cc79a88bb40ffcf3912ec896ab6539ae28b082664bc6ca4b19d2c888376fd5d2

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 15:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
Size 2.3MB
Sample260803-sfclpsej7z
SHA256 cc79a88bb40ffcf3912ec896ab6539ae28b082664bc6ca4b19d2c888376fd5d2
MD5 152c2a86a8ec2e0aed5b774db670e678
SHA1 10538b7f12f055f9e77a206b75166bd6bd2c66ae
SHA512 6a4cbc5349771402e848cf5630221a6a5b1dd1124e9ca64a4a29aeb8771aa6ef8101d7097aa14fc10a032e310e47d60a08518e128365c757f5fb9a271ab677f6
SSDEEP 49152:jf3ZoG3UCj5qzWt2skmzb2R3NBHCYcMbCqy+Xy2mp6IDQ/lFTjN4:7ZP3UCj50WtQwb2R3N9cMbCqy+XTLm
TLSH
T1DCB5BF31F590807BC63317719F9DB36863ADBBB10B75424733951E6D3E70883AA29A63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5772	elevation_service.exe
2216	elevation_service.exe
4516	maintenanceservice.exe
4172	OSE.EXE
3444	PerceptionSimulationService.exe
5448	perfhost.exe
2844	ReFsDedupSvc.exe
3696	SensorDataService.exe
4412	ssh-agent.exe
4400	AgentService.exe
3044	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\94dd22a983806d8d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f983374c5923dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ae9369915923dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000bccfa4e5923dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006b76514d5923dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef1b1b4c5923dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c1d994915923dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
5772	elevation_service.exe
5772	elevation_service.exe
5772	elevation_service.exe
5772	elevation_service.exe
5772	elevation_service.exe
5772	elevation_service.exe
5772	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
Token: SeBackupPrivilege	2844	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2844	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2844	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2844	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2844	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2844	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2844	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2844	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2844	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2844	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4400	AgentService.exe
Token: 33	3044	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3044	SearchIndexer.exe
Token: SeDebugPrivilege	4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
Token: SeDebugPrivilege	4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
Token: SeDebugPrivilege	4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
Token: SeDebugPrivilege	4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
Token: SeDebugPrivilege	5772	elevation_service.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
4124	2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 5016	3044	SearchIndexer.exe	100
PID 3044 wrote to memory of 1524	3044	SearchIndexer.exe	101
PID 3044 wrote to memory of 4684	3044	SearchIndexer.exe	102
PID 3044 wrote to memory of 4328	3044	SearchIndexer.exe	103
PID 3044 wrote to memory of 5032	3044	SearchIndexer.exe	105
PID 3044 wrote to memory of 2256	3044	SearchIndexer.exe	106
