6a5bf9f2efbd9fbe6c546200f4b96dde450ef1c6296dc772fa3ebd8e7da05ed2

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 23:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
Size 2.4MB
Sample260722-3cmbvasvhs
SHA256 6a5bf9f2efbd9fbe6c546200f4b96dde450ef1c6296dc772fa3ebd8e7da05ed2
MD5 bb10ea8be5c59151963c064937cf6a17
SHA1 f412e5a7b93494033f8059c67e71e2018c23b682
SHA512 8cd6675a8a24e8c5bc7a66b48144c4bd2e2275e7b739821c1ac825fae07f237320e26fdf8cb049f208ea6a8e3176b5dcbf7717ea653d2a8ffed399f833738f6d
SSDEEP 49152:4eyG2/hQ5xMijnT/4t5sNpOLRFxAX1sETZvHsr5Sz1OCZwPIvXp59Dmg27RnWGj:4CCG5xMWTk5sNwLRFxUqevHsYz1OCTD6
TLSH
T1EEB5CF3279E08077D57317318A9D772CA2BDBF710B75428B13945E2E3DB44C2AA2D6A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4428	elevation_service.exe
5392	elevation_service.exe
1820	maintenanceservice.exe
3144	OSE.EXE
3348	PerceptionSimulationService.exe
5180	perfhost.exe
5832	ReFsDedupSvc.exe
5492	SensorDataService.exe
4720	ssh-agent.exe
2960	AgentService.exe
2532	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\77622bf4763f1d8f.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_113484\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1536	3352	WerFault.exe	88
4836	3352	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000823113f7301add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000027e644f6301add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006a235ff8301add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000115b5f3a311add01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4428	elevation_service.exe
4428	elevation_service.exe
4428	elevation_service.exe
4428	elevation_service.exe
4428	elevation_service.exe
4428	elevation_service.exe
4428	elevation_service.exe
5392	elevation_service.exe
5392	elevation_service.exe
5392	elevation_service.exe
5392	elevation_service.exe
5392	elevation_service.exe
5392	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
804	Process not Found
804	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3352	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
Token: SeBackupPrivilege	5832	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5832	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5832	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5832	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5832	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5832	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5832	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5832	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5832	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5832	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2960	AgentService.exe
Token: 33	2532	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2532	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2532	SearchIndexer.exe
Token: SeDebugPrivilege	4428	elevation_service.exe
Token: SeDebugPrivilege	5392	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3352	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
3352	2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 868	2532	SearchIndexer.exe	100
PID 2532 wrote to memory of 5252	2532	SearchIndexer.exe	101
PID 2532 wrote to memory of 3240	2532	SearchIndexer.exe	102
PID 2532 wrote to memory of 3416	2532	SearchIndexer.exe	103
PID 2532 wrote to memory of 1260	2532	SearchIndexer.exe	110
PID 2532 wrote to memory of 4308	2532	SearchIndexer.exe	111
PID 2532 wrote to memory of 5864	2532	SearchIndexer.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_bb10ea8be5c59151963c064937cf6a17_bkransomware_darkgate_elex_maze.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 1472
  2⤵
  - Program crash
  PID:1536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 1472
  2⤵
  - Program crash
  PID:4836

