9130a5c72006eba1108010446ac33ed0428169157704a3953dd80f723f87a217

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 08:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
Size 2.4MB
Sample260730-kxdlbsvclf
SHA256 9130a5c72006eba1108010446ac33ed0428169157704a3953dd80f723f87a217
MD5 3612cc71db63fd2510f36d18b37f517a
SHA1 97e6bc54699c36c1dcbc7975f3e2095ed3cbba9f
SHA512 29a314755672136c87dbad36213af60eff6c90172d49e37db986ab019aaac7efc16fda491ada97730261d66e68632f2dd164cd246d35c4a30526377b090bfab1
SSDEEP 49152:opJkc9/Oz5WCgmbWOcjtFgmTah8khNl1KfoQ1qftvCtlsxtmIzVBQ/lFTjN4:ogu/Oz5WKb+jtaSah8kz0b1qftKtlsxD
TLSH
T163B5BE3275D08077D53357315E9D772CA6BDBB710B35428B23D42E2E3DB0593AA28AA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5112	elevation_service.exe
992	elevation_service.exe
856	maintenanceservice.exe
2792	OSE.EXE
576	PerceptionSimulationService.exe
2020	perfhost.exe
4820	ReFsDedupSvc.exe
2264	SensorDataService.exe
1396	ssh-agent.exe
5352	AgentService.exe
3032	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\6a0885c0763f1d8f.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3128	4748	WerFault.exe	89
4344	4748	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b10767a40120dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e93bbba70120dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f21266a20120dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006b9c2fa50120dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\explorer.exe,-22000 = "Desktop"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000673e97a50120dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
5112	elevation_service.exe
5112	elevation_service.exe
5112	elevation_service.exe
5112	elevation_service.exe
5112	elevation_service.exe
5112	elevation_service.exe
5112	elevation_service.exe
992	elevation_service.exe
992	elevation_service.exe
992	elevation_service.exe
992	elevation_service.exe
992	elevation_service.exe
992	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4748	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
Token: SeBackupPrivilege	4820	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4820	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4820	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4820	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4820	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4820	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4820	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4820	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4820	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4820	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5352	AgentService.exe
Token: 33	3032	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3032	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3032	SearchIndexer.exe
Token: SeDebugPrivilege	5112	elevation_service.exe
Token: SeDebugPrivilege	992	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4748	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
4748	2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 4304	3032	SearchIndexer.exe	101
PID 3032 wrote to memory of 5092	3032	SearchIndexer.exe	102
PID 3032 wrote to memory of 2108	3032	SearchIndexer.exe	108
PID 3032 wrote to memory of 2800	3032	SearchIndexer.exe	109
PID 3032 wrote to memory of 4632	3032	SearchIndexer.exe	111
PID 3032 wrote to memory of 1192	3032	SearchIndexer.exe	112
PID 3032 wrote to memory of 1240	3032	SearchIndexer.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_3612cc71db63fd2510f36d18b37f517a_bkransomware_darkgate_elex_maze.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1468
  2⤵
  - Program crash
  PID:3128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 1504
  2⤵
  - Program crash
  PID:4344

