c530178ff9e9fde64365069cd7293cdf70e61f7818ab9d56b7225f8ed35ad216

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 09:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
Size 2.4MB
Sample260714-lw3phacy4x
SHA256 c530178ff9e9fde64365069cd7293cdf70e61f7818ab9d56b7225f8ed35ad216
MD5 7b7ea2268e7344e2cfe8c111d714e86a
SHA1 e016b6a88297448de42b50a029c3cbeb9484971c
SHA512 c1c983afa3e8e74c0cb3f7e29c54d560b8846209fd88b38af2960f17f440a235843557c0baf90982960464df8d031b632563a4ef1101dd789137f71f7238bdb1
SSDEEP 49152:K4lTs9xsbcqr6EWqOT+4pGdGtYEnLYDPw4CcUH6QBAdQ/lFTjN4:RTs9xsAq5WqOT+4pGdGFUDPw4CcUaQZq
TLSH
T1C4B5BE3275D09077D53317368A4D736962ACBB704B35438733E51E6D2EF0693AB28AA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
2100	elevation_service.exe
2568	elevation_service.exe
5088	maintenanceservice.exe
124	OSE.EXE
1376	PerceptionSimulationService.exe
512	perfhost.exe
6056	ReFsDedupSvc.exe
6048	SensorDataService.exe
2756	ssh-agent.exe
2388	AgentService.exe
4684	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\cf61cb723e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_120921\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000079c917bd7613dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002fadfbbb7613dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000038cb0cbe7613dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000071eb4cbb7613dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003c6dfcf97613dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e52484bb7613dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f17c8dbb7613dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2100	elevation_service.exe
2100	elevation_service.exe
2100	elevation_service.exe
2100	elevation_service.exe
2100	elevation_service.exe
2100	elevation_service.exe
2100	elevation_service.exe
2568	elevation_service.exe
2568	elevation_service.exe
2568	elevation_service.exe
2568	elevation_service.exe
2568	elevation_service.exe
2568	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4512	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
Token: SeAssignPrimaryTokenPrivilege	2388	AgentService.exe
Token: SeBackupPrivilege	6056	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6056	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6056	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6056	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6056	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6056	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6056	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6056	ReFsDedupSvc.exe
Token: SeBackupPrivilege	6056	ReFsDedupSvc.exe
Token: SeRestorePrivilege	6056	ReFsDedupSvc.exe
Token: 33	4684	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4684	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4684	SearchIndexer.exe
Token: SeDebugPrivilege	2100	elevation_service.exe
Token: SeDebugPrivilege	2568	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4512	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
4512	2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 5692	4684	SearchIndexer.exe	98
PID 4684 wrote to memory of 5280	4684	SearchIndexer.exe	99
PID 4684 wrote to memory of 1644	4684	SearchIndexer.exe	100
PID 4684 wrote to memory of 2372	4684	SearchIndexer.exe	101
PID 4684 wrote to memory of 1288	4684	SearchIndexer.exe	103
PID 4684 wrote to memory of 5040	4684	SearchIndexer.exe	104
PID 4684 wrote to memory of 2892	4684	SearchIndexer.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_7b7ea2268e7344e2cfe8c111d714e86a_bkransomware_darkgate_elex_maze.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4512