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5392

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1820

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3144

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3348

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5180

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5832

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5492

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4720

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2960

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:868
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5252
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2736 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3240
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2592 2588 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3416
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1260
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2736 2876 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4308
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2592 2588 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:5864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3352 -ip 3352
1⤵
PID:5744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 3352 -ip 3352
1⤵
PID:4440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b59576a84d5f85959d1f4eea407f5ea2166672288b003245abefbe52b0d86247
MD5 914e3fec2896b523097ed5e26efdc884
SHA1 dbc68892a90d956c4f43dd83fef7f7737cb18a6e
SHA512 0a6f2117ce331aa4921f60d03aee1713222c0f22322f68807a131a08b1c9d27393b313625e1cfa2d16af0dc19184b7f2916234a2343e13ec4da2f68b33b4fc55
SSDEEP 49152:nb+632BuPkFKRrdE6ohvstBhuXjfS4LWxnuDmg27RnWGj:V3q6sjBFD527BWG
TLSH
T151D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 e703c00e93ac46e01a9340bb7e3f7d33fa018c74fe240997ec2bcae598082a3e
MD5 652b7880a4c99e1171c9514febff931e
SHA1 f513af29ff8175d5f890154ac708ba6bbb8dab96
SHA512 cc5c9319fdd47b7b010ea0c9eb68e75fd4b8fb00a82331822bcef05e4c61cf826b1970dd0948a0cef2336ff3878bbb8d4b8fc1f09302551ad6dda3decc1c3260
SSDEEP 24576:XXYfDtczAdsqjnhMgeiCl7G0nehbGZpbD:Ctc8Dmg27RnWGj
TLSH
T15D650129A3D408F9EC67817CC9A2C516EA337C554760E6CB03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 776cf13e01fca07f1256867962c2332bb879e1f5732bf3dc4963e04447351d84
MD5 5f2e2cfa2713d6a1cb7009c7a3ee1b99
SHA1 f4ee649fac9ed8064c387e8b18ad0bba0fb11511
SHA512 05901b615ff2f3413907484b5d5f816f6a19c0106010534655756cc4255dab896e9cc30bd49449eec2a859172d388500baf269f0f22d3bda680838ced6b0f1dc
SSDEEP 24576:z0Le5ji0hmxxrMSsqjnhMgeiCl7G0nehbGZpbD:zPji0AjTDmg27RnWGj
TLSH
T157859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 b576c9d76ea6f319ecae65abd6b2daa36018db2352a67981d9b07f52fb7550c5
MD5 f2c446f731a024bd87d3e9ee165f7920
SHA1 40d25ad94e616c548a896aad24e178fb81be12ad
SHA512 ca21e9bd585fb379c0fbfad72fd0ebb56faf84548fa82c7a377ec1cf38c1fe56b68f548a82bc4b713835dfa287185b47d5feb6082fd8261e722744de5fd08d99
SSDEEP 24576:Ba7/ezSC6vUyD/aqgrvWn6q8wyuQsqjnhMgeiCl7G0nehbGZpbD:A/ezSC6vUzPveHjyPDmg27RnWGj
TLSH
T1ED755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 babc3e0ab8b119469f42579f4866b7395a704426ca578af0846bd0d77dfd8573
MD5 0ea737c02b7448dba0976a4b8299a297
SHA1 482325c2bd969fdbb70deb55fe242db58438179e
SHA512 3e1122366a2dd713b76dfb081347ba0a3c5244bf7478416a541ab074db8de830c568574bc189d7c6579d6552660db463fdd8f1d8aaebecf38aba4e2058c5e011
SSDEEP 24576:WVbqPb88hv/l+YBsqjnhMgeiCl7G0nehbGZpbD:WVO88hXl+EDmg27RnWGj
TLSH
T1C3559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 dcb330af12ee4c341523d8f75c7c82690d1d31f4e14a24df280f25332da3829a
MD5 4376aa40cec6fd92316ee4235c325402
SHA1 318d0a5de0077738ca787fa19e0f612f5bdee2ec
SHA512 f4d87cdb31903744e02e64b2cdf5c36c6710effd4db70719baa42b899323545c3bfe4293f1423da63a36a6febd9deee9f6139fbb4ea87a9a479a2e572009ae11
SSDEEP 12288:fLmXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:fLmsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AE4523BE824C11DAEA7708B5C3E9F51DAC137D56982008436A637DFDE6F5458CB39123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 1eb3e3fb8603f6b7f4f0d79e052df777b444947c6d8d5243d4530d9c999bfb54
MD5 3aaf761d5901709e53d77f3daa301f03
SHA1 822ec97d118393244a76fcd0543cc279c0acba58
SHA512 6ecf44de6283ae849ac21572303a15fb03443570c60adb05826def20a8c80b55773d497b2430f641429aafb685c231aeb29e6b830257de789fbb40329da92ec0
SSDEEP 12288:ZeBNUbTVO86UZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:ZJIUZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15C65CF7BEE28FCD2C27A8DB95791C600E76278314F21A3CBD165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 702fe45ea0bd810655fc6f9e5413ca860f4401010f6050c3744aa620fe2953ce
MD5 792838c24c47cad20acb62635497d591
SHA1 48931f05200b0adcfa4391f1af60891fb95e49bf
SHA512 2cc6b10aa8e704bbcb1120eebe3c62ab51b913c98f9e8fce12535154dd645f48223bbb683f1d1afe42007aa2930c2578be3382d7b3c6a136a3ad9e2c978d750a
SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THI:mQvGAdlCEL8c/DRNw5CcD527BWG
TLSH
T1AD266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 386723c75abf7093925afd9bf4c3cd66988b3c4339c8dabb4482a5ae9b953978
MD5 22a7c1842563ceaf3cf69c1bf20782e2
SHA1 16e49175084a37e67792a1eb330ddd059fa80065
