a247bc42bea0a51d6968aec477054181f463426a148168734657d6ad00898d41

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 23:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_c331c206101acba945306b96e063e2b0_bkransomware_darkgate_elex_maze.exe
Size 3.9MB
Sample260729-3vsatayses
SHA256 a247bc42bea0a51d6968aec477054181f463426a148168734657d6ad00898d41
MD5 c331c206101acba945306b96e063e2b0
SHA1 3653b2548b2c3183142a8b91ee351996a60a0197
SHA512 915ec3fc0f774463e3a8b2717177df4374e6ae225014e7bb8d80177cd1fd5acb0fd646fcaf80468e7c1cd4757b98620f1e19030648d391cd2a3a5735cd4dbad8
SSDEEP 98304:ht9dswhwQxn0lcw1qKN45qZbVDGna92m7wRGpj3:hVswChsiGna9FF9
TLSH
T141169D2167D99029F5B30F755A3C666DA169BE310F30E0CF93880D6E1DB1AD2A931B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
3900	alg.exe
536	DiagnosticsHub.StandardCollector.Service.exe
1384	elevation_service.exe
4292	elevation_service.exe
1748	maintenanceservice.exe
3340	OSE.EXE
4528	fxssvc.exe
212	msdtc.exe
2284	PerceptionSimulationService.exe
3360	perfhost.exe
4344	locator.exe
2340	SensorDataService.exe
1048	snmptrap.exe
4272	spectrum.exe
3940	ssh-agent.exe
5108	TieringEngineService.exe
3420	AgentService.exe
4856	vds.exe
1712	vssvc.exe
4476	wbengine.exe
4568	WmiApSrv.exe
2588	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-29_c331c206101acba945306b96e063e2b0_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-07-29_c331c206101acba945306b96e063e2b0_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1ffa591ce52bf895.bin	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-29_c331c206101acba945306b96e063e2b0_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\dllhost.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\spectrum.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-29_c331c206101acba945306b96e063e2b0_bkransomware_darkgate_elex_maze.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101250\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\mip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	DiagnosticsHub.StandardCollector.Service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	DiagnosticsHub.StandardCollector.Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_c331c206101acba945306b96e063e2b0_bkransomware_darkgate_elex_maze.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003272214bb51fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004caffd4ab51fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001602554cb51fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fabd6d4bb51fdd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006c80b04bb51fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000090ac3b4bb51fdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bcd4234bb51fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a5d6044bb51fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
536	DiagnosticsHub.StandardCollector.Service.exe
536	DiagnosticsHub.StandardCollector.Service.exe
536	DiagnosticsHub.StandardCollector.Service.exe
536	DiagnosticsHub.StandardCollector.Service.exe
536	DiagnosticsHub.StandardCollector.Service.exe
536	DiagnosticsHub.StandardCollector.Service.exe
1384	elevation_service.exe
1384	elevation_service.exe
1384	elevation_service.exe
1384	elevation_service.exe
1384	elevation_service.exe
1384	elevation_service.exe
1384	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3624	2026-07-29_c331c206101acba945306b96e063e2b0_bkransomware_darkgate_elex_maze.exe
Token: SeDebugPrivilege	536	DiagnosticsHub.StandardCollector.Service.exe
Token: SeTakeOwnershipPrivilege	1384	elevation_service.exe
Token: SeAuditPrivilege	4528	fxssvc.exe
Token: SeRestorePrivilege	5108	TieringEngineService.exe
Token: SeManageVolumePrivilege	5108	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3420	AgentService.exe
Token: SeBackupPrivilege	1712	vssvc.exe
Token: SeRestorePrivilege	1712	vssvc.exe
Token: SeAuditPrivilege	1712	vssvc.exe
Token: SeBackupPrivilege	4476	wbengine.exe
Token: SeRestorePrivilege	4476	wbengine.exe
Token: SeSecurityPrivilege	4476	wbengine.exe
Token: 33	2588	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2588	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2588	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2588	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2588	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2588	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2588	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2588	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2588	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2588	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2588	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2588	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2588	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2588	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2588	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2588	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2588	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2588	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2588	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2588	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2588	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2588	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2588	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2588	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2588	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2588	SearchIndexer.exe
Token: SeDebugPrivilege	1384	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3624	2026-07-29_c331c206101acba945306b96e063e2b0_bkransomware_darkgate_elex_maze.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 4464	2588	SearchIndexer.exe	122
PID 2588 wrote to memory of 2796	2588	SearchIndexer.exe	123

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-29_c331c206101acba945306b96e063e2b0_bkransomware_darkgate_elex_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_c331c206101acba945306b96e063e2b0_bkransomware_darkgate_elex_maze.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3624