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5112

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:992

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:856

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2792

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:576

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2020

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4820

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2264

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1396

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5352

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4304
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-189034102-168398478-1159367937-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5092
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1760 1756 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2108
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2580 2568 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:2800
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4632
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 1760 1756 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1192
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2580 2568 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4748 -ip 4748
1⤵
PID:1876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4748 -ip 4748
1⤵
PID:2908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0875de7f3c60fba0bde4bf5c28a077f82d44c941f91e34a6a55cf8cd1356c549
MD5 7f8203096d5d48adff697667b4a99c29
SHA1 cb32772cb563dabb1cf6469088015c9cfa29cc83
SHA512 44a28eb0660e00cb931ecfcb2c74c7543748e4acd07254d02bc872c2e8b60459bde298d7c3435e557d0d1036379cd4a4cb60c1a027e5f2ac855bcd694a8f58f9
SSDEEP 49152:3b+632BuPkFKRrdE6ohmstBhuXjfS4LWxn9Q/lFTjN4:l3q6HjB1Lm
TLSH
T189D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 63ae29a75d8c14bd3e7798698618a37026a9238d960b882bfa9cc1322e95eeea
MD5 00eb7e7cf43bcf0c7c565d8e20948354
SHA1 c4a9fbd104e66de407f5e95f39115069f0c0e577
SHA512 a94977db03f65224901f60cbe3c51483603abeb502f3a8aca186c0dd54cd9d41e5fef9af4054bfc4de8f4e64cd0d439a8f810beaf67e583cb07454ccfcc6b2e1
SSDEEP 12288:I1XLsswWkxy2lRq2czA+GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:uXYfDtczA+nQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1F765F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 a1719beeedc279b15d773600083ad0190231c3e1dfe55bee2aa280fb54735707
MD5 9514513599445983a6508d32a313f2dd
SHA1 9e0e56744b8939bdb2c7fcbd30a0cb3eefdf59d3
SHA512 5a46187abfd82ecd0770de1e2d84ab24509c5d2f0138953d3a43abd1c761a895407fff9c66f411f691141968e7302b7f6bc23804a9021f53627d0604ec2d4dd9
SSDEEP 24576:i0Le5ji0hmxLrMFnQ/tbw/2Mkjy6Fr7g0oJ:iPji0AlYQ/lFTjN4
TLSH
T18D859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 91bc6881dd6b576707991b78b1d13bc756c703eaeb1a49e925630d912abb0c8c
MD5 c5ee355b5f3881076d2ce20d940834e9
SHA1 368e0e5d7f761f4f10192cd84766fff3f69acf0e
SHA512 85b4260e84ba8fa3c14707e28ddd8531607d1c3ec1e78ad7eb8cd7b1d09807b4c296eaa432569a54a7081527cc7e0fb53e5e0d93d83c5916b330ff5f8f76b85e
SSDEEP 24576:Ea7/ezSC6vUyD/aqgrvWE6q8wyurnQ/tbw/2Mkjy6Fr7g0oq:z/ezSC6vUzPvxHjysQ/lFTjN4
TLSH
T160755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1a76201e1ee4abedf89c634ae6505f0893e0f38fe1cf94f25d5cf84bac46d84f
MD5 2f3d71d93db93b0f6192b2144105e7d9
SHA1 9bb0e83ac495e765e79f8d6a21b88459f164b481
SHA512 bb590665767c0edfde454258ee2736002ed2274412c99628ffc35108a804afb90bcccc1cdbe492f4be4fed0a8f6058399ebdf25d134d49c170acd6662c9bf73c
SSDEEP 24576:VVbqPb88hv/l+6KnQ/tbw/2Mkjy6Fr7g0ot:VVO88hXl+JQ/lFTjN4
TLSH
T1B3559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 f5287131b9f7ef43efd72ec1ec4f4e2a758ef446a3f588b47398104c7eeaa3d9
MD5 a94c40373bc957a153dcedb696baeced
SHA1 3016c6b3d66f57093d02bcf7c7a8edc0c29f8887
SHA512 cb406576854e2fe0a079a47d5395326a189e0bc6a742d2b8138c34f4150ddddcf461f026bda034d57c8781cca6d453b2c61167a6c25efdfd1af012fffc257fc2
SSDEEP 12288:PzRGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:PzhnQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1435523796A24F897FF2B06B55C8284826B7B0EC1BFD4E74E6B44322D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 99ccaeb4a7bb468b1db1075324adf64fcc31f77115a3641b581770bb69a6ac0c
MD5 1b6a3e9caa9c7fb7a30ec044859f0a21
SHA1 6a64bcdeb6125291700600dc486c0014305d0464
SHA512 77be71d82f8f21088837fb7fd53ea29c16486bc565f6057010412e02fe56683db3325b32b134eebf95150e8e8c61a7d5de7d9f988031d9594b24400dc7807299
SSDEEP 12288:5eBNUbTVO86USGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWT:5JIUSnQ/tbw/2Mkjy6Fr7g0oT
TLSH
T1CA75CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 17c500f0c3ec05f5091d265a86cb13812d3469f6eeaf9c54fa29571e52ca1bb4
MD5 6314d761923b0050218aeec97515124b
SHA1 c9512e413fa955b24fe355133ca53f7ca238af7c
SHA512 b94fdf16659b252b9d5ef59ad304b693ef8637b2bf65d409e9d5fabd1dc2163d612d3e013bf95c4696a549f25e0753b2cd6f55693f833cc2efc1919ea9be2c4b
SSDEEP 49152:/QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THY:/QvGAdlCEL8c/yRNw5CwLm
TLSH
T18F267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 bb4183fba73f416403e92625010a889733099a7496f1e0d071622b03be7d54af
MD5 98c989853efd6b5e38c39e9bfb48dade
SHA1 ebd34b0ab5d97ed51c8c00678c784b60e1946749
