c0da59c1b4ca5955cf44a96a0ef842c97a807553208c1038b60d8b817c264cc7

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 13:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
Size 2.3MB
Sample260803-q1vxnsae48
SHA256 c0da59c1b4ca5955cf44a96a0ef842c97a807553208c1038b60d8b817c264cc7
MD5 f617e5ea2b4c9cd9a2d5534106aed5b1
SHA1 c38bc9534b51ca53cc1fc2a8a490451868319947
SHA512 fc49e7bf76715c9b77aaa4f85397aa7be553bd867f71fea641ca27b336184b3ac6e312517e8c971d07252d90d9cdcfc73aac7fd7955e422266112916bc10da34
SSDEEP 49152:Sf3ZoG3UCj5qzWt2skmzb2R3NBHCYcMpCqy+Xyzmp6IvLNiXicJFFRGNzj3:6ZP3UCj50WtQwb2R3N9cMpCqy+Xf7wRI
TLSH
T190B5BF31F590807BC67317718F9DB36863ADBB710B75424723952E6D3E70883AA39A63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4104	elevation_service.exe
1476	elevation_service.exe
5344	maintenanceservice.exe
2420	OSE.EXE
4816	PerceptionSimulationService.exe
3500	perfhost.exe
3060	ReFsDedupSvc.exe
4024	SensorDataService.exe
1964	ssh-agent.exe
2808	AgentService.exe
4456	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\43cc3346e62f061e.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c335cd095023dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000aa9115095023dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000195e75085023dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
4104	elevation_service.exe
4104	elevation_service.exe
4104	elevation_service.exe
4104	elevation_service.exe
4104	elevation_service.exe
4104	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
Token: SeBackupPrivilege	3060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3060	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3060	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3060	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2808	AgentService.exe
Token: 33	4456	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4456	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4456	SearchIndexer.exe
Token: SeDebugPrivilege	4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
Token: SeDebugPrivilege	4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
Token: SeDebugPrivilege	4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
Token: SeDebugPrivilege	4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
Token: SeDebugPrivilege	4104	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
4580	2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 4720	4456	SearchIndexer.exe	99
PID 4456 wrote to memory of 4404	4456	SearchIndexer.exe	100
PID 4456 wrote to memory of 4332	4456	SearchIndexer.exe	101
PID 4456 wrote to memory of 900	4456	SearchIndexer.exe	102
PID 4456 wrote to memory of 4864	4456	SearchIndexer.exe	104
PID 4456 wrote to memory of 3924	4456	SearchIndexer.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_f617e5ea2b4c9cd9a2d5534106aed5b1_bkransomware_darkgate_elex_maze.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4580

