5dd3ca78780c2ff8a2e7fff04a373411090a1746458c5b491142aeffd8f2f8c6

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
Size 2.7MB
Sample261110-vrftlshb32
SHA256 5dd3ca78780c2ff8a2e7fff04a373411090a1746458c5b491142aeffd8f2f8c6
MD5 696a230133026b8b20fffa16628c24fc
SHA1 b157341adbc2c55ae1c559fbc5fe1b34b9c2785b
SHA512 27afedabaff1aaa42a7b46722effb1caf14ca94785544ac8a18b9eebc68dbe787ce2cfb44f1553ae201f62a34fab8a13c93aa188b1159eb4b6484fa5707f833a
SSDEEP 49152:Cwj+Go/U/Mt6F84nF+hvNtioRiQapt8IzLha+fZdr0l573uJ+ur2C0BspWDmg27z:CbE/Mt6F84sDtioRiQapt8IzNZdM73u3
TLSH
T1B0D5AE313B91C039D2622632995DA37962B9AE705B3443DB66D02E3D7E701D39A3C72F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4940	elevation_service.exe
2544	elevation_service.exe
1052	maintenanceservice.exe
5320	OSE.EXE
5784	PerceptionSimulationService.exe
6064	perfhost.exe
3668	ReFsDedupSvc.exe
1460	SensorDataService.exe
4300	ssh-agent.exe
1464	AgentService.exe
5184	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\576e5e40612dd39a.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_112109\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004d67c1d03671dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec5b63d13671dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000030c5f0113771dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000058683fd33671dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000057d77bd03671dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000c2d155d13671dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4940	elevation_service.exe
4940	elevation_service.exe
4940	elevation_service.exe
4940	elevation_service.exe
4940	elevation_service.exe
4940	elevation_service.exe
4940	elevation_service.exe
2544	elevation_service.exe
2544	elevation_service.exe
2544	elevation_service.exe
2544	elevation_service.exe
2544	elevation_service.exe
2544	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5172	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
Token: SeAssignPrimaryTokenPrivilege	1464	AgentService.exe
Token: SeBackupPrivilege	3668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3668	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3668	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3668	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3668	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3668	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3668	ReFsDedupSvc.exe
Token: 33	5184	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5184	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5184	SearchIndexer.exe
Token: SeDebugPrivilege	4940	elevation_service.exe
Token: SeDebugPrivilege	2544	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5172	2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5184 wrote to memory of 1996	5184	SearchIndexer.exe	100
PID 5184 wrote to memory of 2848	5184	SearchIndexer.exe	101
PID 5184 wrote to memory of 1284	5184	SearchIndexer.exe	102
PID 5184 wrote to memory of 5880	5184	SearchIndexer.exe	103
PID 5184 wrote to memory of 2272	5184	SearchIndexer.exe	105
PID 5184 wrote to memory of 5748	5184	SearchIndexer.exe	106
PID 5184 wrote to memory of 3908	5184	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-09_696a230133026b8b20fffa16628c24fc_darkgate_elex_mafia_remcos.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5172