SHA512 124be0d3ffe5052b193a88ed839743ac86457f46c82ce38846471902eff29ce32b508124f13435018197d79a19cd65cc8d53d698193088d83712d5e8c99e0cbc
SSDEEP 12288:AAwSfxL/2Dc39DLLmt0LDQewsAjoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgX:VQewsAjonQ/tbw/2Mkjy6Fr7g0ol
TLSH
T12B75E031FE74E436C77F0DB61B22C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8e9730d6c839f523142eb28f3ec5dcd0db47bb058b8f02ea67c96a510e52817f
MD5 47aa50b9115a5f2098c7e023a8dd17a5
SHA1 e5af584eb4962587a4caf17ad97120e6b2d90efe
SHA512 dff7d13d404ccaff692c462d82752f775591b64015920f111b41bb5280bc1498a7b05e923cf97c9b296743d782ca2d8362bd9cca905163f76177942e82bf99d1
SSDEEP 196608:XUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHzL:XUEtQevvqc2W1cpV2EI32
TLSH
T1B5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 554a7439effe7cf12c941035af96bdd5587c910d96dfb705e8f6f43748012528
MD5 afb2768461228628f43e8f84d23a55ab
SHA1 5c108a70586f1006e198eccfa3626d3e1c0d35b8
SHA512 4ea5743b35689e938f99bfb353c4792ea11f7d00858610dca97d7a6ac07c0566a3ad3ac23a53ba9c14048965edc76ef6c55d9939302fc353039053640bb278b2
SSDEEP 49152:kCbRquA/m2yL5zQfFiV+XenmE3/zIQ/lFTjN4:toqtVjnmELm
TLSH
T1F6D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 c988ddebeb92279f7a4739b21e5d368ec9970e1c6bf4b924fe047480cdf1b3a3
MD5 95d9f719f9c33e9463da80d4f1cd0f63
SHA1 c74ea185b7536fb27d4be210dbf42471c405cef5
SHA512 78cff66733efc1b9e5472a2abb3698e1e38c109ee1b25ec55003bd2b93272bfff512da83c8e1110924888ddc7f852b5373d50aa91ae0937d63f0930dad450a62
SSDEEP 24576:LAhGLJIFoiwtA5l7S53vnQ/tbw/2Mkjy6Fr7g0o9:LAMyFoiq5fQ/lFTjN4
TLSH
T1DE35AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 90adf4d8d7c437c2dffc22e8b2431efe58be102243c65b0e9621e0c62e60e698
MD5 2aa602a1741dcf0a20b5bbb2b8437660
SHA1 d5be3211f8040e10b645a0c84306c8d99c0ebfd3
SHA512 0d3158ae43e6e2cf6c2833929b19672232e5a653c997746b5cfc3654efd589cc57e2a249e093a92f2af63088c328dfd01016997cb299a29ecc9f01d085b1b78d
SSDEEP 12288:omw5HEjsChN2BFgl0WDm+CbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMR:FwuHOWMnQ/tbw/2Mkjy6Fr7g0oA
TLSH
T1F765F14A36A45CFAEA6742388993C136F7B3BC422A61D71F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 dcbe622462c42a5080ec94a456005f22a02f1d82b0ef230262a250e6cd32d060
MD5 df642a8cf99e06f485b9ac0b25637019
SHA1 f2dadd577e61e45341dbb051f3058c2346e22a11
SHA512 0ba8fad587463f85bdf231fbc478e163290b5e8d149e09580652bd9e74bcf63f0e8f115210eef852fecf2eb31dd6e8b011dd423983ca5308f253b5cf50b02496
SSDEEP 12288:OXZ1Iy4GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:eZuNnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T15355126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 2e3b9a26f107607d291f98c7dd5003ee7f68008e1c0136af86798de428cf0627
MD5 3f61e920ef07bc4e3bfddf380dff035b
SHA1 b201b5f19c28b36aa9320e51bb3832a8a797d5f2
SHA512 2886862792ebf1614b73b8b8a4477752b45657ede74cf3cb195c47f9c16223c8a8ba31a835d911757238a2778c20b51fe8288ef94b81056ffdd94acb381b0800
SSDEEP 49152:Bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U8:IQRQyi36YOcPQLvw2gAf+PN3xLm
TLSH
T125666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 c6600f7d983637706323740998117f80fbe237f6625d85cf2d8607641069c0f0
MD5 e1325aae9b52a28e8a0d58e9680db437
SHA1 f6104df75a3d6ae2dccb3058c24b694fe5a57d4f
SHA512 9b314a215c41ec0c525c9e8cd5b55dba7bb4f339939846c2d3fa96ea81c9cda551ac46f4a687fdcc21c2faed9239a3167ea99c6c9261550f7a3790febbfaf492
SSDEEP 49152:yj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U8:xQRQyi36YOcPQLvw2gAf+PN3xLm
TLSH
T189667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 7da7777e5202dfdaf3ddaed45795eb5fc0aa275dc7918efae5d81530c902ee92
MD5 4eb317b2ad08885717cfed4174ba1dbd
SHA1 fea9c0f91f86c93daf8cedd49b2ba42f884609bf
SHA512 fdef56eca1ed08d11d56d75362be742f7afd6e717f75c550faed1aedbe9947874a2097262cd65652e867652bd4b74715de324dd05963b780b2cf08ce93ca4222
SSDEEP 24576:TwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL09nQ/tbw/2Mkjy6E:r68Qg55nhheWu7PNU3/YQ/lFTjN4
TLSH
T134B55A33B2F600A9C44DE1769F46872196D27C758FE0E3DB8505721A1FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 b9345331898a54c6e7691acd145489e4a5221e7983f9bd5e2e7d9b14717247b0
MD5 06bc1e66405b7875ce3ba71133510ecc
SHA1 1f81ceaca421e943e34c7e425aeb44d422635601
SHA512 42fe5152472d2b07038b841f0f00d051037268a0d7a4f76d58b6bd4e185a968a2fc847340931149ac64401468db0cba478b162fd5681eef00a39590998556e6e
SSDEEP 49152:p3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99u:4y5112gYy5azzVvL69nLKnhZGLm
TLSH
T156167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fa757f8fa7c5b278a206f3c9ebb7549b32a8c6aea35a1af3ad1b00a5b7909451
MD5 6048d7dac6dc0521d35b9fb7a78e27cc
SHA1 43e533ed61cb0a9d04f893e58287879426eda23e
SHA512 4809edd7850a7e86591b51dde90dc459472d136f960314abdbc3e129402ed06c3a677f6085d752a92552721d2648bab5b3a413352e5c8aa32b6dcd3f6643aba6
SSDEEP 49152:tB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gluQ/lFTjN4:zu6JmVxd2dJLm
TLSH
T157D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 9b45d4e5ff39563a099c012aa36542d1c34625d34808c9b89d481a41ebae541c
MD5 8408f7bab59a5da70678937fd0eaaab5
SHA1 62e43e2f0514f37026500b5fbed5660cf620be1e
SHA512 ef908390cd3f26036cc49eef18bd2812d48312f65cd55b688ff65557a15bdbd887b878479bb2170e4b52964cce1feba01dfe9b680f88040d91e5fa156bf5b315
SSDEEP 49152:c1hpsNoJpF1A6UU44CwH7R4xyQ/lFTjN4:cmifPbRELm
TLSH