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4104

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1476

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5344

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2420

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4816

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3500

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3060

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4024

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1964

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2808

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4720
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4404
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4332
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:900
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:4864
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3924
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3060 3068 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7f812a3aa7794764b5479fe07dfd9a51376a4160d8f3bd6adac21d54f26c1a02
MD5 41fe45e0d92865c99d30bce0768d2b2b
SHA1 f17f8ffd7e03e6052b4548b2954ef69bb2759a47
SHA512 72f8bd7070c257e627286f7f057177255044cb223e5b67c885b737b3fd3924638cc61e34713a407f9bb787a8f104c3f64beeb73bba8082995f80e441dafb634f
SSDEEP 49152:cb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnyLNiXicJFFRGNzj3:G3q6mjBJ7wRGpj3
TLSH
T15AD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 8e67ac5217f83af4fe7e4a93375b0cd6271333b974a6d33fc385d7e75c5a6188
MD5 bde7246a7ea900fc462ec659698b04f3
SHA1 5eb4f34cc879276735fe367a8d8f653cd1e2645b
SHA512 d7e50e1cbea5f4f75160bbc4cad70a8a95c9f92b9bb38d3cfd6ce0eb7a020be0a41e9652829c449e92f50a34069bd79423bbdd28d5e86dd1778741f177f97a27
SSDEEP 24576:SXYfDtczA9/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:5tc8LNiXicJFFRGNzj3
TLSH
T1A875012963D408F9EDBB813CC8B28411E6727C554760E7DB03A4A92A5F337D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 5a5d084849a3fb619eb674b17a068ea596a5a5acbb7f3fb0d5f52111d74b8120
MD5 8e9c9c88342b984699aff38924c9da24
SHA1 eada675b458121a8821f88b56e2af5f8934a726c
SHA512 afb3f58cf8166ad9cef9e64c863c7ddabbc69b17ad3ceb0159b5f53e0abed12639e7c1ab8520f1fe0e3c884769d0332d8b81482de121ac2c3fd03fafb028d0ef
SSDEEP 24576:B0Le5ji0hmxhrMK/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:BPji0Az7LNiXicJFFRGNzj3
TLSH
T17485AE16F6748331D073C0B9C5D2A69EE97130865B308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 d9363e91031d28997796d50b6fe206a443f6ace3ca82e5d11dba748d689f7cb3
MD5 e4331ebf3a66dddbf31acb4dc12bd024
SHA1 7f6432e9c4e474d5c2e7aed3f0e01ef03e74dbc2
SHA512 5f8466d556a85f8c2d71ca597b5e6c20587da390576dff1717930e5d4f220555bd2ff9c7cbd53ed3d0c9106ce6be558e281b888468ca3420b15531786df844b7
SSDEEP 24576:la7/ezSC6vUyD/aqgrvWj6q8wyus/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:s/ezSC6vUzPv+HjyPLNiXicJFFRGNzj3
TLSH
T17B756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 53ec473f140176b9d13d4c33b94c275f76e018d5d3fa333c5f7e0e884aa9746a
MD5 f12fec71bbaf61cdb7067d7fcaf85b6e
SHA1 2f7dc0e52b3b2ce17cca88daaac77b47e898c835
SHA512 b4047bf7ee0aaf57d700b60c1cb39d7eb4ce8375c3260e87138c7446a8169904eccbdc5597faea9aafbede8498ea07dcbd28b9f016f21eec284837026708dacf
SSDEEP 24576:2VbqPb88hv/l+B5/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:2VO88hXl+bLNiXicJFFRGNzj3
TLSH
T103559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E67BD6C636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 d31337837c1d7987141349539fcd9f00db8dd77fc809abf02ceb5613788ae076
MD5 e7b6be17a4976cf3ec1f618712bb5f4b
SHA1 9733aaada2a86c3a231d2085069d218460daadc1
SHA512 13922b7338373f781758fcc70c81099e2767010fb44d830a9db84b32a550fee6fa78ac1b99a0a66b84e5e52d0e3e07a2f407625c47467db1df98ecec37984f40
SSDEEP 24576:0GG/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+LNiXicJFFRGNzj3
TLSH
T1C05523D3468855F1FBFD003A867A5828B5845E2C8A595DE2D2503E5EA13CFEBCF38127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 e0ed0e75f8fb0786f33b04cf50fbe3ba1012aaf6bb640a860a521c6d95c38be8
MD5 5b65911357df14c3d6d19831a2ba6e59
SHA1 dcd961c9972690131db389c896a4a27c5f06d238
SHA512 bb6f886aea875448e1cfcac647a1f6cb363a05904e2d0a77d87988256d80614d354ebf13e92c628c665e1566bb7493931ea0afca1abcea19d72a336a7acb93c6
SSDEEP 24576:UJIUx/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:UJIUxLNiXicJFFRGNzj3
TLSH
T17F75CF7BEE28FCE2C27E4C7957918600E76278304F6293CBD165820EDE236E55E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 98a4540f9db9b56e85f3b076943436cc3d21dec97e69b3137c6e1454e6661f84
MD5 6c3c711fce7a197226d0055e04284ed5
SHA1 b7e99ca51305b9609036d66a56b6f50d2aab9694
SHA512 059d0c2193f2caf58e01a900af7aaec7d9856c22fdcdc39b3b713460245bd416decee847ed9bfb52f94c07f612d9f72a08694a1d2aacebcc9cde857362bf3d95
SSDEEP 49152:QQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THh:QQvGAdlCEL8c/WRNw5Cc7wRGpj3
TLSH
T101266C656BF880F5E0B7E178897A8572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 df33d0e891af0541ab2cf82fcbb53fa254a4dc48186efe8cd82c5ee0e876dc21