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2544

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1052

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5320

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5784

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:6064

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1460

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4300

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1464

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5184
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1996
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1704430598-3087477806-3297458608-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2848
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2648 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1284
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5880
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2272
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2840 2648 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5748
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2884 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a400b95e69fe81d0d512795a24f174d3ae72a620861d60c4f9a35b5e14517455
MD5 d38fd779967dbfce13ab69ce2be08bca
SHA1 8ff838948b1168e28119302d781ba62553831361
SHA512 eda00a47104945a80ed6ed52c2975e0b6698af1db28294f15eaafe6bf513099ad5b8242135a58508b26a22310a7c5100a7417ba4c26c054f731c4ef27d85b3bf
SSDEEP 49152:lb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn9Dmg27RnWGj:73q6sjBeD527BWG
TLSH
T1C7D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 878242e7b8b97a9132ee4ffb9c4d6400484164459dcd83ae1cb899e0846f2afd
MD5 925e2068f984732ac30aa2c6a308c90c
SHA1 40ccb04387d714c9c53ba1b6c3ad5595b6e8ed99
SHA512 7769f4be8a9a4dda50fadc699394d23dbee33ac84996aaeb0cbae48814226eddda5d26f9a8f2ece4f895b56c1ed5b0d9427f717f6422708f2384a593ce09977c
SSDEEP 24576:wXYfDtczAusqjnhMgeiCl7G0nehbGZpbD:Htc7Dmg27RnWGj
TLSH
T1FA65F129B3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 f9edfc161d9bee12aa5ba560336fa3ac1623534612d784caae246e06cd74bf39
MD5 8428c0bdbfd481cfab5a781894956dea
SHA1 dda21bf7105e2016d220964815b3e401c2114cff
SHA512 0ce03a0795580ca197b03c916de89477c83aa56e0fa703fa92528bb079de0cfce85e0c65512b8273f23338a6fa4f0b3383a85341149fbf44b5c4aa3c2a5fdf5e
SSDEEP 24576:T0Le5ji0hmxxrMRsqjnhMgeiCl7G0nehbGZpbD:TPji0AjEDmg27RnWGj
TLSH
T119859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 c191828a8fb995ab97ab29eb5fdd995ec0f95b9b42413635b6c9beb8d478e5b4
MD5 14363b6b5a1a33f257a690736ec66281
SHA1 a9182f4aab3b0885a570c2501524d33abc03a3e3
SHA512 70fc65c13ddf63774c553cb10d16b4f4105cbfbd039c483dba5530f6133bc33e197d19a0dbaf596dc9c01d6c79f01a0e00dfaf99e1fff156c55cf9167faebe74
SSDEEP 24576:Ea7/ezSC6vUyD/aqgrvWn6q8wyu3sqjnhMgeiCl7G0nehbGZpbD:z/ezSC6vUzPveHjyoDmg27RnWGj
TLSH
T113755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d390a4e1a36ae70bada21f1a6f68567064855e8c90699b14a0daa31d1557fb48
MD5 5aaf7bfdc015a92e68118166174f93d4
SHA1 6ca4df9b7d9baf2e467b348d57d911189ada2bf9
SHA512 aff5c520ad4aa3e8d70c2aee0cdd006ecf18145b2d0ac2ed9420bddd5f8fecaf8a79a1b8b0a6dcaafa9857421fff88857ea37d15038f8e439276e60619c17f7f
SSDEEP 24576:DVbqPb88hv/l+YasqjnhMgeiCl7G0nehbGZpbD:DVO88hXl+DDmg27RnWGj
TLSH
T193559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 1888c72e78d3679c364935a649e8f8cb050cbbbff315c61a04b82f5d521fa586
MD5 d410aefabe043df8d652274cef89ecb3
SHA1 730e729459c8bc6b3a06ee3b7847f374dc80900f
SHA512 d825302ba0cdd816fb743a9f9b9bc88361c7ebe090dffbe529196f2de0a05b781af909ffd8b8b3f1e9d0ba2eb3e18980d0f8799ba93934a45ed412658c92839a
SSDEEP 12288:6LNXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6LNsqjnhMgeiCl7G0nehbGZpbD
TLSH
T16F4523BF864C50DAEB7608B5C3E9F51EAC137E56982008536A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 e56dfb204c5a59867a6990ab10c1d616b1df1c0e8c08db75518f6da81302d9ae
MD5 37bcb97e660d2e05e6c520117f0d03a4
SHA1 8d8ae5106883574fb58fccb527d3b6ca6fc2eacc
SHA512 3d8b5c59ad1a892dc2dfe9548d77f3e0ade2682d468f9685d6d2e5e955567da31c697c0b4203bcc7e1ae2e0629c3862bbeed32c2c6506b015d08992adb778046
SSDEEP 12288:HeBNUbTVO86UyXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDQ:HJIUysqjnhMgeiCl7G0nehbGZpbDQ
TLSH
T12465CF7BEE28FCD2C27A8DB85791C600E76278314F61A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 1978e8dbfdc6ebd6aec01e640859b7f1f298bec1ddd7b8ca18901bb321811058
MD5 68a4fb7edb88237df7c1ee839c34842b
SHA1 6ae5309e27e1e2d9ea0cc5ba470f52463e588756
SHA512 632b6856cc1658dfd32dc4c9731a6ef2ebdb0a43d245f211f8bde3b140614dd5204b34d3a6d0103f381991c624d513fceb0d4c0e5e4db13c75302d850a00bc8d
SSDEEP 49152:/QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH1:/QvGAdlCEL8c/DRNw5CbD527BWG
TLSH
T13D266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 3d4daa369f48f501553141b756f9e12aaabfc6e4d5ff581f3d067c39916d8bba
MD5 284c61da391051ede25c71f27794101d
SHA1 12cc0b35061ab35264261b461bdee05b85a002e9
SHA512 48a2d73a2a55e2a9ef0edc1b321af99bdde1c6e94d4153d9efe00533801c69b931bddff4e119acaf4a4d3e23fa15925a7ed3259c0f3f0d1fe95d8d4b13eb5573