T126B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 4852111bb96d65d67e76671559853bc19a2a7bc75d1177053d058f535c30b039
MD5 5f7078ab02ac399e7046a0bd74bd6a90
SHA1 4fca8cc488bc16562fca0339ea741e14d3e900ef
SHA512 fc4be0260eaa6b9088b20650450ca05a7dc631620ec722624aa27ffbc4f7ae8047aef2f423daf43e77991702d13c5fd3cf196f5c27398a3fb34aae8305d9b979
SSDEEP 49152:uSuZQIY0Be2KRRVtOnks6NMHqNQ/lFTjN4:g5dKTi61CLm
TLSH
T1EFC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 aebf33e4e48492aea62e15c1c6ef77f5a8e65b62340c0881633e4d84d9ec8fbc
MD5 3d2d328b92d50abba7aa70d215b1a190
SHA1 7cd13eea9441cfdbb5e6702ab4ad5f93d355cf2a
SHA512 b7e5b397a4944ae6a5d7d1f96be30701fb6b4d16408c27fde2eb20068f885353e34cf25aa6a55a552530a87f58362ca5299c122257d43414eb956a2c77e19ed3
SSDEEP 49152:zhtSn8EApI0figngiDn0AP5w+Q/lFTjN4:yX2iyphYLm
TLSH
T1EA95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 68d50daf5855cb3bafc2884f921dcf13575dd7503c1aba14b2a3ab86f2e7ac43
MD5 0d791f67a1b728c6f022bc6bd709f8a4
SHA1 abcc5394d4e1a8985cfe598800c73b9330aa9b63
SHA512 654b1ce4ccbdc722ea869c83e3515023e29794c93ccce4d87563cdb0bfe322ad2bcd5953fd352bd03b0cef5588650be606a10c196d72bfa10582f2596927a649
SSDEEP 12288:+5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:+JnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1085523697965F98BFB1706F188828182A73F0DC6BFD1938F7B482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 a25dc981bb4a88972342cff3c5ba1d3bfad06fac7e96b7937b28ea2d4301f6eb
MD5 bbc9b6dced5cb5e1d311070eaced115e
SHA1 0d6ee90cd093ddedbc4fcfba6fdaa2781c61a2cb
SHA512 942dabfa96fe85bd9dc17bae76949f8521275c69c548a3c905122247901752b2e8434101ea980d0214e1fa4edd06bab1587e8d8eba3c4500b4b40ba36a24c625
SSDEEP 12288:WEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:WknQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1CF5523697965F98BFB1706F14C828182973B0EC6BFD1A38F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 74b389ea855c79b5226d6df021bcbcc13d086052f1e50d9624c207bcd9119901
MD5 8a4942f3f8c8dc104035cfb03c1235a4
SHA1 8ea3ee1e0a66be1254cd810c08271d6f923c2c63
SHA512 51cdde2a1b0d513cb265a8c5f06942e62bf6d1bbdba4ead67011bf8a833dd4d5529d65e175b4538c6976a3687fd0c1893c55a05e1c6dd3708f47833c6b9a934d
SSDEEP 12288:y6GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:y6nQ/tbw/2Mkjy6Fr7g0oA
TLSH
T11E5523697925F98BFB1706F54C8281829B7B0DC6BFD1A38F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 c1d134755d68eb3659c6aaee003c2c544efdadebc6b3adfd9bb45c2f282f8454
MD5 763b9eb341521512c17be338635d2e2d
SHA1 9b8404a93b4e5a28c86c946e33c67de916d823db
SHA512 2f8a3ff0f3099176c3c575962fa4a5c44af7358f29f8a797b715128233e8f4089d047767ef99b810577043b1c80fcb22a26d9bc52e95d0963125bff7981a7f5f
SSDEEP 12288:RVvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:LnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1725523693A69F4C7F92742B4CC938142E77B3DC5BBA1A3CF6B04111D4E793D419AAB80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 5e04569422f60bbbad75274e8ddc1e66b1ef6cabf820ef457c052a4ebaf89c72
MD5 c1aad18b54fea32fff10e3adb0530ed9
SHA1 7f048019005986b3741162230a27930cd2394393
SHA512 5c550c8cb88d0d38914dec79d1956aa8712db35030070a6e1d602fa513e702ef2023fe4035b7eee9136dab95c523df5677926f26a51634f21c0a6f337399d20e
SSDEEP 12288:3nGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:3HnQ/tbw/2Mkjy6Fr7g0og
TLSH
T1775523697925F98BFA1706F54C8281829B7B0DC6BFD1A38F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 38995bac9a574004f842534640dc38634e565e0a9a2c7f8cb9743f7287fef372
MD5 ff9b77856d270735a826317e377c3855
SHA1 15d526adfc55e016ab8ad7633128e025f3b36640
SHA512 3311d627abe145cc02edb4539acd173dcd4ddba810ef53d7a11bde5b1afa5f3575c68b4463baa76bfc56198d1003561dcce4bfe16ec672a42339887f370fb07d
SSDEEP 12288:xQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWS:xwnQ/tbw/2Mkjy6Fr7g0oS
TLSH
T17E5523697965F98BFB2706F14C828182973F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 4830412ba77d99a4b5fc8ee1308e8c7aefff548b869a93c74af956931fd3241c
MD5 df585559a8cea962dd2ef3cb327ee264
SHA1 87c9941ac4af92ea714b08e4ae553ad4cbeff4a6
SHA512 6e55c0b7b6ede1e3a96960f277ed3d41ec53c991a4341f418574ff57e47c9bd7878ebecae18a191b02b874d252f64060167189ad22934378448ff681f0c61637
SSDEEP 12288:u8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWy:u8nQ/tbw/2Mkjy6Fr7g0oy
TLSH
T1625523697925F98BFB2706F14C828182973F0EC6BFD1A38F7B481129967C39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 d00216b59ac4bc188566a107d099749fe4daa89834804dff72b2a154f947567e
MD5 19648a8b45e2d272cf76397f0aa6b437
SHA1 f7b66c15b750a7d11f7885ed7c3758585b32eea5
SHA512 801ef74e967a62d665ce01fb2507f0f9408d80074c829ebd67ce6b0bc55a3691a3f068ee98d1e3211e6984183261366b3c7850323c7c337f380323cb94951665
SSDEEP 12288:viZwbDzzFEoS2cPvykGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWV:KZM3zFVSOEnQ/tbw/2Mkjy6Fr7g0oV
TLSH
T1207501A5B35058F9EC67427ECC528906D7B27C5A1BA0C71F13A8322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 b93c2c4a7ced37b1065dbc1f6c0692aa41116ce6ed011aac2cbfed8ae42c0bc8
MD5 beabdd40db392a7ee2e4014d1bd7da19
SHA1 45adacf84ffe09c88794dc22912d74c7158dadc7
SHA512 9056c9e8d20119479b08599971de712fc29922aea62efee551f79fcd82ff97e78034b4f30dab2fc150078b0d328199e78c99a1df7f03eac5681ae8d6ab0bbb7b
SSDEEP 12288:y9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:ydnQ/tbw/2Mkjy6Fr7g0oH
TLSH