PID 3044 wrote to memory of 3752	3044	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_152c2a86a8ec2e0aed5b774db670e678_bkransomware_darkgate_elex_maze.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4124

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2216

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4516

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4172

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3444

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5448

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2844

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3696

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4412

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4400

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5016
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1524
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 904 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4684
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3056 904 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4328
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5032
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3056 904 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2256
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3064 3060 904 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:3752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 247968df74799b5e15ea1a52579978ade68b190ac64efde85e148fd616a22b9e
MD5 8e16a712525057fa08fb508457a9458b
SHA1 ff9ea0512689acad9b4da75a0630b6d6025cb15e
SHA512 a9224ea279caebbd00e4f89d5bbee3a911fe233841bb167d8ca17828cb423af85432babb6be533b54d4fe7f77abdb41a613b308f79109d6094bf8b1602b188bb
SSDEEP 49152:Yb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnmQ/lFTjN4:y3q6HjByLm
TLSH
T10CD58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 1645e7e049414c6a9a7f0d9a3edff2766a3e93d010bc626e0ba9f750ba47c40b
MD5 73e0d4a9d25be378fa6b8262fe388e49
SHA1 68d6a7675b6b118d1891b5911718b9a35fef1d1b
SHA512 7b47ff42c8f3277a1fa88b566870379aeaee2044c3d72fa1390f30474bff61dd53b6700ee4925237acc86b2117f4d2e2d9d130ebc7c22a96ee01192c4d1df6f3
SSDEEP 12288:E1XLsswWkxy2lRq2czApGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:CXYfDtczA5nQ/tbw/2Mkjy6Fr7g0ob
TLSH
T12965F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 17717d9aa92c2377511c3b0f687bd6c3c726d40461b6fe7f1c6c7d87e66af01f
MD5 67c01b7b5875ebd5624d3cffc7c69f06
SHA1 a47e4a0a9f9cd9fedcd9e183b336658f567dc57a
SHA512 a56bb637697c17e1899a8c5995382f51cfb6907026d6ced3523877c7c4f4a26e3650f9363a0109b20d731f67194583692a03da257706c39f4004a7bee7845fff
SSDEEP 24576:y0Le5ji0hmxLrM+nQ/tbw/2Mkjy6Fr7g0oQ:yPji0AlnQ/lFTjN4
TLSH
T161859E15F6748735D073C0B9C5D2A68AEE7230825B308ACB4286D77C7E677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 329ec6d5027b5d4563c92feb969ecb32e3978fb3b9968ca5d4138ae3f06c44be
MD5 c222b38b2b3a5bbfaa3d59093ab1c8b2
SHA1 736251e8a10b71dbefdc262c58e55d977a12899c
SHA512 eb93194e70f18290b74e4d4100db28caf42d2caf3cc35d3caa71ae048ab9e3f6affd817f3d1f9e5ca8bdc42e804bfdf8cb327cfe87ca1458fd44930f70359a45
SSDEEP 24576:0a7/ezSC6vUyD/aqgrvWE6q8wyuQnQ/tbw/2Mkjy6Fr7g0o9:j/ezSC6vUzPvxHjyDQ/lFTjN4
TLSH
T191755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 317308f17d657c81b27cde10181dd7f47922c62b8bd1c0cc2ec96e83d964663d