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2100

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5088

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:124

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1376

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:512

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:6056

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:6048

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2756

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2388

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5692
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5280
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1644
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2372
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1288
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3028 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5040
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 251f2febfbedc6a3792e4ae8b406b3ed41077355ea83da569b399653eac39043
MD5 016cb5baf1846dbd63f347ca62cc0312
SHA1 7f90c522fa7f446439a392a065aa1f61ef2b8ce0
SHA512 9deab41bb8b7e1c72a098ba07d43aa6c3a18df61b3d532ff56883a7bc3c2021ef50e1c6e1e5efdf5f1291e2be87ccd83af91bbed648f436cf51b671b6703c6cd
SSDEEP 49152:ub+632BuPkFKRrdE6ohmstBhuXjfS4LWxndQ/lFTjN4:w3q6HjBdLm
TLSH
T139D58D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 4142bc29c36a485771aeac7a5eb9f2f376fbb0a12449d839066c903e826fab72
MD5 a42a531af47f8e0d1f58353ced06f615
SHA1 e8f825ac87aedfb35bf9cb156948a9eee59023ff
SHA512 c793e22bfd7574988268fd6310164afa750109149429fac97310a0bdae3fb4fa6450436039c279225cf8d9e4432de29a43300503adbcf1bcac8fcbec18d95433
SSDEEP 12288:b1XLsswWkxy2lRq2czA2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:hXYfDtczAWnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T17B65F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 b5cc39c9ff4a1c686a1162a8bfaaef0c617569ba8f6005511125b09d91b029dd
MD5 031d58386a8d51f64189e9ce2109d17b
SHA1 520824a77c95760395fb01a86f54dab3a55d9f46
SHA512 eef168ae6cc9ce941f7e3bbb41f1b4522251d211355f322133123c313148b4573055a5c6eb85838dcb3a620abe4aee0ca126611bb94f809ee449dde9c1b8ea16
SSDEEP 24576:V0Le5ji0hmxLrM1nQ/tbw/2Mkjy6Fr7g0or:VPji0AlAQ/lFTjN4
TLSH
T1BA859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 61c0ef4c7ab6fc9979ea3baa5e547da854336514c6cd14eb9636787150cae671
MD5 b3738975761268cf5ec4406b886c3df5
SHA1 603ca8809561354cfa3d743f5434af6c9ee1fa53
SHA512 fcea13bf9664a15b1c1124065bb7524fc6d0a77b34c412e71ad2ed0abf70d92e630314638f0a2ab1535b795bd6983067adab4af66663ed3e56313f05858e86f8
SSDEEP 24576:pa7/ezSC6vUyD/aqgrvWE6q8wyu7nQ/tbw/2Mkjy6Fr7g0on:Y/ezSC6vUzPvxHjykQ/lFTjN4
TLSH
T1AE755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 63fe4c791eaa94c888adaf6c885a7fdf603011e84f25742a436aac7bfb358fd4
MD5 673fb51a946e7fe9e12389c519740699
SHA1 cedadb5b75c0e3ef1f0d276e226cd0deb9b5c044
SHA512 6f71221d2c8a8500a8c9df2a2654fc7dc21998640581704f3814a5625d722635e7a9b7b46f1e07f5fc43ec02560313b68b5983a44a9b938c5b66741c47128ea7
SSDEEP 24576:HVbqPb88hv/l+6CnQ/tbw/2Mkjy6Fr7g0o4:HVO88hXl+ZQ/lFTjN4
TLSH
T1EE559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 12077df200b9196ef6260565ce5958cb37d6a63514cf2f1de5aceb70c0155708
MD5 08d3a214b8307ad3bd1d66050244ea51
SHA1 f35dc89752bc4ffcb3bb65d47a2d5bf3a23ad5bf
SHA512 78af6c60b4599dfc3cb6e7607bf9cfb87e34dbd77545b7b1316fa31ad19ce8eeaf3f4cf9f8363059935bca1f84e73a6f2b7b123da556afc50fc62e6dc1d29b4f
SSDEEP 12288:HzRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:HzhnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T16D5523796A24F897FF2B06B55CC284826B7B0EC1BFD4A74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 0002d74e893cc46c492d08c4e0ef979c9c20aae88ed6d6ee262f0cba06158acb
MD5 1ed65a0e71ae51400f3aa178c6358c1b
SHA1 0f6b8d3ba2987d96052da27eb2d9d0cbdd3574ef
SHA512 f38526ed8b357bd427ab4ee51308c48276b376c89a84a7b9ab07ed6556060423fa4fc12580d6077fd7f7fd60c302fb1471301efdac293fe124678b9499eacd25
SSDEEP 12288:LeBNUbTVO86UaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:LJIUanQ/tbw/2Mkjy6Fr7g0ov
TLSH
T16775CF3BAE28FCD2C67E4DB85A91C600D77278704F61A3CBD164820EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 fb718f76e553d11a9360a5c0dc7413a7e546cc5a8eecda5b7b0c3e5cdb575d34
MD5 b80ffdd007223cf48825bc75a7696028
SHA1 21f95954eb0d2cd1392e0e02100c67f4b3180633
SHA512 17d4bf8772d62fec7de65517f7979becb2d6d09f570c7509858bd7bd164449dc65f8d37aee50ae6298dbc335029773eff6b83c7300393ed599ee3473f60f11ec
SSDEEP 49152:sQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THQ:sQvGAdlCEL8c/yRNw5CgLm
TLSH
T188267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 c41c0e47fcc8b236e00c00fb241d51e93754524e6a8d4a0bed046b590fcf414a
MD5 b64ae2245f7e1325565cdac0ebfef8bc
SHA1 665142e84773619b0b5c32f70308842487466982
SHA512 e5f817c05ba406bf67d3a5ed3d15434de7c7c9240b9675819c3f719b0ddd68d4469131560665d281030fb7021b82e08fe178acb7b8a369027e951698ee542df7
