ad68aa66a88402db3a96e729d01a796b35a74e806aa6d38c567dd3d591b51111

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 23:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
Size 2.4MB
Sample260722-283s2aam6x
SHA256 ad68aa66a88402db3a96e729d01a796b35a74e806aa6d38c567dd3d591b51111
MD5 ce952efa2022d0d39307cc9d54a936a2
SHA1 d550dfb351e66a12983cc59a6284ad75e7c1d3ba
SHA512 33d22094b8f6a6b7475f63c8486d07c0503036bc2f1f60b9a77273dc341d6a1f89db01a67ffc62c273fdc9dd14aea699d02ce0a265614c946cd1584efa18f42c
SSDEEP 49152:uQM0WrzrYW3KHIU4idjFEp4OQHmQ/GmKZyf2JJCfsBxrDmg27RnWGj:vM0WrzkWaHOidjFEp4Oc/GmK8f2JJdD6
TLSH
T151B5BF3275E0D076C5332B368B5CB329A5ADBB704B75434733E50E2D2DF0583AA296A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5100	elevation_service.exe
472	elevation_service.exe
608	maintenanceservice.exe
5884	OSE.EXE
2612	PerceptionSimulationService.exe
5592	perfhost.exe
1764	ReFsDedupSvc.exe
4900	SensorDataService.exe
1880	ssh-agent.exe
4580	AgentService.exe
5996	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b9e66e59e05f6396.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000766e2b1f301add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cf7f681f301add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e32fd85e301add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb26f31e301add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ce3b921e301add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000a4811b1f301add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e8c5905e301add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5100	elevation_service.exe
5100	elevation_service.exe
5100	elevation_service.exe
5100	elevation_service.exe
5100	elevation_service.exe
5100	elevation_service.exe
5100	elevation_service.exe
472	elevation_service.exe
472	elevation_service.exe
472	elevation_service.exe
472	elevation_service.exe
472	elevation_service.exe
472	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
804	Process not Found
804	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5496	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
Token: SeBackupPrivilege	1764	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1764	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1764	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1764	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1764	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1764	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1764	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1764	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1764	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1764	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4580	AgentService.exe
Token: 33	5996	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5996	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5996	SearchIndexer.exe
Token: SeDebugPrivilege	5100	elevation_service.exe
Token: SeDebugPrivilege	472	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5496	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
5496	2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5996 wrote to memory of 5760	5996	SearchIndexer.exe	100
PID 5996 wrote to memory of 2528	5996	SearchIndexer.exe	101
PID 5996 wrote to memory of 2812	5996	SearchIndexer.exe	102
PID 5996 wrote to memory of 2284	5996	SearchIndexer.exe	103
PID 5996 wrote to memory of 5092	5996	SearchIndexer.exe	105
PID 5996 wrote to memory of 2148	5996	SearchIndexer.exe	106
PID 5996 wrote to memory of 3152	5996	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_ce952efa2022d0d39307cc9d54a936a2_bkransomware_darkgate_elex_maze.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5496