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:3900

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:536

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1384

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4292

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1748

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3340

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3700

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4528

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:212

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2284

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3360

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4344

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2340

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1048

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4272

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:3916

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5108

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3420

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4856

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1712

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4476

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4568

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4464
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 6ff56bbcea3c2ecb78fad209a250437f12767d4402409b335410b5dd7fe16343
MD5 b30261e4e4c41b82820e716dc71567d3
SHA1 e434db0b78381b9278d131dd4334ef012615f9be
SHA512 9142d5ca358bfaa24c78fd420d722cc8196a06965c779d29065256f736c8015391b832cfe5f299ca0a0d5de8675e90e894ec5c6a17e8f7186e6ad7098aa2dfb3
SSDEEP 49152:ob+632BuPkFKRrdE6ohdstBhuXjfS4LWxndLNiXicJFFRGNzj3:C3q6mjBC7wRGpj3
TLSH
T1C2D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 7ee69df4e6157c46f04cb2873512f851f021170f682e5c411bbb239109f753e0
MD5 f28c28cb43e46592c30021a77417c1f8
SHA1 f1818a061d24cf3723e0c6c138de6020a9ffa567
SHA512 4488a6d5236b5147f0870371d2fe72be59df559552b29b6eb1ffff9e7d8e5e7c56f60d615214c067fc1ec05defba4662e4e0fb4167c3e61fd6b8ef2ed6407049
SSDEEP 24576:NXYfDtczA2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YtcHLNiXicJFFRGNzj3
TLSH
T1E875012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 4255ab51419012802328dcc4a306c21ac954ee0bcc958dd8b2393022b493c39b
MD5 10078e28295d0eb3c81443951e3f84fe
SHA1 07cb680eb407803727b6eb8b89923fac85a3d39b
SHA512 29fce06b1c09babd2d0ef5ba4207bdf1f1db6b2dae71f1a456ec834b0e7e21f8b1f34bcc2bd62356881205b9a42af69993308b36e87543192cead70aaff94213
SSDEEP 24576:60Le5ji0hmxhrMF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6Pji0AzULNiXicJFFRGNzj3
TLSH
T12C859E16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 84792eb34a1593c1b1721ff39f7172fb23c101d981b8150b6a881711b9bac1fc
MD5 8fb2900b46be2a4819ebc9ae5e3d9ae4
SHA1 bf503ec6d6fe30a484d3dbeebf7d0bf2c7dee36f
SHA512 e7a0a9c923b8bdb696f286b6aeadad37e6cd860778fbdedee62ea2a323bc79343ea716d06ab69ae397e80c502cbe0e52afc2404edb92d5c78b8ea943d23fe12c
SSDEEP 24576:La7/ezSC6vUyD/aqgrvWj6q8wyu3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:m/ezSC6vUzPv+Hjy4LNiXicJFFRGNzj3
TLSH
T1DA756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 5078f72858ad2eb932f3021cb7d2455f1c9eb16423ef02e7cfd5a9e4bdc001b4
MD5 43807e268748c6306394ad936c900ef0
SHA1 6813ba312ac2909416b939225bd554eac43bbd4d
SHA512 cfa8bed40840a896e58bb0ae0b69fab935f60eb7f9d0fd8958781b2216ce0326125d5d0a1cfb0dd0761f5c5d8d62fe7c4106e08a5afecf7febda55c7a3b7bad7
SSDEEP 24576:XVbqPb88hv/l+By/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:XVO88hXl+0LNiXicJFFRGNzj3
TLSH
T12F559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 eae5ce34d674058b082d2294768832a06b8b817bb5c8c7ef7cdf07d035bac483
MD5 ce07427f102b3171fd68a8dc16bea4e2
SHA1 eae5b88ff9039ada797115dc34af00a0a77d22b8
SHA512 01471f911736068070b8eb634560baee7beb545611aca8940e0afc5a9591d562a3b21cf1e277b59d96e96afe05a616d5d5b02081e6c93113872049ef114891a5
SSDEEP 24576:mGx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:LLNiXicJFFRGNzj3
TLSH
T12C5523D3468855B1FBFD003A867A5828B5845E2CCA595DE2D2543E5EA13CFEBCF38123
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 0a978e240991a4539e4a1f5159d7aa26f92b1685a5a5453883e63f35fb5700a0
MD5 a51f5341bea9dc84b8a2c235ee36db65
SHA1 8f12b8c2787a5370940ebe42ca362c86305b88c2
SHA512 a1a18e49dc6b46843cb69fdd4dcd56deb68e0fef5a6a22861a5f478e14e93d40d23a6ec83c5f53ef50ad123968dcf082a2ecf951ca8ac85db75a9f93a48d753c
SSDEEP 24576:TJIU6/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:TJIU6LNiXicJFFRGNzj3
TLSH
T12875CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 7187f3414c25b4325e10d820d1bcf6d4bf83c1bc0b658ef768196e1354082b6c
MD5 870089ec4a0c67d703092d8f3c844cc4
SHA1 bf437c5a2f149e9edb1a8c45dd4d25cfdd2b2444
SHA512 6f1c66713fedcaeae60ba1760b5e2552e232a02d86bb2701f44bc3f5fe689c18fe6c8b35e4030fe145d38b0fb798fd9334724b5fe72daf7d87fd22af827ee14d
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3TH0:XQvGAdlCEL8c/WRNw5Cn7wRGpj3
TLSH
T15F266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 ff4f8fef43b2ff4e6056410bee677d85251073f6e58f3c6e36269068502fe072
MD5 cd920c38e8def030ae19a8fcaa14482a
SHA1 d8b7c8aba5b1a542e52085e3c766ad26fe90a314
SHA512 fe8211205cff2fb341e43b3aba9835a83e989a371d72fa865af73de2ee486cee54396a3916e5627cbf11ce7f62dde9e60de3156f1e486ad02b1209690c6059c6
SSDEEP 24576:+fewsAjE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:cljELNiXicJFFRGNzj3