SSDEEP 12288:ZAwSfxL/2Dc39DLLmt0LDQewsAjQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgM:KQewsAjwnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T13D75E031FE74E436C77F0DB61B22C706583D6A604FA11AC3E3A84A9D59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 16280217010e4a5b31751901457fdec7dbba40e4e2b675a8f89454f1a4584922
MD5 9f736ed0caf0bcc9bd0db6f3dbc314b2
SHA1 ce04b147945203bbe6d9d6f72e0afe3e778cbcb0
SHA512 9ba56ba18abae3a58dfb296df4ba09888a9b47eb3c6c0a1e18e7aaa6cf365fc5055a3123c26deefce7f65bb37aaa0a8bb3d06b2ada1a7152642010447910d621
SSDEEP 196608:BUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH7L:BUEtQevvqc2W1cpV2EI32
TLSH
T152474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5a4f07b1a55e3f3cb9aba76442779a83de711cf847c151cba6bcb24bad1c243b
MD5 ce555c87aa518ad4734e61cd956ca579
SHA1 28c70f4f1e7824d448113bdbfdfb1ed4b99a1e60
SHA512 00bd8b524b30216dd1f552960211cf3a2d3f8207fa5b6b3c459272aef4960ce0907013b50f890dc25d586df94bdd2c97ff90313996fd8ca8046bbd76e06ae99c
SSDEEP 49152:SCbRquA/m2yL5zQfFiV+XenmE3/zQQ/lFTjN4:3oqtVjnm0Lm
TLSH
T1EDD58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 d21c311a1441802f6c9c9eadea81897a0ec6e72bc3919a8a4c56c2ee989893ff
MD5 411793e24b1529a77efb15a477744aae
SHA1 f47e824d8667fa5b3d39560b230a0c0a15ca91b5
SHA512 702930c4350e29cd5f783458862de65cfdf4143b97cfe007f4ca0b859fe3a55d1f2bdab334309f2d29f7d91515015d2ddaf76fa98fb6cf4696bc591d81b4f8bf
SSDEEP 24576:eAhGLJIFoiwtA5l7S53fnQ/tbw/2Mkjy6Fr7g0oJ:eAMyFoiq5vQ/lFTjN4
TLSH
T1D335AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 96b0a6053848d4d10af5ff94b96d359edf0deff0cc240fb7d41490810aacb86c
MD5 2392fb79b93b7d55371159627a7e435f
SHA1 4872b378aac5505e089bd2048eccaa763d18e07e
SHA512 528d99cdc2bba33072a6d63500af6322ba3c141cf08a9d9bba01a4ee1cdf8a38f61eab276b36ce41e8bfec3a0d201d59b3a2b714def8325128ee3df4198be260
SSDEEP 12288:nmw5HEjsChN2BFgl0WDm+CrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMv:mwuHOWEnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T10165F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 0bd1c81a77a79cc361f6bf86add4fda0e87569411009b19c44b6e42db9d1b7df
MD5 21e645e1f44d3b846899c04c87771367
SHA1 d41fc75772a4a8b397415f2f2f525a002dc4b30a
SHA512 45a1f9faf680b1bf2b0b670633a99f025f55d9ed8c1aaa9fb5fe62ecfe8cad5631bf5f4752c2f7efdeddeb0d8eca041f32a73ca378936792ecbba3009a5fa264
SSDEEP 12288:KXZ1IyAGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:CZuNnQ/tbw/2Mkjy6Fr7g0oe
TLSH
T1A355126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 5f8946ca4bd05094ddf3cc3a9c6a904c999c80ca6c0450fdedceb2f501e41d43
MD5 624f29de273e654d969f4d729c349613
SHA1 21db8f1f8be0c7d125a5d1007c81e96cea9ecc01
SHA512 6e64035d5167261c57c59cdca4004a8e721d6923781bb59c003f84c440eefa888b1d9039bdc928f698d071e42beeabe708fbb84709b283e7358c0cc46ab3ac20
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U0:rQRQyi36YOcPQLvw2gAf+PN3JLm
TLSH
T152667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9053700f00f29a0cc534fa7142ba7cb60f058ff39c0329e6917bede03e87e37a
MD5 52e282daf1a210f52f338eeba4dd6eba
SHA1 e213a9a0ffd06b1c4b7a37229536b98b61adb82b
SHA512 cbb90105eb993eb31fefd4a58e9f90115c6260a62199a1b56a6dd4156df181a00bebec38469e8b0c9b133d5aeca1bebb591272a0dd75c9e6b04df566b2fcfe61
SSDEEP 49152:0j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U0:rQRQyi36YOcPQLvw2gAf+PN3JLm
TLSH
T140667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 ba3270b5c05d391ad596f465bd06877f6c7e0d8af45a66b923b20483023cd2cb
MD5 38d57941852ce6dacd57b7b7985c5987
SHA1 13e49ff7cddebadc0be3540a94403b3ef2d7963e
SHA512 79ed1b48c2bcd976b27ae278e033282fa61595198298994adcb544846850e91c4d0dcf4fe975aa4f77e3c8621a992745b0b04671a966e3d7f6766ae7fb8c5a01
SSDEEP 24576:zwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0dnQ/tbw/2Mkjy6Y:L68Qg55nhheWu7PNU3/AQ/lFTjN4
TLSH
T143B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 8ab04692915591ccd19511b44c4aa1b90589a0df35eac277aa21682d92d03717
MD5 4b516da3497e8024a2496cf810f8e534
SHA1 b8a124b6fbbc3be9e57023d079a5339fb94fcc66
SHA512 d94f3154c8f8fa7af8d9f590e440be3a21f1fdf74a58cac3d6d924e12b8b88fb52b6976777e57e5923110d2c554cde21102db88c637f3c661af11b831ee5e59d
SSDEEP 49152:g3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99W:Ny5112gYy5azzVvL69nLKnhZGLm
TLSH
T18B167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 146d2dfa03f8800c1ddb271dcbd9a29d1b014639a49bd993c3d8361518c9d9b6
MD5 79cbe20e84b33612ebad6c5b841bf993
SHA1 f86b0837df58472b51924bf6af3b5115e252372e
SHA512 6cf2bed49bac37a6088b3a71061bf31fd2c82b824b6c43e48bcb96a3cbf5d40b377762637ecf0a67fcf2556241d88fb8841358fc2051efd5f5c90964018b045c
SSDEEP 49152:PB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glmQ/lFTjN4:xu6JmVxd2dxLm
TLSH
T1C2D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b087b913fce560a6379caf4f905adecbcac9bd8bf4d05e5bcb3f5e873d7c23fa
MD5 4240509c4c332b47dcc1d66ea96befa9
SHA1 4806a21d935a128fb7fe53a1dc0a70201179ad6f
SHA512 8459dbd05e6632ac89064b1e446c3010d1462a314010d0ab533147200f5206c9adf9ac5cc28ec042c5420e4c01aa4af3b92c227ab05eb670e8e3a668f8756fe6
SSDEEP 49152:h1hpsNoJpF1A6UU44CwH7R4x6Q/lFTjN4:hmifPbR0Lm
TLSH