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5100

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:472

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:608

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:5884

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2612

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5592

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1764

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4900

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1880

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4580

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5996
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5760
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3797332335-34111092-3597280141-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2528
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2624 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2812
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2284
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5092
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2896 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2148
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2624 2868 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6cc7302d1fceb1166c4bc2c3f4fa4dcd363a26b5168057eed37e4992a382b3e2
MD5 f226edd531664194362eea523b55c843
SHA1 6a5816a2ef78fba064e7ce69788198a1607f0d21
SHA512 3c567523d0009c0bfeb239877b08c73a3a028e59716a87aec72193f23ed64798ed299bc1eb8b0384a8c22ab81ab182846346881c9ce76342038f144b352b633f
SSDEEP 49152:fb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnuDmg27RnWGj:d3q6HjBFD527BWG
TLSH
T12DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 71ff1bb347e6660b90d0b13f88546c43102dd87c84c4205f5d7fdbdf3595db4d
MD5 05c08d2170398fe28ab0e8fbd9295e11
SHA1 ac5a41e7fe87c68f66b15e35c0a66b4daf2be524
SHA512 e03c14f919cc0b18d550600b3029df8a26d6b57f8b41ee216e875de5519cd415656e63850cac6ce970b7600eff0f7860e18f4d5a4d46800058d41bc303e91b38
SSDEEP 24576:3XYfDtczA1sqjnhMgeiCl7G0nehbGZpbD:itc4Dmg27RnWGj
TLSH
T15185F129A3E408F9EC67817CC9A2C515EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 8f8988cfadc0ca107abce7f83452e1fa78b9b6ad17931ef5aa1401779206d282
MD5 f02572e492f37f3c1f2c13fe20da317f
SHA1 990e0a714e749995ffae45638e5ea43ae6cb7008
SHA512 6798b66f5b79b7f205f69213a706643f26447e6784f5edd8c376e002fcb9e4169231dcdbfb5af76518393830b94635ea3bc0cb63b192a2890b8629e4cf6dc44d
SSDEEP 24576:80Le5ji0hmx3rMisqjnhMgeiCl7G0nehbGZpbD:8Pji0AZnDmg27RnWGj
TLSH
T107A59E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 545bd2457727fc2576c221dc0e39ad9a3ed801175379f54fe6de0b7f36855aba
MD5 a894f4daa0eee3348601934801e776fe
SHA1 2d0e07e20e0e3632db5958861a44d85740d6754b
SHA512 1c6a8e284307e36eb1ff2d3ea274f9ce4568e1549cd8dcbe020012bfaa82a4e363b8e93f8cefc676bc3a8d7ecd280a99d956f80f673db43d18bafc1fb655d2ab
SSDEEP 24576:2a7/ezSC6vUyD/aqgrvWE6q8wyucsqjnhMgeiCl7G0nehbGZpbD:B/ezSC6vUzPvxHjy7Dmg27RnWGj
TLSH
T1F9755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 7301375850b79521d13f7873d98dfd8ad919c142b58e52e0cadd0ae8f88f6e8d
MD5 ffff441c5c4ae5efe6c40390b9630646
SHA1 a57a9e4a4281f611dc00de2f68c795b7ce31da42
SHA512 308720121073673d18053445b4010cd5d7b5f58733ed736e5fa68aa86a53cd1adc6b72880936a0f5418a52586d2c204d911528a8fb9d639aa39337cb7775d73f
SSDEEP 24576:BVbqPb88hv/l+6BsqjnhMgeiCl7G0nehbGZpbD:BVO88hXl+aDmg27RnWGj
TLSH
T189559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 be9fe7749f293e739fde6f36490f4760fe99296a6c472645359146ccfafd48ab
MD5 550705f87efb36d99f99db7443356d24
SHA1 76685c28226bac489f1deb0517d27c5430fafec3
SHA512 cf11dcac84a871a518b7531a20f42d4718f5eecfd0cc599fb08130273b5cc1e07812717e8f860255f5f7d00ac5ab244d7aeda8ac339680d7761b60c262ec5397
SSDEEP 12288:oXuXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oXusqjnhMgeiCl7G0nehbGZpbD
TLSH
T1376523BF864C50CAEB7609B5C3E9F11EAC137E56982008436A637CFDE6B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 2b33c023b7c37a8bfac8c4f6699d3e5929c45cc2d524f270cb0b507dbbfc19a3
MD5 fd9cf1bebe51a2c052387f7180c5dc63
SHA1 064e7bd67d53f528f4e4b61f63719f12ec628cbe
SHA512 827556404214c455d2cc1dcadf16fb73c1330bbd0033abad3dee4f766c0e2ef8d8000d5b98597c70057a1b6034e9ab835d564877036cc1014363bfb9cffae800
SSDEEP 12288:seBNUbTVO86UJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:sJIUJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17385CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d8d750de872ead7138582b1ce7066a6877379d7ce24ddd7c21f18dda8dac39bb
MD5 e40aafde1b02ca3fa5e77791ece50929
SHA1 ba4681be37d6bf59e96cecf645f2a7f86a6b12e2
SHA512 cbe8641ce0ffcaf7b348a83df4eafd90d094d9db888b5dff2cc2f2b242f67b591b35bc237bf9685636a097cfb9b29182b422ee6dcffc16ba1c1ef6d9366bdd79
SSDEEP 49152:YQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THI:YQvGAdlCEL8c/yRNw5CYD527BWG
TLSH
T1FD266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 5c3565cb75184c0b4ba229b54afe385de507f3de87e3c634f98a2ccfb9595835
MD5 6d07eeff86fdaaabfa9af9bbdc1a5f52
SHA1 5fb04cdb23e71da56e803af80292564439864a39
SHA512 8be871b37f31b3e2e191d9bc22f460352deb6a2b3b8ca3fa228a6bae28f67d351123e230bb7ecc6fe08ede9354343489062d472ee80a64ba40c32115446d417e