TLSH
T1D475E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 e98e29fd480d66cf857b280786b642039f8220572ded6e8050b5c0c41e8a3bdf
MD5 c8a27c132e728a7e844d1b25c4ae344c
SHA1 4a271d274a2d7aa5a157b2de58c0a2b9e95c6b74
SHA512 97294a8df9e5d7c5e222ee946631e256f1ea55bdcc9259d43754cb0c416c8112f09c6708a1eb7505983b35736132a809ee13fc1025f45cc6724f532281277b0e
SSDEEP 196608:PUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJH4F9:PUEtQevvqc2W1cpV20I32M9
TLSH
T1A9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 989f7a8952fee226ca437d4d7edc5db31e6f20ed2020b471a4c09f2ff4239d08
MD5 65ba256b4aba00e0159eff6b773302b9
SHA1 7ff047b90ce6cd581acdd114b30c54b4ab1eaefa
SHA512 3cebcb2a43b93df8212cc5bac57087c2b9f5b60e3649f2a0ae1d24ca0f14dc6ece90eb2071a5ac6c2900730a1464e68b7ae8dace29aca7f4307fe93e509df4c2
SSDEEP 49152:+CbRquA/m2yL5zLfFiV+XenmE3/zkLNiXicJFFRGNzj3:zoq2Vjnmb7wRGpj3
TLSH
T1B3D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 edf5c646109db4467ebe51bb4ee1eeeb67fff5411e9cb15f064bfdc7e8fe25e9
MD5 542f411975a84d19d96fe248f5f7b767
SHA1 010f7192e5162d6143c5e70e5e122185d2d8bf92
SHA512 0c86be77b3f741ca057238a91381289a3ffb39c28885df1b3b859d6f9221dcc000ac3b8cf9b14b886b747b126417543d28dc939f85db2278dcfe056c04234635
SSDEEP 24576:uAhGL6IFoiwtA5l7S537/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:uAM5Foiq5LLNiXicJFFRGNzj3
TLSH
T165359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 8c521fefd65114c8d66f213439a0a5ea50e0e574574eb398ddbf0e1dfc517995
MD5 26ed034a9e07049b9a845d9ae2a90164
SHA1 fb91a9d6dc39facf161021c70d38aebac8a855bf
SHA512 7bc01560f987fa84da8a7b3621bd4585b7f13c6e5572bd9cb34f0f8358852c500ca320ef3ecf6c5ac2ec9ff65029572afbdef7bc4fa70a6b0c7ae2353539b553
SSDEEP 24576:qwuROWY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:qwSOfLNiXicJFFRGNzj3
TLSH
T1ED65F08632940CF9E9BA41398657C036F7F2BC152A21DB5F5360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 81d134f07ec6c140356882c6b7189b201ba5102887d59e44eae28f64aef8f29a
MD5 d1cdeecdf045e1d584b3bf4fa3eb16b5
SHA1 f45b4112f263093025220a555ac704b0d81fb47c
SHA512 4f5fcd4cef4a3c7bf89b8d03a12f046d1b1931be57ea98ae0c439c484828b3c1e04ef8ca351c05056a1042c5ac346921755062c7515d695a4e9fc9774072cbe0
SSDEEP 24576:hZuN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aLNiXicJFFRGNzj3
TLSH
T1A855129622C820F5E6BB403DC9F54504E7A17C6A573643CF52242A6E6F36FD68E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 8a77b2ee3ef4febce0c1b0371028118a0176b6e2e517aed0d0602f4e8361a05e
MD5 8e1850a3570b0d67471a8c678a967687
SHA1 57a23834f8aa14082ea016dcd1e3c0df4b63c72a
SHA512 eb43a50e6f41b54d0aa2d36974fc4065a6640242dd0c2f13a42d468de5fb383b7580a6412998e623e7ff0fe30d03a006cd543f47916847167cb6b40c3f426d71
SSDEEP 98304:FQRQyi36YOcPDLvw2gAf+PN3+7wRGpj3:8QyiKanX+PNiF9
TLSH
T1E1667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 82e09ff5c749a28cb6c50d4be3440062c139959f898edd831fdd3bf4e03d07ac
MD5 1a8f77589080ea73a490f80fdd2e7542
SHA1 bbca1f38437f477d8c0ae54b63d0eb6b128c9114
SHA512 8aae17d3c6e7e6bc324101a8f29f03d5483fbd09c7ace27cca502ddcaefd5b20cddf7091a31149e3f08b1b849c72b274554cee782729fd6f9110ca5cc6388e24
SSDEEP 98304:VQRQyi36YOcPDLvw2gAf+PN3+7wRGpj3:sQyiKanX+PNiF9
TLSH
T1A5667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6d84d7fc8ba7b0a413e470f352e52a5c49d7467169c385d9be3ea28a6491b2ff
MD5 3e71187bd5eb0c9ab90c4f49232a9e4a
SHA1 613700c04f2651ec8b3e4ac69c3d3d059fe69860
SHA512 95310efbc211221138885349c5bb50c6106314f11427f90db8f1f1fd1d1b3dd4e7753360a352ff4534587aa4f19c34b13214b85d4d5d25f69b1cf9cf10f11bad
SSDEEP 49152:c68Qg55nhkeWu7PNU3/ULNiXicJFFRGNzj3:WthTRc/U7wRGpj3
TLSH
T105B54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 66da20f23584d7692f4723d046ef85c8425cce66d5951560338d71029b138702
MD5 26ab670437b7f3211518c7be540d4d2a
SHA1 fe725c0147faee7759ca011dfe059828c9a9a7a2
SHA512 20e2f9d38e0bddb708576a80857156fb834a26d9f2f99e0cab0033ca57f54e2abb765b5f0528c9ce0917c54e9ad6cce73e3ce2e531444338c2fe367a13f5e85c
SSDEEP 98304:Zy5112gYy5azzVvU69nLKnhZx7wRGpj3:0LIHRWhnF9
TLSH
T1D4167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 7662abd14ec4dea2a2b1676f6137825ca2abe59e6e91d90860dbc5cc906311d4
MD5 c5a444cf8f2d44457b506515c2c42c04
SHA1 7ad5c394ad88dea54dfff80c23c4ddc1083a164c
SHA512 02194df54b26be6f41a1b27958b88a4fe346983b50b945027849ff75f7c041e886af62a1c208af5df200451f12afe0cffd5cb4c74c00d816de7b68e4a4ad8aef
SSDEEP 49152:sB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glGLNiXicJFFRGNzj3:mu6JmIxd2dG7wRGpj3
TLSH
T126D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 6a95edc0985e49dc61e14349015af8fad696d2487f44a770a336f81e501eef76
MD5 48dcf475f13b58c7fdb17e8c2926e48e
SHA1 9bcf40272546bef323c8679477ce3eb933a4f1a2
SHA512 e4225e46ed8a68df0acc8b67cd97333f5a6cddf45003a62d3773753e967318957e06cf70a4fec02a0eb8230b999d48c50d77c1920aff8a4e8794646c26076a5f
SSDEEP 49152:Z1hpsNoJpF1A67U44CwH7R4xaLNiXicJFFRGNzj3:ZmifPqRb7wRGpj3
TLSH
T189B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 f74d0d8bcf178ebbac0e7c164cedbe6bd6b76107adab73ee57675ab039d55339
MD5 5475083df67aca4d3cfc32121b67347e
SHA1 70b8679ab25f80b98d6bc9738e787bb796e40d26
SHA512 1816a13b6a9f3b39c209817d0cb1c5a76f7410005b7d3226d830b844b899b81163016edea8a22d846c73481e5c1c7e35ef84a012b6c16edc0358dff421514444
SSDEEP 49152:BSuZQIY0Be2KkRVtOnks6NMHqNLNiXicJFFRGNzj3:P5dKqi61N7wRGpj3
TLSH
T197C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 6d53ea4d2b2785cc2a9270b0d728bd07d2c4aaeddf0db8b97e21075ab9b48ec5
MD5 e9d6af3318f62aad139ee8dae9fcbb97