SHA512 244f061e882d81f955a059c1841b2fe7a2291709f6654b8f0e3629972014798618eeb8400928dae2973f4b798cb0d0944de711f78e7e72cd8b16e23145954dcf
SSDEEP 12288:rAwSfxL/2Dc3RDLLmt0LDQewsAj/Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:U0ewsAj/sqjnhMgeiCl7G0nehbGZpbD
TLSH
T14A75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c0cc2c837d8a2094bd87729432b245578d69c28ace1353b9849cd78f15ae8610
MD5 80b0245d5754334a2ac442434e1a0ecc
SHA1 3ed8c2a10d8b3185b94ef07a11fd9684c13145a5
SHA512 20cd8c24c317dd3e88720e696fbfa5ea812ee59642aad6d8cd2eb0b240d51e03f77889a15225f241103c0ca9e5de742a743b75d71270713897aecf58fe7522fe
SSDEEP 196608:XUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH7VQBWG:XUEtQevvqc2W1cpV2tI32SB
TLSH
T15D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 cb9832e23f5b077f2952410c8d5c1598cec8e496cc97c6246a496a9eb80256ab
MD5 c01455c443410025b855feb69a951d09
SHA1 4711f459a67a81b8f9e10c564fc6b8f8ed107b2c
SHA512 2cf10258947819e47fdfe2792627d13ac4e45f2f7fde81c895207cc428c83ad18d4a757a85f2a640ea5a2a6d1371f6a268f9e5802ddda2a8def490acc116b999
SSDEEP 49152:sCbRquA/m2yL5zTfFiV+XenmE3/zDDmg27RnWGj:FoquVjnmoD527BWG
TLSH
T188D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 4aaca468b31845aa1174a4f2ed8a508fdd1c39763a50a4bc8be59f61be60d82a
MD5 6a5605804332eaf72203922421a28eab
SHA1 f04cf5f5ca67e4d9e4dc998c3df670e446432a29
SHA512 0d80c06fc08faf0c54880a9347f5afb20f5a1cf7a90d27ef1dbbbb547492647fe11735802065e20a98fde108edda0d5880b3614270889b2d5c7aa8fcfad13397
SSDEEP 24576:EAhGL3IFoiwtA5l7S53csqjnhMgeiCl7G0nehbGZpbD:EAMUFoiq54Dmg27RnWGj
TLSH
T116359D81E7F951D4F5B3AAB899B6D171E976BCAA5E30C20F2160D11F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 528bf9d99fd8e567bbbdd8f58add82a77be4618d5d66d0136a35139dfc5cef1f
MD5 973cacbc6fd2443584dbe130b3604604
SHA1 88985898066596052fdb0c512c57957f9e6317fe
SHA512 5c50cb66632d4af6a9d60bb381b98d6157f7bccefb17632c8384f882f09a3dcd4c1173b1257481f01b09012417ac8313df29819f8d83e0288b9879962cf46b66
SSDEEP 12288:Cmw5HEjsChNVBFgl0WDm+CwXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:bwu4OW7sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18965F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 c869fdf75dc4235379093c9a9f35bc771747ada77b0a68e3376c6b440ac4b7ce
MD5 0b299330383f4050581c322a33e5eea9
SHA1 332cb5e6b1efa2d53e0b1e51d748041796c89c8b
SHA512 5013300f68167302a463b67638d69cf8141a08c5b6bb3a7749f768e7569818fc8e12afa29c04b246884fff9e46737b7d876625374140fbe2595dd0278fa9818f
SSDEEP 12288:/eZ1IyPXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mZuqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1395512AE239820FAE5634178C5E5D609EB333C62673003CF166656AA6F739D44E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 030fcb3f289bc50dae2176d1985a28a63cdb3173a361a300c4f10061a4a260ff
MD5 6d61fe6b25b3a48e4f3e9ec5960ae730
SHA1 12f242b90215d8d19badbceedb6feade800b2c22
SHA512 7ea17c4c475011663c7cd57fc59a2658934a0da5d56824b6df2d8dfb481d0f9a6e5f500aa202d3fce9b2cc9c73071d7b9e00495c6a103b63f416b7ffb6bfbff4
SSDEEP 98304:wQRQyi36YOcPbLvw2gAf+PN3JD527BWG:nQyiKa/X+PN5VQBWG
TLSH
T1ED667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 790cd7626ca580034ca1ecb6f2c01ebd707675081a0dc349d63bedb8ad1d9f66
MD5 dd81dc6c3b871e3621d632d810e987c0
SHA1 e80c723fe4a246a3afbdb1dadf79cd18f2f34abe
SHA512 2ab9b6729a011d75757861b6c47ca4e375663d85f881990630bd9dc01ba8db8c73faf0f61f30bcc43a8e42d660f0b4e0701a58d2572c212c17f3f5d807b6ec5e
SSDEEP 98304:jQRQyi36YOcPbLvw2gAf+PN3JD527BWG:yQyiKa/X+PN5VQBWG
TLSH
T1C3667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 1eb8d17b891a5ff0dc67d17cd455939a70c9e4ce88e9ab37a228f784b7fe4216
MD5 d0295c6dedbae52cc31496503e7acaa8
SHA1 742783b0be97f669d11e76c12d35447ca16e2388
SHA512 8e93f93b2eebbff31d3710fd15b6600c29eebbf84c6c076b60a209716e612e58ab6b064e56fa20b2084aac096f00c6b3010d50343c6c4c7197e7bd8927b51151
SSDEEP 24576:jwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0asqjnhMgeiCl7Ge:b68Qg55nhceWu7PNU3/TDmg27RnWGj
TLSH
T13CB55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d354cfdb89e66e4d197880431f48ab1e571ac0812d00e5481d0f9dec1db9066f
MD5 8db25d9c28221518ef76559eb0ef8f31
SHA1 beff43ec5c50ba16c79752efc7899646b685aab9
SHA512 098a856362ada8ddcd3b77edafbf4d45631f98f58e896d10e3c36374ae191eea0c45360b4a9c17bab4228fb97687066a3753180cd1f337d3b6aead0ec67295b1
SSDEEP 98304:0y5112gYy5azzVvt69nLKnhZqD527BWG:1LIHEWhgVQBWG
TLSH
T183167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 89169610aac06808d4ad7363dd7917ef6324ff6cb26f1d40208d707a18c7b326
MD5 f044a20f0e6869c81e95e7e0546c890a
SHA1 ebf8b2398db340ccbbbc0f3ddbbb2dbde259f639
SHA512 5a3b39dec5b741d93915c204195f9f6ef0107e1a5c13911bff1b11df01cf8a5b083bbfafb167022c808d408281fa75ff6836d02dec804c603e20a039678bcfd6
SSDEEP 49152:9B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glxDmg27RnWGj:ju6Jmdxd2dxD527BWG
TLSH
T19AD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 17df5ddcc877a34d5a1023a24b73ae4f7082a00d69d69445aba3d6e23e5c478f
MD5 7857794ad45ecbc0ab1b47697e0449db
SHA1 5fa7facd98cac01c2e7f2b80fba5b45492692102
SHA512 8a7f3251cd84671d72e828f5ae62f804de0462efaea9c0848677e7d1483f43d5fcf817204433341aca20ce562eab14a46877a493072916dac3a4382c6c334504
SSDEEP 49152:T1hpsNoJpF1A63U44CwH7R4x9Dmg27RnWGj:TmifPWRoD527BWG
TLSH