MD5 9a36b6685a2ed8c4cf382ee25389ca59
SHA1 3a901082f2a1fc40caf3103af24cf29ad28deeea
SHA512 afbaa57b4431823d7a34b16bf77e7039228a5e66cd3e31f96c7ed851fec49e8ddd4936cff4e76178f28744437ae24aafaf7dc890de95b77482c713f95da99ea3
SSDEEP 24576:cVbqPb88hv/l+6tnQ/tbw/2Mkjy6Fr7g0oJ:cVO88hXl+qQ/lFTjN4
TLSH
T111559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 1173c4b6a7aaf8a27e2b7b0bb8985874de68eda9b79a4c213e75921b15b21a86
MD5 772d53a2859eae9a1874cdc18fa63de6
SHA1 4570f626295aa0116b6082c7c08ba7c7a2d1091e
SHA512 ccf0fc812c1a2c4fbd1c6bf345bbbe2d926e8c65692f986bfe743e82e06f46b243bbf6bfab670c4445a37522259f80c07d264fe44ca40e4e2602df5b32785b29
SSDEEP 12288:3zSGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWp:3zSnQ/tbw/2Mkjy6Fr7g0op
TLSH
T1565523796A24F897FF2B06B15CC284826B7B0EC1BFD4A74E6B44362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 80d7e0f06ad5cfb69e2dc2dba008310bc7f952c7ac7b972c685f887782a2848f
MD5 f6d61f5576579c3278060242f68a98fe
SHA1 53ed09645ef23a152e8c1a732d2c6d99ded6808f
SHA512 dda928574fae80340664250c64fbc4e0b0c920960362d32c142b3a7effba880ffc82267f6cea97c5b31b838ba08ff9dfe2f03d6be4015653a8ffd56264ee788d
SSDEEP 12288:ZeBNUbTVO86UlGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:ZJIUFnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T13975CF3BAE28FCD2C67E4DB85A918600D77278704F61A3CBD164830EDE276E05E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 6e15ca1510ab1add2386b57db984ab2436254e99de637de2e0fa4bab57df564e
MD5 7b6423adee873086226e32e36df3bef9
SHA1 6f4a21aa29e74ee79aa38fa059e204218b6de8fc
SHA512 01760ebd36698a05656cc81a5af52724b94080789ace15f618a8294cd978afc4f9f91925fa31d23d3d0ca74856e42e41ec8a370b8cde2a445bf517aae39b6461
SSDEEP 49152:HQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THd:HQvGAdlCEL8c/yRNw5CTLm
TLSH
T169267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 f85642c2598b0d465e26aa87410cbb4f476b7a4447c1597d953fe20a3eda2235
MD5 43b4df2ad9ffb4f11fa2a1c4d88ec58e
SHA1 d1f3f2a4b418a66cc4dde7eb7d235e5846367fa4
SHA512 5c3a2c3c954d1bab85a812f737c0a5f2e31de106fcc5da5a7dbda933d2526099764436eba96d710d6c5ce3487cad61ebab6fb1b3abe99fc84fa465583b05f660
SSDEEP 12288:mAwSfxL/2Dc39DLLmt0LDQewsAj3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg9:7QewsAjXnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T15175E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9D99342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 522e024ab0afd0c6d47d179d50e34679ab53f141d3340816c5989747123b1749
MD5 2112ce6837b19cc9ca8f9d3fe17202a6
SHA1 172b0845bff9932c9b5dc9013f9af0e3aa145ab4
SHA512 7ca37788c5d1ca30833d445122f6c0b56c85388f7b63c603f6e221d64b5faee914aeb9d4f8a365293342033bd21aad185fdc8662861375647cf923f4d343e5be
SSDEEP 196608:0UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH0L:0UEtQevvqc2W1cpV2EI32
TLSH
T1E4474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 5b21eaf5dcad90445deed4ec119cf15b267b4bd88ca2c0ca06ce9a5369b99a5d
MD5 b64408551da47b3fdccb00af702c0382
SHA1 6ae8d0193e97bee601e0280a01287cb4e848ff9a
SHA512 e9d31e567ee90b9d7208110328bf0be92e0b2a500b09e1fb0d712ca044fde08d1dc4c06fe097124bfb23e4b8ba823993f18917dcb630d968c3eae4be67f209bd
SSDEEP 49152:GCbRquA/m2yL5zQfFiV+XenmE3/z3Q/lFTjN4:roqtVjnmfLm
TLSH
T124D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 932d417dd232e20211fa342c0f4f2b586fd7149012f0727f1dc350d8fa4d21fe
