bf7534bfcb2496b9f1d9fc65ab90d27
SSDEEP 49152:BDVHeBIAADCS4g0djtLhVR0HL/iiLONqkUJ:bL4/dxL/RkLfOq
TLSH
T1DBC5027DE65C04E9E57BD1BCCAA38706E2F138A9432296DB118081B65F3BED46D39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 944KB
SHA256 2232c8e71a54d0f05c3cb0c184bb346da7fcec6f8847b01aea69388b2fe225f6
MD5 4ab76ef81f3ee1268450aa167e5dfd9e
SHA1 f2f5759d98335d2b9b59549410d04450462dccb4
SHA512 3c4fdbc19ff883a3ac25029dcfdda47be7ead6802568bfa0afccc788800439007a9282575eb1035c242cf64de0371778126437013b2c35b4dc5bdf071c2cbc17
SSDEEP 12288:v1Hck6j5ZI7icR4uS7v/Xf6Lv/tIuR9jM7U0N1FNZYQZ6k4rSzXpUqkLMtxv7Ya:r6DIGeSL/Wvee9jYFNZ+rSrpUqkLsxJ
TLSH
T19125015C73BA11FAE0B7E07E85930316D2F2B465D7429ADF468089B94FA3DC8B538E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 928KB
SHA256 efab53ac092ccfee96d451ffc993ae6a2bef19666ca15a0c4eb6635b86a7cdfe
MD5 0d3aa6c7092fcb8b0de72e240176fabd
SHA1 b61aff82761adb100e070ee7234c0bd2840917fe
SHA512 31f4836c5475abbd51ca79db6dfdd2ab70d5ae353c5b777626bb46069958549c83f18df2f5e0d67a43265fc80e06129171483ea6f80f31b2e0c50510601b0c89
SSDEEP 12288:fG6kyFcR4uS7v/Xf6Lv/tIuR9jM7U0N1FNZYQZ6k4rSzXpUqkLMtxv7Ya:utyFeSL/Wvee9jYFNZ+rSrpUqkLsxJ
TLSH
T1A9151208A394258AFDF656BD95B753A946FA7C25EB42C3DF50818A3D0F32EC0A430F06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 800KB
SHA256 c22744778597808e16527e69744ba9a3fea477a9176841a15338b57b4f1adeb9
MD5 461461dfbf57563babd02d780ac58863
SHA1 ab0c41695593a000f02642c0d4e3e8057e2210c6
SHA512 bffa966054fe39358255bb9477371eb58a0344effccf9daecaacc7d30379b324f6fd6fed81ab96776836575fe8d036494ee880ee5431b8a22766f9901dc3a443
SSDEEP 12288:MoncR4uS7v/Xf6Lv/tIuR9jM7U0N1FNZYQZ6k4rSzXpUqkLMtxv7Ya:XneSL/Wvee9jYFNZ+rSrpUqkLsxJ
TLSH
T10205235CA2952A8FECA666FF50EB337F51EB746AE78786D7A0814C704F12CC05170E4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 0a09f32cb7b6405a0f197a884c19982d2b10aadfe7e0eaae88d1bff575dd75a8
MD5 e1f355ed48ae32dec5b1ed136479f9c8
SHA1 d9a44e0e59507a031f10493388a1d1ab79f61483
SHA512 931ac40f549d57e90c34fc28a3b8ccea29f4748a9274cdde841b645f85029ffd42c6db2fd1538ac889fc740882393dbcc4a19d33c8608d851a0f116897f94e7c
SSDEEP 24576:DYgzLoTfaidZYeSL/Wvee9jYFNZ+rSrpUqkLsxJ:8g4TrZYHL/iiLONqkUJ
TLSH
T1B0659D1DA3EA05CAE2B2D679D8631493D673B4315772C6CF2448C03A4DABED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 2.1MB
SHA256 9638ce933b172566ef4bc42bedd0f38ef4d0ac9b72f2776bc013bf303e37bac7
MD5 c18cc7cf2f010e1a53db056160b2a9f3
SHA1 a2394b58d12b3dd6e9d44534e02cfd17bcf2dd21
SHA512 83e972fcae573d863d01e1a01491f9bdffb2cc74ba141d057ae397727bbc2ee1c86d9be444dccaae8e962e45575da1540c1430121f8dfa8c97d2cb249d49df82
SSDEEP 49152:dgb4mBIBhGFECS4g0djtLhVRCHL/iiLONqkUJ:dt1L4/dxL/RGLfOq
TLSH
T1C2A5D01E22E802E5E0FAD2B8CDAB4517D6B278165332D2DF1151423D2F3BDE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 2.0MB
SHA256 fa8160a14f9a03ef0d1ff96298665f76baeba7674b0fb2fdbf6cffc352912d71
MD5 fbc60fdc2507a111f46911ef6b2bbfec
SHA1 7c4a4646915795f2adc56ac3f71a118b872bcc0b
SHA512 d6aafab8ac5aef8bbadfca7eb2ac1ba6f466c4dd1b65618999c0fb94f227086c700d9b062356602a568c27f4b041ba4eff88732193f885e3d02e7e221f1c8479
SSDEEP 49152:ODMwBtOmiCS4g0djtLhVR6HL/iiLONqkUJ:4FKL4/dxL/ReLfOq
TLSH
T1B1A5D16EB6B806E4D1FEC6B5CD238216F6B27861173293CB5290C13E0E279D89D75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.1MB
SHA256 697d25bd9f3717c47a4809326a8115c0c9bda16f78a169a5d63e834f17fbff8a