SSDEEP 12288:UAwSfxL/2Dc3RDLLmt0LDQewsAjzXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:pUewsAjzsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E295E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 6b73b70e5537225c018e6219970f18827e7fa7a8a8d29c5f4fee3fdf4d3aa8e4
MD5 6e7f22c5d5208e625c8ec25e2619ac0e
SHA1 97fd3a011a3364f80413c717afd9d9fd1706d86d
SHA512 770f4908176f450bee0841269c4b8038dc9f3c1ae6d248be1651857af7f0347d35797e99adaa80788709c4526653235d10753672f3d41333e9151659e95370b8
SSDEEP 196608:8UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH/VQBWG:8UEtQevvqc2W1cpV2EI322B
TLSH
T169474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 a04880a8884292513b52d79c3403f68bdcc3e63139df8e4c6dff8eb3689e1ab3
MD5 c2086f02d0e088eb4fd59c50f3db6aed
SHA1 fc3c22f5aa7f668e646823d5c86883ea5e68109f
SHA512 b1b4b1a771c6d3a81290e8d041c706d7d2ff0758bc7bafb50cd97197a30d9dd457a241ce5f5118e10d889964af1adc6c67be29ab60a51df1ca675ce70039c336
SSDEEP 49152:kCbRquA/m2yL5zQfFiV+XenmE3/zXDmg27RnWGj:toqtVjnmsD527BWG
TLSH
T166D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ddaea7d76e6486719f4e9ae589ba5abe059d472521100a0f2572ef9d6b37fcb2
MD5 cbc235ebdeb0b251efaf2fea1587870e
SHA1 e5469b7eeb3b3a5766c9c8f5d56c9cbdaeb7b8c5
SHA512 d81ffe4bb93304181b571bb70c87c4d2cd90197ac66d58d03610680d28a35989aac8759d255c3d619efd5960bf0e6336ccfefcf858986809ff175d8085788b58
SSDEEP 24576:PAhGLJIFoiwtA5l7S53QsqjnhMgeiCl7G0nehbGZpbD:PAMyFoiq58Dmg27RnWGj
TLSH
T10E359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 b0508a0e9d12f94db7a1e37814cc834f85e7abdc80fc8a7836505d6151d8bfb4
MD5 5fe094c679cf0a6b2d904e9a38ef3506
SHA1 b63fefed921d62c294934909814001aed1dcc4ff
SHA512 9e7f1ce956d8a037826f91a396dc9291be8fe5058017a21c8f7bd515a272849b88ba48f9d5927647e65d816d5d62cb92634448af8035e9226cd647de3d5498f9
SSDEEP 12288:kmw5HEjsChNzBFgl0WDm+C8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:BwuSOWHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13485F15A72A80CF9E9674539C697D136F7B3BC122A20C71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 1efbafadff57e09ccbe69257faf625e1f7a98cf8d479b5f6818f8d67023921fa
MD5 fe2010080dd7a1d3740284ee2a0e9a34
SHA1 0f4fd4045af640b0a70a624baa980c70fe5afb8e
SHA512 ae6ef94ac422c1239b1dbf60787cd39df4479ad263422e46bf681ec489cc267a14a0a0fceaa5115d75ad04dfc75ac32f2cb1d1214f42f949f90b9f4b0750ea67
SSDEEP 12288:QzZ1IyDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8ZuqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1447512AE239820FAE1A3417CC5E5D609E7337C62673043CF166256AA6F739D44E39723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 864e7ee6069ed3beeee25617c52d052376d9a3b69a436bd7a9c81abb60932bd7
MD5 66e30176b2e5ae81b2c79d0f6b63aaf3
SHA1 c48155a2a05455a05d0aa9d8c84f438252840656
SHA512 b02f6c1d25eda5cb29c303198de7f77e66f19bbef1942a6af62ebc85d52ac5f20af6dec6f3846d6a77639f01b673cc753434a9eece2c35057e9d58572a279000
SSDEEP 98304:NQRQyi36YOcPQLvw2gAf+PN3BD527BWG:kQyiKayX+PNxVQBWG
TLSH
T184667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 bb2897c50d6359d2632d2e7718b96771ddbc8f84944fddd4c22cd06f1c3ce2ad
MD5 49c999c565659a0aa0cc7dea93447c98
SHA1 0d68a03ec586e16d62393a2210adfd9819867e64
SHA512 087aefce64bab5766b68baac2622fe49040641f9b9a8ad598ebfe35e76db2318b316cb1abf7181ef9c721e0e3ae20e920253662342ba1100339a9227d5f7da9a
SSDEEP 98304:2QRQyi36YOcPQLvw2gAf+PN3BD527BWG:9QyiKayX+PNxVQBWG
TLSH
T1A0667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 5e964a90c00816d0dec07fbc30fa5566554437de3c619ae7df5053a889d60dc0
MD5 cf31222038a6121a40ebab4c0b1fd93d
SHA1 f9bd1dc22c78e48cb211d3655766b1b1665bf990
SHA512 8b789b9cbce683896b891184d9047706ebab8d6c3fec164e5b9bbbe6f6ec754cb944c61ce1167b3b0f1c807d1d75cb1b9fd8b7bf7d512a5885164768e2ddf954
SSDEEP 24576:owvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0asqjnhMgeiCl7Ge:u68Qg55nhheWu7PNU3/nDmg27RnWGj
TLSH
T119B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 fc65fd97c584ebfeeab40183c6877496ca626853f0f4fdc780ac926fc3431568
MD5 fa42f30dc77a9b06fb177a3bb85dc82d
SHA1 8c2366c93fc18e151e697c38ea7e5f98fdef0e0b
SHA512 bc751058ffb8e315ab60f283a88fb98cba2a68d9d19ac1051d85ef39874e104aeaf448b5cb61e30f843946bccb0ac6ea8cb492f7b9b6e61b2934633205c0b27b
SSDEEP 98304:my5112gYy5azzVvL69nLKnhZCD527BWG:XLIHmWhUVQBWG
TLSH
T109167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fad0d615b2d971568ab0a4118dca1387794d10dafe467e1a74a487e8b34f95aa
MD5 964cef8e501fff15e14c1ad940b8c341
SHA1 cc1ffa3770219b7148a7ed2a1c8de17a0dad6148
SHA512 c689bc6375e6a694c4e329aa5d781fbe6a740a08c482df2e4c0375477548d09a9d0be88f90a5808778b10b8358c8688ea0d5583d3c4ed1aaf081a3df4d0b5881
SSDEEP 49152:tB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glZDmg27RnWGj:zu6JmVxd2dZD527BWG
TLSH
T109D59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 b4579b5d74b2dbb302bc681317379c4f4c991052a10143a4bd019c8798907595
MD5 248a846395ae6f55738fa2b74643b494
SHA1 9ab3d44d34f412d5ec3cfd7c4f39a0c23c69a3b2
SHA512 f6978d89eda845e80afe7ba1e740271b47301700bd4edaebf3023b8450d66e178f19d92e6cb180e6be41c2d27005f3acaa525fcdb964420693698c629ef716da
SSDEEP 49152:C1hpsNoJpF1A6UU44CwH7R4xtDmg27RnWGj:CmifPbRsD527BWG
TLSH
T13FB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4e6865db469eff9fe5e32b51da94f4c6e9cdeadcd606e114562ee27948ee0bcc