MD5 f4eafd18bb2ddc4c3a86eb6b0174893b
SHA1 0ed604e73b0b01f07b89ab77f05c192b6a8023ca
SHA512 1a53c419a238788fc58e3b9c7bfde972959d72945cf65a9bc4fb9b33ecec19ef6fd30d3014789edc855dbf0a7cb6f4049c9810f5b5e286a24ed5a8257b3d4c71
SSDEEP 24576:pfewsAjr/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VljrLNiXicJFFRGNzj3
TLSH
T14775E031FA74E032C7BF0CB61B36C716646C7E204B6119C3E3A85E9E59346D26736A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 b736a1f0bb97390ec01a038fa5f401039bbb929e535a5252f40911428d9aabe5
MD5 ebcad75b83757da9c0204c6ed0fc9081
SHA1 6292c0cbc208e894e1324527e3b93980e62862e2
SHA512 9b2132b44d3871af577b7267e75579e9786f0229ee6eee8f058c80623c8d18909d3909b5e431650c627b84d3129438aaaace96fd9c50be29e2f9e41ff8c2f0ea
SSDEEP 196608:cUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHHF9:cUEtQevvqc2W1cpV20I32l9
TLSH
T108474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 8f6253b680485b5f7f88e260920eef5cf8955121a4a96f4fa5a1d6c32dba317b
MD5 7fb9aed6c757cdb89559a511eeaf2430
SHA1 e7f0efb1bd5a5ba09efd43543204d4b59881d0c7
SHA512 ace6cf427d60c52b78b13a2b10f4a6643883cbc2a46d0cedef6ad966d48eee971a06d34f47e9366c8dffd7f56cb67e57198cc7e6990549edf918aab450fef4c4
SSDEEP 49152:5CbRquA/m2yL5zLfFiV+XenmE3/zLLNiXicJFFRGNzj3:Woq2VjnmA7wRGpj3
TLSH
T113D58D0976B881E4D1F6C77886A2C647F37178154B31ABEF4265461E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 496993a817b173e53f9abd1a74ec26535a4a6801c1c75bbdb1522089b4fa99ca
MD5 6c16ca26f015221a35f02825af5bf62a
SHA1 6536496c9faf36197d7550b618d4c670a69f287e
SHA512 845886ca9a3cbef2e0a2629bdd2b83638e302114d80b833fa001661dd52eef2c263b8acd4b76443407541c65528b07fe878020b7f466687d4a74c00e4c31af69
SSDEEP 24576:eAhGL6IFoiwtA5l7S53g/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:eAM5Foiq5wLNiXicJFFRGNzj3
TLSH
T146359D81E7F955D4F5F3AA7899B68170EA76BCAA5E31C20F2150911F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 b2223350a380bbc7f3076a526c5e36c28fa909f0bff8c41536ed95b3b1f5b61a
MD5 0950a68b3ffd83dc1087d5cab8aaeb60
SHA1 2562fd4c3008eb15df99c89476949b933f8a396b
SHA512 0610df31b68566bd5d9347294a7be2c6718bdc543b0d5dda246192467362a7cd3c7c06f72958f2c42deb969a96d07f4ab57f0c328274f72aa574a9b44bef6fd6
SSDEEP 24576:6wuROWv/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:6wSOELNiXicJFFRGNzj3
TLSH
T1A765F18632940CF9EABA41398657C035F7F2BC152A25DB5F4360C65B6F37361AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 a06275f7cfcc940dced3993f7fe691355fca35362e58701b5a4e6cb7e6f098a5
MD5 1b3b2a5ce26fce1ce2283178ab8472a4
SHA1 e53548788fdd920780190197faca06fad30ba2d8
SHA512 294c52416d302d6f28d687f89820797d6bfecae3e1ac96f79a67223c8efe6b7c3e39c7ebc9d5ef945f5d22511e5bccfa7e4f4dbf4344f81f4de91f7afae5e3bb
SSDEEP 24576:fZui/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DLNiXicJFFRGNzj3
TLSH
T17555129622C420F5E6BB403DC9F54504E7A17C2A673643CF52242A6E6F36FD69E39332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 d953b9dbb775e4fe18e6ca6c7b132f3c486644321abb21dc71b4c5407b3bac82
MD5 ecce10885dee9e40565c2f9cee34215d
SHA1 46d174fde0a7e5a3af347d5bb845bb24e1d6b950
SHA512 bead68325a029b3fa08736b095f1c561b0d584d2edb0ca9d339eecfeba2d9ff8d0b6aac2da4271571f23ac126d58ccb261cb03838b42c2c2a17ea95113ab2153
SSDEEP 98304:/QRQyi36YOcPDLvw2gAf+PN3V7wRGpj3:OQyiKanX+PNZF9
TLSH
T100667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 e648d3a12222c7210cfaa9811554795989ab7f5f34e56ecb0066adbb1c393e47
MD5 fc450f6bc6bc6049e2c9f14fff728520
SHA1 fe311c69202ea600c92aa4dad4fb69c288214d23
SHA512 15130254afb9051a6e23dd4dfc30e0c3e33a413370f85d8f494edb93cfa984e0fc453b485a2ab42c46edfb383a5fdad0043f55b7480bb5477dd6b278ae9e0059
SSDEEP 98304:XQRQyi36YOcPDLvw2gAf+PN3V7wRGpj3:GQyiKanX+PNZF9
TLSH
T1F5667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 909f416f7949107245239de3c51b6b3b6d71f85f0b69b2e98499c107500df381
MD5 c854ab9553dd57296ba9bfec37cc57b2
SHA1 a7b8087cd47da3c4a26dc7b803a8bdefdf93341a
SHA512 619fa4155accd126f6040320cdaa0f4c458eb0d2641ef900f3a22427c1dcc9cb95a30bde7445274fbe5be8ce8ab0d1ce7125a7768ce9c270f136c238acf50997
SSDEEP 49152:d68Qg55nhkeWu7PNU3/7LNiXicJFFRGNzj3:bthTRc/77wRGpj3
TLSH
T13DB54933B2F600A9C45DE1769F4A873196D17C758FE1E3DB8111720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 7219e6c5f9f0bf93f3db872190c56a259113e5970cdaa8433877d55dc8032df8
MD5 74244c02ecb172075c329fbbd2266356
SHA1 e39cd0a725370dee512ff6817adfdc98f76e5e09
SHA512 97a3b4cf24b27a89ac630122bcf0675d4bc5e04d6adfbc4da6c3a7ff12551f7ebae8527a4b2986d9b52b1bba541dea8edb03485a533ba580990ff97dd3ec1e5f
SSDEEP 98304:0y5112gYy5azzVvU69nLKnhZG7wRGpj3:1LIHRWh0F9
TLSH
T145167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 9f2584976cea90a0a021efa30272e80fb32a0e12c4677b02600817a84fe3bbed
MD5 41b7ba2956deadc09686ae7673f8624e
SHA1 070588064e01884801c4e15e5f6dada36f47630c
SHA512 501275cd669420066655f3565bfeb3bf4e5054eab3ff9ab26b034dbf97c518144215fae2791b122976cf2ab2338fd34cb8a855c2e0d85f911c118e48aa177fee
SSDEEP 49152:yB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glNLNiXicJFFRGNzj3:Au6JmIxd2dN7wRGpj3