MD5 478eb702611987c738af4d2e915f6824
SHA1 c7303d9fba643420c5c62ad18f1f1e7d0a395225
SHA512 f812785eb568647d50d6c240fdbd5062dec079e9b8558ba3fbb66c28f85e7cd44434ac2a02f49fca88ee985487a4b17b19dfa0b6407d213feb567546415111a7
SSDEEP 24576:WJnJPbzB4SfeSL/Wvee9jYFNZ+rSrpUqkLsxJ:WJnJv6SfHL/iiLONqkUJ
TLSH
T1D235E13CD2A810E9E4B7C2B4815A276AFFB1386D2F1669C755B4C4343F12ED0A979F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 792KB
SHA256 104f114b42ccf48dff462ae0926182b8b0d71608f2d519ffc550f7e0291ccec7
MD5 15d07b0c17ad4ba45763307aed6d9b63
SHA1 ad8ec2c8ad9ade987ce762735736294d52c6fb01
SHA512 f08bf16281b87f2ac57666655bd0bfee4ee9d69d133112a3bdafcb2b76164b3bbf688316206c4e72e19a34dd53199a75c2d3f9a0ea7ff3810c1aeacca40a05fb
SSDEEP 12288:C/cR4uS7v/Xf6Lv/tIuR9jM7U0N1FNZYQZ6k4rSzXpUqkLMtxv7Ya:C/eSL/Wvee9jYFNZ+rSrpUqkLsxJ
TLSH
T11B052398B2951A8FEDE666FF54EB337E12DB785AE7C6C6C3A04108714F12CC46170A4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 936KB
SHA256 737d0cde462a63b29b125882f80fc535de6608b275cad6c961bcf9fdaf1db3ad
MD5 f6b4aca3f353385c5635f64e718292fd
SHA1 01cc63370be4ea7a45cfc502a356b2c92d736207
SHA512 5142277db28989edc755c1eaed868a8a7fb271b85d4c2c4b52ea33a5919e0cf9b4dfa2991e0ae2865d197e8b9c629d1db2b6b1d9bb3ac06c4d2d3d8effcd48ba
SSDEEP 24576:d6Uqjp9eSL/Wvee9jYFNZ+rSrpUqkLsxJ:d6UKHL/iiLONqkUJ
TLSH
T1FB15225C62D428EEF8BA52B8E4B7533A41F67C26679686EF70C0897A4F32DC09135F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.1MB
SHA256 7d922527a0e9c49436dff98e5db3ae66e630c432234eabad66635b29e57ec2a7
MD5 6bb72fc56c31d4231508f9dbe56cbf5c
SHA1 109938586e9110805df9a7e6258f19bacf2e0cfc
SHA512 27dd7a395f308b4f31d6787cd0e9b7a9f27667ba492fc4829d8a380c9c4c7081cfd556e2969d7adb696e6093f944e4a24bf8fd65332ae6033b6b8a0f404d9296
SSDEEP 24576:kCLHGL0MoeVtFumTijCmlKQWDkleSL/Wvee9jYFNZ+rSrpUqkLsxJ:kCLHGeeV5ijCmlDWDklHL/iiLONqkUJ
TLSH
T1DBA57C05A7EB4188F8F3CAF5C92695169A327C549B34F7EF4A80C96A1E32FD0D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\system32\wbem\WmiApSrv.exe
Size 960KB
SHA256 be6138e20bbd76d31fdf5e1804a93b321314e24b4937e03413e9f65e2111daa8
MD5 557ba1a3f06a6e0768a1fac2b5e056c6
SHA1 ec7eda35d4a831f7faae45ab6e74318a3360d1b5
SHA512 a43c75fe1def480b857e1a30bf58f827db602dcc09b4bcd28c8646a6cf45dbbb818b04a5208fa62ece17ae0509e6880a720b10f0e0468f332717e30d12710e5a
SSDEEP 12288:JpJcm8CNRRcR4uS7v/Xf6Lv/tIuR9jM7U0N1FNZYQZ6k4rSzXpUqkLMtxv7Ya:JrcmRPeSL/Wvee9jYFNZ+rSrpUqkLsxJ
TLSH
T10B25015EB3AE00EAE5B7D27C8886035AE2F37031A34297DF41918B7D4E279D87934B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\system32\wbengine.exe
Size 2.2MB
SHA256 7d8889ccbe773f84ec645c5f0cc10704487502d1ca6fe4df4070259370eebe72
MD5 0d593db0b4aa6752ad7fc41e90c8cf80
SHA1 18a8de803bde69529290ecb674e1d619cdba7970
SHA512 4cf155eb6c6d7f0eab77dbcf50c2c47969d950109e40f0bfcaf842ddc8c352439c3550742a9ec405379ed9b66be2c97cc8bd5eb5462db123fc642c4211080a52
SSDEEP 49152:FDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3HHL/iiLONqkUJ:G3Upow8sBMLfOq
TLSH
T149B59D3DA2E800A8D9AAC379C54213A6EAB1742D3F3055DB0170C578BF1BDF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1236-48-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/1236-58-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/1236-47-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/1236-54-0x0000000001680000-0x00000000016E0000-memory.dmp