T14E5523697925F98BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 af21994a4b015111a9d24a73800e20958b68aa56c95ebfc61510cb944e5d8c90
MD5 9d9b0497f9dff949b54adb4f9eb7c156
SHA1 a2e82a87a428ed98f44c65feb00f1796f13b97b9
SHA512 87d713d0d7755a7fba831e5c93fa28eb8fa50d7e841ce07de288ea5b173e18b8d08a786d4d2203783f858e03f08dd47a6b10f8221d9a0803ab414e0dee65f2b9
SSDEEP 12288:ehGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:exnQ/tbw/2Mkjy6Fr7g0om
TLSH
T1255523697925F98BFB1706F54C8281869B3F0EC6BFD1A38F7B481129967C39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 a25172644dcdbd654f669c52d65854964401fa7fb3b4d26acc678fac77100437
MD5 7eb26c584e1f0412f40c6550300fb000
SHA1 a98babb7056a4dfd0eb8ddee9fa812e477e7b7b7
SHA512 50a0cebbc1a74ba3ac1744211db68b63a6b8ec467530bd4380d202bc67cfd60e03c706b9b7860bd9bcc8df5bdc48831029166775be4bd5aa728f47ebf0b153fa
SSDEEP 12288:YyPz5L84GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWG:5zy4nQ/tbw/2Mkjy6Fr7g0oG
TLSH
T19765021777A170FAE537427888920A02F77678725B609B9F2794037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 9a0e5b069f354dc92a8028f9eeb56fa7bd54f46a007a12ce6f4c09e68081910f
MD5 319121cc76cda55cbe3b876a659d2f8d
SHA1 c5889cc4f04c9e0ed425596c7b2d8a979c386ef0
SHA512 02caa4756f8187a4ccc2c418192d4857207972dbf4efbce8f1d2bf15bb3ab797ef3666fa451c8147227ffeee418c41b4bca3120fc033339b0878c9dd32eba00d
SSDEEP 12288:r9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:rdnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1655523697925F98BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 252e03e18eea24f6e2c8fc013a00efcd1c5f0b3a4328a6188c9be1b0b1aa8c69
MD5 d3154fe7bb8da0e9bcdbc7906b266410
SHA1 2d7328dd83c7d9553f0d3f4f346950785a7364f5
SHA512 d3d2182412da1e599e963d9bdcb565678721f92941d9f3f96736b5fd8e40ea3ddc58dc531eb7fcbafaa21e04df20ff6a343d889e281be727dad6011eeac50f6c
SSDEEP 12288:E9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:EdnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1AE5523697925F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 b9beabc4490bdbdbc328d305ebee5c76a8cf33b3949e895d299f01c783924abb
MD5 8fd824706ddc0170d51e2024389049d0
SHA1 e4be9070998efdd3b1a6721a560158f65d5e2937
SHA512 86ea7617176bcb982bd9ffb0655d687c42b53ec287b525971e03047d6009e22c1a5e1aca085dcfe4d702a9817a066b71baf05cbedf1dbb5ebcb07c076ffa2ad1
SSDEEP 12288:zyPz5L84GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:+zy4nQ/tbw/2Mkjy6Fr7g0om
TLSH
T12765021B77A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 21f82f88251048ffdd19255a4e866b1ab384ff00a1ee16be79e4601dca3799fc
MD5 9fe749854d12debed71da3c39a0de22e
SHA1 66ac9c5afd464d6d7209223aa7ce57780d3504b4
SHA512 1e2e8704acee40bea173f1aa07715fa2281c085a57bbe40a2c9871e238f5478e061f85ba171ce190b2596c6fde6387350fcc5138c395ce131938a997f3e0dacf
SSDEEP 24576:NT0aLl3z0zDqnQ/tbw/2Mkjy6Fr7g0oK:NTDLljrQ/lFTjN4
TLSH
T1407501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 2a9564bb4ac041dccd13362c6dead8d26c063460f08fd3fd78656555d55e3aca
MD5 d095c0665b85e94e61660e70cd9a6420
SHA1 6c2106bada3d66a0327d3d7288099cd4bd027372
SHA512 ba57a563897865b717361794df0c1503edb226d279d1cc5263137a171d9fdf023208a0f0d9b096c1c81d5dac024b82a1e1f0830516aa713997dbdaf3bef8bf5e
SSDEEP 24576:n31d9CHKy7GZGnQ/tbw/2Mkjy6Fr7g0oP:31d9CHKyaAQ/lFTjN4
TLSH
T11A85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 390ae29f9ea94e43a3e994a614a38c72a2fabeea56f522e41919fde0739038f5
MD5 5c509bc692dd05c205852d7b9ace9c49
SHA1 d74487daf94b699bcd94f92337acce0f3c2cedbc
SHA512 55466c704c8cd48f0f9bb93b867ec998bc5a3e088aa8022584ffc5986fa50272c1b59079c82f79ad7d350ca15f46c463e9275ca07abac6482eacbb71207d8387
SSDEEP 12288:vaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:vanQ/tbw/2Mkjy6Fr7g0o2
TLSH
T13F5523697925F98BFB1706F14C8281829B7B0DC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 e740dede33a6b11f219895ae2536618e674d8e7f30fb9258f7bc4da0463df7c0
MD5 2e03785d5a2c9cbec21e14a9b16542f8
SHA1 60d36f374ca62e620f27ae9414fa67532a678697
SHA512 130c055eab489d703b9703a83fafcdcaedaffcaa338fe3ac38a84e368e1afb7e5ec73cde910956dbc11d79155ebd158130c76ca436e4e99222cbd456016edd35
SSDEEP 12288:CYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWk:CYnQ/tbw/2Mkjy6Fr7g0ok
TLSH
T1645523787924F99BFA2B06F54C828182977F0EC6BFD1938F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 c9d16d9aafbea3b970033d0133a1511756e667869d8665aba453079f69f1a503
MD5 1f585e8246449794e6a4b3ab704364e3
SHA1 3c160e53826fa47fe7760fb041d2f2817a1e8ab4
SHA512 da9a31af084c1ec6907316a8e84d377e08cea62b846ba1054bdb421bbc8def7d762222b2db2de07c49cdc2a5eafa521439c6b9454e19436e649fc01e7d63fdac
SSDEEP 12288:wTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:wDnQ/tbw/2Mkjy6Fr7g0og
TLSH
T1B35523697925F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 d370558781d446a245fe9cbc97878d12ae271c770fec8f169ac780eb525b5967
MD5 313be9ca4169b5d98a994eefdd74e7b6
SHA1 f3e0f50703b22dd42ea7a70e97b951b714f50c08
SHA512 7d7104fb310017986fb0287889a8c2cdf048009ad5d84e91a3fd81f207a7c83ce091dcceb28d64fdce83ece2537c14da56693b0b0e612ed563e1cbdb2d8b5c2f
SSDEEP 12288:W9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWa:WdnQ/tbw/2Mkjy6Fr7g0oa
TLSH
T1655523697925F98BFB1706F5488281829B7F0EC6BFD1A38F7B4C1128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 47e4915942536716d438c6baa6c41bdd99d685525e9b77e81ea7c984a2c9c4ad