MD5 18b44688dd55b0bb925403864888384a
SHA1 f7faef3e7470581db12db1f3ef1778ee629b6021
SHA512 2a275f8acd99861d96888cb21ab07b553d288e6c65e6938b7c0bc5dbb1daf6b082cdfbf04757fa0c1292597d8d12502b434c621a037c0bab26d558c9b50690bd
SSDEEP 24576:pAhGLJIFoiwtA5l7S53cnQ/tbw/2Mkjy6Fr7g0oT:pAMyFoiq5sQ/lFTjN4
TLSH
T15735AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 f7166971c6951d79eb2880f521ca5cb3bf518fd2daf72bfe24559ea3d95feccb
MD5 2e4a75e05fdfbecfe3345f11f11a2e55
SHA1 0b61a959b08621ea9c647b635e8b7e18cf8a406a
SHA512 9f62ad939cb795e0b21e0590993bbb4d3180d0a16ca6c278db2722379cfc5cb7e69aa907f5425d2f611e34fc38f8ae4b0b927d335ee87558e47ea0a3a323da74
SSDEEP 12288:/mw5HEjsChN2BFgl0WDm+CQGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMM:+wuHOWjnQ/tbw/2Mkjy6Fr7g0op
TLSH
T17B65F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 42258c5fbaaf4608c9f09992ef976b64cab58da6944308207bd7f63a89cd3564
MD5 b9101e99998fb71dc39ad262c7d497ad
SHA1 5e40ec0cc95640a329818b0b570b01fa2aac80e7
SHA512 6bbcafc1ef2ebef91257a0eb25a985930b62a63352b5d482673ad52ac4ceef0ca58761ed69cb7b2960202aa87e919c5b40ff5c2b0b5e62ee3479b5e2d8297878
SSDEEP 12288:FXZ1IynGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWv:VZuWnQ/tbw/2Mkjy6Fr7g0ov
TLSH
T1B755126937A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 9cfbb8de659a8615bc0ca498a33a8ee214d57e8624179c5f379f3583c8801fa5
MD5 7ade9948e55b4e53ef136b78ad494420
SHA1 ccf5394c60e72fed93eabbddef8bbc9753e108f0
SHA512 40d6635690e4ca2133e80089344da804ed261d8110ec35088e7f98268778c50f10caa5b6c449b918c84fa0608e99dc542b7f7df1ec4f3cdb28e593befa496bcb
SSDEEP 49152:dj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U5:0QRQyi36YOcPQLvw2gAf+PN3WLm
TLSH
T14C666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 9236860aade3c9b539501d24434bdb55461839a5a2e08f32815be9abd92065fe
MD5 0f30f8b82e45c197f64026fd52b777c7
SHA1 6832374e1b23b3976113a86c361cddee81cd2293
SHA512 da6e2e966756c5b74c561358c75e64f248e067e874ebd43169854fc4ad992f09ea7ad06220ee092ffde1176c424004d871e86699f79a36d27ff1dc666d6911bb
SSDEEP 49152:3j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U5:GQRQyi36YOcPQLvw2gAf+PN3WLm
TLSH
T1AF666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 43a81df16fccdcc13bc94bd1a053bec9240e080da056c03bb596f37a11bc6286
MD5 b835016fb17564f14ad20489a8e87fae
SHA1 ccbe311572a24ec1375ec46112d2512926b8b1bb
SHA512 95eafb46ca2823dd71db3dcbe5088c633c614eb2ee05baf879a1d7e21cd6e7fdc992c6f26c9cef5027c0bad43c5e5799c85694d6750044f2c0033ed92d7b8596
SSDEEP 24576:fwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0mnQ/tbw/2Mkjy6k:H68Qg55nhheWu7PNU3/nQ/lFTjN4
TLSH
T162B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 9e85552ec8f3dd75e59432593a2c0c59bc8d7764c8366666c052359041e9f592
MD5 114dcfc7ad9fc60540f99e53a8fa7c80
SHA1 615323e354e073f65fb334915c81ef0f3d7ba85b
SHA512 3462fbb71afed5a6d01769ce2e1413f7d468d41c42c495a872d20c7e5133ba883705afb235469c3f80097b56e2abf26e2a27f5de575b34f9796c8cb6e8d27328
SSDEEP 49152:13aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99f:0y5112gYy5azzVvL69nLKnhZdLm
TLSH
T1C6167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 5b470d1707b39f79325253494efcd516d86d2c3c900ac120aa9f2631512099d8
MD5 bd57aded008b2f308002b2d70f1da4e7
SHA1 00bd4d46ddf1bd2f296c2ad4d6fa99ca0023845f