TLSH
T1A9D59D13F1D901E8D06ED478974A9233FA62BC490B35B6EF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0e56a757744da5ba16ab5c65a94625b61ce509200a098bca614e808c630a3c81
MD5 2ef8b4e4222822a05f5500a34ddba06a
SHA1 6bb91e5331a80fc5ba3ef786b5da79b15e354807
SHA512 2886b770f8afb13c71af58fc8ab68645c186f980cd0a7974991665927600903676d6a620ab235ebc9fb240c45cc30a21cb3c6124ae8bba69826f3e077d6610b7
SSDEEP 49152:01hpsNoJpF1A67U44CwH7R4xRLNiXicJFFRGNzj3:0mifPqRA7wRGpj3
TLSH
T1D5B5AD13F2D900E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 167659b41b29c71e8796cf0c7ce65b872c687f237a1ba8daae080db6c4298def
MD5 d48f2717ed2184f92b586a51f6e3a41b
SHA1 47a6ac91b3e9933fe235cb94740aff0474620387
SHA512 e4dabf8aec583d82eefabd25206a7ccd0242726fdb5f97e3ef540f3b9538fbaaaf0b15f74849e30b1c90af5f4967a1ecd96459805ea35b6c787426c3db93af65
SSDEEP 49152:kSuZQIY0Be2KkRVtOnks6NMHqiLNiXicJFFRGNzj3:25dKqi61i7wRGpj3
TLSH
T145C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 37cf2fb0fc0aef11492d6a0219c686c861df53aa36ab2cbbf42c27635b77ba07
MD5 a99aacff8a8521d6bc1bfb48e8ace743
SHA1 2d6f7d94ed4c0bb3ad83f81c17daba33b7824800
SHA512 10ec633fde2d8923a836ba511936d50f2b5fdc9431ff96cfa4a82bf6e26212ed6839618ceaa81b7fa7a020e7caecbb7225b77e2bb0ac7c5a8d921dcf59c5dbd5
SSDEEP 49152:jhtSn8EApI0figjgiDn0AP5w9LNiXicJFFRGNzj3:CX2iWphk7wRGpj3
TLSH
T10095BE13F2D900E8D06ED178C7568632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 16b0c5917c1176ee7c9cd2a500d62bdc2bd6bb1be8ff1c37142dbd46078458a7
MD5 b0edb2390a3b79c985afb4b0522fa4a7
SHA1 4c0d98c835f08d66fa6b6c36fb74ec57e77683cf
SHA512 38b5e76ad81e959eb6ef885f77a650eb8ff799ea538f739069f0ed479eaf08c497211a8b7d96dc325e7da86bc3f4b73cbd44f4b597fdec4c9a01eb37657f6771
SSDEEP 12288:TUiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:T+/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B55523D3558955F2FABC0039C6754428F5881E2DEB5618E3E2483D1EA278FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 9fb1ea2265fae8d91f8a9c321599f25f60e122a68603f450611072ad7b977e40
MD5 4681b17c649d44fe4cf3fac0f8b9f77a
SHA1 ea63fc406ee7c1a8a7d4972c2d8984b9039d3ed5
SHA512 d35a1a1552b3905e45b1d1c726d5eeb209345921cd1dd61b96b9482d4aa333d25abe1f943035ef6a1ab87bc84db601fc573c59a96fc22e4e2ab988746c713782
SSDEEP 12288:5jiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:5X/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1715523D3558955B2EABC003986754428F5881E2DEB5618E3E3483D1EE278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 b3642ad1b8f7c524ee0368e8d6bfccb189a0200d9f48f38f350f7fd27c2078c0
MD5 e602e1627aaf3737b26b433cdf5b5335
SHA1 9bb5335c03924aba42ec951be290c10ffea27619
SHA512 a424fdf23ace8dfbf6e9c32726845043ff9327e0507ff38aecb28894a6478c813d9fb97a158e0de9df5a027bffe30b7c18c57b1b3c29cb22b62da1d5538bf414
SSDEEP 12288:AFiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:AJ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12C5523D3558955B1E6FC003986764428F5881E2DEB5618E3E2483D1EE278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 9e625e96ca018e679364b5b742b4796aae3be9dddc07ca70fd1af35d4528d8d3
MD5 d3eadca4215db21e755eb3170385706e
SHA1 bf9983fed2b883428ee53bf49a0ed8328d219133
SHA512 fdbc4860e3e20f997aa578d0b184e2d1fd432a8a80f936b3c668233a3c228c2693bcd56595598823c21c56143c7d7c784e5ec149a09c13f787876f8028017320
SSDEEP 12288:TV2iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:a/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T103552392168900E1E9FD803DC6764424F2A47D6CD7365AEBD3003D1E5A74FEADF38A62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 5956ca13b4c444a68437585ad7699a681f210c2805cea7ad3897800ac894df3e
MD5 5cd01061a1b1660d8694b19924970b23
SHA1 61fe7a9b8ffa3a41a592c8826ffcc8675788778e
SHA512 94c097a2f97de2a8984039f02a9c3ec0c8b8ffe07da76ed3d49bea640f17959426ca64f9a951fc96132bf88520d6245326d392a8641aef4b880b32d0e333164e
SSDEEP 12288:r+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:rI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A25523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 974836a3fbb11ca406a93762a4c9edc15d11793e0565be12656388c603c7abdc
MD5 50f34ec9cab9012b768d35347c0f45f8
SHA1 58ae39551f0d27bd59b06b2e971225002e5ddf7e
SHA512 723807fe12d1b4a37b90032d5cabe0abe6fc5e4b08a57f5bc679418337d3a0f48c4f92371ff6a5c02b4f69f5d678615af87acab533ac15bb3a4e0213058a90b6
SSDEEP 12288:pXiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:pj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1405523D3558955B2EABC0039C6754428F5881E2DEB5618E3E3483D1EA278FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 10c0b8270cc474e4c833de8e51f8b7c264e9072cce87dc13b91efd6dd0a3b96d
MD5 0d6c68c192ec276e160e15bbf39f0947
SHA1 7a6e53e1aad541ddf8ea04e25d0e8a2a02138499
SHA512 b5f991febcda0887a05989436552658fd51fb8c768e52a4e8ea5965fd4a3e75d6dd984579aace833df41e99c425a8527fd02c494fd91d4697657bc379b070daa
SSDEEP 12288:AriJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:A//TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1875523D3558955B2E6BC003986394428F5881E2DEB5659E3E3083D1EA27CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 fd85215cfd1b94d976dffa7c626ce1332fcb1167c55f8975ca0f508588d0a5bb
