8c9a30713ea57dd5b5e1b251132f04ab17806610c5e5a28364e806bdb6769ccf

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 03:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
Size 2.3MB
Sample260630-dyscjsdw9v
SHA256 8c9a30713ea57dd5b5e1b251132f04ab17806610c5e5a28364e806bdb6769ccf
MD5 cd753757cb0976a32db482b461baf800
SHA1 a798d61cb69de632d64f3d0fb3099c6af5746764
SHA512 332fec65ae48660965ff382105189ffbd332f67c7558e308998307dd881787a3296c8ffcb8c196e90be04cda9fde43d83839d23c1ef345fe2a4d81f0445b4daa
SSDEEP 49152:n9OKGI23TVbb/r7011naib4aMP4nzwkeOrv3iZOatyQ/lFTjN4:VGJ3TVbzrc1naib4aTzwkeOrv3iZ/Lm
TLSH
T1CAB5BF3275D1D0B7D53317315E5D7758A6ADB7705A3A428B23E80F2D2EB04836A2CBA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 11 IoCs

pid	Process
2420	elevation_service.exe
5788	elevation_service.exe
4724	maintenanceservice.exe
5572	OSE.EXE
5376	PerceptionSimulationService.exe
3184	perfhost.exe
2528	ReFsDedupSvc.exe
5912	SensorDataService.exe
5140	ssh-agent.exe
2476	AgentService.exe
5172	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b88f7f2b80095f6d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102734\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_102734\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000053f014254008dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000e3781f274008dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b3ec99264008dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005af61a274008dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e26877264008dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe

Modifies registry class 35 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{38E38421-CBF3-41B1-B9FE-ED18512293D2}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{9BA43D01-A3A4-40F8-9BC8-5CE9A28537CC}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2420	elevation_service.exe
2420	elevation_service.exe
2420	elevation_service.exe
2420	elevation_service.exe
2420	elevation_service.exe
2420	elevation_service.exe
2420	elevation_service.exe
2640	explorer.exe
2640	explorer.exe
5788	elevation_service.exe
5788	elevation_service.exe
5788	elevation_service.exe
5788	elevation_service.exe
5788	elevation_service.exe
5788	elevation_service.exe
5788	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2796	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
Token: SeAssignPrimaryTokenPrivilege	2476	AgentService.exe
Token: SeBackupPrivilege	2528	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2528	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2528	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2528	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2528	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2528	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2528	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2528	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2528	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2528	ReFsDedupSvc.exe
Token: 33	5172	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5172	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5172	SearchIndexer.exe
Token: SeDebugPrivilege	2420	elevation_service.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeShutdownPrivilege	2640	explorer.exe
Token: SeCreatePagefilePrivilege	2640	explorer.exe
Token: SeDebugPrivilege	5788	elevation_service.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
248	sihost.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe
2640	explorer.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2796	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
2796	2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
5192	StartMenuExperienceHost.exe
2576	SearchHost.exe
2640	explorer.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5172 wrote to memory of 4448	5172	SearchIndexer.exe	98
PID 5172 wrote to memory of 3084	5172	SearchIndexer.exe	99
PID 5172 wrote to memory of 5504	5172	SearchIndexer.exe	100
PID 5172 wrote to memory of 368	5172	SearchIndexer.exe	101
PID 248 wrote to memory of 2640	248	sihost.exe	106
PID 5172 wrote to memory of 4380	5172	SearchIndexer.exe	113
PID 5172 wrote to memory of 2920	5172	SearchIndexer.exe	114
PID 5172 wrote to memory of 712	5172	SearchIndexer.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-29_cd753757cb0976a32db482b461baf800_bkransomware_darkgate_elex_maze.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2796

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2420

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5788

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4724

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5572

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5376

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3184

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2528

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5912

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5140

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2476

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5172
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4448
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3047816590-610495838-277027736-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3047816590-610495838-277027736-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3084
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2956 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5504
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2924 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:368
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4380
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2972 2956 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2920
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2924 2912 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:712

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:248
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2640