T1AAB5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 77de26ae0c3e7dc9308b606c0615cb4b4c141e1a63b741265e90c460031611ba
MD5 524a818a50369e14aed8f597afff814d
SHA1 4aef6c53fae4c3329d36a9c694bd1b58649a955a
SHA512 ce8042681108a0236d3021a3aac3caf9d1afa48758ca61c9deba99221d56b361ff02cad359ac999d5335aba0ab3fed46aa37a90acbb3054e9d73c94ece10c88a
SSDEEP 49152:qSuZQIY0Be2KcRVtOnks6NMHq+Dmg27RnWGj:05dKii61+D527BWG
TLSH
T182C5BE13F2E900E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 2a80b0732f707b6099c8d18b7525f107e72dc9c7bf4f4242b29065d1215fd5bd
MD5 e7f09d510277bddff2c82bbdac1cd5ac
SHA1 3a0451007e587a9ceeb9146fafd3f83d590c714c
SHA512 6274b342d6ce44c7eb7a280cee60345bb700e7b4d7ae9270a387d5ddc2db69b7db058f67c17e2a31faffa980be7aa3be266044849ec85d2afd9521685455f8c7
SSDEEP 49152:ChtSn8EApI0fig3giDn0AP5wBDmg27RnWGj:jX2imphUD527BWG
TLSH
T14D95BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 9946aab45ad4032d4ff21264e2030b07a852dafd6fec9809ef1cde39646feb9a
MD5 a7933ed401562780ac95de088e96ccc1
SHA1 298706f1088cc70cbd257ac5fc00fcb8fcfbeaee
SHA512 c3e3cecd3eaa167bfcc7d4821b63a64906defc94f276f85f87a068c87d75394d4709f560c8ce03ef4519a432874533ac4dde894c0c6d19117474f654a2a79c20
SSDEEP 12288:DeXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:DesqjnhMgeiCl7G0nehbGZpbD
TLSH
T1334523BE915C01CBE92648B5C3E5F15DAC073E57E92004837B5778BAFBF24A84B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f08b5d26676d2d87091532f12ff43fc87d7ef2f36fcfbb847cadc7dd092efe4b
MD5 8df8d1cd70110bbef3a7d3980bad35bb
SHA1 ee8237c0c079d7c0c82bd0abdfb00adf3782be27
SHA512 38c65760b1d05183044b8ab6cd63f6b891e14496a9f2469e37b09a18c9223850590cf0faa911fc8f06cc4c80ffa934cb47108f8cd297ec64e109c140829dd1b8
SSDEEP 12288:6jXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:6jsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F04523BE915C01CBE92644B5C3E5F15DAC073E57E92004837B97B8BAF7F24A84B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 6c1c4954b5deb0a8eb82f775b71887809da4e09aab7b89db0347a96a26434907
MD5 d05496c0f5739c9e3d5b71c49cb19bc7
SHA1 79fe680f5f1f97ffa6bbc93442ab9b422216b0b4
SHA512 4bb837656a79e999cd7e0b0dacefad5f4389366e76ac5ee46c900fe2c1e21fd49244ff81faa8a96c8ce9aaaf562044c186530f4a7f98ecb5508aee8a1018b5fa
SSDEEP 12288:zxXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zxsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14D4523BE915C01CBE92648B5C3E5F15DAC073E57E9200483BB9778B9F7F24684B39422
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 8468e5372dd193755fc3eb2c3e03074f7cf171aa4d58dca11a2ffa10465d0762
MD5 8a245e7dcdaa2647c87b07d38042a396
SHA1 0d11e813cfc9909141a61581ecd0937a7c5a62a4
SHA512 47f656a802240dfb60f2fb625a053fea6a17d97a5540cd4bb2ed59fabf708fa15d327d2101ddbb9758e3942e3e6835bb475e336b087c17af4f979a5a7460fc5a
SSDEEP 12288:7V8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:KsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1FC45236E535C01C6D83285B5C3E5E11DE8237D56EB3005DB6B532CBEAFB26944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 4c6f058e3dc419f6b58795651a8a3b2da5127e10c5287e59295446cc4078e1f2
MD5 03f5d3b89b1a452694b699f7b0a3adcb
SHA1 8bdda913364ab4d62496bb45b117333fa602e6cc
SHA512 c34762471bbaba6297f65068addf12359df72edbd3373932ae2490d07e7d9bd061c376b0298367d6f0644315de9aeb8a0bfc9c641c187f4ed3cc0268437f5b7c
SSDEEP 12288:CkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:CksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1574523BE915C01CBE92608B5C3E5F15DAC173E57E9200483BB9778B9FBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 02cf1cac1516c15c44c8ec06ed3a8cf46e94f9348ae459adeb786559d21aa539
MD5 24e3319dc8d5f380795af8a1c6ea7506
SHA1 8c31878040d4982c4d938170241fe9ac58c28091
SHA512 067c8f76094be9584af342233d50bb7a2cc15c2f6f350cdb7afd142a18228f9b0e84aa3c1823fef866119d9b09bae400719bd539c3bc69fcc2a98fcdda9a1fde
SSDEEP 12288:C3Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:C3sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1C54523BE915C01CBE92644B5C3E5F15DAC073E57E92004837B97B8BAF7F24A84B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 3ed85750337e1a0e51bb56c17523827785a375c0be48e1adaf0fee96c283bc2b
MD5 a0d72adb0fb5091a36584a143befe4ae
SHA1 3b8db434559adeb23983a6bae8b8aa440eb19c62
SHA512 6f589872393e530ce198387cb2d7051a9e97677cdd4735910a35153da956975edff32ff9c8096fa73faa78503f19bb1020586250a162d3e041105631f2aa843c
SSDEEP 12288:yrXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:yrsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B84523BE915C01CBE92644B5C3E5F15DAC073E57E9200483BB67B8BAF7F24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 7df64eeaf29721a6b1b4de3cdaad63e59dca5fce119335b0cf619ad3bc56e9bd
MD5 a21e834b623eff6ae7c85e03ebba5b01
SHA1 7def69f40b42d5da9a9672975481b520c510b1c9
SHA512 66fd46104f5aed57877cece42aba8db7d5e90de84d54e429d3256f23493bc0016cf60dfdfd8fe05cf7264c43e45bddddf208109e02ed616f9fda95942988e803
SSDEEP 24576:gZMRzFVSODsqjnhMgeiCl7G0nehbGZpbD:gZMRzfbDmg27RnWGj
TLSH
T1686501A9B35018F8EC63813EC965D90AD5B37C5A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 d17bd5825bd5a4125e93db2c8819d37c1dd47c02ffccab60b8dd8a66735ac9a5
MD5 4b550769f98d27d57624a90849643ce3
SHA1 110cc432950f9034130eb4ef38020ec81a247f42