Download

memory/1236-62-0x0000000140000000-0x00000001401A1000-memory.dmp

Download

memory/1276-63-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/1276-73-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1276-64-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/1276-302-0x0000000140000000-0x000000014019B000-memory.dmp

Download

memory/1396-373-0x00000211CB670000-0x00000211CBCF0000-memory.dmp

Download

memory/2604-100-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2604-106-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/2604-101-0x0000000000970000-0x00000000009D6000-memory.dmp

Download

memory/2604-338-0x0000000000400000-0x0000000000563000-memory.dmp

Download

memory/2712-141-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2712-140-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2712-363-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/2712-147-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/3020-173-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3020-162-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3020-161-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3020-168-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/3020-175-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3316-17-0x00000000030E0000-0x0000000003165000-memory.dmp

Download

memory/3316-93-0x0000000003D70000-0x0000000003DD6000-memory.dmp

Download

memory/3316-9-0x0000000002CE0000-0x0000000002E18000-memory.dmp

Download

memory/3316-61-0x0000000000400000-0x0000000000705000-memory.dmp

Download

memory/3316-86-0x0000000003D70000-0x0000000003DD6000-memory.dmp

Download

memory/3316-1-0x00000000025C0000-0x0000000002626000-memory.dmp

Download

memory/3316-6-0x00000000025C0000-0x0000000002626000-memory.dmp

Download

memory/3316-7-0x00000000025C0000-0x0000000002626000-memory.dmp

Download

memory/3316-11-0x00000000030E0000-0x0000000003165000-memory.dmp

Download

memory/3316-0-0x0000000000400000-0x0000000000705000-memory.dmp

Download

memory/3416-110-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3416-31-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/3416-23-0x0000000000E30000-0x0000000000E90000-memory.dmp

Download

memory/3416-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3752-80-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/3752-322-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/3752-78-0x0000000140000000-0x0000000140197000-memory.dmp

Download

memory/3752-91-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/4600-121-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4600-111-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4600-351-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4600-112-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4600-370-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/4600-372-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5020-126-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5020-356-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5020-362-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5020-360-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5020-127-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5020-133-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/5800-35-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5800-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5800-44-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5800-139-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5868-184-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5868-178-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5868-177-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5868-367-0x0000000140000000-0x0000000140172000-memory.dmp

Download