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2576

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 78d977dbbc7c8bd82dcc3b7ccad5a1037ad0675955c185db2ae4002510877a53
MD5 2c6de6c0ea57cd34a14a5ca1b3cb5891
SHA1 bdd6a94321ac5547b51c86c7771729ed00d249be
SHA512 77b072cc46b29affc3578b62830f396e064d5c99e6731c60b42cb36eb63a8794d1eb4eb11e63c6e4c597262b67f7e6cfe8c4155fe9faa5f8fa1625f05ab778b7
SSDEEP 49152:wb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnmQ/lFTjN4:a3q6HjBmLm
TLSH
T18ED58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 47f9e49ffecbd7209576a992d8990c481db4465c54ea81e651867e5e40439d66
MD5 a8d79efb1d8bce9266f7c5c0bdcd8cbc
SHA1 8bdd574ad5057edc49629b57d35bc36edec281d1
SHA512 c01ae1870339f33c6c0c150a155a7cca33d2cba1391cf09718bcf9c993c78c1c305516525ea1d1e7a0b45c3518ad10e18a93e416dd0715193194a1c653b4e4ac
SSDEEP 12288:+1XLsswWkxy2lRq2czA4UGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:MXYfDtczAlnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1E365F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 c98d48ca9409483dee128b5eacea1a35151f7e79c6ca5380c40bab0384457ff9
MD5 3e7ea5097dba15336220ed5b6f63237a
SHA1 d1293456839b7c1eabfd1d67155ee3398e62d14d
SHA512 884d3be22f602de73937e8239841b1d6a2e186a41d53a7efd3da27503fd637296ade5e8252433690da518d00b25ed857d886775ac9963700cd82aa7d19229f31
SSDEEP 24576:60Le5ji0hmxLrMenQ/tbw/2Mkjy6Fr7g0oZ:6Pji0AlPQ/lFTjN4
TLSH
T18C859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 228ac1123af75f4b4cec751e6b83e3f767e520accb3b37dc46e939bf1cf3a069
MD5 be251da4bb601120066de74194edca55
SHA1 36e33f7980c658607bedadacba21329c1497411f
SHA512 f39ae35d41391face921bf08aace26888e108b588d74f04e936bc964da1926cd6ce24e40c0024b30115820fe6a59d2ee3e3e92db56d0a0119f6ffabdb5630e62
SSDEEP 24576:La7/ezSC6vUyD/aqgrvWE6q8wyuEnQ/tbw/2Mkjy6Fr7g0oZ:m/ezSC6vUzPvxHjyzQ/lFTjN4
TLSH
T1A8755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 c62680bbfab7ef00ca465d54c95ea260ff0cd8d24f0c08106ef88bcf6e4a0bed
MD5 efaa8bfa5860d085e3e62bbdd557d383
SHA1 35f16344498fc47fa16061baca706e055f77c2bf
SHA512 4cac0e8b2e0c3759d4fb91904a82aa0079682e16c0702674e6e36027af434ec48b9dd5d7cce12048085ee60ba3a1e38f3d72a60e387dc0499f91f48a615b4090
SSDEEP 24576:rVbqPb88hv/l+6xnQ/tbw/2Mkjy6Fr7g0oC:rVO88hXl+CQ/lFTjN4
TLSH
T1B8559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 fc4ff8ed5781b8c6dd6651bc8d73120031d1ca1d7f5635c21e7662118ef45633
MD5 672bd3939b61e2fb68c04b4663eb4eb9
SHA1 ac36f724bdc3de302bd2052c942c44a100ed9845
SHA512 c7228e165458e4eef5ea4892c647ab7332c0cf5739891d4710d863ecc624cd96b96b054154d4cf872f10a8d2f054ce09c123f382ce54209d9cb052a4d6d7d685
SSDEEP 12288:Xz5UGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:XzKnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T12D5523796A24F897FF2B06B15CC284826B7B0EC1BFD4A74E6B44322D857C39446DB385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 6d44730e97e15bb6a1bb602c3222752f262084916f04463efd815b09d33b3ac4
MD5 60e6bdbaec688bc531c3a9f20e9b82dc
SHA1 c792b93a7fa1ba148c39ce6b779f28153b5bd7c3
SHA512 d9ff762ded6a12610656140b897ecdd7e18d4d4c79079ffffaaef32bd16df21ced9f5ee10106cdd9b030cd77882748be02af50bc155db40e6c30b29054bc64c3
SSDEEP 12288:4eBNUbTVO86UMUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:4JIUJnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T11C75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c1514003ac9881f73be537a81250b0cfc9597a56cc5d0b06e9d088d9e33d9595
MD5 0f6632e1d943b385417a4fe71be71560
SHA1 b96d51547d1241548ea94289a6f2e0dcc2c5e391
SHA512 89a7c388f45c67328cb7d3fbae1e87cc7793b93614ace8f2c0601c3d9e54011587b79198e5575e539331bcb57994a51030a5fc6c0bc108e9d3dbb1c8eef0c0b5
SSDEEP 49152:1QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THx:1QvGAdlCEL8c/yRNw5CnLm
TLSH
T133267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 e83da4c50027f9829f6e767cb4afaca0f0983385eb7952c4229363891e4c9cfd
MD5 1fd6298076b8eae0b250e94ce43dd165
SHA1 d0df9ed9cdfb24b233b685144c8296edc75baa57
SHA512 f9458c7b2799806547175656bdc0e638ab133187cdb64e3977a99a14b4dca78fb45a5da65ebf1a575ad1d8db64a9d2eb0690d3aa3f1796f68887bd256faf85ad
SSDEEP 12288:YAwSfxL/2Dc39DLLmt0LDQewsAj+UGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsK:9QewsAj/nQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1B675E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 29d7e1813aa2f6da7eafca86344753b9515d75d70798be91ffe2107b6947f8e0
MD5 eb8381d33c5b8c16909089ded2592c32
SHA1 1f153c5e9cc300923418feb88dc583bdf82e16ce
SHA512 092ad0ae8191d41a7252b6614733794ef94ba7747d74787dd1368982f42e2e8b4b9cf88a60ba9067fed6f2e756b8b25f09dc5323a50b3a8decec6137fd3c8aec
SSDEEP 196608:5UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHML:5UEtQevvqc2W1cpV2EI32
TLSH
T1F3474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 56b179caaf996416dd730c427979505f0eedf9a319e368b98730cac0fa197909
MD5 461f24e09304f856974bbcb09c8ab16c
SHA1 ef1136e3c29e427c62637ce10e5c7bcfe3cb4240
SHA512 6cf92a2dc76bd27d6ab8fd023f229ecb832eb355d7e9e6a80506fb42076e9c84a67bbe33aae3adbe5cd6041c53a04a719f40e34f4250564c3bb133f96e3ffeec