SHA512 5f2e0b988602b5b254102c3c0816ba82dcc17d32abc14461a5243135b716d70e5e33e660cb361b34226a69a05a7e73e6cca1a16fd9590596c26764427e48ae7a
SSDEEP 49152:VB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glJQ/lFTjN4:bu6JmVxd2d+Lm
TLSH
T10DD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 cce2d6a95c65e995e16ec395cf6c1b3c642f885a1e6c084331dc94055f7c31a3
MD5 90e5654551f5f0dc7db4a5d060d68127
SHA1 f00bda7fa665e7e1523a3ec5b2b08c34b4444c93
SHA512 40524c2d533a4f235d973d05665908080af94130b3da62a7b7611097caadc4a726e243ecb7003e544dc964b2b7d4fe528316eaba8e653da7e1399671a2702548
SSDEEP 49152:G1hpsNoJpF1A6UU44CwH7R4xlQ/lFTjN4:GmifPbRfLm
TLSH
T1F5B5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 84e317128db27ff9e5c39c4f33a16c83d660f3af31668a93e49ca5a84f8acd2a
MD5 71157710b97f0e36dcc085c392144737
SHA1 2be6dfbcd2b76834384d336dfbf8ed836013871d
SHA512 30344dedc03ad05329ba9732d404d8b20013ffe121c1dd849e2195f61aa3e31e3df5d918eb69ea7885467d3db73364318402edf0748103d421b08ec9c801749e
SSDEEP 49152:ISuZQIY0Be2KRRVtOnks6NMHqWQ/lFTjN4:S5dKTi61hLm
TLSH
T15FC5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 3bbb7202927d2f9128cb5c6f172bd2ea10ad6625cf7b994966d521357fd3848e
MD5 cd8388417d84588702a80904bdb07714
SHA1 4fbd5101b80123f20be241be2800cfeaf4379f95
SHA512 df2ac4a6ac25244a3a533f8ca68a8dcb314fe190fcea1a310697227a780f36a363d4cdd45ac776b605dce10343d17e3140e4272179fc65bb2be8972a68907b73
SSDEEP 49152:ahtSn8EApI0figngiDn0AP5w5Q/lFTjN4:bX2iyphLLm
TLSH
T1EC95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 8a5a919f796cab1511bba759f01fe1b00db0cfe786a45a4c20fc9d4c2c8a2a3c
MD5 44f46503f1e6966983555dd2ae57ed57
SHA1 4ffdfb9b500e926435b4508d3f8d8d765adb0133
SHA512 2df736dfbcd1121bf69bbd23ad6a270dbf54d71e6ba181047a818594872e7aeae04feee172cf28f5b2d5cd43a7ac6d325e7c117c7ece8a6e8be6d83795820a90
SSDEEP 12288:HqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:HqnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1A35523697965F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 eeafe1e48f8cd6b633179e7c6dd6e48310714425230a45d4567db572757a404c
MD5 f94503ced8bfdf4eb9ecb1fdc60fe1d4
SHA1 ed4dfd2e1ea5c8cdef67d5ba2e31c0f0bd4de6a9
SHA512 b4790a15a227406b4af769baa898b04ea531e8c660342cd660587343f15910ef17a6ab0466ffb464b0bc78eabf8670ce0b27aca441403e03fa732a576d15ae25
SSDEEP 12288:T7GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWt:TrnQ/tbw/2Mkjy6Fr7g0ot
TLSH
T1785523697965F98BFB1706F14C8281829B3B0EC6BFD1938F7B482129967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 78db1699a2d3e3536debec7f9658d258d93be6ffaa3b51d6a2b12664cefb85d6
MD5 4d7f0a6f345b13239b5a5c1bbaf8d252
SHA1 dd38406bcdb3c3ad83432f351553a12590caf845
SHA512 3601632807cdd2abc093264cf359d5f25289c17aaa608423dfdda8c3a173262d912e18bd588177e2a7910fab51acf2328f884f705048c0132410c632b5bfab72
SSDEEP 12288:1dGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWw:19nQ/tbw/2Mkjy6Fr7g0ow
TLSH
T1D25523697965F98BFA1706F14C8381829B3B0EC6BFD1938F7B482128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 244d690c8a749eb7398c76a851ad3ceb7b9191fccad65acffe9486b39fd731c7
MD5 28e43b9c643a71c34fb5856d9883f8be
SHA1 ee7308453ed48fd9123bf5e6713b893804c61953
SHA512 ecad3107ba8ef1e7f55e5edc307b450d258959c1a765c310963fefaa7374ddc8add1bd864744b05e8458d4f24302081b9aa3910e27d509118217bc08bb6d038e
SSDEEP 12288:HV8GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWX:anQ/tbw/2Mkjy6Fr7g0oX