MD5 11eefe3b1d8f312b725fd54cf13d6e6b
SHA1 c9233e357354122c9ce25759843d410f62d12e6c
SHA512 9fde8cd73533d292de138d7c1e73dadc475e08031a34e79c45d8b34d7661ed4801c147ed5d68df15e280f926c4332c7a3f9e7d7b32e0892f38e8bf1c7ac0b453
SSDEEP 24576:mZM3zFVSO3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mZM3zfTLNiXicJFFRGNzj3
TLSH
T15F750295B39018F4ECB7813EC9258815E6B27C194B70CA5F03A4362B5F337A15D3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 64388f8dadaf8991febc4f9f2070fc0a2a98e64ad6f940af00a6bc0ffb1a4bea
MD5 fa7b38cab55f7df41f3276d4fc0f501b
SHA1 90348d658adf617e7eb1fe55c31579e6fa05b31f
SHA512 20741af1e967f3373332a817a1d6ab56c3f81a27ec6bc0043d70d33f07245fcc87ebc82be8fdbe4ab0dcb08039aa63a68c088f5923abfcd8439749b2822d7247
SSDEEP 12288:GAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:GS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T12A5523D3558955B1EAFC003D86794428F5881E2DEB5619E3E2483D1EA23CFEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 cb9ccc80d0d4712219e12898399aae5e18b8ffe8c7ffdea6233a898276a48723
MD5 88ea0d0a150a28a5996fabed36064cde
SHA1 39330db05d78e647d4299e156851c98252f6796f
SHA512 5240fdc5934a5dae0dea6c52c213ac4d9c61fbb9a62bd8d24e3a4ab794f478f28a3db3333ca233ea235aa31cd00dc58fa2fc1379a2cf3c80d43571f04045d9a4
SSDEEP 12288:rMiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:r2/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1B15523D3558955F1EABC003986794428F5881E2DEB5659E3E3083D1EA23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 dd96802b4b75e97efb981c1b8b2737e92a4ae1271930217979dafd4769c2265e
MD5 72beeaec4748b83aad7ad2ace4231ff3
SHA1 871479417f723dbb0ea379232452b37c96e57703
SHA512 bed2daa098257b48afdc6b23a486988a69726fcdeabcea6f555343589dfb01eb74326d73c78d401067dc2360e3c9e1fcc9f64ff1d50902b97e7d73aff6ca900f
SSDEEP 24576:vzyb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vkLNiXicJFFRGNzj3
TLSH
T165650257629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 479c76232fbcd6157638eaed8be00b1cc459e54fe5c367ef478ec10d81b1b063
MD5 84494fe47d8c0d9e480212078707694d
SHA1 1b147828ff8ad5f6bd0caadfd758dd9b6d67fc30
SHA512 f46f3adcc4a61fbb383ffa98d6a8ab2b8add1cb3b19e7f1283bcecb38a1498154d529e3e68b8476e7c5ca7f2d0ec1a6483da7fc21284493cf21076a57d025694
SSDEEP 12288:kAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1A85523D3558955B1FAFC003D86794428F5881E2DEB5619E3E2483D1EE238FEB8F38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 09be6f17345b8478504befc4814ca2b8477f5f8c58ef746d7078aa76d120c0ba
MD5 61dc5582cb1c46ba1c14a02cbdaa0244
SHA1 62e3eb054cb68fbc50f6820cd38f5b3d09f06ac6
SHA512 6534a7a21871f632adedc834f1f72b01a043544db4e2ddc0fdc9c039afd78138db390e1e3dccfd9fcf34678f452227ada650bbd2f3fde40fb010cd55ae738ab1
SSDEEP 12288:gAiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:gS/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E55523D3558955F1EAFC003D86794428F5881E2DEB5619E3E2483D1EA238FEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 3e5f4b63bb95df6868aa3eded56dee1750d11b42ba040522b767ecc92032556c
MD5 adfdb36f04eeb0d317d5146514f206bf
SHA1 ca8b602ab4d52b299c06ce37d88355dee080866c
SHA512 e040172338ea2cc6fca3af200479bc2e51f527019e1172a97f1190884ac4746006275059fe3da28fa538e949be92d095e5faaba82f0c4bfa2280fe87b1d8cc18
SSDEEP 24576:3zyb/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:3kLNiXicJFFRGNzj3
TLSH
T1DB650257629530F9E17A8139C9620911F3B17C3647208AEF53641A7A2F37BE19E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 cf68f6dcf807b3e636a2a7fec8ecd42761564346bf427c9e51d0b946a5ededad
MD5 968c19ee025b0de8bf54e0b5033439e6
SHA1 e84e3c7c3fc6dc255a06b2d7b969c3c9be353347
SHA512 c1e6d8da79bda5bc14072bbdefc2563a8dd8ec278f788aab33994649dc02f790b030cc3c8dd3b936abd075d8c3ea9154c04ff2b3912c435ea987d5e7a2f6ead0
SSDEEP 24576:ST8aLl3z0zDZ/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:ST7LljsLNiXicJFFRGNzj3
TLSH
T1707502A5B39018F4EDB7813EC9258815D2B27C1A4B70CA5F03A4362B5F337A15D3DBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 09f1412ab08e600f9c0417786534587853dbcb47f7723f936d090a0d841d1079
MD5 5ab47e99902af796f18854100ab6645b
SHA1 862af01977ac632f8bb1caff19fc056299f5c255
SHA512 ee259ff3fb7b1a387ad2c3f118fca54c33bf5eca67c0dd5b4a14462d8b6bd63999dadce35f0ff3fa45bfd554f0d9ec7110775a48482064012e2aeb70018ba22d
SSDEEP 24576:J3rd9CHKy7GZ1/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:Zrd9CHKyaTLNiXicJFFRGNzj3
TLSH
T16985CF90F3E414E8F1B78A3589764511DAB67C5A5B31DE8F03A4261A1F33BD18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 87954c6987a64b563550e1412d21148c3ddcb561e26b38011c0d1d5c86332f3e
MD5 b5bd645b4399732cff0c2050b7937bfc
SHA1 fce3cedf924b3c4b3bd5ba4ec7bfb46107f9d7b0
SHA512 52202cf7aa57232d2ca7e7c587461a323256800fa5b56359a336bc46ed316e2848b7ea3c1c827fb54c69d21c76ede4ce7b0da59e8cd2df703aadd939c2391fe1
SSDEEP 12288:oliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:op/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1965523D3558955F1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA278FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 15d044c8cd4a16b05e43e1993da7d7bb94474ef3125012a1e89807df50ea99ca