T16DB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3b915df5536f5f8f0ff18ba7b9c99b5722271cf2c1351b0b32634eec7df16462
MD5 344a78935cfa3e5fb5d574943c78bb56
SHA1 6774622bf05a021a77f6512e0beed45e4ab72c8c
SHA512 247b0d790d90222500ea6541be67e6302c08e222b75dbf94cf904a599c8e3c60993e96de3cc39b85aa393bbd6c2b812ec0acc11e9fad041dcc5084e2000a2392
SSDEEP 49152:xSuZQIY0Be2KRRVtOnks6NMHqNQ/lFTjN4:f5dKTi61CLm
TLSH
T1BAC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 36fcfdedd3994d07071877ca4c95a7db9b68141289d1f5059d77a27d01fe875e
MD5 88111cf6c289fbc5a7be9fe47242a374
SHA1 0bde8799ba84f437aeb272484b1019222b4814d0
SHA512 4e98a48534cffa470e93efec19198816cbb161036ecf47ec84798464a2a2368cf52acba76697bcdb1ad16ed1b0fa546cd2e76e50ad119052d23fd790eab959a7
SSDEEP 49152:4htSn8EApI0figngiDn0AP5wWQ/lFTjN4:pX2iyph4Lm
TLSH
T1B795BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 f4e297d3203104fe1bbf7fad7d4f156f6de7b1525bc23a7eff271d99f4c155bc
MD5 f40303ed34a41ef86f93afb23d4f530f
SHA1 143080ea5766b36e89dc1a8dc68b875a777cf7d1
SHA512 499b9a31f847d1dab62cfdb469b195123c7cb0876bc5455183b9473ecd3b3edc6ba878fcce7769b6da6576ea47750d874890a90aba76113f56566336d022b106
SSDEEP 12288:nJGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:nZnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T15A5523697964F98BFB1706F18C828182977F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 41313b1364403e7b0a18383a603574ea2357c48e0a4d52188f8c94fe06e571f1
MD5 f17fb6e4cab4f4facfe962a86ca6fb28
SHA1 0e00edd7666394fde4ff343283326e6c67687ccc
SHA512 07dad39f866caa4853d05a30fc110db1bc177200ddb16afe19cd23da416da9ce4d609918d99fa6c0549092b79f514c4b9bd509bf3f09681630a6654c3ae3b7ef
SSDEEP 12288:ZsGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:ZsnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1F55523697965F98BFA1706F14C8281829B3B0EC6BFD1A38F7B481129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 7310f23c8d1a26bed040f9d60c8ea0a1131e596eb5499b195db0ab9ae21f5573
MD5 6242ec761a0813177cfe9dd5fa2f1f80
SHA1 0ef12656bc8ab5645a49c17295210e7f3f3ae71d
SHA512 7b828d73ac1270ad45aa7bbe59c8907b5f853d6aa3df011fb59d9ffb660d0e5af3d55d42ac5ca0013eb1c1b108d44a65a07ef40d4188b68d40aed85e2ad6bbe1
SSDEEP 12288:LSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:LSnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1F85523697965F98BFA1706F14C8381829B3B0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 7c81c9aae2ff67563ebaead2513414e13763b68cda22a4584568080f04118d62
MD5 b90afe0f36811ddfc71691b955322604
SHA1 835a332932a46a68574c4e8df199ed8d573ac2d1
SHA512 22948415596e09f71b539f6e2ebd1dfdedf8848a6fac0a90c3e5fc4fa4b5240ef3b6f6befb0edc0bba5d1117690f2a2b8ffb372a0e18125c35ef20303d9ffb9c
SSDEEP 12288:NVfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:nnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1665523693A69F4C7F92742B4CC938142E77B3DC5BBA1A3CF6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 212a40ec6f0b1c3af09962933336d123dbcc75648d1df365c055faf76c2c8a04
MD5 30272f8fb4014b2cf326828be950fb91
SHA1 45466f4a1ea6a63a0d1704cce784431d0e88790c
SHA512 f15012e3e02418532173c454b776e2dc18ac8212b493bb2851ae7a14e28a7e3967e7c5f443055198989b62363a3e90b17e869b19cddcf5d1e75a4374f09ea31e
SSDEEP 12288:QHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWr:QnnQ/tbw/2Mkjy6Fr7g0or
TLSH
T1425523697965F98BFA1706F14C8381829B3F0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 55da8c31824e7b39ad12d59797ead4962c5b06db05d39245d5c2c6ff261a487b
MD5 44d1a4d69e1d2a7b3eac3e656c2f6495
SHA1 443b44c51d215f3ceca8b1bfc9fcc7cbd173bf7f
SHA512 7250bfa00f9b835a6a4c6ba165205f92190561516954b98ef17d9ae64e20ac09fa257abe97ec0018c134c9c2b57d2866bc7f47250ddd3a9a4da88868820b14aa
SSDEEP 12288:0IGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:0InQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1AE5523697965F98BFB2706F14C828182973F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 d0fe3cef96d196264ec4c5937c250e8d86122c58374106161ce616529b421ff5
MD5 7237483e0353b56bd2f2675cf0d252fb
SHA1 ac47f6f449ecc7087e28d10855ddbadbade19b89
SHA512 7c73bad83341fdea843fec51669372580ba2136b5bd796b0da9c41ee1843b775892bfac234fa4d8ac82fdaa2498f0248de3aad2bbcdbb708c938cb17fa164e48
SSDEEP 12288:k0GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:kUnQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1F25523797965F98BFA2706F14C8281829B3F0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 efa55a76198065f7d6d40422bb0aa0fdcb467002f1619b0f5d0b0ee91c7c5367
MD5 1591aecd480f7753ea4e5ba9f192bf39
SHA1 824abb8556abac9a1a8ed3a11a87a7d00a047e07
SHA512 be3f16321412d3032050c2b12ff83b7873550e5abc412f3edf383dd7a1264329d48c63aa77ab1c0c24339f1056347fca2ea7e25aa4f76c86c29bf86546d1f739
SSDEEP 12288:3iZwbDzzFEoS2cPvyMGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:yZM3zFVSOMnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1EF7501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 05f84c5d1ae154759f7b11c97d6b40850f9ba46a3144e97224c5c69f20b3ec5c
MD5 22b03f2ec4fd1cf3703cf4b8c97b1fb5
SHA1 16f43be44b55a057e0bd6829e7dfaeb4046ee3d1