SSDEEP 49152:pCbRquA/m2yL5zQfFiV+XenmE3/zfQ/lFTjN4:moqtVjnmrLm
TLSH
T111D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3babd2fb4d2158373c80d76beeddc978fa4a6c233136f15ad34abaeefed42de8
MD5 48635b5f217406ae883571de686547c9
SHA1 763474cb9ca8ae977d35ef2651eb8eb8b69920c6
SHA512 52564f03ab992186b7892e79125cd52bab7c58f5bd54df19d483b60ea434b054b97659d1c7386b9dc007903cffef28a28193e5dd6c3e323cc8174f0970913a8f
SSDEEP 24576:1AhGLJIFoiwtA5l7S53onQ/tbw/2Mkjy6Fr7g0oF:1AMyFoiq54Q/lFTjN4
TLSH
T14235AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 22dfadc3b92bc5157732d068566662fa551b177ae0433f0a90c7e3df2928c185
MD5 d6a229513fe15b81d33a3b1fc106bf8c
SHA1 a3922020d503741431ebb6973bca90cbb4dd63ff
SHA512 774189535054b8364adc92e24a9cdb7f88024bff37385b5e8486ab2fbebe7a0ab051d42d14969036f5be06da0c45a71ddf676635a7e5dfb490bfc7d57bbb929a
SSDEEP 12288:Bmw5HEjsChN2BFgl0WDm+CXUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0Hjo:cwuHOWTnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1B065F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 e404a926121f90ab4b2d2434ce57313efc6ef7cd6c99cfc122165c9afe90c2bd
MD5 c9b65087e76b888e62385d086149383d
SHA1 1955faff6f5ab66e2f58e1fdf5d3f678db937106
SHA512 94ea7112c0da66ac66ce5813f4a993ab9c43f1f478384373a361e676c6b9d1b24e96dc6afeb911b5cba1e8aa04e9ff435fbb7a776e08302b40d57a620a07014f
SSDEEP 12288:dXZ1IyuUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:NZuWnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T15E55126933A4B0FAE6674278CCE28646E773388267B183CF275442695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 098996b57332b07f0ba363f24410a85861da247eb7c4ca508c583d2b16b64d0d
MD5 72856fd76ed5e1d8315a000325501b71
SHA1 ebefaf1dbdecf2385ba1d36f688baa234f4af66a
SHA512 8a2c196bde817a324beafcfbaa8ec77ed4148e4a8ce5536fb2ff52fdabcc36a463cf8447c2c81edfde50482bddd03a6c4b4832015d15fb576e2d211946f51bae
SSDEEP 49152:1j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UV:sQRQyi36YOcPQLvw2gAf+PN3SLm
TLSH
T152667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 bdeaa0840cc94d92243b83e83afff06dca5416c4f7f9d88e36385bc8e3d66fee
MD5 639f1f77b6ea51c76f454148139243aa
SHA1 d857fd149df4f409f30eb6e20cccf8c99f6fb631
SHA512 120b0893016f0cee5b3ed5a2e300d34d46defd0d1b73d9ef1cd457fc618e628ae54ca5c6d813c65a4a4992b4e6816b2245a9500e57deaf95ee43b6db587c9696
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UV:qQRQyi36YOcPQLvw2gAf+PN3SLm
TLSH
T1C7667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 724e406fb937931043d7135ed29c4082bc5535b58970813f7d942e664200b918
MD5 a14b5d2aafc58d454aaf2aecc352bc86
SHA1 431702a02fc638f52814678fa4d4abe82fdc1381
SHA512 0c06b059dde1c52d41e152e0d7b4d1eb8ecd2db38b2f7c6a6b40b5dec82529c57324b5f9f3dabeb86c301152fa3d92f021c3f00e07a15f71abf20f735626e1e5
SSDEEP 24576:VwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0mnQ/tbw/2Mkjy6S:R68Qg55nhheWu7PNU3/PQ/lFTjN4
TLSH
T13AB55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 61433f27b6bd688582c5842b1222c6db109e113ee9cecae1c83508a87ee15c30
MD5 5471cb2cf0cdbca1831806018f90d6a7
SHA1 0e88d362d00d4f5226b92273ea315f6c9a1d0fca
SHA512 014283205b5d48ed76e06e37c595ee43e7560d5916184d595c9aef351a3a01965e1c229aa572623e1c011465202e8d67004e2a9578f524b06529ebd31b6ddf0a
SSDEEP 49152:S3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99H:zy5112gYy5azzVvL69nLKnhZFLm
TLSH
T107167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 912050c138153c8d86b08ea4954c29e1dcadcd22b10c0024a631194c80c857e4
MD5 788d866c488870cab25981a858d9ad31
SHA1 efb3aa6086659592f9ac985a6278fa99f6680046
SHA512 2aaab4463cfeb0c2d803c1368a8f7a41ea1ec7ba994910a9b9d22efe4127a14631c13e5e3e4548b8a559d354e929ca917bba175be8b443239db52579ef435ce4
SSDEEP 49152:qB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl1Q/lFTjN4:4u6JmVxd2daLm
TLSH
T1B1D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2883036543e6f0f7aa95a69eea15df1936cdef8f82d04f0702192e4004277cff
MD5 20c9c34d7aef33cb8b8199b67235eb9a
SHA1 4873cb0d970013266d04268cb7eb7c548f351f5d
SHA512 784f4af083cad1c66a67aee12db27b899fee6053718db30cf689acb9c7c6f715c683bb6e66936034ff508eeb72ae5adc5897714036ef595fc0a1746348d1ed15
SSDEEP 49152:e1hpsNoJpF1A6UU44CwH7R4xpQ/lFTjN4:emifPbRrLm
TLSH
T12FB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 ff0e358a40af99b3c80dc18085acb42b2057538b5b3305a8f9ce47dcd7a9a62c
MD5 3bc8e9b4c30cd8939c94e8d8f1bce941
SHA1 3d70c9b0c31b37941c784c149741f2ba549cdb78
SHA512 d2b912569a7d4069018e455d28cf9e5ac1d3733fdf0cf8622251bf65d1dab25b1df8812d46c05594e3f9530fd8b8596db09732b69ad13fe061da95aa574f5445
SSDEEP 49152:ySuZQIY0Be2KRRVtOnks6NMHqWQ/lFTjN4:s5dKTi61hLm
TLSH
T13BC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 72872c673449a3ce87b2403751e94a431ade96517cc269f9ea2b8eedf108eb14
MD5 06f13a880b8b019304abf46563403dca
SHA1 a9171a6fa94ecd42bbb9789ec2baba5fadfddfc4
SHA512 3a179de78a697287474b6e8b6ed7007df340abab2f4fe228b9694de9a72dda627c1c7025c65e766ce857f5f3851b59f4d6e9f2c1415a50dcd9e752a4bbaa0145
SSDEEP 49152:rhtSn8EApI0figngiDn0AP5wlQ/lFTjN4:qX2iyphfLm
TLSH
T16795BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 5f4d3ee3b200d77ceb275113ada33ded238893f113a553d47d5ca61c4fc66367