MD5 6b70be7b6086f32127ba5235ccff02c2
SHA1 c649bf45adb4a5c1d2c8e854c3924667278cd62a
SHA512 7b3de17fa3c3c3625860e1463d3701b3a3991e8758ad31b29de39d332af4afe761890d98aefddf730b1484abd7c04f8dd6b721ca83dfbf2d063d08c9255d0962
SSDEEP 12288:wPiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:w7/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1595523D2558955F1FABC003986794428F5881E2DEB6619E3E3443D1EA27CFEBCF38066
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 7cfb314d443c414e0665469fd909e1ffd0bbce6679c702747c8c07424793d021
MD5 9ebae10b3b060acb71736d1f978df38b
SHA1 fd28a5b43a35bd90cf9d0d669a936a344c241b7c
SHA512 d3eff3aea9b614e12d4f9f08fc47eca76ca9e3c35a4986da250fd29d6c001ad669c6fbb51fbda62a4c6149bead485fba351e06371c1d13794d556a71da10a706
SSDEEP 12288:nyiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:nU/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1495523D3548955B1EAFC003D86794428F5881E2DEB5658E3E2483D1EA23CFEB8F38476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 44fbc68d892954ee2d4d42ba8c5270b40188607ee7857c90b53723f5b600f0da
MD5 ee637c4c2d7712a946b7393e75bdae35
SHA1 384aa2f00113e49e225b4fb59ce294e13707e709
SHA512 1505eb22168114407eb56661655c3a5f9a367115e78887cd5615a56d9f61e99be5c581f799b22cdc95c90478200130c51b526ef4976ffa3e4eabaa6f2e678d69
SSDEEP 12288:2AiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:2S/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EB5523D3558955B1EAFC003D86794428F5881E2DEB5619E3E2483D1EA23CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 dc11f1bf224e99211ef55d2af757a4f1ea09dd07868fda1cfd5c8bfd50d7a2c6
MD5 921e16014a288ceea3592449e30070c3
SHA1 10fb816442f276f305bbc78a72efdf8a56dd86fb
SHA512 3c5ed7e621fe149114b1ce927c715c56f386acc7b8ed00a596658768ddb226743d014b94e4049f59be615d9ed0c59ad88e9878edb1f92e3f9d74b04fcacb280b
SSDEEP 12288:kliJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:kp/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E35523D3558955B1EAFC0039C6764428F5881E2DEB5658E3E2483D1EE238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 8da28aff4d499aaff4a285ea308e61548c7034ca0d55b3450e8ce44027f440c1
MD5 5240c4864600e722bf97d1ab5445012f
SHA1 aa8cf9ea36f42db8fdca253a232852bd8a44987d
SHA512 d3d1272acef14bd092708ab22ae0dd03ae1b510b16733156eece3a84fde266722aa769420c9ef88858312d9b0746477c442c0598f9dca48ded108276a03ee31a
SSDEEP 12288:voiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:va/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1615523D2558955F1EABC003A86754428F5881E2DEB5659E3E2083D1EA238FEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 1ce5b26eaf6ca7a8650203085346939f845681da22977c6fc6595c415ee5319a
MD5 44b1b9df1ff7947e691a58f80e44d3f3
SHA1 c68c2a33b825f059421123fa53045f97854fe76b
SHA512 0412a81137222a642bdd5a2ed3a235344fe0a487905c2f3662d6aa511b76364737a3885dd988b2bd5fc74e0355e612fe30b18e25e35013edd0df797e780c7ef4
SSDEEP 12288:b+iJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:bI/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1E05523D3558955B1EAFC0039C6764428F5881E2DEB5618E3E2483D1EA27CFEBCF38466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 4276a34ba11970477dc1f3aad81844b78ae2700123d167c278c3d2c536d29c36
MD5 8f1c40b0453f3002d9957a92d3a7b292
SHA1 a21bf9a5e43b2c2e040b180a5144d1b7a54af3a1
SHA512 db27242f05b65e77e4971f485f7d2059e72ff0f3299c2d99b5193f773107affa6824bfafb3b802182e20ef2b724bf60b68991cc805bde97af54bc46f86b4d481
SSDEEP 24576:Gfwvzk9RX6wkyAIm/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VMnYImLNiXicJFFRGNzj3
TLSH
T1F785D029EBCC44E5E1B7913C89B7460AF6B178691B31C6CF025A536E0E37ED49E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 ff4b95629521edec5dc19c7b2a03fe0f51befbe3a878f204209c2f03bd061a37
MD5 77bb58b202e6a1345a0936736ba6c4db
SHA1 876e12a2db12210e254baacbc3e3951e9d9c4dc4
SHA512 84c5f185cf8628b1e6350765ea727f57982496063845a42ef33715a501b9c40a39bd867e887f308ed4a1f491fee4f7b366f7cca267ed98b1abae1811309feab0
SSDEEP 49152:lYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0dLNiXicJFFRGN:UySzP17wRGpj3
TLSH
T1AB066C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 79e35a387a026cd086b1488e06682ad2ddab5efe632665e0df8dd92da03fb100
MD5 695a878c92076280aa1232f45d7eb3ee
SHA1 38067063a1983a0609e76529875933e0692d8ed5
SHA512 d46d1b0f6051e0917dbd8a8f8e7d8b84be769e8c7a3a663e4651b8eace12da005046792505f3466f97e413b1ade943f2f7692f5b6a604b2ebf90f6325c5d1b61
SSDEEP 24576:k47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYn/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:k47JUQjqirIhCnDHUPfF/NLNiXicJFFS
TLSH
T1B965AE1EA3EC01E5E1BA923885154A1AEA71782D5F31CACF1270537D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 c059140ef1014e724f61d9fab600baccf6494b4d0eb1399f5f4e3107ca46a1e1
MD5 ce70bd2f08909c4d076ac8aa0d580e50
SHA1 02c5e41d773736418742bf207dc3b9c985105449
SHA512 0228cbf8cc04c3bfb447f640da69e633d11c699659e258a20ac767bd4fa599326f3b37b25892cb2e0146e62fce0ed1d88617093cfa0f4dc5d26238a72e6387a4