SHA512 709c19c230da1e73173ae17fb1ae4171b16fa6e6250adcfdd4ee8064a1c22d093425ff056f0058f8622949761018bb3619c78333526b943d175d087ba59ef663
SSDEEP 12288:I6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:I6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1AC4523BE915C01CBE92604B5C3E5F15DAC173E5BE9200483BA5B78BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 2583d3b0090cc1e612d2a750cd52c3fa0db3eaed3a1ebdd0ff081e5312cca92c
MD5 7ae5f9bfc6f42311a04bd02c6d2d8e1a
SHA1 26d0a42213d3512896b543aeaf82edacb0521590
SHA512 5c30d98012b4083d6063e2e43ef8b812c19201523d2da97dde7eccf427462ef18bad5ac32882897ffe0ed1e29dc480feed49c3010dfa0301a260b3aa8cf48f53
SSDEEP 12288:k2Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:k2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T16B4523BE915C01CBE92604B5C3E5F15DAC173E57E9200483BA5BB8BAF7F24684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 980c3bf32e7f0c4dffb751e51026c948a331a681799ba7c1e8474574d2e3e387
MD5 ccad4fbe6458c2a252f8dd76684d7834
SHA1 41e402c11868ef1abce122a48130d8042148e928
SHA512 cf512567269a17cd27c2a9b424c8e92a78a34a1a754604eafe6498d97cb73a5ca6db9f54c5142183260a0d00dbbf108ddc343f8aeff4aad26aee1590bbecc4b5
SSDEEP 12288:gyPz5L8PXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:RzyPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B755025B73A530F9D1378138C5A29A06F7337C3247204A9F17A556BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 1d385e22c64c5bf0de733832023c86ab8da4e5a6571d79631ca935b2afe01815
MD5 6c7c320d0d7af9fc4fcdb3567130395d
SHA1 575a0f7522d15f4bba1405c6d3603c87d7b05200
SHA512 8e0b67fa043bd3ac45dff29dfb42f85053cf3259ecd8557f0e5f86341b2f4d67ad7673c8a54fe7e767204f28678e6bcd1e5937bb46c9c3bcadf052283b2c2db4
SSDEEP 12288:e6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:e6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T18D4523BE915C01CBE92604B5C3E5F15DAC173E57E9200483BA9B78BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e0533de6f00e6ae190b23cbb974b214277af14d30315fcdab09aeef667f2c991
MD5 9b9f72233e045310ee124a7431056318
SHA1 7843e345adfffd140760ff01a3c077242cf75f8c
SHA512 efb8efe8cc1fa24ad87924e262d0f78b8dc88bc04095b22f0f0ee6544f4b1a71c56bb0c8b08f0dc0ddde8d6a82a51b56fdd815a278631cb0dc2050c603978d94
SSDEEP 12288:q6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:q6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F74523BE915C01CBE92604B5C3E5F15DAC173E57E9200483BA5B78BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 4801bb4ea8d5e120904ac48365c0a8dad135a53b505d0fd25b2e6ef60f2158f9
MD5 a1d8047b74b04e885ffad6cbf52d7ea1
SHA1 833039212fda1243cbe9c68b2f74118d2d49aa76
SHA512 2f509f1cbfd33ffe65bff50029e03260da323b814faf6c660ea5a9c4a99468ada01f4f1f0d956677d5c2d7f53e1d375d47df7cd7c28a168600b8bef7a7ef8a79
SSDEEP 12288:ayPz5L8PXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:HzyPsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15A55025B73A530F9D1378138C5A29A06F7337C3247204A9F17A556BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 2e10decd95d6ade5400ca9addafe0f5bfbc9badb53bea11cb076b1fd0bed971f
MD5 e2cb2ff5733bec42666f4b5030db3d08
SHA1 43c80418eb339205bce36e6893d1d875412b29fd
SHA512 d9ee5700da33045cbb7d21b9171669452679b13139097b1352217e0ac604927265dd2ab05de4c039b03bd4914cfcce004ef91e673cfef21e726fa5b5461ed9ea
SSDEEP 24576:kTDaLl3z0zDhsqjnhMgeiCl7G0nehbGZpbD:kTuLljMDmg27RnWGj
TLSH
T1E16501A9B35018F8EC67813EC965C90AD5B37C5A0B70C61F13A4366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 f981b374a8b2f988fe2dced6be72d60717dda20d2626b0d4aadc7cb9525abbf8
MD5 8234a62fe6450ac752f853a4cac8889a
SHA1 f1a8b32be1c2aeb0d90f6b06aeb83cf0f57a7d1c
SHA512 692047375923688f89464a87f234ec017f1e81af6b6b9de65042d9fe5fc75732cef3a90a452ed69feb8d4930fc300302702327502594a08e1020a17a7ae127dd
SSDEEP 24576:S3vd9CHKy7GZ1sqjnhMgeiCl7G0nehbGZpbD:0vd9CHKyabDmg27RnWGj
TLSH
T16575CF90F3E810E9F0B79A35C9769511D9767C5A5B30CE8F03A4256A1F33AD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 ad83fa77b35bea39e9bfa7ca99a1fcf87fd61f8798cc0a78236828d3e408550a
MD5 25615956129f679aa26e07261d5d2675
SHA1 2498a1bbafd96d162ba26140df0d94d885e52aaa
SHA512 2f7be54a97be395b7e1393c628ddb5ae14f92971ea88b4ac5c07f7b1ace9a0cf34f6c6bc4af0a6b6325252f28f74865ffd2814ea9957612c5b1a5bf2db852ae6
SSDEEP 12288:gRXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:gRsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1284523BE915C01CBE92608B5C3E5F15DAC173E57E9200483BB9778B9FBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 8c3addc9d3a7f35d8cc472e789188a44800a5e5d20a1a48fab203790d8998c18
MD5 4166eb272da205d6d922a631ac647ddb
SHA1 db1871ca750248a79fcc61ad3a9f34a6c013f598
SHA512 9bb58b38f613fcfb2e39fe69e69da415a3ff47a734fba6938c158df13961fe525362ce8ee5eff1ed39041e4bd8509f3b6918ea9caa91d6374c41d2b5295b2601
SSDEEP 12288:IvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:IvsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1854523BE925C01DBE92644B5C3E5E11DAC073E57E92004837B9778BAEBF24684B39427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 96122b8efd03a4b799e56911cd9af7df81a30ab70f05aa2b164c4b2d7b0711b3
MD5 8360b9b608e840ba667f833ae8cf064f
SHA1 72d58d2e4d83e145065f546d9a1de604c94e6f68
SHA512 587658defcb930130831fd176bf6ad0fa8ae939c03a07799bec7a2a8ad072eff127e7222b7d2f43c88e6be4ac390b5055fba1dc12950c2dc5d93cbb0387d8c36