MD5 2d33ed8d2a32d3caf480e9a7cc695608
SHA1 a83655532d2442e9f1c55c69aad0a3c7dca354f6
SHA512 331eb35a4b92e6fd8dcdd1585f92adc689d570901df3ff3532c9b217f978661e559e8a16d219b8fba3331d4e03c9a287956e17fad4d36eb0ef1e812c3dbe835d
SSDEEP 12288:yxUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:yCnQ/tbw/2Mkjy6Fr7g0of
TLSH
T1B45523697965F98BFA1706F18C828182A77F0EC6BFD1938F77482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 86de034c34c20ef5501bb51a53bc411a048494493b9a750e5f2353e29db04709
MD5 c88e51da54e94465859e4fcf4ce7c5e2
SHA1 507d99cf2b1d32bfdfcefd7f948fa331d713bcae
SHA512 86b03452da49c9272daeebd6d81ddb50a1a5e9fb003be776c12ca4248bb3b8070391af9479779c175620f070d6f6ff0c10d0154e1d492f186cb7c4fe3fa2b942
SSDEEP 12288:JaUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:JbnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1B15523697965F98BFA1706F14C8281829B3F0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 313a88b706c84b5bbb4af1885d8ae0f9fc58cb45c7b75e9a4605d4c0e8aa5d44
MD5 9bf41ac34ea65921408fed7d5d3acf43
SHA1 3b7589bfcce5725d3a240cfe985b5b27bce4e343
SHA512 f4ba3b11808dc31193d3e016cf0e6883c460039ccf9a55ff4c0737f3fc4e9ca7cdbd8eb20b049b6ea7d5b548a48a630edb10c7de009f2bfa015a1df092de0040
SSDEEP 12288:3kUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:3BnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1225523697965F98BFA1706F1488381829B7B0EC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 9d2bfa3863da0c2216bcbed1edf70d26d6e0112624c583af25401c82969d3de9
MD5 04eacc8674ee010f4c680e3f689fcb48
SHA1 e3e747d9e8e0fd1ac82a5d3b1bc8356a6e48c9c0
SHA512 aec8fb598fd4b8149cfca15d1508d5995d6b2d7fae6803371c097fa36dddc379f5d757600ef71db6e2390a69883271d56da9707eec3d9ef8512a1df0b5d4043e
SSDEEP 12288:kVLUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:tnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T1475523693B69F4C7F92742B4CC928142E7BB3DC5BBB1A38F6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 b2c5b3c0b6b18aab21f6919dd606495a45a15ad798e5deadfcdcc17c18bda10c
MD5 119ff69e3a09482b36ea61e21254fbf4
SHA1 c41a609893931a1f1ee0b919a34a5fb4764f1939
SHA512 3ace756d38fc57158a9ab22d8c02400be12d60377150691eca1d0d226469b2c6f6ab2a05b8881f166cd4927729f50a5d18b075a35e5ba45e0e0bbfca29db6925
SSDEEP 12288:3zUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:3wnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1185523697965F98BFA1706F14C8381829B7B0EC6BFD1938F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 53272ec13b7a0da806a57adddd6e267724c77a4e77c512a60bb4335bd1fbad12
MD5 18cd8a0c8645670dadd96ba295f85a53
SHA1 b839ba7f440c512ac4b8d3f19310f3e7aa47bcb8
SHA512 11c20c3e87cdde7ae8d928f55db3dca472a47a1f0d5c7a92a24d13d3d78004d20ef5f439a0d5d49fbf45d3250b4a2b276052c4ec01e33a5deadbc2a3aafef7c3
SSDEEP 12288:B2UGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:BXnQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1C05523697965F98BFB1706F14C828182973F0EC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 f088b93626564be98f8b27b97241c513d47e971e39e207c3040f25456b49a562
MD5 5109bfb452431a848b4a7dbef51de3be
SHA1 9471d6b594c87b2031414a72367eb228ff0cbabd
SHA512 1e30631b21a783b8df1711be48f415f4d7acdd9ec7f3ab3e5ea36e8d09af57900f001885786ed3acb8c36bf03b24478dffdb2d71771096569f48f14c73ca7d33
SSDEEP 12288:4iUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:4jnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1055523697965F98BFA1706F14C8281829B3F0EC6BFD1938F7B481128967D39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 d91f95df8224ac275d7b51d74b051e5025a0773ffe1286df646c90f424483bf9
MD5 8e047d7cbab3e5133e5bb332c72bdb68
SHA1 aaa4cbc532127736ce52aa0c3beda3ae24c0e0bf
SHA512 3cd922e6ff6adecc36a67413422617d59ab545c64a37a5319f0f0b8b9ce536a476716bbb7a79a8c56cf62c5dca480d2f57fe97cb783cbc4f25256b84889523a9
SSDEEP 12288:piZwbDzzFEoS2cPvy6UGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:sZM3zFVSO7nQ/tbw/2Mkjy6Fr7g0or
TLSH
T1D47501A9B35058F9EC67427ECC518906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 16cb0441ca8c0985d74c71316d879e1deb1359d0ec2dca61cc9328f16a3354f8
MD5 b2c91600eb5649cb667845b5c7e30e5f
SHA1 c6561512471ee7baeb262844cbc071ff1fca7441
SHA512 7e056c351aa3ff2bb8f4bbf52693731b3e8b66818f44785e2e47eff3f194aa599700408b19509d4a99e277aae5547c1adb4d90f0cc189f700852c1cd8b86baea
SSDEEP 12288:aFUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWJ:aGnQ/tbw/2Mkjy6Fr7g0oJ
TLSH
T1F15523697965F88BFA1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 3ff115a6cb651502ff869e37df1fdc5c7f743f767665af4a920a809cefcbe8a7
MD5 8767656e3f284c26fd37a8e94d43906e
SHA1 d66126b94bc6d8a289ee5475942c5725d210a322
SHA512 533a824279b11658418ae9f244a308fe8b662adf5afddad5f4c6e8ecd36d6cec668403e9079ed11e16e0544ee079965e8402b9951ad8cbc8dcd7f657ee3a09df
SSDEEP 12288:XpUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:X6nQ/tbw/2Mkjy6Fr7g0oG
TLSH
T1F35523697965F98BFA1706F14C8281829B3F0EC6BFD1A38F7B4C1129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 72382d6264f15ae49673b139cbb2eae40b06a493f9c98bccfd3feebc078f27c9
MD5 1d4f9d995f680bd07fbbbfc807524836