SHA512 963bbd3e60b448b1967689a701c8fa100441fabaa2903ff6dcf44a73236caa5e0b766e88f22f156a2d62f68b52005fd2483ea393aff981c7e98e0b57f8ea691e
SSDEEP 12288:gdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:g9nQ/tbw/2Mkjy6Fr7g0oz
TLSH
T11C5523697964F98BFB1706F5488281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 371ee17fefe982e79a7d13dddc643241ec196a8598aa1eac4e46075764c6e074
MD5 07fdd362d013053963d27f88424f78d4
SHA1 d3b96bfe8d2ec01947f12a3e8691ef3fbc0b8c20
SHA512 5ec4f305580db4f8a2a2fba4429629a81cb2ea429571033ff13e660513060586b473a9a5a399dcddce8007ef4383d2a0c680512b758365e6400d3f96a3421f8d
SSDEEP 12288:aBGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:aRnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1715523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 ca2bb2e1b10b03feaa67d539111197bf1d1fc2010a192a121ee9f4bb1a76813d
MD5 037a88c002e7ac7126391e044692263c
SHA1 c4dcf72a1e3be2eb68feb7709402abd61a671b44
SHA512 292e55d63cf4c16fc770493edb5bb1b54cdcee75ca6d38b5f9439c892fd86f2eaeaffa089fea1481bbf79c5aba369863971d14bc71cbd1c23b7922edff6d44bc
SSDEEP 12288:LyPz5L8AGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:mzygnQ/tbw/2Mkjy6Fr7g0o1
TLSH
T19965021777A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 3a45fa20630cd7fe99c607d214fa3c46568f8f2885992828030e0cda33ff1ac4
MD5 7fc4c4166be53239c5b521c18499839e
SHA1 24226f58398efa623a9a4368147cd16eedb1fa9d
SHA512 c2b83bf969287bf478490276acc0a2562b8fa74b38ee7f246b4e15f0eb29c2787fe16c1e75b76751700664fade855a6277bef7ba61a94604b140ca636b7797f4
SSDEEP 12288:cdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:c9nQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1085523697964F98BFA1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 64322d0ec1e947f16538a9a5c958a81a4cc207f9c956762c9140e25df1d09a42
MD5 c811efd2e0350ef067df551fa41ce142
SHA1 fe81ec2fc48855bd3caec39c8ff14a1c60f7a454
SHA512 315856103eda3c8474bee29b58e37fbc0aea1e5eb5cf263e31273e9b20b0fe04ba6ed2490e7cf64ba873bf06707660dac666eebdc909f29467eabfccfe0dcabf
SSDEEP 12288:4dGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:49nQ/tbw/2Mkjy6Fr7g0oj
TLSH
T12C5523697964F98BFA1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 aa173a6b807a8013ae053e41393687737292eb1ce024f959263dc2f3d9a57353
MD5 99a98f99c8465e7d5b9769a358214571
SHA1 dd6b758a0cfd16ff3a6608e59d482b17ef678ef4
SHA512 1cb18adacefebc7358488391802852a17b2ecdef1751fd313bd792df54c30a58c3f11e55d3b11384276bd6389f890fa2d6a74ec471646fe862eae4e94372b4ff
SSDEEP 12288:NyPz5L8AGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:kzygnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T19765021777A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 4f0322141e3a1c1acde4b60077fd9036b1ce5fa607bf85e8e821392b77170c3e
MD5 3a0f3f619fbb18759118e916d87853a7
SHA1 65a2cc6893084895f86e1a07f7c7a270f8764628
SHA512 8bf4c02b5592e31b9f9e8ee1be87152d54af50e3b4f7ff3e36623dedbe7baeae1935d7c35dcc696a319dbb57fb0b7479b49d9850d25f28a72e4fa9eddc2e368a
SSDEEP 24576:cT0aLl3z0zDinQ/tbw/2Mkjy6Fr7g0oW:cTDLlj7Q/lFTjN4
TLSH
T18B7501A4B35068F9ED67417ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 f5ea0cbf392367dbe7fbcbb34bca9ea619c78d09e99839eade8ef61f30860cc9
MD5 5131c0ad3fe2bb72634aa61e4a942eb0
SHA1 63f04e2c492ecd1532ec4d02217be872a84c5274
SHA512 656d6d3bfe352d872685affc085153ccea1da2aafdcb7eab11eae432c4cbd94957703ff5fcddfea6a116a18af7e92f3f2ccc8988a88df0ca5be0b080cf7c87bc
SSDEEP 24576:P31d9CHKy7GZOnQ/tbw/2Mkjy6Fr7g0o4:f1d9CHKya4Q/lFTjN4
TLSH
T1AB85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 e961df185060b4a184d2cca11b6aa5cbc8cf168be8b160a1d6053f16d86cd931
MD5 ed248694ede09c90afeab4742fda05b0
SHA1 941676b7fef187e57e9a2cabad8912943cf22589
SHA512 68ce5d0f8edc2e5916918391513d9b712a7b21ab145b8c183e08d7445e518ee586f82f3c8e18d833dd301952ae52daaa3ed90a671d6857484f25ee3741bb3277
SSDEEP 12288:kyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:kynQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1E05523697965F98BFA1706F14C8381829B3B0DC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 124290a65b42e0b3e6edf93b4aee2fdd0182bfe3528a5ef4e46d8e02a3ae711f
MD5 e7a122cfe41fe05a182aa5f65cdc8edc
SHA1 2e632c7bb82b70ae857f7ccb723b46b2423b3957
SHA512 e12e23c8037bb884d68982f82c2a69860bd69ca3bb8004e3c8754e822021576fb4dc4a8ed10f464bbb542389daafe8dc106fb5f59fba5df0daf93385d565d309
SSDEEP 12288:vgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:vAnQ/tbw/2Mkjy6Fr7g0om
TLSH
T10D5523787964F99BFA2B06F14C8381429B3F0EC6BFD1938F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 7f6911af7c301ae8cd267760b80ebfa9a7df8268ac8f60483a477e8a42d25339
MD5 119e69e7a64c3a236e15b3bc27a87206
SHA1 88569210e75b50ef29603100cf05b10248ff653a
SHA512 7f1c44042bc1f899951567da48ee15880810009d3bd3bc4bc1ac785ce4ab8e97d2f2f8c83b4fdcb1648b27e2cca71c5d95121ec89a0cf952efb0d137b69731ba
SSDEEP 12288:kTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:kDnQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1995523697964F98BFA1706F54C8281829B3F0EC7BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 cdedf38ec0308822139d1f6e593d22f844ffda9b9f5ee6e9f59f67d2fe23912b