SSDEEP 12288:+AwSfxL/2Dc3RDLLmt0LDQewsAjoXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:j0ewsAjosqjnhMgeiCl7G0nehbGZpbD
TLSH
T10275E031FA74E036C77B0DB60B36D71A582D7A204F6119C3E3E89D9E99702D12736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1b508030eb8051bb25c1764a5d4dbdd8933a518fa67ab1368be1994007f1f3cc
MD5 cb76cb6ed455d8e93d8948c99a421977
SHA1 eb94b437358c967529354b86486317daaa396d3c
SHA512 12fc29aadab716a2819413888f0b1ef38674e7fada52f4fe32ef3e7dcdd0dc780c40e93da8d0dd4da8abb34f7b5bddd3a92509cfa3a54b11e9ef2b463ad76217
SSDEEP 196608:+UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHsVQBWG:+UEtQevvqc2W1cpV2tI32zB
TLSH
T12D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d757d22cb271ecf4386793f61f052b54f0bf1ccbcdbb895916a5df26eb86673e
MD5 59f38386e80753c060f14251629cd779
SHA1 866071df8323d7ef31251e195b828d136f85514f
SHA512 91ec72f9d641ad7a961e7c8ca9f4bf436d34520396da2bc443ac1e8d10249c552941573bdbe8b61a8dd7b966349fe95124af856f2f9ff92716fae2f506e34829
SSDEEP 49152:xCbRquA/m2yL5zTfFiV+XenmE3/z0Dmg27RnWGj:+oquVjnmvD527BWG
TLSH
T18BD58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 55671f597ac0121711abe61d0a0d6f2c987d9ea3feb6930ec8e10bdf315d064a
MD5 e6ebbdd7c76a68b9274fbedac6abe774
SHA1 a22ec56563181d47312d5538b2611b28c2409558
SHA512 06137a3bbc2326219ee9494c0b216a7a98b1aa20df6790d6dc2d6abf7596915cb20aa8f5e7a873c913e3063162c1f4de46a29fc4cb5052c328fa91c942a36960
SSDEEP 24576:JAhGL3IFoiwtA5l7S53bsqjnhMgeiCl7G0nehbGZpbD:JAMUFoiq5/Dmg27RnWGj
TLSH
T13D359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 24dbc24ab8d982890b31b8ef09f900e985e02967094112d7d61ab95af7e3c09f
MD5 572e7c893a88b542ef4db0c8977e6208
SHA1 703effa8e3af9ccda6dd2db77caee1787c26da5e
SHA512 8550018c23dbc5e7de431317dfa82b6ab7d7682bcee12ad37b99fdbdf1e33e2b14d3232b2f7ffa5fb9c64df333b98d9b8b6b67a3fddcfa97496af617899a4bb0
SSDEEP 12288:8mw5HEjsChNVBFgl0WDm+CXXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:5wu4OWcsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F565F14A72A81CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 d217d33a3be40419b763e3c0b09bde55e93f37737a3ef6a8a684feb08e8fc41e
MD5 af8b460ad677cf029ed465d43fe9e30b
SHA1 e465cbf332aa2a43debb97df2cd1018b6cafd591
SHA512 50b55165995e0e6e3cd84f02bc971ff157542fd39f5d9a6edb1b347555544f63784a60d9d586859edbc115ecb61ad1122b63a4ef02e5696c795c9fc81a48cc99
SSDEEP 12288:BeZ1Iy4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:UZuJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E75512AA239820FAE167417CC5E5D609EB337C62673003CF166255AA6F73AD44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2972e37158ff82277a49d14f2b09cb506c712fb3edbfaa9d7d0a357f19e2e8c4
MD5 558a02c65d026698c0b33cf3b979077f
SHA1 bfa90264bec12f15ff71282ff2d4b50ddf037abc
SHA512 e5d0e80c7d84899fb25b177c669c4e90e9a0a0e9d8aa1d1378b25531acb4bba7f229c57e880efeac143f37f5eca38667c094b14d287339f7e292c73c1a098af1
SSDEEP 98304:eQRQyi36YOcPbLvw2gAf+PN3KD527BWG:FQyiKa/X+PN6VQBWG
TLSH
T1A0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 ed5fb9709517f843eea3eac8788ce85941dc8339be4eea31588e26146357f391
MD5 0be419db6a8b7461b6853f4dce6e0bc7
SHA1 c0c66441c91b48ff1410f5edaab80f97fdd45fc6
SHA512 1d90331258fd7833ee71a61687a5da13ba983d85521461a2118278b90f36ae190f8f232f5b6425711a003d3dd62ce0a2e373022c36ac2832b534578012c9322d
SSDEEP 98304:dQRQyi36YOcPbLvw2gAf+PN3KD527BWG:UQyiKa/X+PN6VQBWG
TLSH
T1CE667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2a129c9bb7794cb20628d8a1a8bffc208961efac7571c96ebd92cc717f71fcae
MD5 7ddcfff5cd9631ee10c2a93a81112773
SHA1 ed137398a5dc9281885e533ce7d5a77143672cdc
SHA512 f3ed2bed38515a5568c1a379039fa40c2696a6273a80a64d07595d7188cd0eff5daab54a6a584d76699c1fc81b32f8a1d3c0032ac64da04faae4e109ed3f3d63
SSDEEP 24576:ewvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL05sqjnhMgeiCl7Ge:o68Qg55nhceWu7PNU3/EDmg27RnWGj
TLSH
T1E4B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 f6b4c16b4c9dff8b798bf654b55c00f3f7fe5d63a619f49c64008bfe68a9b4ed
MD5 01310efdc6fa16b519d1ccd12bfd0139
SHA1 1ad566ba470fd4953899ccd4b9e884bdb3feafe1
SHA512 83f490f17afaf117085e19b21dc049bf03ddde827088516e41098a07b9182c3d7a4b5dd10356edf60f92f950fb769a46a65adeab27c48823d21dd3be702c7a78
SSDEEP 98304:uy5112gYy5azzVvt69nLKnhZxD527BWG:fLIHEWhHVQBWG
TLSH
T16A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 27f899de2736f770d952ada709446fa75e8ff1be7acec705778afdcb83007058
MD5 d21ead19c1efcaf1af8804892d4196c2
SHA1 be91bb124f480dd409480b40f34124043448cd7e
SHA512 8b29c301e67fbc04173f815d5cdc68e1210bc7099be395aceeea92d1eed9a336fd933d1a8468364edf4ed1e65114ac25bdd418315aa5d8e71c11be5ecb02c051
SSDEEP 49152:LB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glyDmg27RnWGj:du6Jmdxd2dyD527BWG
TLSH
T1AAD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 d45debd2d936304e07ce3d3e871b7d0af7fd4495a2f52fbd06c188d9d64b6c9d
MD5 4fe922ab8241f36ebd6292430b8a30f4
SHA1 87f5346e94f80534fe25ab10e00da5c17bd37968
SHA512 e626a4d337abbc17f8b656737a2abe1203796f2fdbfebe82afbd29e5a4f400f3f278882f86e438a056569aed1be021ae9edc29d5e032ef82e39111756e11a148