SHA1 e8bd67808915e1ae953a202b90fa17d2b215e242
SHA512 f67992d7936f613495a7f5052ad237a33a4fed4405a6776d1626682c698c7f889b4523d856c374c1818e450faf2945ce36f5c036cec6dbbbf97b591eecec83ab
SSDEEP 12288:SyPz5L8uUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWE:PzyvnQ/tbw/2Mkjy6Fr7g0oE
TLSH
T11D65021B73A570FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 822811dc892736dc26ddb5fe3d24e6647fbbb7befddc62f05de8fa67011f002e
MD5 86e92c64750d6604012381c79a08c4cd
SHA1 5a1a61241f9d829786b6b1abd235b45f04131d52
SHA512 1480a396550b09834ad68d57857ca1f45be36834d32ddc2f1c58d04924e53d119b859a9e18354c41a446fadc752ffe52a4d537c26b592579c1878c332d46d26a
SSDEEP 12288:GFUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:GGnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1FB5523697965F98BFA1706F1488281829B7F0EC6BFD1A38F7B4C1128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 0e7eb644f6accd9ffd8f296bc2511f6c4ef564f87cc453f0566c3d4643c06279
MD5 aa7ae13fe4106f360208b912b149d7ec
SHA1 adf272e89b2d83833af7731ae610e02104f9b0f2
SHA512 0c3e49f05bd03c8f7d246e179745521ecb3ceb30891193b7a6278fcc2e18f8af462a3d35d9ffaa9393209c6678880e6d3a09a29e969eccaa2c7214b3656f19dd
SSDEEP 12288:NFUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:NGnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1E95523697965F98BFA1706F1488281829B7F0EC6BFD1A38F7B4C1128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 16d398bbc5146408fa9b5d392d91549da57ed04e2547a40ca3898b572c1c611f
MD5 4a2e47c9792ced7f3fc68c1d4cf7b96c
SHA1 c1049567d16adb21f12e601ed39552a614be2486
SHA512 3fd165529039cd22e442f50d13291f37983a396152ce63f94c2e7c3ba28b345bcce686c96262fcfca48302d5b31f1118fd7692d3a28d8d3077e1ba3d4f6158b6
SSDEEP 12288:LyPz5L8uUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:mzyvnQ/tbw/2Mkjy6Fr7g0oo
TLSH
T11B65021B73A570FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 d1506e36b1a4c27d0ca67800674e395463058ddac98c8717f4d5dd028c12c5bc
MD5 ad51d2fa29a7b6d5a8865d9f7b824ae7
SHA1 359efaac9b402f3de52eaa210f13c6a4934951e1
SHA512 dd9004d33cea4527fd7961d075f14dbabe4f99135e93d39c423e4af24f50ffb3be4f8fe673a563a4b51cf05949fc4bfeb0b99f5f155399789c4f7c41989ccb1b
SSDEEP 24576:yT0aLl3z0zDRnQ/tbw/2Mkjy6Fr7g0oJ:yTDLljEQ/lFTjN4
TLSH
T1617501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 a6356c890bbbff941448ab2a63aed36b58f30243bf47942041d6736a6f25b552
MD5 25e1deb718fab32e635778fcda782577
SHA1 817e31a5a6337e399877da717fad9d523c76374e
SHA512 5a3075b10b3270c569e4bd8722df6d62b1cb044092879e32dd2df015d52e303639557d227e2047c4896cb765e02671f31a1c6af0affeadc1a4570dc040433112
SSDEEP 24576:Y31d9CHKy7GZ9nQ/tbw/2Mkjy6Fr7g0oT:i1d9CHKyaHQ/lFTjN4
TLSH
T18685CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 409a548e56c140a4f2d1c9f4ad0490dcb2d6f9e4b61fb61edd74180093b97054
MD5 5b31b497b8abd2ef3455b47165597c41
SHA1 82ca561739b2257701b91c9820ea98627703ab8a
SHA512 28770571c16817cb090a4cf790086fe752ba88998bdda3c7eee9e70e2ba374c00da24736afb80bbf475c0829afd329fa34649c6b2766b4531150ec27c8f47001
SSDEEP 12288:8EUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:8hnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T11E5523697925F98BFB1706F18C8281829B7B0EC6BFD1938F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 c38f540ea1ada38a9c903bd5dedb65d276d76bf7b9954777304ced13b3b4962e
MD5 e6a9ac6998c2445a39a716f89aa50804
SHA1 f5a05e29977f613f80084a382949935e0e2c22d5
SHA512 f334c96d5e5f5a182964d7f1934f320b1f7e698f035aa73c4ea0e4957ac6ae357893b1659e6ed1e5a72b00ff481c976b5e73bc9b5283ac5af5a8fac71b2ccf47
SSDEEP 12288:DOUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:DPnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1155523787964F99BFA2B06F14C8281829B7F0EC6BFD1938F7B481129967D39406C63C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 1d4e87d4e24194327881abe265ce55b5ee676332c4b784157fcf71590572dff5
MD5 740bb4a93e1eee9d5997e6f7a9966114
SHA1 d2ba26ad1919636b7e3355267f384d6380e1e0d0
SHA512 7ff7dde578af969149f673324334b854e21f56d60c172b53cb4a7ec223231c26139c417f20fed6169477dedeb2120252524e3253afbb1b70f04824f073238a95
SSDEEP 12288:bfUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:bsnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T12A5523697965F98BFA1706F14C8281829B7F0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 c9bc2df42a39c0bea35c741c223306d01faa6245d9433658800f1f024899da44
MD5 6d97091f07307f551e31938cb16f2358
SHA1 6f21295d44cdbf9e98053f4c5c62d6fe96590c85
SHA512 87566752602d8606ea3a3094cd6ad859ffe60b476b0c8402f346b3bacf4e13b0c9c40446531331fa9cb8dbec757d2865c07b922a8c876666a8f1221cf47ece7b
SSDEEP 12288:yFUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:yGnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T16A5523697965F98BFA1706F1488281829B7F0EC6BFD1A38F7B4C1128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 f042c2befa46cd418fbd4fc5bb73327d5cea2769f5af3b326cddf8c076c7cf4f
MD5 ab8c21b19ef80be50859b4a110a05497
SHA1 fccbb3703872c0a22737d22d1244e7c771f99749
SHA512 256b8473bb4e74a047c5c3444fe080a33699ab86f8b4a1abb4cd7162b327458ca2ac472311455fa2df027fd42a7ffda9cd70ac2a9c283471713838c103afaf20