MD5 4c2c785774b421b41f8cba6e7892a619
SHA1 3daf7f391efd596f4d3afb9f7e4e5da5bb72ff7c
SHA512 a26de09325dc4a4ab7d95196454312fa778639748a4ed374a7e92b6f10992138d5693038f83b4f84a0da4d54a5fe528aaf7d7c222fab70e86770d60c127fef43
SSDEEP 49152:bSuZQIY0Be2KRRVtOnks6NMHq+Dmg27RnWGj:J5dKTi61+D527BWG
TLSH
T10CC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ef12d3ab7e2d856102ace9100f317abfd60677321f40f36578af98fb899b51fa
MD5 2d8da901a13154b9f949c426f0d47d8c
SHA1 e47c1dcf67983c31b691e76ceb4e9de0dcfdd4ae
SHA512 ff00befb5569e9b51f720935e577a1cb340377de2622e92a04ee1253166dcced36b3f22531203b847b5034e1da2780871d361fc7ffdf42f4160f32463ad9489a
SSDEEP 49152:JhtSn8EApI0figngiDn0AP5wpDmg27RnWGj:4X2iyphgD527BWG
TLSH
T11195BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 91cea13375579fdc9587f4e3c89d705ff8ed963b4a0f2807e65831c13a6c4b1a
MD5 ddc6d28d974dfb57ed5a830b1c947624
SHA1 ea8c9cf07efae486bf2876ecb1f8cee9f93e9137
SHA512 4920b9ab15929b566be6442466c33039aa5487a5bf807e8f560d0e6cb9dcd4936d75e23091800ee1618550e4b2872610d589446876c417dc1c686fa0a5011305
SSDEEP 12288:7WXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7WsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1276523BF965C41CAE52249B5C3E5F10DAC073E5BE92004937A977CB9FBB24984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 5e4b18d073c127820f72268bd7a21487c319c468b9a36a8433eb8058bbff82db
MD5 7b1710a96e0972db9e6403eeb4dc88dc
SHA1 e6d6ee6651341570e85b2a5f16bb5e4be34f5f52
SHA512 94a7586bfb889846a9c2b6c4b1393419a9ba4c6d622286a760a0588298a01fe92463b1f7a01a86425b573377aeead46197ca0aa30e20c1cd1f867ef76120c58e
SSDEEP 12288:B/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:B/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C56523BE955C41CBE52648B5C3E5F14DAC073E5BE92004837AA77CBAFBB14984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 80f061c0e9f327c455a87b47884af0166ff4c91cee212f9da6bc2d72f85042cc
MD5 e2ec641671afed741261eab5dbcf7189
SHA1 29a89eea489977aa975647cb5e332bb870149a51
SHA512 88bb0d52b1e6d82de66fb851bf9ea41700990c6d827a5cbf5ef95c551c0121e40fc25b20db8dd54793df9dbf926e38808ce2f41cbd833b4ae2871faeaa7112a8
SSDEEP 12288:exXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:exsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17B6523BE965C41CBE52648B5C3E5F14DAC073E5BE9200483BA977CB9FBB14984B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 d372572bd5d6bf228d74bacb7444eae259f321cdc9c320e5529d5e00a0d3dc29
MD5 9e13899c30ef4f72f83741a52ac4e887
SHA1 8a918b25d128d3cbbe2acfabba7675f03b799784
SHA512 cb9a1969cdc2566ad3ee31b27f02153cd342f3d02a842f77a9e054fb9a32f0e20ee2f2d881d4d9df5fc431ac0556332f117b2f0c3592ce078927aebbf15fea7d
SSDEEP 12288:nVwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18675237B675C01C6D83285B4C2F5E11DE8237D96EB3005DB6B532CADAFB12944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 c977b0fc949c617168cfa90792475f95ebd38a22d40512515ead14882d64d9ad
MD5 c11eaa98cf6426bf9d615b78748f986b
SHA1 b57b2784078890d27c8b4df87faed0c2c29cb3dc
SHA512 0496aed02d605d4dd2c13838d8be425daa2c70b53d72c9de447609a917c3e1e03de975bdc53059bc379db53cd99ec3c29331f0072974102c344459592ab67082
SSDEEP 12288:5IXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5IsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A46523BF965C41CBE52648B5C3E5F14DAC073E5BE92004837A9B7CB9FBB14584B38462
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 327c3771655aa7775d1594b3528183b7854c5cf395b0bc90380c2003bed99981
MD5 a889932dab67a7ca50fcd1f22538d570
SHA1 16eb2eb323a7b0bd78f4129d07d383edaaed9a9f
SHA512 bc6b9fad26e8f469e59d5b64174b2921faa7957d35e797c5fae2905e0ffca360f38aa3b2f59923911b45699e663d6768383badd483bb0edfabfb087f1dfdc202
SSDEEP 12288:3bXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:3bsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15C6523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837A977CBAFBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 def8bdd87efcbfdec0fc772dbd523c8c082440cde38b5a67b45a73d614c60cf1
MD5 63fbf6e3d0d4bfb3859932cf63e021fc
SHA1 ce16b39cefed402e0b134e0c5677ad26a8459498
SHA512 2c6c8e2d5c65f9afacf79d219b4cd6d73fe5aecc19513249fd7659a0b64c9aef851c5a034f249bc64a5a6c564cb5a04aa693d432d81b07ed81cb29d2e18eb68e
SSDEEP 12288:h3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:h3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B16523BE965C41CBE52644B5C3E5F11DAC073E5BE9200483BA67BCB9FBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 354e8b5dab5eca24b8c6bb9166ce3c22906a8c64748e14d3960600035f024167
MD5 0eb0522a84f82f2ec82a0b32bdb9a8b6
SHA1 c640057b69d57888da39bed5341ce89698b24e57
SHA512 6413345a2333bc519d369bcb629ca51c50df028bb4e050bf2907916efb6f412d57796a3c540648b90409bd2a0a947d02b6f9151b88229dbb4bca18915fe1dc47
SSDEEP 24576:PZMjzFVSOfsqjnhMgeiCl7G0nehbGZpbD:PZMjzffDmg27RnWGj
TLSH
T1248501A9B35418F8EC63813EC965D90AD5B27C5A0B70C61F13A4366B5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 e9000137f2758cde76c533e16c8b57e2dd48da096f92bc051a3701e96c32bb92
MD5 052e048fb79b29d24de8ce6b22d4a26b
SHA1 09cb03d31dc82d1d0c824bdf580da7fdc0f50f9f
SHA512 b6437494d7a1a3f8d1a3cf14086234c2e93a7cc17400402b1243fd69ef771c39d152ea92866f02638d8970e00eecf61982269a1e28812002e8aa12b6f625bbbf