SSDEEP 49152:d1hpsNoJpF1A63U44CwH7R4xWDmg27RnWGj:dmifPWRvD527BWG
TLSH
T1B9B5BE13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 29ace2b5c631f26c151b8ea39a6196a0de11fe9dbfc5e6def9362489cdb254ba
MD5 e1dd0ef5f39cfd2159b411fb173bee9c
SHA1 5d7fb2c2d403a2a6ca50ac03e9f7c5d36a38cef1
SHA512 f86bfbf47cc144e72c4251b2d13aaa69d17e953d4f8e012ad6a4d58beb32cac124abbb36027a0b543f915827d8a2b9a4a1201462ff30a0757938090088ae0ffa
SSDEEP 49152:USuZQIY0Be2KcRVtOnks6NMHqNDmg27RnWGj:G5dKii61ND527BWG
TLSH
T142C5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 dfb83d2590daf1aeb58f22bfe3c06619a74e7f7dacc4d311dcc5fd2f3a792208
MD5 35b605edac1dfb443135fe20558157e8
SHA1 624320bb38e6de4ee1c1a87a2f778baa6694d87e
SHA512 c3e28b18c220b53e8fae9221e721cfaff40d5a3ab019a66607f365bfcdb73959ffde332c8c289d7f7b8be1ff786ee6ddb28043eb2d14eafe10d1d9d2b12f9be3
SSDEEP 49152:/htSn8EApI0fig3giDn0AP5wCDmg27RnWGj:uX2imphTD527BWG
TLSH
T13695BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 b041f68ecc120fd2796c1969349b8ee5d5f2dd9c471f88d7ec05452400f06397
MD5 7627725b1f9c112e20db0e62dd33bebb
SHA1 3f4fe54b127d505bf047382e4ca00bc2a2210877
SHA512 530423413a0e30cb73bb49f698247c35d0b7259c12af6b61f779d976859c65e6ee808b8ff9de55ca90cbf3df2876fbd3e9f067357fa553f90c328594e076f5f5
SSDEEP 12288:JFXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JFsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15A4523BE965C41CAE52648B5C3E5F10EAC073E57E92004937A977CBEFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 447d6bc1303007a881a2103cabfb8b74d9d86ddd7cd2baf26560d4517558ca7a
MD5 2c7f80c510c928b4a01b7779aa4286d7
SHA1 87fdbff5c83603259f4ee1a4f2c5ee218cc61157
SHA512 076fb8dbd9043a2119b85d13b7cbe57cdc63a21e627e6368e90bf5bb3c8c4a7d8767fa8dd431c93509165a051663f3fa78be4570112253e605f100d5f0aa5bf4
SSDEEP 12288:aEXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aEsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1774523BE965C41CAE52648B5C3E5F10EEC073E5BE92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 6f00d62ad64e837374492a11b539d683b92a6194327ecdf43a7337018757a7b3
MD5 7ceda69ced213048858db8853e1a1ffb
SHA1 90dbbd7e61627bc533582133a0e5623426888578
SHA512 199ced948340c168b8141366002c35b2d5a62b78ac9e989624c76c1632153001e5b52bed5a450e16b0901d6956c23657660bc2b2a11368552adecf878d06cbaf
SSDEEP 12288:rKXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rKsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1924523BE965C41CAE52648B5C3E5F14EEC073E5BE92004837A977CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 cf54d3ace6a6d3ff1a9e5ec8f766d4dd2fc609aa94e0c4f2cd99ae1884576b9d
MD5 244c8b5e19afbb12e1f29895bcf3f1f8
SHA1 8cc06969df70afa0e1973cef6b10e9193ed3512d
SHA512 1d03b0555689612fcb1ee39574ce81f3f2cb397100c788a23f44d01c5105d9bf0142e7614dbd4fde8d0a048571a7279840a260790d939b49a3ad88440b5730ea
SSDEEP 12288:oV7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BB45236B675C00C6D83685B4C2F5E11DE8237D96EB3005DB6B532CEE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 9f58b4fd3ee5b5fd44b4eba33319f471e446252481ae4983d43fce056811ad5e
MD5 ca03a8e71bfa76b2c82a767cc5ee0744
SHA1 52145f31a1c077f3b8d3082f5fbfbc76b443d820
SHA512 7161f2f6f8784ecf63dda711323d552323a2485c172b785b40c3b0431982ddf80cd7918c3a968d610153de6ba25c3007a6a131b678bed47a404a746a3e850d6d
SSDEEP 12288:XjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:XjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E14523BE965C41CAE52648B5C3E5F14EEC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 a1968debbe9a582ea3b83915d67da8a0a5025b1f16ac98707864d06053fae96b
MD5 ea345459267b02039158ca9435d9746b
SHA1 0decffa2aa279e0a9604f43745b19883c077077e
SHA512 249f0bd153910ca711191e5f4a0165935b75904567b7884e3d37d6aa5a88ddb8f55011982aecbbd81a0cba4f111af09d540fd320d312b1b120077e864aae6603
SSDEEP 12288:wAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:wAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12D4523BE965C41CBE52648B5C3E5F10EAC073E5BE92004937A977CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 e1fc8e2b69f1fcfe6c9004961e19babb091955d85f25ae31e957d9fc15fb824f
MD5 920d3ea4d6f4c285c018df1d2000cb15
SHA1 ccbe4a4f8165c8fae1bb95f1409d206214e37a8a
SHA512 d68a531cca8125a2777b641347548dcdea7148153287c09813fc99b01e87467a4164c872dde741577a1ae35c360f72fb800a9febf2274ae50b20ecefdc7bf7e1
SSDEEP 12288:+MXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+MsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1284523BE965C41CAE52644B5C3E5F11DAC073E5BE92004837AA7BCBEF7B14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 50db9dc1111d3bb8c5dfb5eb611582419c5e00e6cabe1a6602d37cc80d382004
MD5 1137da4fbfab96bda38162ff65d0d165
SHA1 15d49cd0ca7395924b64537badfab7f41c456abd
SHA512 a04a79e8b03ca3e7fdfff925876f158673660c277d169b1545d06d05b2722abca204ffd8e8f45076b9525b08d10fb832fcd8fc5b0c7ad9fb96c9d1f02a38308b
SSDEEP 24576:PZMRzFVSOksqjnhMgeiCl7G0nehbGZpbD:PZMRzfMDmg27RnWGj
TLSH
T1946501A9B39018F8EC67813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 1880e1110e1688083b15303a16efaccae24cd65d77ac14c60d62ec49cef06de7
MD5 e83a1ee37aba851ac4975b35e71c8a69