SSDEEP 12288:QEUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:QhnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1135523697925F98BFA1706F14C8281829B7F0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 38acbf354eea9eb73c852e9e66f5301f1559d500f4a28ddeaedd7524be24937a
MD5 33e6e068b86e780ba541fb68c464a789
SHA1 ae834d487e8c90408ad339d1c1c4eda09df9b13e
SHA512 05cfd3cbba182fc9970d1e2a81acb28e81db3eeecb34f1cdeb90d1029bc0840b052d7638b11bc483e270829ad2445a5d494f2c6d361748d9983b8a2d592714fa
SSDEEP 12288:KtUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:KunQ/tbw/2Mkjy6Fr7g0o6
TLSH
T18C5523697965F98BFB1706F18C8281829B7F0EC6BFD1938F7B481128967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 dc917899decc74ec2b8aa6d0ac2cec48b4f5877cb540253061a3677a538db55b
MD5 5f09aa4dd908505507fb74c3eb580f0a
SHA1 ab677c269d89473de1cacce9b74090c3f22c88ea
SHA512 2f836bb3469b541d6dde8336c75ee57acbf362186ce40c7d8058d158cec174376b8ae067239d8ca940d071b8fe9613b25be8ebcf6bf773ad38519685caa681bb
SSDEEP 12288:/zUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:/wnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1675523697925F98BFA1706F1488381829B7F0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 96cabcda7fecf05bab0d563e37df7bcc054bd854d9edbc9ae0f24c2c417444a5
MD5 b9d859a4cdb2345b05d99a2ae00ecfc4
SHA1 b70fec7044f32a1fd691ddf15fa80d46b3cf5454
SHA512 9a7424f55bc0d2214887b4b82e2e76cfb739124a003e4bc469e99b299573a3a77b39322d12fa29eea07a4603b40e3b52c4e752a6b2ecb38e6f125f9993318f7f
SSDEEP 12288:j8UGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW/:j5nQ/tbw/2Mkjy6Fr7g0o/
TLSH
T12B55236D7925F98BFA1706F14C8281829B7F0EC6BFD2938F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 bee66c458e7c25d837c70fbe5c90813941b38d499ffe3f4494ba29b2d37e2d75
MD5 97a70060a7e0ebda0a3e7bd90fb66856
SHA1 d558630cc5db149d75c84f05802ffbde5f8f7de1
SHA512 12d48f34e577b07b249a70b5f2d0fa97ce984969adfffa6c4c445f378a28c0f0f5468007b324b9a8d922655d462ca0cf3e33d544fb706c248e585fcbd1143f11
SSDEEP 12288:PzUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:PwnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1B05523697925F98BFA1706F1488381829B7F0EC6BFD1938F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 01da30986f2ffe857e2c3d1ce6a077f14a95e1a18afe009411ac20d3ac8f8870
MD5 18e3188fa30980271ca92baa0df1992a
SHA1 3cf2119cbbc9d52f4de029a09861634a42ed10c3
SHA512 c596d8954dfce92f256604a39ae77ab6d11662721a75aa10a7bead8a8b5845c29b03959886ad0a56f85561a467623d0b11a846421a66ad21f225f4e3b14f2261
SSDEEP 24576:Rfwv/k9RX6wkyAIqnQ/tbw/2Mkjy6Fr7g0oS:AMnYIqQ/lFTjN4
TLSH
T17685DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 7734d63c55a008d4c023e017e836137f82697409163d994810c30b1b0e1a6c98
MD5 3af9b807b86386bab538e8f80da17615
SHA1 b48737f7ad6f5827edba3ec73cb437c37ea163a9
SHA512 0502acedbb6b6d801bf9f4a42e83b68b9092df566f5e86e4aa4d93f174ab0390208e770cd799b7a519eac83c9772ce12a220356f0b4ea5b2a033d050460d496e
SSDEEP 49152:uYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0FQ/lFTjN4:gySzPyLm
TLSH
T106066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d33fd41be59a3465c49d1c328b02994e80258c55d3086ec8a83592529280f6b2
MD5 a8195356a86fab348e73a789082fcf41
SHA1 4fa4962778479d10a5d47d392fe77c22dd323af2
SHA512 defc89027b81794f3e37043a0e22794fe22d8fc1ef8c9e6d92c329a072b7fc427f47d6504f7e48c2bf4ae9617ce72b9f2f50b9ac200d7c61fe693b258cd7aaa7
SSDEEP 24576:L47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYrnQ/tbw/2Mkjy6Fr7g0oD:L47JUQj1irIhCnDHUPfF/1Q/lFTjN4
TLSH
T16365AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 a1e75e4be523a877c9185f71b30e500a3ce1c964b2e776a8f106a80832e580fe
MD5 e18a12c6644317cfc3cc610b6c406d92
SHA1 727a583be328807fb9df10ea2288a169bf949cbb
SHA512 b332aae803dec46ca42954f344235dbd2362228ad04d6a45e3168abda7125f045381b48312083bf424cace4652ee4b6c0b449e128b407e363c24b17074be98f1
SSDEEP 12288:wssfVUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:+WnQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1DF65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.2MB
SHA256 db620a8b0951f30433e8902207d17f368e34d74da488c151060c21ad7ba01ea1
MD5 79314f01bf0d80423adad8781f6f3964
SHA1 6f148ab3c424ac4d1cfe2b9f15b8d7d9cab0fb1a
SHA512 936ba3a762d6c91badd28190d6a41c35a5a7dc29b18af6c5cbb26adce5906f047a4213179c8b612552280af9279500f055c30e754597d76d063306354547834a
SSDEEP 12288:WIv8E7U3fNNA/SFqrP+97zJnPzUTcqHPOZ8/M/Os5BjpcS3M:WI0mUPgo7zJn7UweP08/MGs5Bjp
TLSH
T1ED451741B526D78FC5A940321E76D6CCAB707D42EE04AF0373C94B3FD476658BAB6282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.1MB
SHA256 ff781509f791410c4632fdf4f53c0863929c7ca560dab0460ccf191854d28d41
MD5 cdfaf042ec274e4984266cfd0abbfc22
SHA1 264423369c06c8803328f7edd56e8bf810416287
SHA512 88fc2693aeec9c2cc01956ad82c2dfde77739d71a866182e3736935166ef3d5dff1d8df44bc36d74d12e00ea58fc3132a121a2b9dc253142bc8baeca0a2d7cd0
SSDEEP 12288:5Fy8EcSEPF/hgnX+/QPxlupbmiHaTLMNToTcRVo3LNL6Lr4tAc8FExoWlFJVp1j:S714dSEbmiILNLRRkrWD11j
TLSH
T12A352949A077A70FC9AD40335231C6CEBB749C52AB453F0673880D39D86AB5DB9E27D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 179e036400ac8c0110e106ce6fd4798bf69d1eae2670f9f034c6243f4d96a366