TLSH
T1A65523693B69F4C7F92742B4CC938142E77B3DC1BBA1A38F6B04111D4E793D419A6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 7bb6641d8c9624c85e80ee2e1d7798f078c7bd8337e82d7c2f3037c13f387c9d
MD5 ab37c319877cb81f032bdddeb6b0085a
SHA1 727a3f059bd5ae0ed30c0e0b0e57a5743eb46e5b
SHA512 ba31451c4293215b930d3321892055390b0406d0737d834ecfb2a06f6f166059130e57190836b1af9d408322a8912bbdc0efecca290b3206eda464689aff99cc
SSDEEP 12288:rEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:rknQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1EB5523697965F98BFB1706F14C8381829B3B0EC6BFD1938F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 12ac934c7c94473b96b04b3f1f67b16267f19a7cfdd2dc964c1083857db3fc93
MD5 46398cdfb9d389b77788ec407d11e3f1
SHA1 d06f5f92268c49aefe1d126a72aba8f9fa0c611a
SHA512 d76d0e6f61cabf9bb8de5c0de7a1c6095c63da11a027ca92c798142658bfe597c542079b9db65c8477243a5ac2ad2e975a56eff94015733084ad87c19eece739
SSDEEP 12288:uPGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWD:uvnQ/tbw/2Mkjy6Fr7g0oD
TLSH
T1165523697965F98BFB2706F14C828182973B0EC6BFD1938F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 b86aa1de47309d78dce435cdbdaa2d4faee524b1e7f5e7e60bc58c5eeea35684
MD5 fd7a9dcefcae30a132c919384638edca
SHA1 458151e2fbe29b6b699d0529df80094792569dac
SHA512 f227f444bb7f55412bdc16320197fbec64aa2975faa83c2a8878943e38510aabf2fe34640d789a6f65ed4f0b7ecad6c4796286e91d1d48d529877a87fdb3aae8
SSDEEP 12288:6DGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWm:6znQ/tbw/2Mkjy6Fr7g0om
TLSH
T1505523797965F98BFB2706F14C8281829B3B0EC6BFD1938F7B481129967C39416CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 bd020b96c09186108c9d4b40c2655bbbd26e30c08b3d9311828fa54eca0145be
MD5 f97fec6f9cfb55be8227a7e04f2b03a8
SHA1 259fad6a85aa38d8d94347a467af081559358f94
SHA512 abfa071521967ef11c21c97f3c6a71297779bb32d2bef067bdc4f7c3618636caf8498be79e5cf0a7736f147c2974a40d6934b1adc8c366609bc63a4d240578ee
SSDEEP 12288:oiZwbDzzFEoS2cPvybGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:rZM3zFVSOLnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T19B7501A5B39058F9EC67423ECC518906D7B27C5A1BA0C71F13A4322A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 4f835c16988903ae5cfaf0d8bd25026efa1dd1a1178bf5633d865ed0d322b467
MD5 caac431989e82fdcdeda2905aa48a066
SHA1 5e22243e12af8ed6940356608c9c3e290e0935cd
SHA512 bf7a06bab5c8f7d371bdf50206ff0fd799f8882b5e6d8f0a58229c0477fdbd29cc280ed2aa6a7e62190d4bf6a793cad8db48ec404bf90b04d4655ea0cb822a1b
SSDEEP 12288:VmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWR:VGnQ/tbw/2Mkjy6Fr7g0oR
TLSH
T1F35523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 e907f29ffbdde74972947336008466d67f09366b5cc87083ce6b8e5c2000a5dc
MD5 c74f7be1c856ebf9d3d1fe813342853d
SHA1 0b7353fa7424abb43a1b859747f3005bbfedffc2
SHA512 b91458c5a5c5e9a48e32f2c16483762c004170fad993ecfb27cf8d5ff6bc453ad8b61b149616fe172fdbfe3d18d0b00588fcf3920bc60685b49e9ac12db87edb
SSDEEP 12288:mCGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW5:mCnQ/tbw/2Mkjy6Fr7g0o5
TLSH
T1885523697964F98BFB1706F14C8281869B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 03a60a10b35401978176984a5444a9b9d297e57990c0d8bd8c8420f801296238
MD5 d7bab5e9f24649f364e742a2901c022c
SHA1 311b262d50b5c20e3cd549793dae0c8b6cee7466