SHA1 b771723dfb31bcc64475c6c4bc54da826d968778
SHA512 6b0b79dcc4e99b397286732c2f3c440fcb454dcd2e72d9ca55d6c14050cab6a2a4186fa24a29bfdfc22900352a2bf7d9dcb46d83a219461924ff002e5cd93f77
SSDEEP 49152:FhtSn8EApI0figjgiDn0AP5w2LNiXicJFFRGNzj3:0X2iWph/7wRGpj3
TLSH
T1B695BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 ab5351069210181dc315067bcb8d42ee264989985af82642274b34166152211e
MD5 74ac170e073794f201874e7b3ca3f9d0
SHA1 71ff0f244bbf2773ed7b1a04c080fa73739111d8
SHA512 5a3f69ebf9feefa1c62af4f3b531912ac3b73e803c76d15ecff759c1ac451c7e655454d0993edccd5821bbd8939447ed0b83e35506ab7e474076a6f32d267d0a
SSDEEP 12288:6ViJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:65/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11E5523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 f76361df562357a9d889742960a92641ba82b78f5fdbdccc5ad50b553bcddb17
MD5 d1252fe3e9bb410513ec9fbde0278671
SHA1 d16c5276db452f3f32abf1e29b2cf2f84a99e968
SHA512 b3587115f869934a5cbf04fb9c7aeaaa872f322d6d203be69dbeb0a65d4cf32f936dd455324fb8d09764561bcd43daa29316ff48e1a4030257cc1b54cde0bd50
SSDEEP 12288:xmiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:xQ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CC5523D3548955B1EABC003986764428F5881E2DEB5658E3E3483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 73ff9c2afcedbac2f4b6a24b128e9f70497c2a3576e0a787487d550f568a42df
MD5 de1dca5921376c8f6531ec3b4345a6b8
SHA1 59605d56c863f23999768fd9e62f2eecaa4349e3
SHA512 698da30f97fbdf8dd2dd6167cd524fb34d17398f8722e15c18ec59cadc1d6519d4133c62ab3ab7216434a40ed93caaadd82ef4b23a36fedef8668c61dd3d40c6
SSDEEP 12288:kQiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kC/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1C95523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 ae7431eb9e8b662354aaaa24858dc7cad26d91ee2639aaa03fac5db7767479fa
MD5 684c3e5ec9794f4c98b025da8b76b28d
SHA1 09b048974aef105360786d0de6c39d285daa7e70
SHA512 3f36ffce03c856e4295e516aa6aa3635683a947ef1bda7515ccba63ef8690e6eeb02dcbffafad292d08edbbc67b3f7d7683a4c3898c6dd21af5453c027e6813e
SSDEEP 12288:KVviJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:A/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T18A552392168900E1E9FD803DCA764424F2E47D6DD7325AEBD3003D1E5674BEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 0d374c274a034c540cb2c72ccf45b16f33dfcc22b6bc7c551e7ec3f415e5f695
MD5 eedeba05c6a01e3410e11ec6ccbf2a85
SHA1 42b6965d53a88d45e26b0c1aca7b4c99be4ccc2e
SHA512 d29f42d1f47e4fc9063bec66fdb6fc27d64953498de86fab639c4eb1912beff57576070b7b6cffd8fa89590976b9a72f263f8f649c860492cca3eb02e914ead5
SSDEEP 12288:1HiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:1z/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1185523D3548955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 cfd359dc836b8f146f42d02a8bf6f92a9c36ffae72d9e8773fbc4bfa513c6dea
MD5 3ed96670cba2f1f8af54ab7a9bf10a85
SHA1 e52c739acf54002aaf7f3e7bf45ba81f8978186e
SHA512 cd664dc8f4b52d581439a4d0fd2cfb20dc3ade10223aae07ece40448e6e79ea362f96588fbb3c25adc82cc5f543b775d3c861e724a68027606cd25e6430e9fa1
SSDEEP 12288:NKiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:NM/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T11D5523D3558955B1EAFC003986754428F5882E2DEB5618E3E2483D1EE278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 0841d8768299ea4398262ee0d991410f2837c367be0a16b65abd1cfb5d3be5a1
MD5 65c9f0c19fa6318040312875aa4186d8
SHA1 aa70252a0ec43c0718bf407d412a806ef5cc4aa4
SHA512 27effdd4d72f6043c0d0c4eb39353c20ffb479e4b87f5ef50d1a13148a1c99c7a72b1079570f9e0fd0116b31d445321e00a65806b9f3e83137fa49e2bcf65fda
SSDEEP 12288:TeiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:To/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1F65523D3548955B1EAFC003986754428F5882E2DEB5658E3E3083D1EA278FEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 6302ad00c94878a7398f3cf068a92530972371af12b3537b6c747e4cc976a04c
MD5 d1676570deb4563c5bb075c9a6d36163
SHA1 50f7f15cdfc322175de3c50dd6e5efa1e809573f
SHA512 61b879819a1033fca7e7b1dfbfcbe04971c85390bff4b5ecd9ad2f85483ce84287e00e951c4536de4ec32cead56db9c4e8c11af6932f74835093a7664144f55c
SSDEEP 24576:1ZM3zFVSOw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:1ZM3zf8LNiXicJFFRGNzj3
TLSH
T11B750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 4115b7798d31961b1e2e089ec0d69bde146e6feab43b7a7c1d817d7e1df46258
MD5 4da53feacdab72a2bf55f6e08b1e582c
SHA1 43739c9309d64891db68ad332ab81f186638dadd
SHA512 d29614732669fcf7857c26018f64595af3c549c2305bedfa5d5d084c99d682ad7323293748d80b8ed89e631e0422aa9752f10663c9f91e3a28aaaad581383907
SSDEEP 12288:sxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:s9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AF5523D3558955B1EAFC003D86764428F5881E2DEB5658E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 5a525a07182e72f236b812d472ee5ff5036b2923eb5f9e38cf22979cf922e172
MD5 03224cf2754ad00d00f788be8a08ce74
SHA1 d0a3b33d5980246b9b00adb80f2b46a4e89aed7f
SHA512 7bf5e157058ff5a113fbbf7eff124b4e63d7667d8165b5c896b9abdcc976230c9c53a3c7b8b7c327ceb0a7336561a2993c80cfbf4e61ccf63f2b04c87edf3dd6
SSDEEP 12288:s9iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:sh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1AC5523D3548955B1EABC003986754428F5882E2DEB5659E3E2083D1EE23CFEBCF38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 61776cddd9e48affc67e47a9e521810de5e1de5cfa7bff10ffdba8f4b8b4e7cc
MD5 1100e920bb8feb1dbae18548438cc417