SSDEEP 12288:D6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:D6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BB6523BF965C41CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 076a7406d8e7137595a85b61a5c9faa4c7756a94351a7a0c3058cdd799e0f83a
MD5 ee13c83623cfe0dcabf2d1ac0c9cdfb7
SHA1 bca5f8d5135e17bd71bf27d9ca0ccbcc241d97d3
SHA512 9721e4a010c3a08dbdf7e21e724d4f9de06032f1956ef5b95259f05bceff9740f2923d3dc9e7b6c72973ad0d041fb76ac6faefc1a4cdc18ef140dc2d5aead175
SSDEEP 12288:9+Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:9+sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1476523BFA65C41CAE52604B5C3E5F15DAC073E5BE9200483BA5B7CB9FBB14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 d23abdb664402ff6d6bdde95c51e68574db095d7cee6989a013f994d756d5f66
MD5 b32968ddceb1ba39ce80dff02435e83a
SHA1 10b60cd53051a0fbb7d3cb9bbdabea644fa69550
SHA512 35dbe169f4783b65bc41aa2670da1f1703621376d34198800dba4b95a6868ebd3ab9a2b0b6c37408ca4df6a58d373956d0559b0aa41d4d5f0728aadf5c86fbf1
SSDEEP 12288:7yPz5L8DXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2zyDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17775125B73A530F9D1378138C5A29A06F7327C3647204A9F17A516BA6F736D08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 96a47c47a94d03a5fb47c98ad38e2c38b58b8738b9a605d8ead9058546b4778c
MD5 9bcb0a2fc8f63fa4cccdfb2f8ae20189
SHA1 8392c0da3187bc5a9ccfa8f3818f50bc213ee064
SHA512 57ed71abbbc784707b9b8cde7a9a8e921434962a17e6aaa72c520d25904eff141da09f4c7f121eba98a34a4de00586b64f3b9a40f68f8c6af37bae03411bec65
SSDEEP 12288:l6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:l6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F56523BF965C51CAE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 ecc9d008a00274b54b6ef80f6fe82c8f634213e7207da456873b460c67375a20
MD5 7c5e0b3699ef21b8198604ee66a5c688
SHA1 ae820a61d8607254977db2e12eb745a7bab83113
SHA512 9079ce28681bc4285294c0c0a1e3141513863fa1b07a9892373f88d2070d55a615de5fae5429f341d63826b375c33333fce462c588e1b6712874085686fd6a17
SSDEEP 12288:u6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:u6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1016523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 20fa6c4894be54f05cae29a579c85e77941f43d2cc337463be384874128f2a4c
MD5 b2273c7450de866b7f87b646a7f78562
SHA1 cc15695e8770b090ae8a0cb3f8312ae51de5cbc6
SHA512 b4965570f81fbee527df85b14e49dfb5f421a2f95ad9bf075064302709038f3c44350b882216569db12861fb2b83f38ea6e79917d41978d675daeb8cc8f97254
SSDEEP 12288:zyPz5L8DXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+zyDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B975125B73A530F9D1378138C5A29A06F7327C3647204A9F17A516BA6F736D08E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 f3440e4d7fac5fb34ac3956b27cbc3cc35775ee6eae324e553060d0ff710be24
MD5 db839a736efb96afdc77be2815978e28
SHA1 00bff5282d73e7e9154cd2b4180739d522c4694a
SHA512 9dcaac77429876e57f08f8656b907bf9c40e254004b07aea3d9f6f01cf4ea3be734333ff7e9b2338ca8713190a72070a2aff3d35573d90bc07592ad9d110ebc9
SSDEEP 24576:NTYaLl3z0zDhsqjnhMgeiCl7G0nehbGZpbD:NTvLljIDmg27RnWGj
TLSH
T1408501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A53A6A5F333A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 6fd128efdd1f0dcf38516c8261acf03c00b6d06af064f9399c4454752fb44aba
MD5 0a7173f6af9e326c33fbc05ff42cead1
SHA1 98f2223a42eebea161bb2be0df8f22d0cf04b253
SHA512 6bfeec3b998b410e0c91a8322fdaa12cbaf2eb8d9152737c5e62de4f23a9eb87934132ddc3476bd1c034f0abe39e96fa7d58159715baafa973b7fbacae637fd0
SSDEEP 24576:f35d9CHKy7GZ9sqjnhMgeiCl7G0nehbGZpbD:v5d9CHKyafDmg27RnWGj
TLSH
T1B295CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 f745643d7e8bbec0303a9a053ecdb6e5dd1506b006e58f2dcd6f51f128fec1b2
MD5 26f3c9c41f032d850ecb0baeeb64a4b3
SHA1 caea28431a188a8339a7cf981e2e49fdb89df77d
SHA512 c95c5e459dced43e9b9d1350cc6c563ea63a9c9dabbb5df1f74a4477c123b7c0962dfb1108b244e622c2bf71b48b15b7300a45272eafff3ed5650cc153573622
SSDEEP 12288:PRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:PRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13B6523BE965C41CBE52608B5C3E5F14DAC073E5BE9200493BA9B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 bddb647e978d4ddbaf89a695f5cad3e96b5b1479707779fa1c91c514d6e2de17
MD5 60ef275034a8437cb569f2904763ec09
SHA1 74d276c3d0b441efbcaeed28a026dd3d4f7dc716
SHA512 2fd1fa241e8e0fc556fbb2e9271f833228c3faa14ee6543d41817937d5a662f66710db2a05f55956cdc6b31a743645634c73a265b96e1c4766abcb0cf51a1ba3
SSDEEP 12288:GjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:GjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DC6523BE965C41DBE52644B5C3E9E10DAC073E5BE92004837A977CBAEBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 94d77d4500e23b89e6d6488fc5202217e982aac5a71eb75242b082ae877f1cd7
MD5 6d8951f4d87778ccc86087f834ad7320
SHA1 e715a6a3ea38e15ba3bd9f29da229e502d52d08d
SHA512 56016ca0706e4181b281e3384aef4c3f4c5e40ec100f0d307b35cbeff6b5cc72ae55a06a8008a26371845c819baefda03dcb3e8be3fb69107a2b86acabcd46e6
SSDEEP 12288:nUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:nUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A96523BEA55C41CAE52608B5C3E5F15DAC073E5BE9200483BA977CBDFBB24584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 54140f0cd848f0e251d7bfa45fd49c3be0e185d17be46ab445522b0e994dedd4