SSDEEP 12288:T4Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:T4sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B64523BE915C01CBE92608B5C3E5F15DAC173E57E9200483BB9778B9FBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 de0a34959a70fe2ff36c454cb7b201a374fabf739ff1a8d8bb4517046f9f4fbb
MD5 0817e48acce7ba37cb7ed9d9e5ad3046
SHA1 e5d402f3756d322d7cb5ecb611b8426f257f3cb0
SHA512 c2857af5e0af5b88aa2800e596ae8b721c85a9826d5c8a92068492e6c0bbfc949ed39830f1d800f237e173ccb6b6f7d05b8554399d349fb2a892e9d1fa089a7f
SSDEEP 12288:R6Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:R6sqjnhMgeiCl7G0nehbGZpbD
TLSH
T1374523BE915C01CBE92604B5C3E5F15DAC173E57E9200483BA9B78BDFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 7bfeaad3cc0886dd6fe20d1e9844ed99a771965a395501d0bb82af1c4229b2eb
MD5 3ffd441645206d70d4377a0fa282ecde
SHA1 a610e60505337cf5d147c3d2ba5bcefdbfda3f92
SHA512 6d5f1f072405b2843b48a80e1945efad597b8f99b60b98ccff36046788e4ed367a5724cee973e86ea1beba31989e70c7eb1c2610273ed1eb0339d45e78fde91b
SSDEEP 12288:ARXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ARsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11F4523BE915C01CBE92608B5C3E5F15DAC173E57E9200483BB9778B9FBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 2b546bf0c4fac8d428e3f6e30dfd2dda0460f8aea2566a12ea0dec2791d7b5d8
MD5 e401d6fc334fc6da0b483ffe06291281
SHA1 34342f2594dc2cc5eb7e72616830b376a7cc44fb
SHA512 fc87acd2805f6c953dbc0c556d7270e0cc485337fe86d88504197e7fd3b4ec2a09ab1c7084a9f31d6dea5799572fd7cb7516c65d8660de7c4f4e1ca43e9cbfbf
SSDEEP 12288:FCCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:oCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1EB4523BE955C01CAE92648F5C3E5E11DAC073E57E9200483BB5778BEFBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 675769401fb66fd4cb2d9de3b910415420ada71ab1cd7987e90dfacc3b81f35d
MD5 09a7b977570f3307cbd92a6e587780c8
SHA1 b44ce893c43b7a0f173f527ca9f36ae200ae48d6
SHA512 f1115efa2be3589a4ac52fb077688c39d03601595e6a7050cd6fe280c7fe82ac4ce3a6424201aa98be414bea1cea4a0bf63a4afcb6a295334f6ffefd8e9be665
SSDEEP 12288:AkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:AksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E74523BE915C01CBE92648B5C3E5F15DAC073E57E9200483BB9778B9FBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 726d8466ba6b6e770d9496d2b7175a8990cd7b2903daf75e0c22629abd55e420
MD5 ea47ce922b8b18ccac7ce89991a4e420
SHA1 3e8c459f6307770451fc555162223027d810dd85
SHA512 1f5369021ce6174e674f6f87afe35571a005698fd86cc8b3e13484bccf0dc979725e9ea9fc00c6efd1887823bb2dd0ced35e888b59990ab9e7f81761b16a2b2e
SSDEEP 12288:ZpXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:ZpsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15D4523BE915C01CAE92248F5C3E5F11DAC173E67E9200483BB5778B9FBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 21b0a0f6258d1f694e2a2984c95560ace093c4af813865fdb86222bb58dccb3d
MD5 09b876d3a23db30500fd91a501bf69e2
SHA1 6c10a37a0c73b3c2a08e742119fe64f689467c63
SHA512 f66aca59ed38cbff6b028c0f7010e47c1646234c6790b0f18778aaae1ae3c6e8e06df3c863c0b925b7ca8c6a1c12915211a0000c34de9a916ed2c8422895705c
SSDEEP 12288:mkXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mksqjnhMgeiCl7G0nehbGZpbD
TLSH
T15D4523BE915C01CBE92648B5C3E5F15DAC073E57E9200483BB9778B9FBF24684B39426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 5ad3175cf8006233c2979564c1642695c3efecfbebe8c8df8e38acf56b5e0e49
MD5 2e4b3184178eab20ffbd00dc8737ae07
SHA1 790ff6e56f568fce79df8ca49be9bb6896dd2b30
SHA512 6ba5c3ec12a712ee03d2df1afaba6fccd0e1051efa98d38dd4000f79c4dd4e37836247f622207bdd50b6dec199d870382003dd44f13fa4e9fc892454bb6fbaef
SSDEEP 24576:pfwvUk9RX6wkyAIGsqjnhMgeiCl7G0nehbGZpbD:jMnYIKDmg27RnWGj
TLSH
T1D685D029EBDC04E5E177913C89B7860AF6B278591B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 cf0c1274a11687c6fcc274146b7bace1c09be5860e2dd6212a724f0fbe10d16b
MD5 0284c17636be5a6ca40876c432cfa7e0
SHA1 0fdf6349c15837c0dc948b2fd8f326d85f91d697
SHA512 41c352219f7de5995ff82ba14d979bb903447e864f84a31d5c2152745c707c5a732149fa06cd43bc35c8b220ec4eaebef1ba2ed7d1871c8d1eee682d59478967
SSDEEP 49152:7YWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0hDmg27RnWGj:eySzPpD527BWG
TLSH
T1CA066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 fbf37a8f241560f935a3ae0ee6dd5efc3f62818561242f6c73af00ef9e0cd5ca
MD5 36b072c9707b15e4967da86b9cddc760
SHA1 92ae5b58385ceaba6fc186650f897b4bf1ffc2c7
SHA512 7f280c245d09bae46ac323fbab085cd5fb252dbab76e03a77384b2d614f33c5f77a14a773494cb3d6ff7a9bfa8525ae50732e8c34e34fa85c7759f203fa9e020
SSDEEP 24576:S47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYTsqjnhMgeiCl7G0nehbGZpbD:S47JUQjTirIhCnDHUPfF/xDmg27RnWGj
TLSH
T10E65AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 c21fc627debe07f479ab1cc6d21fcafb119b3953644b2ebabd0e905083ee1a21
MD5 a9d9e23622420a6ccb53516c2bde5110
SHA1 e288a1e4b4c5d414aec81b8bb8dd550bde676ab0
SHA512 2c7d966bc70e38ae8cdea8d8a880ae5e104abbb1455ad85ac72ccf58114ca85c3395ea95ec4f24a2aa85fa97602b960d74bef4f3d075c3c719bb1f23fc1df916
SSDEEP 12288:8bsfqXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:zqsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18355015AD29802D8C06E5179C3969605F7333C2697E093CB67D1F87E1F766908EFAA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 6526d8d3a64b8a54e3ddb237eabe4cb3e74a081af844b86c7283d4b1de067f85