MD5 eb346905c9a302cec31a48d9dbdbeb70
SHA1 10c7c5cd538e9e8a20f136d4482f6cfb15521ed7
SHA512 783311bfa34e78cb6941257d8364e2af599997d61d779c6df6bce0ff77ff45c449ba356da44fff79d23c31266ef2d4f41c6baff065741026ffad47473c33ccac
SSDEEP 12288:H679UGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWn:O+nQ/tbw/2Mkjy6Fr7g0on
TLSH
T1395523796668F94BFA3B06B048928111673F0EC5AF90D3CBBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 860d597f099ebd4487b796f5e9cfa6651462d5cb0bd2351d7f600fdf303b1faf
MD5 847cb461759f3513af5b277a32c53b44
SHA1 70c50b0e6f825fec5d5b50cca265ed3973abfb8a
SHA512 4536a977b19ea5d2f9cc15ae76a75657eb338ba787b64d2777aa1873c89fbf95f6a3ae59e19f15e8474fe336156e56874034ef473738c42c4293b91663454569
SSDEEP 24576:Sgb6bmBIi49WNNFpg1rSvFv7bYEnQ/tbw/2Mkjy6Fr7g0ob:Sgb4mBIBhGFrQ/lFTjN4
TLSH
T17E65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 cfa638636dea2f88be17e26c88b361618668afda4a7da190f40c9188c950724d
MD5 cd0858cc0637d4be985676b6d2f660d6
SHA1 c492e3acc3a907c1470e6f5cf9e7ace4e178a209
SHA512 0238e3f50a67e91cdab499da34fcaa23bfc2c3a8fcb7f544f5f2b66c2542cd265257675541f8998494731d56fbe176ce074724f03449528022c9737babe998d5
SSDEEP 24576:EG88u8FpJqH1Qzria7/m7nQ/tbw/2Mkjy6Fr7g0oy:37ZFPqVva7/MQ/lFTjN4
TLSH
T11985F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 dffd14aa62dcbc4d400204a28e6fb36e8c420b3e4f347cc4ec44f14ac94dd831
MD5 472b4ff4a07c933405ef414d8ca5acfa
SHA1 379773f7321fd2860a9cb59b295d5953a8d11539
SHA512 89c49f604b2380c590aef16cf0acaa362c5c966fffb6457efd44f17f893a0185b0d188e81e7c02de996f643d39f775311eb9363ce94b2d2fad6dcb14a3941a98
SSDEEP 12288:qHvUrBFrEjwaQmUGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:qPUr+NQHnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T18C65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ee4261e691c22e8be88119796bdd86f7ca38f1734fd113caca586250627b6db2
MD5 0b7098632d0d43d360cf719921d2a6ba
SHA1 aeaa3feba600d9d90bead49f4a57109e61b16f11
SHA512 020c89deb29c753703d5ef77280a14198444a426e426e4dd445a2227d81e81c4a7a51d7b9deedec3e8b644ad1dd61b44ddaeeb6b5a5b8aed5cfc03b437af2c40
SSDEEP 49152:yBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjXQ/lFTjN4:9G05lO43b9Lm
TLSH
T1A2D5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1d0942654931aa26389f4c07466a14d3954721107e8bb8cda137e139c14f1cc3
MD5 71857f82fea1ff815bd2b49be153b98b
SHA1 17833707a6c5800d19df2fef12f59d3257c19a89
SHA512 8777062db371b78561452852c09d2fa4c58228fc523747b1d2e9cf85ee035360427eb27736a84cea439c06c2f9aaf625a2966727f427d7ad4818f08c600b0be3
SSDEEP 24576:Ufa5POZ3dpFWVM50JicR2hG0lasx2+47eidnFnQ/tbw/2Mkjy6Fr7g0o4:Ma5POZ3+Jt2pasx2+mPQ/lFTjN4
TLSH
T1BE65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 23707f866dae782d3a929081907b9806ee670875ec6325c2c88b337794a6dab7
MD5 15d5e34f2f7b27fbb86f34c44d94fe27
SHA1 a716488e331f35e22bfaaa349451aca167712146
SHA512 e25669c6d567d0b1acc3122a9c978175cdd86e160711ef373f57d80cff536c6f742313f0fa2202571090203f6b95916a9b4627a47d94e73f6ad8df45578d391f
SSDEEP 24576:JNcwHdjbyQ4nLC18lb/EOjowL7FkznQ/tbw/2Mkjy6Fr7g0ol:JNc/zEOVHFsQ/lFTjN4
TLSH
T12B858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 3e508680ac5ce61325629624a6f8bcd3bc028872c05c9eed92b0f6ef49e30c60
MD5 ed226797b36f4c1e962a784bcfd6b27f
SHA1 4be3d620089f120628be522f7078a70d60ea1860
SHA512 e932ddb697792960804f6bdde72b86f5762fae0f65d1f8cc5a3de8a82304a4c4a8b16067dc0b9a5bd3b2a42ab4455f623167af2e61a432b8bde4b9bfb50650f4
SSDEEP 24576:t8kNvNnaFeYhJNtmZBm5nQ/tbw/2Mkjy6Fr7g0oV:t8MwBtOm5Q/lFTjN4
TLSH
T1D155AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 b22bb7640fa1c5ce4f6fd1160304590ffab177410e3933af729fd76197ea8ac2
MD5 c6997be908dabd652c5c87c8dcd5f8ce
SHA1 87a0dd82e424835fddf1ded5232e9346a128eabd
SHA512 e9805a05095db693b98dfb0030a21ffb9cf6c24aaac85e9c117de9285e1b4481012fd12d4bf176feb1de63e3e68e80998476cb17471313ef5edd7236ae6954d4
SSDEEP 24576:sD3FHshBIYQgAinQ/tbw/2Mkjy6Fr7g0oK:sDVHeBIAAiQ/lFTjN4
TLSH
T1B075E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2420-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2420-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2420-14-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2420-21-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2420-20-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2476-128-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2476-139-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2476-127-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2476-134-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2476-141-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2528-385-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2528-90-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2528-384-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2528-313-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2528-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2528-96-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/2576-455-0x0000019314250000-0x0000019314270000-memory.dmp