MD5 0519ebeded05fc4b6eada48af722bf97
SHA1 334d2118e8c1ee759cfb43cf2d6e928e5e01f568
SHA512 bd313255e4b4da390f60ee188035f3420822d1a08f91bd5e1f80eaa35b2962849bd83bb3fa8b23efc2a91b26c53629e363f1621c8dc5b4738d3b91132292add9
SSDEEP 12288:+6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:+6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T11D6523BFA55C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 e2aeb62332127c9e57689439dc2b47995ec78a2b99c47160ebd4717d8a2ec044
MD5 688723d054c153cec9c51a6b61136e5f
SHA1 2bc33a6ebe33354b8a27f3429606f3dd57a9ee70
SHA512 0da6344fa9731c248c517799240b33c8943612f75b21ae381da5cf94411ae7f1bc9d2cf36638f9fd59061cd44ea6144b47de2a936378e555ead1304f74817ac9
SSDEEP 12288:MRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:MRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17A6523BE965C41CBE52608B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 95060cb9ce5bf1d6a990211095336d7e775f2df8699ccbcad13ad63c62c72ded
MD5 6c8ba0d4004aa75539dab43c074a7fb4
SHA1 66a6688a9e5b373eafacc360e1df11f6dd8de765
SHA512 272e5cb298eadf8c93cb4f60656ed33d01eeaafa6f7afabdfa64673ecb8ab343f2ba26e71c60b1395b92520b4b8898cbc9d84d68ce5dcf130f8699a42749df01
SSDEEP 12288:LSXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:LSsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E66523BE965C41CAE52648F5C3E5E11DAC073E5BE9200483BA977CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 d73f3b37f41c0b49c615b09826fa52d9941db4961188a7a4cdce14c27a016959
MD5 34a49d0fd480a2b71b39235c53d577aa
SHA1 4549b0843a8072f514fa56d3d7288086af8ff004
SHA512 da383d4c940e9810a837424f701799a59e22c54fa2100a35c11df95bda23af41fe8b5bbd2fa0f29ec3c8b9c108d21c13841091057d83cd09562b4354fb75de10
SSDEEP 12288:CIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11A6523BE955C41CBE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.5MB
SHA256 f71cb196f08b960ddd0b63aefae5faa00fd67b7dad384f55b60c09e8cc13273c
MD5 c78ac42e2a746f7021a72ae6368c3b4c
SHA1 725b7a79c1b0add0ce324813c158e4cf00c251bf
SHA512 53854539c2dd2bf377e1c43a63c339a35cddd95cf4ed35316b9719cd63df1eb15c16d52a714b8794dbd290cd0ae9d29f050e354e11576fbbb6a30eb4e84c76b4
SSDEEP 12288:/ZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:/ZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1706523BE965C41CAE62648F5C3E5E11DAC073E6BE9200483BA577CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.5MB
SHA256 c432d74f7eee3f7620a15f1b89026ff23ee3f2e2f0abb28aff5aa291716a09cb
MD5 66174986710f355a7a6d11de99b52fcf
SHA1 1371a6c330309ff382465f0926eb2b9334872b14
SHA512 dabd42bcb0aae0f0138174e186a245358ac88c2885fde09c707a27306a25478f06ac1eb46708de3789bcbcc6998b6b45cb34285ae17621736a58fbc823a24b4a
SSDEEP 12288:aIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:aIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15A6523BF965C41CBE52608B5C3E5F14DAC073E5BE9200483BA9B7CB9FBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 ae72ac000124d7498f09f2f8b061af986d33b74885d733d46525cbbb518c83b1
MD5 077106109babe48a843ae48843cea023
SHA1 dbbe57e2a6028515ef0fc7d662ebe445d126e8da
SHA512 1165d4dd69ffd4eecde95fa3fa71b5d1785341100d00eac2bf9fc9bc8bc374a23bb4f4e0f10a33c314b675971ffde5a8daf7684740b591f5d78a89a134403257
SSDEEP 24576:WfwvTk9RX6wkyAIOsqjnhMgeiCl7G0nehbGZpbD:pMnYIiDmg27RnWGj
TLSH
T1E595D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b163ed26cfa01b8985f339c5710e9afaf1a7ae35daf50504f170fd2f0a4996c2
MD5 6f54d4a287b16f82a80d94abe84b4b55
SHA1 3c2975b1b3526f13c498aef5bc38afe1b7f51ad9
SHA512 50b9a2b8d58657eaf9a4245148d6933fba72ba775ad902ba7acdf2976bfd34848f87f60b723b5b2ed4a6600d47af410195bcf206e444379b9185c9a5c798efc8
SSDEEP 49152:HYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0JDmg27RnWGj:jySzPhD527BWG
TLSH
T184066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d1625f12dc8fced89d77c796a7ea4470ebe6bc01276f1393e368aae75b78641d
MD5 1782941a2d9a234ab372eff4a41efb40
SHA1 225569d5cd1d596f0999a3a9b52a7028898a8a3d
SHA512 f68c5e9a9b8ab53d8d853c87da72237e51261ecf292602d3bc97378d2920818e66267539b1ce793e56e86c2035460fcec811e336158905e6b6639526bedc6819
SSDEEP 24576:M47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYvsqjnhMgeiCl7G0nehbGZpbD:M47JUQj1irIhCnDHUPfF/ZDmg27RnWGj
TLSH
T16665AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 caff270258b27afe8069e583a223e8beb08608d8cd458c585bbd3d40ff15709f
MD5 546f06a991a0d6614708c05bc3b2f9bb
SHA1 2f6fdf8bbbd5568c8e5867d16a006ca7bf7a66da
SHA512 22dd7eda6b4bf250b8f9052d0c3007407713b790d92c55677230c02f9adbe5a7bbaffeb1b7005589cca71ee6553e27bd3a532ff3b7841e1c259e1f79dc73d079
SSDEEP 12288:KjsfqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:FqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EC75015AD29802D8C06E6179C3969605F7333C2697E093CB67D1F87E1F766908EF9A03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1004KB
SHA256 c99a2709983690a9a13cfe87b9e071001fed0909d19882181607c7255104bd3a
MD5 51c89cc2698b1725f762bd1de928eb96
SHA1 b7a563617561097a44dbf1eee8d4ecd4fc78ee97
SHA512 56a32a5ee1416d767ebbf0710933cbba095db03eed140bbb534c91f5ec2f80530496a8186ebdf98e97a99fc994c4f0a316b5def304cb41923d4ee986a7cb5c95
SSDEEP 12288:gZJ1+rU3fzfGPxWF0qQ2jnOhwWW2wzcDalUVA3joz7OWu93/:gZrwUPvOWUDITg77u
TLSH