MD5 503c2752ca8ee45f0f350a2efa435e69
SHA1 53506e2ef03d334c0861c6a5a80c284c32997a6b
SHA512 805ff78589187ac8a59303246d795e9b5d8b6a93e98d64fc0507ebd15ae4e481f8ed2a2d7f3251a6f88847f7e3d2ebb28ea46a98507de51172e506252b001935
SSDEEP 12288:SZxGRwU3fS5MIhfXHtmYM4ksseCl7cDgNb9H1/F57HxQ:sUGUPS5rhfdmBHBcDgNb9JF51
TLSH
T146351840762AC75FC6A980321E32D5CCA7707D01FE45AF0773C8873FD576669BAA2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 2b37501014d1d5beabe02bac59889b5acafb5f9adddf6eb8eaf5922137bf1397
MD5 4678b60c6e2044b69512a02cebca775d
SHA1 e95c931f4f63b4b2e6bd02ecf413dbec65bb1ed2
SHA512 d66719103fd76cd8da92e7e203b980d3153bae3b185a07e94cfe48a7b3a13a1935f6561978dbe9b67324631724648f375d78af9e729c136093c1fe7e310e31df
SSDEEP 12288:V4JWluc4VqFS0sQyd/hC0f+xSBorDK9uS8MHWupSaNEKL9EZjj2RvA8j:Gc4hr+ZjjcA8j
TLSH
T10455E8415137E39FD1F66032072A5B4CA7A8EC07B7496F26B3C8453AD86B721A4F93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 3e1b70f697dda98d80d6a06b04447323718f28a2b0ff7b60ff5e682c4c580344
MD5 523c1755853e63054c52578e8f438896
SHA1 331638284bdb525715010a40ab864a37cd6492f7
SHA512 2c63f11e3e5afdaddde1edd91d1ff320250b23c00c2fcbe5bb8f73de08a5a96d20910ea6dc3650ddc54cd209176733322821778b406608819ddc95c9f9711d92
SSDEEP 12288:C07yXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:TysqjnhMgeiCl7G0nehbGZpbD
TLSH
T14F45237AC34C118AF93605B482EAE12D681B7E669F2004C3BA5778FDF6B18D48F39517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 51b07d69ae424cbf712089bb71c8e943dac7c82e53248beaf0a017b0d0ab286a
MD5 24ab3a15cc7ff0fc606503cfd5dc80ce
SHA1 144bd459a43e21aa1600c75f69533c91ae8f5e0a
SHA512 118ce7043efeebede635444999ba26f10458804532ed66c2d5bce4d1aef7273aeeca3b243d83ed239eb1cfb6c6234d80583995d46c5aa43242a41add0baedee1
SSDEEP 24576:cgb6bmBIi49WNNFpg1rSvFv7bYQsqjnhMgeiCl7G0nehbGZpbD:cgb4mBIBhGFXDmg27RnWGj
TLSH
T155659E1E22EC02F5E0FAD2B8CDAA4417D5B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 a2b182bb19b5cae272ebb38bb4862acb2a8fb2749215d4d37f2e0a36a082da67
MD5 c275ea006a272498f175aca427145f60
SHA1 da613207aa374d12a73c161a838af98e59b06228
SHA512 63ad0ee4fbda3b6e7186e5045523b56f15c0b9840c51b139943cd554e69a08252ed0fa772abea439232246ee8904bb3aa055c2b33c6d460dd2301a8cad8c1fb3
SSDEEP 24576:qG88u8FpJqH1bzria7/mDsqjnhMgeiCl7G0nehbGZpbD:R7ZFPqVea7/EDmg27RnWGj
TLSH
T1CF85F16577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 7a5911d06be7b5f32108e42a57c3fc7c74923996b0d4d711aacdad221f2c8973
MD5 1744ad703c459b3a4c67d601a325c45d
SHA1 b91e7ea4d38f723072a323186b5d8a2538986df5
SHA512 7bb9fdea9fd5e94f1ba807565c18e7aad035cd78441e34d68c8781d9a374ad509cdb181aa96ffb1005510fe651d278a207bbb69d7f32621327221066b83aa130
SSDEEP 12288:nHvUrBFrEjwaQHXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:nPUr+NQHsqjnhMgeiCl7G0nehbGZpbD
TLSH
T18A65F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 c0015062796979bb933b7d5365888fe8b86b00efc949484b9cf600c49ce0f114
MD5 5da5778f15e8070a920e06ad9627e0a1
SHA1 ce06cb3652dd99644b5dbce7815b3af37a72ea13
SHA512 e2987edc63b9cbbf5c860b4a088002ab44a68e9cb5c0ebe67f0f2ea7be95e122a6e391a1cb23182bd6a3fb97880a7e92252cbcf38fde3855541d583da0a1f4c9
SSDEEP 49152:lBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjLDmg27RnWGj:uG05lO43bCD527BWG
TLSH
T191D5C06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 ec161088cff631817456385cfd755a27e4022b2a3f69962c73579a9bdb30e393
MD5 45b445c3385b482074eee2b96d4a1e9b
SHA1 c62e501b6771e4fdd0df34103e25104b25dd28c0
SHA512 1155b178a00d60baf36db2b415b6d8fd1caf332ab0fd317458635f58c831d5e174676a81da7fe362c07e3545256062aee81212af1b66a938ec8faab135a16046
SSDEEP 24576:Ifa5POZ3dpuWVM50JicR2hG0lasx2+47eidn9sqjnhMgeiCl7G0nehbGZpbD:wa5POZ3BJt2pasx2+mTDmg27RnWGj
TLSH
T1A765BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 3ada062cc8b008e69e80d37c902093db176c752902e4b77a8c6af3f7cb5fb602
MD5 df3f07b7e57d2d866b28ce509f078036
SHA1 a4ee165c7dd1c0cb4403283dcf9f3fb2e6b90bf7
SHA512 82c106eab0b3b5ba3d006e4f77aff138a8aeb9b359d415c518e641db59134b3734e7c374bf69ad01a24c82dfbf1d0e346be6f60edfe9d49c52262a394e629131
SSDEEP 24576:tNcwHdjbyQ4nLC18lb/EOjowL7FkbsqjnhMgeiCl7G0nehbGZpbD:tNc/zEOVHFkDmg27RnWGj
TLSH
T129857B2623E901E4E5BBE1BE89779546FA71786513308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 4467b6e0a8d9b964bba857c735bd5b75f1aca4c4f11c91a9ff434d71208ec747
MD5 673b8ee81b4f0a716afd65198d61008b
SHA1 d0ec54f02b0dac8945885ace984a3b73fd9b72b2
SHA512 441330a35ccd075763c43f8b4fdc3af4523718ebb4d2342887d5d27126f8e83b27f0d4c10f11284630a228f62b793c33063b8265542e0db68c12e23d3e9af873
SSDEEP 24576:LTkNvNnaFeYhJNtmZBmpsqjnhMgeiCl7G0nehbGZpbD:LTMwBtOmtDmg27RnWGj
TLSH
T11A55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 dba30d7c9efff3c320603a28cff8a6fc6ec18fec2ccefeb1ff187ad14e4fd283
MD5 262761dd9f47b229d042f36b7cc59d31
SHA1 63716436a16b93fcc248eafc7249829c0c8f4e47
SHA512 d63420beac6e254e1517858bbcb1457e2fe6efa7d658d22869ffead258a41abca6d9d0f06ce799481b3bca365288c0726131805998fd5bff004d66e49c899797
SSDEEP 24576:oD3FHshBIYQgA+sqjnhMgeiCl7G0nehbGZpbD:oDVHeBIAASDmg27RnWGj
TLSH
T12775E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1820-46-0x0000000002280000-0x00000000022E0000-memory.dmp