SHA1 afdc399c332cc3e08779ab4b486d2e66150d8d9d
SHA512 88f21efd175e29fb61d34ff5d330bed3e282e239cf73594841b61da146567f7ed69785b3e245c359df792e26811e4e359dd507783a79abcb8b8a40b9b4bf5dcf
SSDEEP 12288:3ZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3ZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C84523BF965C41CAE52608B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 ea24fc984200ea7e8de11e77454fa08c424cfb9924fd3f827ce0d68bd20b527f
MD5 9078314b09e78009d7393f801bb87b50
SHA1 76359b906d06c2e4df05b324a5fc7fa6d76aa30c
SHA512 75a0514ef9cafd7c1751fe37f76d462583e9cfe4bd8693e2519539b7770ee43ffe3fc22e80476f7c9fd5312bff765f3727099835f62fa57dc06147e30ecb2831
SSDEEP 12288:JdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12C4523BF965C41CAE92604B5C3E5F10EAC173E5BE92004837A5B7CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 1b4ba7a3c1162fb3defa4395f10fddc0cbc7213626294cc99486e187587c2db0
MD5 32740265ddee8531a2e2a6847a0d0b3f
SHA1 d77c4b19b076166fa910be37e33bcc8eacd6edb3
SHA512 2b6a32e69a7a9d4df320e9d246e190cbb125d28fb0411f3e12a86eaf11636996a8c1a10a017833f13db02a9346ef8d58d4f2bdcf9bd6cfcb2332914b8731c4f0
SSDEEP 12288:ryPz5L84Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Gzy4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T12955125B73A530F9D1378178C5A29A06F7327C3647204AAF17A116BA6F736904E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 9c87efc82e1548ecb14330528cdf25e7df5fdfc32c13314d6fb6640a9ecd925f
MD5 902e1c5c60b59b2044475b51bcd7d632
SHA1 4c7739dc11d9754e3e7375263a0246f4fbc6d5d6
SHA512 f06cf843e912aea74f0c63b88c5c84ae83fc0be92458911963b41127711f9295cd0fc1677145b44647694990471c115376d98ccd072934deb5e1e6a78df43f89
SSDEEP 12288:DZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AC4523BF965C41CAE52608B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 b677bf159e3545a70f8a179e1943467c8a84c45b71af873ba999081f649dc5db
MD5 72c31c4a1e275429282b1ea4b7d24aea
SHA1 c83604c9dc56581de61dedefa10912d15807b02d
SHA512 bf50caa892fc3fde6f09e049d18263262e62da36c6eaa234a629f6cf80ef07ef89c6d4feb94082cd92b6435b9b4ebf1d11a11635418ad8c502509a3872e25a5a
SSDEEP 12288:rZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:rZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F54523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 68fa7a3596277e2e5a8b53e80a3130333a5f31542c781e67cef9a332ceda9301
MD5 15705472dbe49426931e1026cf5979ea
SHA1 580d1d01250d3a46760817b7332177c89630c9c7
SHA512 1628b42891c93f678776cf148031956b0d596a47708d2ef7d0d5a74ec272a6dc8bf6ba3d37de1f72be6e730f3572875b92dcf6f3baa8835fc2eebff8c94576ba
SSDEEP 12288:vyPz5L84Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:Czy4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T15E55125B73A530F9D1368178C5A29A06F7327C3647204A9F17A416BA6F736D08E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 0bce5faffb6537524f6c81148243e7bdc6ac1cc9617146f1a08cfc0b5331e77f
MD5 3400f85dd8824b8d26cd0ea77dc48131
SHA1 55f6db71decb9f4fd2baf5973dd2e6bd3488357c
SHA512 2c4820853837dc25a0d92c4e2cc3c3a9240ae86648f8207f4755e691dbbd7f9bd4e65306fb8f298089a6fd37fcbfd2c46134cbb1d84a792bbfc68010bd8da4fe
SSDEEP 24576:rTDaLl3z0zD6sqjnhMgeiCl7G0nehbGZpbD:rTuLljLDmg27RnWGj
TLSH
T1B06501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 644947045bc2ee8956f15c1931f2fbf28ceee0d844743864830dde4bb186d531
MD5 0e962d4950a0aa7b59136d8f4fa8c21a
SHA1 0ec424346ceafa349add54909e507691713be8ee
SHA512 78b88691e5143748fb2dc90d3b59270627cec264a245f41b4a27550f86ef2cf7b44102323fedc2c0a15f4171b0ae114c9a92b529119d31f1896d17d1a28d0e32
SSDEEP 24576:C3vd9CHKy7GZmsqjnhMgeiCl7G0nehbGZpbD:kvd9CHKyaMDmg27RnWGj
TLSH
T14675CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 179cbc6e11851b2d14196ece3685523a21093e670eab7650c2f174fb626c2504
MD5 7ce5ac86b63608f21b12a649ff9a50b0
SHA1 3fb02aab10b5e910ab25f9ef2b72d4e7ff424ad9
SHA512 c0f11aba7fcf0022ed46b067acaffa2b3c652a7b77fb061df435c9fe35511b708f963d3d2e01a526d3b433d52bb41814258e0553bf6c12ddd2c63da6b3317e62
SSDEEP 12288:9qXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9qsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C64523BE965C41CAE52608B5C3E5F14EEC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 4af281efcb48ee0643cd91a2d6102a5c3bcd69b5245d08d2dbb26548e5f4faa8
MD5 342327e889e183a2c08067dcff7c1236
SHA1 7dbe5d006214755d80bf0184bcc82b45808d20c8
SHA512 32e8083630e3d5d890e45eac95eb5e086576e2e5bcda0a54247efe673e8589fe9ae983d4c529a9b7813a26973977644be8fef58c1e218a30154da9be687960c2
SSDEEP 12288:ZYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11F4523BE965C41CBE52644F5C3E9E10EAC073E5BE92004937B977CBAEBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 4cbeb2408297adf480e0b504a8f5079454529dfb108d0e89dc1cdd58a2f5bfd0
MD5 fc370a54bc5a4252f62b1b26ec03fd4d
SHA1 377df4c4ee1349e8b95ee74f3d40a9de3484f473
SHA512 2bfae7c1bc9b9c0a388e378d9b39278c1f25ebc18d2cf77fcbb7d3c1328441bd1015861c0f979a75b90b77c5c24e4a656dc561e0937002ff66f09e1e63c6a34a
SSDEEP 12288:1/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:1/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DF4523BE965C41CAE52608B5C3E5F14DEC173E5BE9200483BA977CBDFBB18584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 dea6707c23e48d527d32079c1295c3c5a2d5a7e9a98312d92d75e4bdbbb5faee