MD5 3e1a544c4d36ceac4c47f72873698562
SHA1 11522a3d9f454ea951c9fd8c0757f700d3b5b0a5
SHA512 cb5d6b1711e040d940826bc56439892fefd2a3b1047ba9ba1b6ba0fe0bc03905c210a9dc7e8ec1a5a01154810ee81ccb375ca5530a6a5c8b7696cbd89393099f
SSDEEP 12288:aaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW+:aanQ/tbw/2Mkjy6Fr7g0o+
TLSH
T1E05523697925F98BFB1706F54C8281829B7B0DC6BFD1A38F7B482128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 7bd7ca7ab4c80fae4eee2aff8be422311001cd82089d26eb29bc2927d4eed212
MD5 33545936ac18c5d7926484789da0bb48
SHA1 423be1cf5ca77ebca5c33e443eadd147be8eecaa
SHA512 7c7dfc3aa97b00e35f888b55bbb3053ac8df3c3886aecd3e5b4b3f26c824af3c90f7575777606d646a8966202f9e9f89af1b7b686573bdf90e19ce879a96b6b6
SSDEEP 12288:bVGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWH:b1nQ/tbw/2Mkjy6Fr7g0oH
TLSH
T1BE5523697925F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481129967C39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 544e4abaacf6f5fdaf20bba7e3a24e30c07ff88eea5088225371868a15fe3fbd
MD5 f74cbf26b2790068f0a9fbd63f614a1a
SHA1 ee950dccea5e4c03e53cc84d78f8c1412fc0698a
SHA512 26564f5ada6de67729dbf2e10c3783f2c3dc611bae1e2b64163e6d9f7326a3b7de4b25a237a3ef7712f542c6de8ced8875931cf06009f73c4b7faf192277c7d6
SSDEEP 12288:snGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWO:sHnQ/tbw/2Mkjy6Fr7g0oO
TLSH
T1C45523697925F98BFA1706F14C8281829B7F0DC6BFD1A38F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.2MB
SHA256 30ca6ef7f18e5c963e28c12058fb1b96cd4a9ae8bfc3f1982d5b3204d85d5cd6
MD5 f2841e52ef8e7bf5522308c237ad1bdc
SHA1 70eabc0471938df979f4dc04666ababfeae91f39
SHA512 42f80b48d71cdfbbbb409c5236bdb0f1704299b6217cc46dcedce08042ebbc57a99b820ce3180b910a2abe911bbd4b778b33d8f2c938573e619f1c292a87c324
SSDEEP 12288:ZiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:ZinQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1E65523697925F98BFB1706F54C8281829B7F0EC6BFD1A38F7B481129967C39406CB784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.2MB
SHA256 08fd73699b9a96abd4056e62cf9fddd0e7636ed758105b72310870d0ca3362b2
MD5 0515417d9c612061f15cf3c12bdde826
SHA1 8a0e7ffa56a457e53d4d321adcebaa4a86e8d6fa
SHA512 1ca9ed49cb5c3c25834e7bbdf61dd5dfd2c4af423dc4dc571c722b14ea510638cda2f37411be80ee327e774037e5e562110006bb934d1fb766e91cbe7deb8986
SSDEEP 12288:cnGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:cHnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1695523697925F98BFA1706F148838182A77F0DC6BFD1A38F7B482128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 e77247970e826a924d5790f0bb38c7744b68c206ca0b5e45ba9ccdc798028c67
MD5 c0d884d6057e487e6de226b72ac6db28
SHA1 0f309c529a0a050b780371367c9d5cff0f9cbdaa
SHA512 27f984a764f2d4c044303b5264c6458dd29f45ac5096db2f96fa79eebe8634078ab26d4010c874181b0c001f9c4f1bf4001e791b5bbfd625d90aea9d41128e1c
SSDEEP 24576:Cfwv/k9RX6wkyAIBnQ/tbw/2Mkjy6Fr7g0oI:5MnYIBQ/lFTjN4
TLSH
T18F85DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 fa2060572254f54a4acd5800273a0c2c1e556fa5c6de3787309487d241bb28cc
MD5 3b0904fa6a264bc7c567806e950ee99b
SHA1 a261a6ee3b414e64739d79b85957eab3c06eb660
SHA512 4e873480c26ac88ffb5ef5b439724fe52d0fbe6e085a8ad63887d92433d3778cd8f944ef38b0e4b1bca6667d872ac62a7cf2150f9a8fe66953c4a362f7467ac4
SSDEEP 49152:gYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0eQ/lFTjN4:OySzPRLm
TLSH
T13D066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 7e45570131ea663c8618605dff9729cf2be5be1d868bc80311cb4067437cecf5
MD5 78023063e1bcef846a47f317579f6b11
SHA1 2aabeb857e541f28dc09c92a825c5b850d273a5c
SHA512 3d101d732cbf409b87f58ecdf3bbf7bebda06b027db43b07c65252e38f2c9633211a2212f518ec66a95cf5964d548f0b7742b7d69c85620d71ac11cc3332d7ec
SSDEEP 24576:+47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYUnQ/tbw/2Mkjy6Fr7g0oI:+47JUQj1irIhCnDHUPfF/uQ/lFTjN4
TLSH
T12365AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 e99baea6f77efe7cdc6d5d55a3e81024789488113c7c1ad9096ad2c0e134d8f9
MD5 06bbcd8f4a8bdd2ab3bf03c214df8cd1
SHA1 360b60cb3062654f93c22bb985e920292f4742af
SHA512 4615373391167a5e43fba5c87e0ea4aa4adfc6fa135cf54d9da14a10abf73d58a567b754105abdb0721811a06bc9a6f3623632fbf405390f734bd9ed92f43213
SSDEEP 12288:PssftGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:jNnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T10F65F119E29852E9D02E5279CB424641B3373C9597E1D3CB67C0F53E0F7A2905EEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 f2a6a229baac008383738d93837957689bea0351e83c4b16784a022c96663872
MD5 3359b508d1ef6102222bf3e71449872e
SHA1 3bde6607b2488e5182efff7b4e98b9029b01e795
SHA512 32f1258dcf677046c6ba5eb20d65308ffabfa1e908f6abe386dc941fc866dcda394e7bbec2d14dba9a5aa47a07e9a035c7b811144d8181bb8967bbe7409c28ea
SSDEEP 12288:2oR+U3fo14c7gmhHoTdtbjrSBzAO4McN6fcaRMxIC01tU+o:2okUPi4qgaIpdSBMXMrcaRMx1+tU+o
TLSH
T199352951766AC75FC6A940325E33D1CCA7707C01FE45AF0773C88B3F8576669BAA2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 5574f17c6024e48ed8710cf202e8cb48095729636b99732091daf8d6c4106722
MD5 031175c5c59fab4bd50701d592d5e723
SHA1 ac8fcfd5bbaec59f97a14d9d17e762b17b47f2c2
SHA512 8b9ce2b4596f8a50d9cf6e35562505e12cd1172639d951e02e4545b787650dc968e40cb8fbe6194784daff1947b7557e0f0971584ccddc3e3658f2ebb0638a75
SSDEEP 6144:oMktKWbgk6u2TkTtIxt7BhhGg50wxkKMytMxG3eXlMytMxTJ1NucmvE2504ARftV:UbgkoTkTtM7KE2iBVtV
TLSH