SHA1 2be0ee1db509384eaf83bbd365cc0eeeeaaa9f0e
SHA512 d94ce678c730cbfb81c0a18a0e844abd029758966cbc669d7c3beb1121684c5440002848c2f044923e2ec6da29a6ad07278638e9d7e13899324d090442f45c24
SSDEEP 24576:jzy0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:j/LNiXicJFFRGNzj3
TLSH
T1CC650147629530F9E17A8139C9620911F3B17C3647208AEF53641A7A6F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 95543c56c1478c782116e16ec1a1ecc32a3331ebd0c37bdd793054a3b61a0113
MD5 812e1af87ea6338bf80cbf284c2b407a
SHA1 6f89a1e610d260118a4bb40a6d241d5590cac447
SHA512 ffbdb18281aa01905e7421abdf56837af6701f452621c806e7eaf4eddea56417352a25bf6d65f37cd1347b937d145a70e2129b1f914e53760b02a14a05b49058
SSDEEP 12288:oxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:o9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T10C5523D3558955B1EAFC003D86764428F5881E2DEB5658E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 3a6b47c63dbe46945c3b9faa5be40ff05ebccc67cb82d113e86fb45aa524e098
MD5 bb20f50837beaa32fb28e7fa75131144
SHA1 d464bb4ad9aa83417abc4b4c8f18ab0429821971
SHA512 e794949f67f33adcbe8b68f1d2ecd13d06539dd6dee8e8fe1af3f28ec0ad54a8258c57756716267f8ee5e8f19c38681be4367b88e96169f97419b497e9d1be78
SSDEEP 12288:PxiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:P9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1DA5523D3558955B1EAFC003D86754428F5881E2DEB5658E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 d92f2e2b934f42ffe8d0809cc0827e1752d93fa458809b1e89a3c51d114ebc4a
MD5 e4fcdd50bb8461796fe1a6939ca8b932
SHA1 74f769f95b12aac746d3e7dfc3267f9e8bd41cd2
SHA512 4697cb71b3ecbd273bfdb0ccd2e54e44856433e212ca1a57fb4ceb369b56ed193e8f2c1f8584385c16fc2ce63ad2f5210da872101f59de8e756cbdc314f2ece2
SSDEEP 24576:Mzy0/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:M/LNiXicJFFRGNzj3
TLSH
T186650147629530F9E17A8139C9620911F3B57C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 91d676256b57afeadbacd7a3b4021df07066915eb870b02c0ebbbc46320e8e9c
MD5 ef5b188243d22a73f939b5a433eb84e9
SHA1 9d9154e5505cf201a39365516e23831305adb635
SHA512 0aac152bdf0a266b33deb1d93f2be1c5808bf237baa8dcbc1ad60a876338ffbfa0231b6f66790850f6f0fe75e1f436e4a664f2009783d4b1e33907de34d8b3b7
SSDEEP 24576:mT8aLl3z0zDS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mT7Llj3LNiXicJFFRGNzj3
TLSH
T1F77502A5B39018F8EDB7813EC9258815D2B27C1A4770CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 7e2353be0fc48a886850ff80638935dc65dbe1bee2da845c7078a9ee63a4230c
MD5 8dcb0c07053afbc9b1a8b0b42748544d
SHA1 075f90da8a8610f00373bce690d033273eeb9f36
SHA512 147bd1dae074b7fae063c4edc3e5d39f20de02838260d73edce52ca9ebc3564e65909e3bf0bbf37415b095392a022ad45d162332e3916679767151096489fd87
SSDEEP 24576:l3rd9CHKy7GZe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Frd9CHKya8LNiXicJFFRGNzj3
TLSH
T1E985CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 9eaeb4e2c3e4b5b84d03c7472ba27a04e0a48932b8e9de244590cfaf3ff672b9
MD5 273382b8d0755aa6e34ccfcd7f5a01eb
SHA1 73a213a62eeced24dc0d38b2d6c57ab3f14bb4ed
SHA512 fe67edc04d22fcc0a41f1c42505ba1794c9c8d50d31e63746b3d739a4c3ab866192be4a1edf54979af8b175894eb1b952b34b33198b09c01d1ef192119631a62
SSDEEP 12288:owiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:oi/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1105523D3548955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 0c9b21a9b35a8c43a349ff38c5ef6e4452fc8e80232982f26bdbaf0ebcfcf9c7
MD5 a7c6024aa70d984c94c0d01edfa4551e
SHA1 13e9f15f41662a0b24d8957601f5173887d59564
SHA512 a9a74d70b54747f03d700a08314ab84e881341458c20b2cd100a3f581d00f6fce5dca806b736caed6db2002bde623f7d995f01a1ebd0412f577aede4add6edc2
SSDEEP 12288:ryiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1CA5523D2558955B1FABC003986764428F5882E2DDB5619E3E3483D1EA27CFEBCF38076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 0ec0ce600a281d983e6d540b8adce89e6d593f6b47c952d46f2c6e0602cfac68
MD5 586a7b237973822238ddc163a3922cd7
SHA1 cc6e0002f374dd62890cc6464dd287c63d2bcbca
SHA512 23dadfa370614f80cc18617d63baabdfefebd993fa248a7af40d7532803207eaa21d517ef26e85ff788dd9f958b2ce08df38ff821c19515314aaad4139d4d7bd
SSDEEP 12288:F7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Fv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A65523D3548955B1EAFC003D86754428F5882E2DEB5658E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 08f5b8324f493c63ebf48a2c3b301602707cd6fa5f43b3b69c19dbccbf5836bd
MD5 e09a8680d7528e330de896f266290881
SHA1 70876a316992366a4675eeadd50383b2a8a2b823
SHA512 df615a1077226a20a5ea80501fb71171d663422bce7896a8f814caf59d169bfc6196720edf8cfc240a02f87f8c7e6f4d0e496ab1d88e641cc8ad1ccd503f36d7
SSDEEP 12288:2xiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:29/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1705523D3548955B1EAFC003E86754428F5881E2DEB5659E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 e48b57bdccc46f4015dc20b9b99261f3d3c1f8a3c098a64ca2bb60a4427eef22
MD5 b093ed07593b3b0109d7e06441eceab7
SHA1 12355a72045f0857b4080e5fe100eb0b02fcb7ac
SHA512 5fe9c344d14683ea713d851351712d5b5883eec011b4182d12d419bb022dc77a3acc082f03f2f159f9fb0ed5f68025da4ec7e6f9b4a602d5ff21261ad8b3708f
SSDEEP 12288:0psfhiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:lN/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T19F65F15AD28802E8D1AE5139C7664900F3637C2987E1D3CB52C0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-29_c331c206101acba945306b96e063e2b0_bkransomware_darkgate_elex_maze_PCULog0.txt