MD5 752bea9440f27c88ce2f41dbb17652a4
SHA1 377e1d952d9d1636772c8ee6145b9f7fb74ff3b9
SHA512 6650f77f60c247aa01ea3f6075d743327727cc60b75a426eff9d3e27c19eb9a7d4a9390e103ad34ebe8bb4d677b392c755f7539ab1558f3dbf9058856fe51e00
SSDEEP 12288:6ZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6ZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1404523BF965C41CAE52608B5C3E5F14DAC173E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 fe12670fcf5f44bfbf7c2d1872beba4a2fdfc9cddbef8fb263c1d377b35b3120
MD5 07bc9e62072b8ba7873d8f0ae72aa251
SHA1 059a1009799e47abff10e547bb2835e2ab483f99
SHA512 9b5e88ff89297ff1aab7dce0a54dec8e0dea29852cfe62a80133055cf47ce6305774d311aebe2dabde0d464a85c10b40440108ee19d634ce1d499af892e6f1ab
SSDEEP 12288:0qXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0qsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C74523BE965C41CAE52608B5C3E5F14EEC073E5BE92004937A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 310c013991203cad5499de6ead358afa131d1c2d6b6dccd276c390a294a5675b
MD5 6af87039c1b05ace4700de241e1d9ed3
SHA1 7bea0f610781d71ea5403f7d148bfac5627fd355
SHA512 43691588af6ad66bf7708e5b1ddf78941c0b9df6f8475c55ee4864cb5cf22ca82238bf06c1e47c495bb0bf4d3fedcc52bd1c3c361160f6c3ec5ecf7963e7d996
SSDEEP 12288:RBXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RBsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1944523BE965C41CAE52648F5C3E5F11EAC073E5BE92004837A977CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 e50947efc5669d1b6b4843d6c33ce60d307a907c83f168686d32bdcaa4da6ed9
MD5 d9515338c146317482139b10f6a4f95c
SHA1 2893cc0a07e0791b61547cb5f70aa088e6ba5e08
SHA512 904518f43ee88aca7a2e25c016f40d4be817a63bc7b73327b91725237cac491b32966505920a9ef46de34ef512134255b858ae3414b2f50fb4d5c2cb63caaf09
SSDEEP 12288:JjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T19A4523BE965C41CAE52648B5C3E5F14EEC073E5BE92004837A9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 25725d6e2b237f2a5d4df25510fec10d3bb1cc2764e2fceb4b765f690a2809b9
MD5 f701b2c5d56fd1f4eb8604548b80c208
SHA1 8d7249ac554d4a48ed60b26874cc8b1be36c78ab
SHA512 caac490a4803b817522bbc659fe75419d8e706b534e7c9b7985ac81f6e2b2bcd03dc6d70db8ff9cf3917d05873a8d8afa5e5c7069ae228423f06cc14f8c48dd0
SSDEEP 12288:eCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:eCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13F4523BE965C41CAE52648F5C3E5E11EEC073E5BE9200483BA577CBEFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 77eab2af02f620e77c9bd19868b5145d0e80309b9dfd90afdbc65a00d71077af
MD5 85c32c716021f2fa9deddf2360090b0b
SHA1 690a4933adb7c43f24de6bf08271d10b7b58281b
SHA512 8ef747801752d1372f1855be0b358489a7d448a1fcd78aa78d5d2c71b881457ba922634d9f42a8a2b66a843ae1e3230ebca8b4efb78c9e7e5c1aa3a599631b2e
SSDEEP 12288:gjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10C4523BE965C41CAE52648B5C3E5F14EEC073E5BE92004837A977CBDFBB24584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 18f1f251ce279f6245725b8826336f7a345406b675aa30ec6f22be351a1247ba
MD5 38dbb47f4aa52cfd788163f1739aa3d5
SHA1 fe7ea9535650c80c1682771c3e7656193f28a69c
SHA512 cc3a6acf28a244c248169dba83102fec139bcc6c534e9ebc8f753c851d5809aaab9ab375c18210dc2bc5464a539a7a091ca9dba93c07bfd224410c52f94bfa50
SSDEEP 24576:UfwvUk9RX6wkyAItsqjnhMgeiCl7G0nehbGZpbD:wMnYIRDmg27RnWGj
TLSH
T1AC85D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 78eecf953a06fd5e74717e528b7c03b9d9014b24d33b756ba229db5331287a3d
MD5 8a900f7561e7f504e9c7bb058e054438
SHA1 23886dd267850a473fe958013ea3d7c5443c3b78
SHA512 e53a66cc88c57d8b46a625685e6e4d120b1ff5c06495665f496db9743c6f82d6b310f6816f8ab042a3545a20203bf8219b6cde4bf560efd04de161389f1cb03c
SSDEEP 49152:xYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0iDmg27RnWGj:cySzPqD527BWG
TLSH
T123066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 ca96b67d63513ff7efe16157affebb8ed610be1726b523957396634635663697
MD5 62a3a2581b8a4c75c2d3ac6597a3f891
SHA1 a35a279014ad1130e3c45011e8ba4b30d28dd826
SHA512 9a5c3f6c563470d92326ab0048d940d10e9f1b72c11ba12cb9efd8e26c5496dae15fbfcc0c8fead0e1703791d166c5e876554090234a81624d99fb737eea6006
SSDEEP 24576:i47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AY0sqjnhMgeiCl7G0nehbGZpbD:i47JUQjTirIhCnDHUPfF/yDmg27RnWGj
TLSH
T17365AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 3275088c3358482dff96b6d0f99917a30e0c4aee8186556d10db0f6b3c5b0ed7
MD5 5efca75f803c9fae97ff0df86754bc5b
SHA1 70b50f47d550b8d4ab852d27626ac1c986b181a8
SHA512 f2e6f43bef1f76b33dfe49a0e0a8323f07dcf8d3bb81e67c254f07897755b73e6aea4da1273e103e0bf84b7eea4e90c4500f308f60e8041810eb4c6ebec00c19
SSDEEP 12288:FbsfJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EF55015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 9640bf9579c96a30f9f82d01a2f472e6fc594dd8f7a848b355a7a02cc5527e5a
MD5 c36f20f50f286593771d84e852103bd3
SHA1 987c6c9715dcc2414f29621dc6e41308ab679e0a
SHA512 047b2d22e6679828b18015733bb13b89be21f1d0e5be2fd80c95aa8e6a389aada5d16e38caefe427de2eaafd7e566e91b819815728bea1bd017258a1f851bdf2