T1A7252710766AD75FC6A980321E37C6CCA7707D01FE059B0772C8872FD576668BAF2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.2MB
SHA256 47713a14d8ada25877642c9775a34fa80e570ab7c863e4ca6ef8c530bd3a400f
MD5 65eb93fa2a32c6e77f6cf2b8496950c2
SHA1 db018133a8a2fd5e1eaa8556190096c7e5ceacbb
SHA512 db5b32ed7fbdc149d424e4628662c3c2855366fed26c100c25b8532711fa05b147cfe88533e0d1cb9aa432bc55c15199529395b89afe39faa23b2855e72c9297
SSDEEP 6144:/09DWpydd6VwICWbBy4wkxWFVCqQ2km2QLL26tMxBvorzxizuxO8YsFIkE22hA3d:sMqC0kxWF0qQ2km2/zV1k
TLSH
T1FA4595816537A3CFD1F76171072A5B4CA7A4EC07B3095F266388453ED82BB66A0BC3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 123981652e05c5e28ed36ac3baf71e5446cd092f810b624f296a33881bcbc016
MD5 6a959d1a2f5b289e8cb029660e69196f
SHA1 e2c79fb7624ffaf30c69ca36baf8c298e3094df3
SHA512 4fa9df774d1e52915f7c1873533e19d68ce7f4d7991ccaf388382773e6a855cdce520de972ba8f22369e9121402fa995090ff8a3a32de1362c307d7748f491f2
SSDEEP 12288:nO7CXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:iCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1386523BB935C518AF83605B482EAE12D681B7E669F1044C3B90778FDF6B18D88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 02798364a500f7fece957c8dde0f86db2c7f30b9536a681a12df77b98f0b76b7
MD5 99d2f398f948ca51f3504ef490d0fe15
SHA1 31400c3f3d3dd910ff20e11160688b0479771e1c
SHA512 5c59d524beaf570eecccef0156d591b321367d004b8afe303cf21317feb051f7d6018d5ab3bbb7c5b9d97909dca9082e975b5a447e0986b7e00cbe48e65a9527
SSDEEP 24576:Qgb6bmBIi49WNNFpg1rSvFv7bYcsqjnhMgeiCl7G0nehbGZpbD:Qgb4mBIBhGFTDmg27RnWGj
TLSH
T12D659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 611f029c25681d917b0261436ca6d5839ed7d70099e4f0bdb3408b63675539d8
MD5 7469ce9a66673163d69548c9c80f7d2f
SHA1 40ddf7a4ca694cf251b289d76f0262bacf360db0
SHA512 322eee5c9883544844ebf838ae765b9207f9055aff6177df7527e1f0f6d1068311934213ea5bd39995657da855e188cb4a49d167a0447115238d8b4fe82d9163
SSDEEP 24576:TG88u8FpJqH1kzria7/mfsqjnhMgeiCl7G0nehbGZpbD:i7ZFPqVza7/QDmg27RnWGj
TLSH
T105A5016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 9081095dc8ce3119ea74017457a126318370e3d831a92befe0e91b92c1851f8e
MD5 51d9f596534d6933b4fcc3e95616e5c4
SHA1 8285e8696feff2064a1d28d71c092cc083aadc76
SHA512 e72a0a515bc3a03a55c594b08e22af7e638c9774d82b7bf7bac37159b45378d130777c43d0d3226822ab0537d1d58b1f24c65ea3eacc7bb1c7544946edc1f8de
SSDEEP 12288:iHvUrBFrEjwaQrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:iPUr+NQrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10385F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 8f7e24824e44f299927a8eca199687680f308e19ec60e54c44d59fa51122d2a4
MD5 9127a23fd49fbbf697f05d8b7b003ced
SHA1 b3cc98d095a3322ac9822a3155f42d591676e00f
SHA512 6b4cf359b7029dfb134d0bbfe8435575acedafc5a5d49dc3a2f646168ae4499450eac4cb15398774b8c75e04e068421268f6643fb1652ceb66f0cb1daafa03ed
SSDEEP 49152:nBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjPDmg27RnWGj:YG05lO43bqD527BWG
TLSH
T11ED5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 042ec738bc09236b1686dd758bd6b8e30ba3b6167b1a3adb9117717e420e838a
MD5 8d6d89353bade2df0b17d08457a59876
SHA1 7e18ed4bf52b6a913f9aeb6b0a480c4eff765a28
SHA512 e86f4c0b676657bacbdb00480919c350d98e88a727c68f8905f57a65acbdbf42336d3386e2da0017750346595b5d39fb30a49c1c44c114cb47bf59a160037a6d
SSDEEP 24576:+fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnVsqjnhMgeiCl7G0nehbGZpbD:ma5POZ3+Jt2pasx2+mnDmg27RnWGj
TLSH
T10665BF5EA3FC01D5D179D17DC583861AF5B2342253319ACB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b5cb19d166ab3d1a2dd78fa3136a0981e92d083bf6e06a35d733f700e39e6b56
MD5 cecea40a121f734744a8ce82573530bc
SHA1 16171fca970a5b83ac36d712019f2e10ed68c916
SHA512 d90a9ae336ce9bead5654b4440038c406d48a7e54c690f62837536c78d8d91b59b1359d186f06bb8ba1c4fd9dd1a27543482f9635c83b55f9fb775e7ffa8e729
SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7FknsqjnhMgeiCl7G0nehbGZpbD:PNc/zEOVHFwDmg27RnWGj
TLSH
T172857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 17735067989f2c6ae1d1b5c7306b8b950ea1961ac6067cc65f51308b4600e335
MD5 c68057de612f98ee66f2652dea45311b
SHA1 7cfe687984781335d8c81a446fb4551da755ec2c
SHA512 7ccead4abcc738d94751d74260e39ddcc9c2fd6bf1751431a2585b66e65e9a27e67671718811adc88fed2b3dbbb0293f154d9a0a0090ea7d7e358121ad4b8b5d
SSDEEP 24576:Y8kNvNnaFeYhJNtmZBmZsqjnhMgeiCl7G0nehbGZpbD:Y8MwBtOmdDmg27RnWGj
TLSH
T1A355AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 ca1fb0e4f44db49d5ce9a388800128e5cd6d8c285eb92e3ad9f09a4fbd2235ae
MD5 c9de4e5ad9c306b67233f493aca5f265
SHA1 2f67ce3c9afa17a2f70cdb20499f2250bf9ca2f3
SHA512 71e5199d9afd04858004af4a65617f1215c9c94f733348d5720db515d5d5c2339d4d1fe495d3679515378cdd99b5938113f7d358ce1200639c9a6ff3b8090c58
SSDEEP 24576:VD3FHshBIYQgA2sqjnhMgeiCl7G0nehbGZpbD:VDVHeBIAA6Dmg27RnWGj
TLSH
T1AC95E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/472-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/472-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/472-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/472-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/608-45-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/608-38-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/608-39-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/608-49-0x0000000001B70000-0x0000000001BD0000-memory.dmp