Path C:\Users\Admin\AppData\Local\Temp\2026-07-29_c331c206101acba945306b96e063e2b0_bkransomware_darkgate_elex_maze_PCULog0.txt
Size 646B
SHA256 faeb6155acb7d6bc867c13fc334698e70fee017bc0181dba9bca38ac77ee9f5b
MD5 56bdb642d1e28e06ca15aa2db870c57a
SHA1 dbcc641d957b8b6a18a53cb89ca75c37236a26a3
SHA512 4fe3a48b024c8e5d710ceaa63bfcbec2943fe85a7bcae10865571c6f05b1601405f96485eab2b03de58466031ed12a979372d6e2a8f54447141d38fe8487b749
TLSH
T17CF06842A1EBED0129321652DA1AFEC4E3ECF29B9796576427CA791B20DE01F60E7C04
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 6d701cca8808f3943109166278af0452be452b0c23c19f8ccc6168c3ef21bf3a
MD5 b7445face4ce8e564258bb485502d41c
SHA1 d302b710a0add411523aaa09a44eff0de2b00339
SHA512 ec85915e407d397974372751b9e7f9946c90f01e5bdd2c1a78ee21a769eacaee534420371549a03e20a5a075d46ac4e633d5c211a3bee50b067fd449ddd45a5b
SSDEEP 12288:QGiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Qw/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T152552393528C55A2FAFD103986758438B5497E3C9F5598D3E2043A1EA238FEBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 1eb1bdadaea82f526ea38b7f45419e5c3f352ddc9795879e821eafef6f9e23c2
MD5 b6aa9766c942cca22736b4dbf70667e0
SHA1 cc09ef108c2f2ea10a6f6d937a97940f092bcef0
SHA512 9dae9c6548ed912111cdbb219d4bd1ff1c5da473baeaa82610322da76c91777c766d5734c98834a454db7804a505847313f9f3bad4bb0f19baf6909d32b73829
SSDEEP 49152:Za0h2GEkuAe73q3pp46zwwQeLNiXicJFFRGNzj3:Za0hNYG4JwZ7wRGpj3
TLSH
T14185AE1E67DC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37EE84E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.3MB
SHA256 f17fd9c43f89b77ef9deed4b7f93a7602944465b9f5149c43307141a4d906db8
MD5 83fe647b60228e3960b1b7f5e3beb05c
SHA1 2ce5ac93cefaa11fbd20a0b0bc29d514c2631426
SHA512 d230cdb423cd93793d40c2ada75d8f256a745b491bf67d7d8b750fedde9f386919e9c51f8c348cf1d34d87ddfc962540e93a5ce816c4499592647c3c23ea6e63
SSDEEP 24576:/hbHjPp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/hbHjxLNiXicJFFRGNzj3
TLSH
T14B5512BE129C20E5F6B5903D85668409E370BC29172197EF6381527E4F3BFE94E38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 1baf7584b153aeb95c95bb1239827b539f78a27c0372194bff07d3f5f9e776d9
MD5 b3daeea989948a3da3a1dfc239dd4aad
SHA1 e79ddd67b8f3a9ead950e10e06ac54a4e6e4ef45
SHA512 0923fe88b5053697a27fb6d760d340dbed5a3ead760bede25524ce56d64dfcd5b2059b5947aa91cc9f1f71e06446d34da6298f94e47e7aa0354aea8f2c5fdbb5
SSDEEP 24576:b3YgnJcRTk4yti+R5dBR/N/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bIgnaTk46pBR/NLNiXicJFFRGNzj3
TLSH
T15D45B02EF2B910B9D8AAD136450147B5FB71782D1F209AC70170C538AF1AEE89F39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.2MB
SHA256 8f3e79aaa9c5915668130a1b06a9c0d8912904bd4237d52ade0c236c95265085
MD5 a2a7919576f701880955de84517c3391
SHA1 fd5313e231629d6c762cb9d1f57125872259434d
SHA512 94a90687c9cb98376dcff38266dd25354e57bd008f8f75fec5d307562ed3bec648e71c6699159c5a64f8547019b1207e31f89b86fceb986c1e7827c955ead93d
SSDEEP 12288:a6iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:ac/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1185523D2518955B1EAFD003D867A4428B5842F2C9B2619E3E1543E1EA27CFEFCF38167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.6MB
SHA256 3006dac0aa28eb9fbe68e184ed2b6ecca5c04f72e7744a04129c70cb6d815ea1
MD5 501b46822c3cfee69e322e13b494ea54
SHA1 abb8e91b35b84c1f3dc28efe7c3e54cb817aad79
SHA512 688ce4cde5e9e17e3a01f28ccf801488b78260aa48c975cd62ab1becf4513354efe456f927def5abb62a06ca69070f96e3154f236d82987bb4c7ee5c8af3b8ed
SSDEEP 24576:BAL3UTT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BAL3UfLNiXicJFFRGNzj3
TLSH
T1B5750155E79400F5E97B813CC9728916E2B2785D0364E7DB03A84B6A1F237E68F3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.3MB
SHA256 24ff9c2850b09f340d6f33f51bc921706af6c97b76a21c4ff27f9b82f0f1c5bf
MD5 9e8599ed571c5f30020ae2b80c553768
SHA1 300274f2625546b16470442132652e4cc1d06676
SHA512 9ad0a6f46ad0caa6fa2dd9e03acdc275a53cf5d729ee15130ab5a97d344302bc8e2b1341ca95b161da7fb00aa3cc7b561146d21a6b264577785c4717dec1d894
SSDEEP 24576:2O//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2O/LNiXicJFFRGNzj3
TLSH
T1CD55126A32DC10F4E579503D8AA2820CE3B1BC29072257EF4290557E5F77FF89D39A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 1af5fb3a9414eed86d3ae49d1366bd3b5be9fbc2dbd9bc7ea31e5d0d0dd048ab
MD5 95214f4075d9315aa2c3b0c9d1d0dcbb
SHA1 5925d98d0aea97a0c6e455d1eb5388aa6b1e0d07
SHA512 3ab89937bc498fa76078a843be37bae297fef2b22cac9d6e874513312f1bc876ff57631bbabe0b69f913033a6e99b7f6e8bd50f3c749c71109d7ba8f7c18b01f
SSDEEP 24576:57NM9YqZqmWMUkPjZM48Mv6bEhsA/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:57cBWMpPjN8DbEh1LNiXicJFFRGNzj3
TLSH
T1ED65AE2E6BEC81E5D576D13DC9A28205F2F1B8611B318ACB5162833E7F37AE44E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 d21698e7e82e4c70bfdf6fa5e7aa5b17796fd449b0b5c06d8829161e1729b785
MD5 4dac29173cc801839ad321ad85367ad5
SHA1 19e92586a177f7106eabbf24e5c8e43bf00de273
SHA512 abf724113c401e0be143f275e05366517a5ff3a7e52c905fe8209c60fbf18528846385bad4685e675114c7a35abd5425cc477e529cc045dcd130da83883d3145
SSDEEP 49152:vF2YuHNETovAvNYf8kmgLNiXicJFFRGNzj3:26BCf8k/7wRGpj3
TLSH
T15D858E6A27ED80A4E0BBD27D45B6D146FAB2B8511B3056CF0255862E1F33AF44D3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 973f094924cf1ddde5b23fe1437170a06f645c42096b6f0d8b380a2e35f8db05