T19975FA816537E38FD1FB6072032A5B8CB764DC06B7456F6273C8453AD82AB65A0BD3C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 c938ef3a28c7db8d0534e8eacff30f3324542c12db11b1af97d380a690ba306b
MD5 1481692f694ec1e2887f110906c1b83c
SHA1 2404512a18ee6684686fd2b7ccb0f184c97ebd02
SHA512 bbd8118fcce30925d5967b54e1442036805856fdc7810770be5cd48789d6a3aad155243de56baace458cdaefbfebfbaaf2d2e1b36ce0a8c10a696dacd4de46ca
SSDEEP 12288:u67FGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:hlnQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1735523756668F94BFA3B06B448928111673F0EC5AF90D3CFBB082269957C3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 5aa9402a901518a232f32a7d25b76c8616127d8f7151e919a0003c9144377565
MD5 1c04523aff1f0ab26ce1237994f39536
SHA1 cfbc4bcbbacd7635ba63237828ec0f3696c1d2e3
SHA512 2dfb00e29bda52221a730e447dd8aefdb06061c8692669b6dc0b4f934cefd4608c1f78d3c343db0cd63b914b65f74788328ae42d5490b19d876649936ccd804b
SSDEEP 24576:Rgb6bmBIi49WNNFpg1rSvFv7bYrnQ/tbw/2Mkjy6Fr7g0oR:Rgb4mBIBhGFUQ/lFTjN4
TLSH
T10C65AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 1e8c5d593878698dc4f642062e4b835229c11465a3b6e23550c22cd586079398
MD5 c66251df73c6fad26551eb3458ae506c
SHA1 9464a3c642d5f5f05df28ccbf1ec066f003ccef1
SHA512 8983503829e7960c2bf4a192fa5c6f392d1b39d248a19a30b2be2b714b87a4e31cc4004533640d884509203ed72b0a4b224fb0b4db488ad5affd3a51d9805a6a
SSDEEP 24576:zG88u8FpJqH1Qzria7/mEnQ/tbw/2Mkjy6Fr7g0ou:C7ZFPqVva7/jQ/lFTjN4
TLSH
T1AF85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 3feb5d6fe61ca39ece142ec0342942cde88fcd65cecef2a70d74afe29eea044f
MD5 9c832432f5ad042c9bfa2b294044a2ac
SHA1 a91672826bb00cd6108228bdb8db308d05daf55b
SHA512 74dbeaeff1602238350f071c5334eccfa8c59baf7a18add5089896e11013e2bea73af6a91bf6c567578d05a14fb5684650688d07a2a4b503281545e7845275d6
SSDEEP 12288:MHvUrBFrEjwaQgGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:MPUr+NQAnQ/tbw/2Mkjy6Fr7g0ow
TLSH
T14E65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE86D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 82fbcb5d4746f1a56160e6bc57ee6befdf9b3626845d8f0e627f4c2bf658801f
MD5 b32c2c46b5a38f036d60479e43fd513d
SHA1 049c71d623a5110ee5ee1bac07c4c547e6ed8e9a
SHA512 d13253c9b8505b8fe65fa835a1152fea194c143641f1ab174a67ec917b5ee6e73acfab3b71331c08e344a33ceaf80d977aab87b6f68f993c1c8da18b81f91846
SSDEEP 49152:/BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjwQ/lFTjN4:wG05lO43bOLm
TLSH
T1CED5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 32613675e671296fdec909104a629d1397cb62a87801b7d82cf641946313d028
MD5 faaba29a34e1af55f0e00bdd99110d3b
SHA1 14ed43c9bce507f134fc969707d82e22a0a324fb
SHA512 e726d0ce86b6fbc28a52b4fc49113b113d278b4a8a4adcf896f1e6a481608ffe1287a129be78cccdc20f272e44add435040608db78e60468663802c61af17ae3
SSDEEP 24576:kfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnenQ/tbw/2Mkjy6Fr7g0or:8a5POZ3+Jt2pasx2+mYQ/lFTjN4
TLSH
T10065AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 9f2cc453ea7edd918a72ada2a23a4cb403083eca3f7111bacd1733b69b18367e
MD5 a7152ec4d9c99d26d824a5406c225c7b
SHA1 6933285dcc18c831c76b2fde46b0b55ca1f8ecb0
SHA512 9d6941e06c256a843c81f53301f5a1288946fbc1de7cf40ad4a1980bab32e3d86f79ea47c230c6aacf214925be3cbd9f830e07fc4f6979edc9a151e4364df0b9
SSDEEP 24576:0NcwHdjbyQ4nLC18lb/EOjowL7FksnQ/tbw/2Mkjy6Fr7g0oy:0Nc/zEOVHFDQ/lFTjN4
TLSH
T17F858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 00ceca7e091eb7ced61a1cb509a13c6d17cbd1aae204d805f33c950e62e31094
MD5 229cbac58389bd783cd0c9909b6749f3
SHA1 eecb2de372808cc3de613bdb6a80ead5c99074f5
SHA512 8bfb56736dff2f22a0cfb89b9a9850e29df17afe2b901e31c8523ba85391a3fe6036b09f7ca77bb228a89044e6f446f7a2592d1c5e971b15737c4408db383ef5
SSDEEP 24576:I8kNvNnaFeYhJNtmZBminQ/tbw/2Mkjy6Fr7g0oK:I8MwBtOmiQ/lFTjN4
TLSH
T1CB55AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 2a88d5dea6168ff3c9b06f8c980d90b1f69a2b813e917285424798b2b5583f77
MD5 73c1a7c272cb39e6df769ce5e3ca0bbc
SHA1 7478cc02c6d5b8d6fa5caa744574a1074d235a57
SHA512 80e6a02a59aeedef21a1f94d75807989b0c115aa3270259c04183c0f4dd3aea1fd3a17c57093ab82ec8c950ecb5d953fa999766ffa7bf0631531cccac2ae3644
SSDEEP 24576:TD3FHshBIYQgApnQ/tbw/2Mkjy6Fr7g0o+:TDVHeBIAApQ/lFTjN4
TLSH
T1D475E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/576-292-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/576-63-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/576-71-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/576-68-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/856-37-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/856-51-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/856-44-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/856-38-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/856-48-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/992-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/992-33-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/992-25-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/992-111-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1396-113-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/1396-114-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/1396-120-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/1396-320-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2020-76-0x0000000000880000-0x00000000008E6000-memory.dmp