Download

memory/608-51-0x0000000140000000-0x00000001401BC000-memory.dmp

Download

memory/1764-363-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1764-377-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1764-94-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1764-379-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1764-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1764-88-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/1880-120-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1880-113-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1880-365-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/1880-114-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/2612-72-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2612-330-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/2612-66-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/2612-64-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/4580-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4580-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4580-135-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4580-133-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/4900-100-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4900-108-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4900-106-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/4900-364-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4900-361-0x0000000000790000-0x00000000007F0000-memory.dmp

Download

memory/5100-21-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5100-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5100-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5100-14-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5100-20-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/5496-1-0x00000000026B0000-0x0000000002717000-memory.dmp

Download

memory/5496-6-0x00000000026B0000-0x0000000002717000-memory.dmp

Download

memory/5496-0-0x0000000000400000-0x0000000000664000-memory.dmp

Download

memory/5496-76-0x0000000000400000-0x0000000000664000-memory.dmp

Download

memory/5496-7-0x00000000026B0000-0x0000000002717000-memory.dmp

Download

memory/5496-236-0x0000000000400000-0x0000000000664000-memory.dmp

Download

memory/5592-78-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/5592-347-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/5592-83-0x00000000009E0000-0x0000000000A47000-memory.dmp

Download

memory/5592-77-0x0000000000400000-0x000000000057E000-memory.dmp

Download

memory/5884-53-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/5884-237-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/5884-60-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5884-54-0x0000000000870000-0x00000000008D0000-memory.dmp

Download

memory/5996-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5996-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/5996-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5996-366-0x0000000140000000-0x0000000140172000-memory.dmp

Download