Download

memory/2576-441-0x0000019303D70000-0x0000019303D90000-memory.dmp

Download

memory/2576-424-0x0000019313E90000-0x0000019313F90000-memory.dmp

Download

memory/2576-409-0x00000193001E0000-0x00000193002E0000-memory.dmp

Download

memory/2576-423-0x0000019303930000-0x0000019303950000-memory.dmp

Download

memory/2796-316-0x0000000000400000-0x0000000000663000-memory.dmp

Download

memory/2796-6-0x00000000026B0000-0x0000000002716000-memory.dmp

Download

memory/2796-7-0x00000000026B0000-0x0000000002716000-memory.dmp

Download

memory/2796-1-0x00000000026B0000-0x0000000002716000-memory.dmp

Download

memory/2796-78-0x0000000000400000-0x0000000000663000-memory.dmp

Download

memory/2796-0-0x0000000000400000-0x0000000000663000-memory.dmp

Download

memory/3184-85-0x00000000009A0000-0x0000000000A06000-memory.dmp

Download

memory/3184-311-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/3184-80-0x00000000009A0000-0x0000000000A06000-memory.dmp

Download

memory/3184-79-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/4724-52-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4724-38-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4724-39-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/4724-47-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/4724-53-0x0000000001F80000-0x0000000001FE0000-memory.dmp

Download

memory/5140-123-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5140-117-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/5140-368-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5140-115-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/5172-150-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5172-144-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5172-143-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5172-372-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5376-66-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5376-68-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5376-310-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/5376-74-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5572-295-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5572-56-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/5572-55-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/5572-62-0x00000000009C0000-0x0000000000A20000-memory.dmp

Download

memory/5788-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5788-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5788-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5788-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5788-114-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5912-369-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5912-340-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5912-371-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5912-102-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5912-109-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5912-103-0x0000000000770000-0x00000000007D0000-memory.dmp

Download