MD5 1c893719f208fe81476727ff32889ac7
SHA1 fa7cb60443e978a064fed109776b2606e8aea6fc
SHA512 95bd2b90bff98e0250b8bddd243660450e6a1d89d33dd3145a314ed065904b443075f34584b61005ec4967db065e142be6d081ec4b04d7ab160bd011ceeec55b
SSDEEP 24576:bAFs06+Omlf8NXEbTo7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UFs060loXu+LNiXicJFFRGNzj3
TLSH
T17065BF2F62EC00D5D07ED17D8A97C91AF2B1746707255ACB0260863E7F6BEE85E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.5MB
SHA256 65c799cbe1f3319a80a3bb24c10bc37cfb76ad8f9582f5a0d8cd51a7242615c6
MD5 80008bc432a23cd4ae57e3fee5596f87
SHA1 d52ed062332dcd9c5dcbd68c63cecb91e44a6591
SHA512 dc67a8494d3c2657766c4aa65cb08ff1e51d672ac0d7368c1f30a591c8f02526c9decb087d8b46691bd4960aab5e344b060782b758db80c86a88e7e5bd7f5f88
SSDEEP 24576:8JnJ5D3WX+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:8JnJ5DGX+LNiXicJFFRGNzj3
TLSH
T10B75D02DD29810F4E4B7C274825A1A55FE72383D2F226AC724B4E5357F22FE09A79F14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 7abdc02065a2537076123fb59ea19edc1528c25eee492553bca48eaa4dbb3905
MD5 1dc6b131f897cf15ba60b5617fc0d557
SHA1 48fdccb6a93412b3cb59170d00e5b2b6703e69de
SHA512 2340486a075437181dfb1809ffd0d4875bbf62acff1b792677cb7663bc22f7173b73cf10e0c8ca960c8af8a4ccbed505b90eea8ccea39d8206aec4589123ca10
SSDEEP 49152:ag06DIKdwc+eQnSt65aVELNiXicJFFRGNzj3:zS7wRGpj3
TLSH
T1B7956C16B7EA5294E8B3CAB1C962A5159B327C509B34F7DF0AC0C92E1E33BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.3MB
SHA256 67c9731b8d9fc4d9c6ba1b5afb93d46d3c8cb93653ce113abe7672504fb3f65d
MD5 9a33c675f3a4e430a94da74da69c2919
SHA1 387d5822a1299cf873a09ceb3e3e847e9ea7f391
SHA512 048c228487f80ea16a583e633fc80832379ce814063ece43c8d2dbe8488ad1d33aafa3ea31036b80de047acacaafcf08d94b43f9ed325e436695fee803bbc17a
SSDEEP 24576:onW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:onWLNiXicJFFRGNzj3
TLSH
T1825512AE278C70E5E57A903D85618504E3B1F8345B1227EF5290963E8F37FEA5E3CA11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.4MB
SHA256 78dd74d99d30945d406a030a0193094a94f0aceb1c661e83bf85b3dea3080bde
MD5 69810f2c9d3dac1168c0b72c64fd340d
SHA1 9e16fcf6ba9036d87c040c7103870f9277b53c2e
SHA512 b8227540c12966b64eb0d1d8f79b4398fcca87743caf6d76ba2acf77474d0e84acbf92a6bbb8be4b31721152ba335999e6478893bf277ded04686495044159c5
SSDEEP 24576:VIyF/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VIOLNiXicJFFRGNzj3
TLSH
T18A65124553C860E5E6B9013CCA778064AA74BC349F2156EF9180BA3FAF36FD59E34B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.2MB
SHA256 56659131593afa61a598d8fe35e515921a8045780706ea70e01ed6e02005a02a
MD5 1c223952c8b2866bfd6393a8127a4938
SHA1 f3591b54301a12a3f7d5aa7064c13b1d126bec4e
SHA512 0068f4b23f59806e81bf017a2b84aeb110473c98c5b72a5dcb086078dc20ba5a10865947da30c9ceb150d3a62f251399849dd1a62babe9b78fa5f9b2abff26a8
SSDEEP 12288:Wy7iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:/v/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1175523DA118964B1EABD003D86354824B1943E3C9B1628F7A1947E3ED379FDBDF38852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 7d569701caf13d98a840fec8dd0c477ae1082ee3a00f1bf779adeb6312415d9a
MD5 bbb920edc24e722864c7cc00b9ed75b5
SHA1 7a7434fb4f5d6712c02a9b28e2f02b9042f82149
SHA512 2385f7e11ec9b9dc3f17fcab6eebf9329df211dd2e2deac4b34f7c6a84a96529419a814f03ef78f7768f5753169dd4f597a09c9ca33b1ed4a82113b7b42a114a
SSDEEP 24576:FQ9MxZKdcz9dw3o/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:FVKZoLNiXicJFFRGNzj3
TLSH
T15A558D2DABE9059AE177D239D5A250C3A673B4311B31D6CF2048D03D4D7AEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.4MB
SHA256 1013af07769c2b1cba873a49bb583fafb3eb4501942edab253f418a96f4432e9
MD5 4dc1eb60e5a019a4731f7a893ff786ae
SHA1 35f25193d1fe6047bd7438ecf412f8ceaecd4f95
SHA512 678154f663f059877721387d79dc1c54de9e65fa09bbfe0d0909e370a522c96eb58830304f312937b0b4f55a3abb2d3a02a775887f950dc69ff620b1c6069a73
SSDEEP 24576:JyocDAph/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:kocDAphLNiXicJFFRGNzj3
TLSH
T16365E05FB76D40A2E176813C89858204E7B3B4345B6257DB6181C73D8F37AE9BE38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 dd652005182a120899e80ed3caa73ac528971e7061a7153ca52ffc19184331f8
MD5 a53de010bf6c290943d328a1f3ab68d6
SHA1 2364edae4b7f2e2c3772808cb94ede9cac793af9
SHA512 9535fe7500ee00577955e09db14a4bbeb2d37b0e168eb1ad162e5516068b7c9f9f58eb777855d622a78fe8d6d6800c27ea82062c78eb8f7bb7e6b1f325c68b48
SSDEEP 49152:yWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKhLNiXicJFFRGNzj3:k0zuNIT7wRGpj3
TLSH
T101A57B3DA2EC00A8D9AAC379C54513A5EA71742E3F2055DB01B0C57CBF2AEF19A38F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 0b57fcd14d047282d51670215b26b9a7bf3a411d69e85d8bcfc291ed12aba5df
MD5 e3f97763223cd5fdd4516c28567052c5
SHA1 84eaa1d88a9553a962ea55e01e0988c8847c9663
SHA512 544f8c0bc8f6526d2283c35a224eb3f4c9035e7bf910ef4d7124ce8350e67b0f7a9443449704b1058d7202aa252dcc4bf4920138a0b8787cc6b21877ebcf0a4e
SSDEEP 24576:C1QT7EcpfxR+N5AWAz3ooiYzjMqbW/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:fTDxR+N5YzTBjMDLNiXicJFFRGNzj3
TLSH
T11C55B02EA7F815E5D1BE85798A23C512FA727821033193CB42A0C17E1F7B9D85E7AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/212-255-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/212-324-0x0000000140000000-0x0000000140210000-memory.dmp