MD5 bfb5bf6c1dcb2f567c4d3fba3c48f060
SHA1 7d7622c49ce8fe754659193ab7b330e4ec623f0c
SHA512 90c4e33dfe1ec31cf8bddb08853d3a4b998839e39af8de0e921c800c66de6c72310018d96428b9f1908f88a0ce678c7d8bf4be46c4f5df6cea68569e0f0fa691
SSDEEP 12288:PdGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW3:P9nQ/tbw/2Mkjy6Fr7g0o3
TLSH
T1165523697965F98BFA1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 757fd89babbccf2285408efd13f32c430f5006d10f44cacb43d06b95ef96bc6e
MD5 230fb9431344ca055eb419584211fc97
SHA1 70e922abcaffecb58e2dc69d8c95a33cefb08c09
SHA512 740b3c76543ff2d117a69045e1cc90f436c4de6818af637f086125161b7099e2e6966e2c8b70dee09a2240d30fc8d2c015df2214546abbdd913d917855016653
SSDEEP 12288:CyGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:CynQ/tbw/2Mkjy6Fr7g0o1
TLSH
T1DF5523697925F98BFA1706F14C8281829B7B0EC6BFD1938F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 d6902658836b1ae5950e93618540ff483c864784b06911ed60ce10d3b8375ea8
MD5 4bc43775517d5599e49a2fe0deca3597
SHA1 e08ceb1eb489ea0f3389fd02cbbbadec15941609
SHA512 5b1d63fe920dcb849d4c6d0112d96bba64c4df3ff6eb88c6d1da1d991927d5ad412751bbed59ff907c156dc2d295abcba4ff59b11b941b622d9b46d50960b968
SSDEEP 12288:TlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWd:TFnQ/tbw/2Mkjy6Fr7g0od
TLSH
T1285523697964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 83de2998001cadc8abadd0046c354e9d7acde6deaad226394f3d2d3d305581aa
MD5 9f5eaccd51af4e4423bdab85df34bf69
SHA1 f5663efec91c4192ea3db6d98220bb926fefdf53
SHA512 fd1c45d757561f06184138b2c6307cf5ec89d8a90056c5f2f9d5bc5ea4a200074403cb1979c8107c38e5d3a953307da332e50fe77c359ff6bd0af7ba9b6ce9aa
SSDEEP 12288:6HGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWZ:6nnQ/tbw/2Mkjy6Fr7g0oZ
TLSH
T19F5523697925F98BFA1706F14C8381829B7F0DC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 9083d308de92b1c85c87ec855bdc968b12f01a10fc7464b67cfc3f839cafa230
MD5 2eaa75f423a95db96be394805db9d5b0
SHA1 78c5dfb31b58677d7d99da0898a18ac0bf5ebed7
SHA512 33c01c00422aecbe36c5c3a459e212871b0200ceefe3267d64c19addaec82af317dd662f1def3134df10fe97b3a830d21488d1b0aa9a6e60a81ee9fb8851a648
SSDEEP 12288:UKGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:UKnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T12E5523697964F98BFB1706F14C8281829B7F0EC6BFD1A38F7B481129967D39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 3c0cd535c3546dc95d37d1cfca5a069b8529856fe2c27ec59ee084574c30ec97
MD5 9282d93f6c6051412ec01c2136863cec
SHA1 f3d9978616f82b1eb63eaf27eef81cd059c7846b
SHA512 c137a79664e5e7c2df913ba62371830fc159d6b09372eb19f495aa998d8b6d5cda722ed2a9fb3b394e7431a037e8b40aae1d4af24c6a14371fa920392f2b7663
SSDEEP 12288:OHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:OnnQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1425523697925F98BFA1706F14C8381829B3F0DC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 c203b5e51aac8cf0105af702cb314f6a31613a1a398dc3e6f0e1ec4484cc9713
MD5 140c67e55187f0b59f68e171d9c85923
SHA1 9391e105baa5c3749864ed0cc4dfecff7bd471a9
SHA512 22780baf494e87055e1ae39d0ae106dc9b3edae456bb72a0e26985678270dfa4694987ac7d36ac0f8b4c9dca7c4aec14f77d0c73d0c9405e210f134988c376fa
SSDEEP 24576:9fwv/k9RX6wkyAIBnQ/tbw/2Mkjy6Fr7g0o1:sMnYIBQ/lFTjN4
TLSH
T1B885DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 581ceff84a3435d3503f62bdbb4114feec653ecac48227db4758e5e30f7c5d05
MD5 5680d0c02cc4624ab403c8d585724feb
SHA1 41e51e4266d7e16f422580c393c9ad798f934f8f
SHA512 5007837d07c4babe8fc62af1830d9d4227f53ba145ad0e2835964239c2bd41cfba651654ac5539730cd1b6d446309f94512a05e45e159743314c47d93289088f
SSDEEP 49152:fYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK02Q/lFTjN4:bySzPpLm
TLSH
T10B066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 5b545807243425501bb4b9b464a138ae3809db01a0818e29ec24b5722a6e562d
MD5 a90a9cec3e72fe1f1d0100ce2211988d
SHA1 1356f8c6b9f93a951fb7d9e64e40c0bb877092f4
SHA512 5b09c44462b0bc7214ac92706cc3234e8f01576da662b1fa3b51ad89f01d1b2a2c03a883dbefc25b1cd7890926e310db289ff3865e0494f2f4309aa9ab7b93af
SSDEEP 24576:w47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY8nQ/tbw/2Mkjy6Fr7g0oV:w47JUQj1irIhCnDHUPfF/mQ/lFTjN4
TLSH
T17B65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 e48d968bad05da0bb0d05c9cabffb8913df957c61fb4b7448075bd46776c8eff
MD5 1afac7d4b9bd35b0e36068e01ec12737
SHA1 9307779c15d86568790dc4e03362ddcaf4193b49
SHA512 2c6835b2ad92b0589e15ac5a2a6bc1de19e23b1e5a9773ade17f5dfd094960ee236862fdb3af0b14d698c66e6aa3b2c4272b2ce7373a9beb57c0323bb130b317
SSDEEP 12288:rssftGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:nNnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T19965F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 2662431854cab1850c59612bdaac9adf85fdcb6e35dd59bb984f26d83c7f5cb0
MD5 49ae23aef338cd05c17e6a60cf1a7720
SHA1 07c2069410cb82f80a003e3650200cff90b1eb0d
SHA512 ed44ffbd450a22c0561474b2b9b2a1644dfb7d6784728f623fb8d34232a2be44002122c8e4c9ce89058cadfa452ca3a0763c06c804bdf18b114fee4bfc005822
SSDEEP 12288:rrk0U3fAZ8JJmSagGlX3pr1/J+Vsq+fFITe2ZPo:rrNUPdJmtdph/J+CqgITee
TLSH