Download

memory/1820-51-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1820-48-0x0000000002280000-0x00000000022E0000-memory.dmp

Download

memory/1820-37-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/1820-38-0x0000000002280000-0x00000000022E0000-memory.dmp

Download

memory/2532-136-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2532-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/2532-135-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2532-362-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2960-118-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2960-133-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2960-130-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2960-125-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/2960-119-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3144-258-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3144-54-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/3144-60-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/3144-53-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3348-273-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3348-66-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3348-72-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/3348-65-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/3352-76-0x0000000000400000-0x000000000067B000-memory.dmp

Download

memory/3352-0-0x0000000000400000-0x000000000067B000-memory.dmp

Download

memory/3352-1-0x0000000002470000-0x00000000024D7000-memory.dmp

Download

memory/3352-6-0x0000000002470000-0x00000000024D7000-memory.dmp

Download

memory/3352-7-0x0000000002470000-0x00000000024D7000-memory.dmp

Download

memory/3352-309-0x0000000000400000-0x000000000067B000-memory.dmp

Download

memory/4428-13-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4428-20-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4428-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4428-80-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4428-21-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/4720-106-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4720-305-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/4720-113-0x0000000000C30000-0x0000000000C90000-memory.dmp

Download

memory/4720-112-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5180-297-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5180-77-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5392-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5392-117-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5392-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5392-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5492-100-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5492-94-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5492-93-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5492-359-0x0000000000770000-0x00000000007D0000-memory.dmp

Download

memory/5492-361-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5492-303-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5832-81-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5832-87-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5832-302-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5832-374-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5832-375-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5832-89-0x0000000140000000-0x00000001402C9000-memory.dmp

Download