SSDEEP 12288:npsfwiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:Ii/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T17865F15AD28802E8D1AE5139C7664900F3633C2987E1D3CB52D0F93E1F7AAD59EF9613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 209205aeb1555691d0419569466eb6cc0f21144478bb28244d045335adb941e4
MD5 c477b3e2eb80ce68e737e1aa2738fa2c
SHA1 6567b98e539bff1292da15e28a89bf8b59815e29
SHA512 8942a2aba1a519caf623aa75f4a0ef582c0b2f356694db4cb7f8ab049753bf053b60da74aebb01cad4c7985f5a8c1a16dec54ba24cd2a1ec6fde1ac8987e0345
SSDEEP 12288:nF7YiJw/9Rrw0R1u4V/0YG3wx6EcJHUEhPUotFZr+1izHGNe8jKk34z:9q/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz
TLSH
T1EB5523A3568859B1FAFD0039857A8434B54C7E2C9F1598E3E2043A5EA138FDBCF38527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c34bfd93aef2fbcc098c88edee7bfd841c9a52b344ee5c245be189817971320e
MD5 6eb4771019a3879c247091a076d5681d
SHA1 97a036691c3db69c2196db09becfdd48b27a615d
SHA512 3a03d74b838d62faaa86f0a5e79e544c424d55d84214c4aad08945d710ca6e580001c67be43cff618aa31249116cb974e8ab958be5434958a900638fb5cee6ae
SSDEEP 24576:bgb6bmBIi49WNNFpg1rSvFv7bYs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bgb4mBIBhGFnLNiXicJFFRGNzj3
TLSH
T1D065AE1E22EC02F5E1F9D2B8CDAA4417D6B278164731D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 de26cdfae6c87de9d63b540217b7749bf269c4a74c99254e59eb1c31565b2143
MD5 89f0d7d576abe4bfada3fd472b4ef396
SHA1 0bec34dd865160707396bcdf468b0c9a7a458ef6
SHA512 aeef681cbb6b59d43871d9f2c708cc39116d55f602f46ab7a1b30d12e520a834b66e6a03ed5a1f0737e3565aaced335a26c2ba509550d594bc6039b88dc8c633
SSDEEP 24576:UG88u8FpJqH1vzria7/m3/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:n7ZFPqVya7/0LNiXicJFFRGNzj3
TLSH
T13085F16566E101F0D47BD0388A964663F6B1B8250364EFDF07A88B561F33BE54B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 9f3f83f06f50e4f1889c9e8895df5f96a3f008b71fcae49ef5f6087b936504cc
MD5 1f63c8af07de40876feac929f5d838ea
SHA1 64ac60c1deacdd0179db29378dbc99f3d141270b
SHA512 eb48b53d5a90ac2c5912f501413d29e2d6980344e850d37ba0d887b41d4d9a0535837299694f37b6cf568e0c9fd7df8e91e47ad4d4aa0133f1b45408c9182af2
SSDEEP 49152:NBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjjLNiXicJFFRGNzj3:WG05lO43bu7wRGpj3
TLSH
T1FAD5C06E62EC11F5D1BBD07CDAC6460BEBB23815033556CB02A486A91F27FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 dc2326131e3b924075603200d8604823391ace2650b9b62b0bad7f8feb72f974
MD5 effe07c8aa966e227de931df0837cf49
SHA1 81243cc8442be49a196e52b7aaff8d6415529346
SHA512 1e3fadf52c196a4cbf8740af533fd4c19e379eeecdbdf40eddbc46e36cebd4da3268f0ccbbf698e4cd0826d87adf67c64c9151b6aeb3c9bba014421a56215474
SSDEEP 24576:Lfa5POZ3dpyWVM50JicR2hG0lasx2+47eidnd/TwSfVcYG3K/cJHlnFR+IGNe8jg:Ta5POZ3lJt2pasx2+m7LNiXicJFFRGNf
TLSH
T15D65BF5EA2FC01D5D5B9D17DC583861AF5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 acb1681d94f308afe8278761b1710db161ee28f30feff46294a759995f457606
MD5 089844cb4efdfb30207ff1588b4e5e85
SHA1 d8817af4480412e8135d32446f927e63145607c1
SHA512 c789f3f247e614931038a929d58c268839b726312a462b2400ffe861550625c17c7a4239e4392f4bbd56fe04cd76bde196f9acfd73b61db87adb3bbd385391fc
SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7FkP/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:VNc/zEOVHFULNiXicJFFRGNzj3
TLSH
T12C858B1622E901E4F1BBE1BE89779546FA71786953308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 9cae462fca8a45589a4d6be2575c3b0ac943aa689f5d21d3dea1032db0f44a2d
MD5 49544552525733211286296048bf4128
SHA1 2dbdc784e60adeb79f6954b627477e5af6fe1750
SHA512 69f8c9a5eaef87a34b297ab13ab8c9159d5c88f8de800b43040161f7a1dc55360c838d82007c581fd2bafc9ce590ce32f4414b9853e3b2441a08e91931d8c223
SSDEEP 24576:/zkNvNnaFeYhJNtmZBmh/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:/zMwBtOmhLNiXicJFFRGNzj3
TLSH
T19E55AF6EA6E846E4D1FEC675CD238512F6727861073293CB9290C13F4E279D89E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 adf1ec1958ebd06bafe2f5b25c32791b98ee58148048f56ef8069d4cdf01643b
MD5 3496a52e39c540b3cb5be689cb6b223c
SHA1 af49c728385f4d7a0b63a065e822f45b7044a2fc
SHA512 2373d72fd4ce9682663a29e67d647c5fcc6518808b709fdeaefc1486cab2321b0c4011830c0f139d9ac6441d42bd3ec989e36e921257d3f6f25c2ad8456c929d
SSDEEP 24576:aPUr+NQT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:aJQTLNiXicJFFRGNzj3
TLSH
T1DF65F16F22DC18E5E67AA03D85828619F7717866071292CF02D0917E5F37EE8BD3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 681d3c2a2a79027ee60526696b17fc095017d8d5a5b5ba78739a3f8b25869634
MD5 25cf56309bc09f9b216507386cb1e93c
SHA1 d6d500db2c8873233f4b543cb7e9890dbf47108b
SHA512 9793b6e06739fa896452fcf0cf5bb0701b9e917001f823abc83166bc258747e2b1f37dd2a6e5d5d2c0549df734d210c5be28adae29d763b1444f598a4c1c12da
SSDEEP 24576:YD3FHshBIYQgAe/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:YDVHeBIAAeLNiXicJFFRGNzj3
TLSH
T17975E17EE69C04E4E57AC17CCA638906E77138AD032265DB029491BA5F2BFE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/900-319-0x000001CC0CD20000-0x000001CC0CEEA000-memory.dmp