T1882517517666DB4FC66D40321E33D2CCAB707D01EE04AB0372C9972FD5B6658BAF2682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 dbfed3c215a36ef0a88b22861e5d4307ed51c557ac11372ed9b2f1e4d6601aca
MD5 49b40d01f03ac243258047e8ecc1fa37
SHA1 dfde92742365ef574282e6824ff5a57e5eaca231
SHA512 7f94f2a7f7600cea15e35f62c17abde8ff38e7ddf5abc2de66ee4be4d2be75197bff181345da0bdfc6a11a831edb20524c7f4ffdcce22d394f202d6f242bb40a
SSDEEP 12288:vO31wAM9hW4ZfUUjvZw2TLujZnRZwasuGN9pveDH7F:vO314UUjvZw2TLujZnRZzDGN9oD5
TLSH
T1EB75F9806536A3CFC1BB6072072A6B4C7BB4EC16B7095F2673C8453AD86A715B1F93D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 149d91a2d97e92e64b6ae98b48be960fcd1cf1dd33bba99e5ad14f96965a21f2
MD5 eddb782e873ca2112493104e4828d521
SHA1 559000fae295491a1011516b190b8364a410ae70
SHA512 59e8753691bdd163664381d038103b5b6a5712393eb1531bff820487fe3d0543db4bd45ad1829dba9ccbf447b12ff8fc13ad3633e5bcc677d7dec36e2d80f78b
SSDEEP 12288:r671GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:yVnQ/tbw/2Mkjy6Fr7g0og
TLSH
T15F5523796668F94BFA3B06B048928111673F0EC5AF90D3CFBB082269957D3D40EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 87b4cde6d113e4b4c65576061f72a771efd75d0db4fff5b8ff265616bed7e321
MD5 dc895a13ac8ae4e1b1202c8ed20bd301
SHA1 ecfc0f87b944637758050c59b8ab5ce1dd6f6e0f
SHA512 61aa66dcd395bb5071e3bb0f11cb2046ebc964637878f9bce174bb274201a0f93bceacc24b92d7dd9002c2ad235b753fd3653bc681bc2340418b153716669ea3
SSDEEP 24576:ygb6bmBIi49WNNFpg1rSvFv7bY7nQ/tbw/2Mkjy6Fr7g0o6:ygb4mBIBhGF8Q/lFTjN4
TLSH
T17E65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 5081aaf5df5189ce9c88d7c8f58fb243b30a9f79f86562f91f985096c9172d7c
MD5 da228ce68859252a6f5c242a6578b478
SHA1 a8b3069dae80066da1bca2252df0e3bfcbcf54e6
SHA512 0326f2bf68aa922109db5f3e297e87a2fbb6b9d114d03125c96df1aec544deae1779006efdfc5ea41b65f4634cd0f32645ba5a40901ad060695f0392d64fcee2
SSDEEP 24576:DG88u8FpJqH1Qzria7/mMnQ/tbw/2Mkjy6Fr7g0oy:y7ZFPqVva7/jQ/lFTjN4
TLSH
T1A485F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 a98a7035c90b4331ff09e7e435ccbdcabea679d349843346c53a90d25a16d58a
MD5 8f06e0eac39446f1877e50a76dab90b9
SHA1 e41cc1587455a202bb2985b615421bb79d7510ee
SHA512 9b42f89858b168af05a4bcf3daaaed9077ddcfee98ef625011e481ec252daa7eec143659549570eb18a810241b977e0bfdd7c9ab56bfe1e82448f05db0a9e222
SSDEEP 49152:5BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjIQ/lFTjN4:aG05lO43b+Lm
TLSH
T1C8D5CF6E62EC11F9D1BBC17CD9C6860BEBB23815032556CF02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d0ecea04de6b78003c3977ae29a13c2ec6fcaceeb348e89798693357312649c6
MD5 7e076347418eefd3820c52588850726e
SHA1 1177dd3ebee9f851bf9e749b3b94f110138e1c3a
SHA512 a1e7f0210f5daa12aa717c7814bbf221cc7ebd437c4154168c173ac0c70383363953c77f3c80a91b5cac638a9d6ac16ae6964514b6519258569d5c844ca55c71
SSDEEP 24576:rfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn2nQ/tbw/2Mkjy6Fr7g0o+:za5POZ3+Jt2pasx2+mAQ/lFTjN4
TLSH
T11365AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 000f616e7893de9554d7f05e6e660220a0947261ca54d9c707854516c3aec5a3
MD5 89d84c22811c23d3da6f93df490a527f
SHA1 ff68eaae18bcd67802c678383dac1e0c05c14bde
SHA512 f2e29eabc9f647332050e60842a9981c45254decf18e247d10f1cabcab522f18d762bc5bad08dda4a93f5cb4a0635e22ad22941f5f9a8a681326b638671d00fa
SSDEEP 24576:zNcwHdjbyQ4nLC18lb/EOjowL7FkknQ/tbw/2Mkjy6Fr7g0o1:zNc/zEOVHFDQ/lFTjN4
TLSH
T1F4858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 30fc9a98136256fee14829de59779487f2181d8a1371049728484e19085d5745
MD5 3b217d633143c6ba7e6ab5c1bf44fb55
SHA1 fd72d25cc0355168f9b0b7b7e38f8f9b8374a6ee
SHA512 83575bfbab73c82a1f6d1edf70bf0e5c40b9979ecda1999e8a1024e645ddaef552ce5f56f3e594fbea9bf11d3f6befbad36f3af80a5f2ccebb615da13b69e70d
SSDEEP 24576:A8kNvNnaFeYhJNtmZBmKnQ/tbw/2Mkjy6Fr7g0oS:A8MwBtOmKQ/lFTjN4
TLSH
T1DE55AF2EBAB846E4D1FEC6B48D238512E6727451173293CF5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 5b71af81855850c66e3c140d39d5edc08b13fd1c5fd50a3cd343614e19dfb942
MD5 781eaae09ef3cc4e28ec95f98178ada5
SHA1 806f08ae6d6baabf0fc34ba7e296aae7922ef679
SHA512 77ac5bdb900f2bb6c30ab9efd60557471063f4475885e518815e28f2054f1b878ea488393b046f768a0ade09e9b9cb6a51acc943b886cb85260a1fdc0400b29c
SSDEEP 12288:jHvUrBFrEjwaQ4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:jPUr+NQ4nQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1AA65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE86D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 b9ae3a667a35e004bb102c628ffe40099da95f4a634b8207c6ee40aa8b76cc4e
MD5 e8d0e0d0689baca85d2e9ffe4bf48b43
SHA1 d0f9c40e10a13d81ab31c825cead089e05f21f10
SHA512 6de7658ff6982082e1ba16684a388dcec3b9f824ceed5dd5394c1f5b46c6acfbdcdc63f1f350fe714cb52a363f652fb12a74a38ce548679f3fba7942cfd20ff9
SSDEEP 24576:wD3FHshBIYQgA5nQ/tbw/2Mkjy6Fr7g0oP:wDVHeBIAA5Q/lFTjN4
TLSH
T17275E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-276-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/124-53-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/124-60-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/124-54-0x0000000000980000-0x00000000009E0000-memory.dmp