SSDEEP 12288:+fCf51U3fXLRrP6Bks0fB6VvrMGy9IRMXhz2h:+fQbUPXd+asMYVvrMGIIRMXB2
TLSH
T14D2507007666DB4FC6A940321E73D2CCAB707D45EE446F0373C98B3F9576658BAE2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 6eb228141171c7cdd9d2e684e83d78cadd15a45ba1a0694365233d5a8d51df58
MD5 c7ea3dbfebb5270e2cab9aec329925b9
SHA1 9954cf1d943db5b1e6cf353051fd260358d67588
SHA512 5072039e4aea5a84ba977698608822afeff40a312b9727b4dc988b8fb93179cb9a864cbc1d71525640c14f070d838863b3cc248ce64a1eb8e1c659ad0e9565c0
SSDEEP 24576:8R1md5TdF9dHrlfvcK5VzsWV+IuuuPXsUQvbEfn7ojRyit93:8R1EpfvcK5VzsWV+IuuuPXsUQvbEfn70
TLSH
T11E55B7405037978FC1B75032073A5B8C7BA8EC16B7496F26B38A453AD86AB15B0F93D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 cbaf5e3ecad5e54cd30d91d153bc9523b279f67e60148fce8010aa3407c91159
MD5 030cf888b88baeee73304835f33c751b
SHA1 b1d0cb78bcc31aefd3b0d724d57aa3fd48db3e10
SHA512 5718165ee3b637cd24254c7c7b822e8e52244cff516fa38df9f84f43bcce9347cc744e1ebfa4b58576238bc4467b0aac208b94a7b6bf6e50f54f56083eb64d08
SSDEEP 12288:I07xXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EF4523BA934C518AF83605B482EAE12DA81B7E669F1004C3B91778FDF6B18C48F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 2b80a2386a3ecb6dc02816fedc5c151d64462723eb41a022dde8369892589e5c
MD5 1a5c4bd24957031f345d17236b9b9ede
SHA1 c2dd2d0e85276ce025206ec7a6e8cfbba52e802f
SHA512 ba1a3abaf0eafe2eb1c37af6594a954e4a21a63e2b92097744a3a9fa6a6e9b140e275e7e15d1cd30059c442e7733159dd0cba0eee32f963e63abe4e95be78716
SSDEEP 24576:Cgb6bmBIi49WNNFpg1rSvFv7bY3sqjnhMgeiCl7G0nehbGZpbD:Cgb4mBIBhGFQDmg27RnWGj
TLSH
T11A659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 bd42f3ab541e4c9bd1caef6f2a6c6910cf8e7bd7c16f3679163d5bcf06026836
MD5 f7174f750d2baddec60a5248737e362f
SHA1 c423a5d0641ff6dd76eed25f8856979b63796016
SHA512 8e0aea95ad716bda0efe31b6b428a1b577b46dae6a270912f7dec9e67f2300d7fab45e9dae8835121301e5faf2f1c269e2b1c6ef298b37bf570b5225007a6a98
SSDEEP 24576:BG88u8FpJqH1bzria7/mksqjnhMgeiCl7G0nehbGZpbD:E7ZFPqVea7/DDmg27RnWGj
TLSH
T1D985016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 32ba73fd4af8e72b0cf263c1745aa972f9105bbea12163a7f504003103c60881
MD5 0e6e59b402c4ac2fcd9c5103eeac76bf
SHA1 8f9f7299f6228f4e18cf52b9d25b2f3e2bf1bf11
SHA512 d080105a96a04a099ad35f68b355f915de2ab2a65beb0de1acd43b6008011b67048ff7b643894ffd2faa33b9f704aa3734d7565b84b0780c1b562bbc37205c8a
SSDEEP 12288:gHvUrBFrEjwaQQXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:gPUr+NQQsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F665F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 7a0964db16d6f63afb83bf1b19ebc42e2c39c1d9199bc866768e0de2f7cc3822
MD5 72c16e83d151b7c8034801ba9ad929d7
SHA1 4c5177305804fb1c056eeb2f972e16ddd953a67b
SHA512 5e80222cda5f65ecd9f65fd18861381dcf4d4ca370c671d9fcddadf06f50b1126c84fbad1d115450229ca40d4b24e5f64902d4865f18d188825099a1f36c7e13
SSDEEP 49152:dBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj8Dmg27RnWGj:mG05lO43bJD527BWG
TLSH
T1FFD5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 f04de8177769c71bc47a74771fec7b4e62ff1d921ab137560cba31b37f3af700
MD5 6ba632330111a420d25bbc9f4a18e175
SHA1 05dccd2e0a9e95a5cf32c717a21a5cc39df4c6a0
SHA512 239954285153e7e8db42d8a7e04cfb0bfbbcaac9550fa155af74cd9d681f46dd9bf9a3237a7669baf36a4d4c101faca828c53e58dfc585927c97fc1ad7aa9b58
SSDEEP 24576:Nfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnOsqjnhMgeiCl7G0nehbGZpbD:9a5POZ3BJt2pasx2+mEDmg27RnWGj
TLSH
T12265BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 401a369aa3cc64cfb74e3177672033c4ceeee8883f7863ba2c7c64d45b8438d6
MD5 80a18b45447fe0b62937f2e1137a14a7
SHA1 8101db54400839f33d52a2cb015ddf585e0931e6
SHA512 b45c34e9b1c5cabc420dad4971c614b15135b5e1aa76dd547ec5d260579c55f82d20436fffbc4128ced2ba8c2e4be2e7472eae4a677696b1acc6662d2e92b798
SSDEEP 24576:ANcwHdjbyQ4nLC18lb/EOjowL7Fk8sqjnhMgeiCl7G0nehbGZpbD:ANc/zEOVHFjDmg27RnWGj
TLSH
T1CB857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0b9112c186116cbd8e1927f0a1b01772061a54cf306649fcd72197c4320efadb
MD5 3ae88986e8473b089099598a3ed10db5
SHA1 68ff902f5b06189fe350098f59ab41ea514eaf35
SHA512 581ffac598783a283f731f5ffc371da1092d7a1bdae8612360db503a4c14aded483a73b66e6d51c1eab439102254c9d59032a6e910676295fe962d863b4233f8
SSDEEP 24576:HTkNvNnaFeYhJNtmZBmCsqjnhMgeiCl7G0nehbGZpbD:HTMwBtOmGDmg27RnWGj
TLSH
T19455AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 85f6ec813ae77b3f9e76a9347283b4c01e44a434ccdb005c0b902150bd893f40
MD5 59670303d603cd3e035597e587132dd6
SHA1 987506feee0f821d4ef661120984b7b4152b5f5a
SHA512 f2b9c2895db3d01fb45bae899f1e9c92787db56fc89a620633112e895b15601e07b07f34fcc02526cd9a4e910eb7e4b1465a3efbd8c0b3962ff86ee277bc6200
SSDEEP 24576:oD3FHshBIYQgAlsqjnhMgeiCl7G0nehbGZpbD:oDVHeBIAAZDmg27RnWGj
TLSH
T1C775E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1052-45-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/1052-39-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/1052-38-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1052-48-0x0000000001AF0000-0x0000000001B50000-memory.dmp