Download

memory/1476-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1476-125-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1476-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1476-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1476-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1964-120-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/1964-315-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1964-113-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/2420-54-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2420-53-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2420-274-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2420-60-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/2808-133-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2808-137-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2808-135-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2808-127-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/2808-126-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3060-310-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3060-329-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3060-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3060-330-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3060-88-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3060-94-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/3500-77-0x0000000000900000-0x0000000000966000-memory.dmp

Download

memory/3500-309-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3500-76-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3500-82-0x0000000000900000-0x0000000000966000-memory.dmp

Download

memory/4024-107-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4024-311-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4024-313-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4024-100-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/4024-106-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4024-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4104-14-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4104-20-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4104-22-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Download

memory/4104-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4104-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4456-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4456-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4456-149-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/4456-316-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4580-86-0x0000000000400000-0x0000000000663000-memory.dmp

Download

memory/4580-1-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/4580-8-0x0000000000950000-0x00000000009B6000-memory.dmp

Download

memory/4580-0-0x0000000000400000-0x0000000000663000-memory.dmp

Download

memory/4816-64-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4816-294-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/4816-72-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4816-66-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5344-45-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5344-39-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5344-38-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/5344-49-0x0000000000C00000-0x0000000000C60000-memory.dmp

Download

memory/5344-51-0x0000000140000000-0x000000014022C000-memory.dmp

Download