SHA512 a6e685889889e1b36c67be8b4a75b09d4dd11e102e17de228d0ffb15193a4402747e6b4e9f3d312eadfeb51aba04116d5ee186eb8322c4b4df07c2718c2a413c
SSDEEP 12288:ZyPz5L8nGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:YzyHnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T11565021777A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 c66fd5673001b3e4390a90eef5bcdfa258a309fc08a59991635bfa2c01a8df1a
MD5 a87d711d5d3ae380ab77aec228677faf
SHA1 1be5fa00d5b7b743de0a1a72d49e18fa0e24cc6e
SHA512 c509fba0d95cf5759fa7ad801feca9e011532f770d357b18bf0db64d16bc46e5100822d7adf351f6091d6e17850f8e82522d025631727a26a1464cf1bcb80ac8
SSDEEP 12288:0mGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:0GnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1405523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 8ba069132df5b764c8006ba09b28b045cf9d91c6f4852e4ab99f4daeb5331400
MD5 df062328d9f775dd25d8602370aea388
SHA1 9bf60153d8faadfeb0c5fbed505b4ed0d6482244
SHA512 76fc7da9e6ac3a0bed463860e4d915d194d40f0fe75c4af31316bb6cee4ce3c90b9f46620819e4907aeb94d94154feb10f688e41aa402799f21f4299a2b51cbb
SSDEEP 12288:xmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWi:xGnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1025523697965F88BFB1706F54C8281869B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 910248784b937f8b75e19376282bf87623497af0d9821202b8c897b9a0ed2c52
MD5 838a7ed746aeb47d6c6623340bc5d190
SHA1 57cc753f968db22ac8ff1ef9a648e51572346c89
SHA512 6d15f0bcc24663fb253de8dbc03c0023b1146996f2ef667c8f1afb0752a2c4b6cf68e91e0b75e56a4bb5080e1815f601232145badd457294a0cb8583e4192e75
SSDEEP 12288:CyPz5L8nGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWl:fzyHnQ/tbw/2Mkjy6Fr7g0ol
TLSH
T1A265021777A170FAE537427888920A02F77678725B609B9F2754037A2F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 64f7cae97009b84706e22b83e80ae53a2de41a00da0c9fb24117b50522c2a385
MD5 ee71c2745a86d17441d5bfe570dc88cd
SHA1 a7accb8a3eea0c80208f3f2821c30d0e8e3b2996
SHA512 ed023c0a521373adade4b4a48feaa5650f1c6e53ef53e2542aaf9977c079cd99e192fd2518440baffcbad9235f91f931359002e42089e0766141284adfc8d720
SSDEEP 24576:FT0aLl3z0zDNnQ/tbw/2Mkjy6Fr7g0oJ:FTDLljQQ/lFTjN4
TLSH
T1037501A4B35058F9ED67427ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 9adc901975ce8afcfccd8746fe828489ddcb4dbb71cab39074537100f319edeb
MD5 1fd9b8f51e1dce0a6177b7f633f4ee2d
SHA1 3dd8c033083196177059d71db16875307aee3833
SHA512 4ad7ea630dcaecfa5458152c52eb5478c7a2ee4d4cd5ec785ab308014fb0b5b77681ec750f5c617658d2ff185a81984740399f78423d99188dfb1e5b874be000
SSDEEP 24576:u31d9CHKy7GZRnQ/tbw/2Mkjy6Fr7g0o+:w1d9CHKyafQ/lFTjN4
TLSH
T1F785CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 73301203790ea787ed5f088c4378ddb5425bd42180cc201353327c5437138573
MD5 bdbe0b214f4f9d600128e924c4a49402
SHA1 39718eccef83a8b636c7d3b6742adf3481ef7a74
SHA512 aa5fbc832a67dc49085f5383c2a7c4753b428a47c77a4e5417fedf98ef458a7de458d41c47bf49c26ec230fb75b7303bc447420560331d578fe84b4e48b0c27f
SSDEEP 12288:z9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWb:zdnQ/tbw/2Mkjy6Fr7g0ob
TLSH
T13E5523697965F98BFB1706F14C8281829B3B0EC6BFD1938F7B481128967D39406DB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 3764cb405385c88f648be879ae5350e9b56ef93701d93ce59fa5c063d3e0f6d9
MD5 e46869a76845b1652b73abc2cb75b4f9
SHA1 b9beb0615aeca48db368b3d471a37bd0f58b6c3c