Download

memory/512-308-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/512-78-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/512-83-0x0000000000940000-0x00000000009A6000-memory.dmp

Download

memory/512-77-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1376-293-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1376-66-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1376-64-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/1376-72-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2100-14-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/2100-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2100-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/2100-20-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/2100-21-0x0000000000E40000-0x0000000000EA0000-memory.dmp

Download

memory/2388-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2388-133-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2388-138-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2388-127-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/2388-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2568-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2568-27-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2568-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2568-35-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/2756-368-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2756-114-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2756-120-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2756-112-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4512-0-0x0000000000400000-0x0000000000664000-memory.dmp

Download

memory/4512-76-0x0000000000400000-0x0000000000664000-memory.dmp

Download

memory/4512-6-0x0000000002670000-0x00000000026D6000-memory.dmp

Download

memory/4512-1-0x0000000002670000-0x00000000026D6000-memory.dmp

Download

memory/4512-7-0x0000000002670000-0x00000000026D6000-memory.dmp

Download

memory/4512-313-0x0000000000400000-0x0000000000664000-memory.dmp

Download

memory/4684-369-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4684-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4684-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4684-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5088-51-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5088-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5088-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5088-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5088-38-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/6048-366-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6048-364-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6048-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6048-367-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/6048-107-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6048-101-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/6056-88-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6056-94-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6056-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6056-381-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/6056-382-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/6056-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download