Download

memory/536-213-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/536-39-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/536-26-0x0000000140000000-0x0000000140200000-memory.dmp

Download

memory/536-31-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1048-342-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/1048-291-0x0000000140000000-0x00000001401ED000-memory.dmp

Download

memory/1384-242-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1384-44-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1384-53-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/1384-50-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1712-329-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1712-458-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1748-67-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/1748-75-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1748-77-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/1748-79-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1748-73-0x0000000001A30000-0x0000000001A90000-memory.dmp

Download

memory/2284-260-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/2284-328-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/2284-268-0x0000000140000000-0x0000000140202000-memory.dmp

Download

memory/2284-266-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/2340-287-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2340-418-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2340-339-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/2588-557-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2588-423-0x000000000C980000-0x000000000C988000-memory.dmp

Download

memory/2588-366-0x0000000001A30000-0x0000000001A40000-memory.dmp

Download

memory/2588-350-0x0000000001790000-0x00000000017A0000-memory.dmp

Download

memory/2588-343-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/2588-415-0x0000000009E70000-0x0000000009E78000-memory.dmp

Download

memory/2796-450-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-452-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-460-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-459-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-442-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-443-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-444-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-463-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-445-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-446-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-447-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-466-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-448-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-468-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-467-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-449-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-433-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-434-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-451-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-455-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-435-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-436-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-437-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-464-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-453-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-454-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-465-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-456-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-457-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-428-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-429-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-462-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-430-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-431-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-461-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-432-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-427-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-426-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-441-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-440-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-439-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/2796-438-0x000002306E030000-0x000002306E040000-memory.dmp

Download

memory/3340-89-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3340-83-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3340-82-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3340-244-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3360-278-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3360-332-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3360-271-0x0000000000770000-0x00000000007D6000-memory.dmp

Download

memory/3360-276-0x0000000000770000-0x00000000007D6000-memory.dmp

Download

memory/3420-322-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3420-320-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/3624-0-0x0000000000400000-0x0000000000800000-memory.dmp

Download

memory/3624-8-0x00000000008D0000-0x0000000000936000-memory.dmp

Download

memory/3624-30-0x0000000000400000-0x0000000000800000-memory.dmp

Download

memory/3624-1-0x00000000008D0000-0x0000000000936000-memory.dmp

Download

memory/3900-23-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3900-163-0x0000000140000000-0x0000000140201000-memory.dmp

Download

memory/3940-306-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3940-312-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3940-421-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/3940-314-0x0000000140000000-0x0000000140259000-memory.dmp

Download

memory/4272-300-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4272-302-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4272-294-0x00000000006D0000-0x0000000000730000-memory.dmp

Download

memory/4272-417-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/4292-243-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4292-56-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4292-64-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4292-62-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/4344-284-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/4344-336-0x0000000140000000-0x00000001401EC000-memory.dmp

Download

memory/4476-333-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4476-539-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/4528-251-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4528-256-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/4568-337-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/4568-556-0x0000000140000000-0x000000014021D000-memory.dmp

Download

memory/4856-425-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4856-325-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5108-317-0x0000000140000000-0x0000000140239000-memory.dmp

Download

memory/5108-422-0x0000000140000000-0x0000000140239000-memory.dmp

Download