Download

memory/2020-307-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2020-82-0x0000000000880000-0x00000000008E6000-memory.dmp

Download

memory/2020-81-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/2264-106-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2264-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2264-100-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2264-366-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2264-367-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2264-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/2792-53-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2792-277-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2792-59-0x00000000007D0000-0x0000000000830000-memory.dmp

Download

memory/2792-52-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2800-410-0x000001DC96E90000-0x000001DC97013000-memory.dmp

Download

memory/2800-378-0x000001DC96E90000-0x000001DC97013000-memory.dmp

Download

memory/2800-377-0x000001DC96AC0000-0x000001DC96C8A000-memory.dmp

Download

memory/3032-368-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3032-141-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3032-148-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3032-140-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4748-0-0x0000000000400000-0x000000000067B000-memory.dmp

Download

memory/4748-314-0x0000000000400000-0x000000000067B000-memory.dmp

Download

memory/4748-75-0x0000000000400000-0x000000000067B000-memory.dmp

Download

memory/4748-7-0x00000000024F0000-0x0000000002556000-memory.dmp

Download

memory/4748-6-0x00000000024F0000-0x0000000002556000-memory.dmp

Download

memory/4748-4-0x00000000024F0000-0x0000000002556000-memory.dmp

Download

memory/4820-93-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4820-95-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4820-87-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4820-308-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4820-383-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/4820-385-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5112-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5112-13-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5112-20-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5112-86-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5352-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5352-125-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5352-131-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5352-135-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/5352-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download