Download

memory/1052-50-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1460-93-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1460-343-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1460-346-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1460-92-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/1460-99-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1464-128-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1464-125-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1464-130-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1464-119-0x0000000000C60000-0x0000000000CC0000-memory.dmp

Download

memory/1464-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2544-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2544-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2544-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2544-131-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3668-80-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3668-88-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3668-86-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3668-342-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3668-371-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/3668-373-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4300-107-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4300-106-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4300-113-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4300-359-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4940-20-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4940-14-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4940-22-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4940-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4940-105-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5172-6-0x00000000025A0000-0x0000000002607000-memory.dmp

Download

memory/5172-1-0x00000000025A0000-0x0000000002607000-memory.dmp

Download

memory/5172-8-0x00000000025A0000-0x0000000002607000-memory.dmp

Download

memory/5172-79-0x0000000000400000-0x00000000006C2000-memory.dmp

Download

memory/5172-0-0x0000000000400000-0x00000000006C2000-memory.dmp

Download

memory/5172-268-0x0000000000400000-0x00000000006C2000-memory.dmp

Download

memory/5184-142-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5184-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5184-360-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5184-136-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5320-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5320-55-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5320-60-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/5320-210-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/5784-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5784-253-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/5784-66-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5784-72-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/6064-284-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/6064-76-0x0000000000400000-0x00000000005D6000-memory.dmp

Download