SHA512 2eea7703a7f0f735945e47fc2ca21fbcb2b7690099f44bf6e1a75bbdb88fc4280fe7e9f45dd573027b450609aae8caa51b9c69787c4679a38cd1ac22cbbe02ce
SSDEEP 12288:dHGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:dnnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1A25523787964F99BFA2B06F14C8381829B3B0EC6BFD1938F7B481129967D39406C67C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 b23c768407ae4f381eb446ebf8e7504685be0b0a8dbd5e41480ecbd827d9f74c
MD5 902daab4b83049625fd19310e2d8cf77
SHA1 db05f50d4740b6694006ea74829b51f4f0a14cc2
SHA512 f764538c16701851b7070853bda2ca63052086e38e558d5ccfe072e1a5bccca0eb6c12cad6b16c2bdee1be07875e90677a878af420d04aa95e5d16c4ce80b27f
SSDEEP 12288:jYGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWg:jYnQ/tbw/2Mkjy6Fr7g0og
TLSH
T1725523797965F98BFB1706F54C8281829B3B0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 40b8d0740be72eca4b9d5039b0f03cb3352e4428ae088429759733d8889e7f54
MD5 d6c6701d13f937c38f7d3665a41b96c1
SHA1 ce255840445ab80feb99699cf39b29ad67a6a243
SHA512 4e497b2a725a9daf9c902f053a430301e9d27ce5c60989e5b5c230abffb0ab15c13a79156c3f0e59626055834f2eb90489abc39c6c93a685873125538a010e7b
SSDEEP 12288:EmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:EGnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T17D5523697965F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 d6cefa66fe1948be3e8db7ee1ca148c6e7ecd4f929b2b06e5d92ca9d6a0de628
MD5 8988d217812eb4801539993160127683
SHA1 f791eac8369f35eec0455528e18c292568d16ecd
SHA512 c1d9c6da6627c17a3de5f68c4f87f7584f13410d231fb128736a3ee2d2414cde82966d35f497c885fb42acecfd3bfda08a7069276393762db4dae3f41dd2d0a3
SSDEEP 12288:q9GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW0:qdnQ/tbw/2Mkjy6Fr7g0o0
TLSH
T1205523697965F98BFB1706F14C8281829B7B0EC6BFD1A38F7B481128967D39406CB7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 4f8f97f373a3e03efc407c30614c058acb99fb3518166de56582f944c4b5f648
MD5 55eb2c0980d3b25a40d995ebacb0e663
SHA1 846cda520f935d2d360a8de442be5cbadfeed9bf
SHA512 06cc3e517a7165624ad1bbad558b6c14ba2831be7452835bf660fbc153fb0e7e38cf6f8bd42d3f9139edd4ccb1363d6a4a1f5a3c0673f60c7f289c266ed1da9b
SSDEEP 12288:mOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:mOnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1FC5523797965F98BFB1706F14C8281829B3F0EC6BFD1A38F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.2MB
SHA256 505a3624fcc393047993e1c650ed4e1a86ff1a5c014be8d69e9f5e2b6a718f1f
MD5 9a87477f5e929c44ba2cf1bc5f7cb5db
SHA1 464526148a229fed06b237ec900eb9d5d94c4ccd
SHA512 bdafe40d1a57b0699f3b34cfb445d5cd642109b864c203a597d736e25f62464f36348a8213732c4dbd157f623a91274973088bd285a37f2a99fee69b3b7602cc
SSDEEP 12288:iEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:iknQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1C95523697965F98BFB1706F14C8381829B3B0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 fe5785b5d2b89d9e6867628e558513dfb12dcb99bf77108c901c04c8e8b37f69
MD5 8a9617cfed857e0777374dade19cc4ee
SHA1 7e9b0d256ea8b3d6da22af3cd7db2bd2f4ec23c9
SHA512 f4ae2c7ff20e61f03915c2cb3ce58645be951f69126561b14528ea7b0a8180b888100b1806c05263c2199ad3f72b25e2d0e35ee9ffe5a4826d664d4e7c535594
SSDEEP 24576:Ufwv/k9RX6wkyAIynQ/tbw/2Mkjy6Fr7g0ob:jMnYIyQ/lFTjN4
TLSH
T1E185DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 eb2f6d7e876c56f03a1cde7c030f64bc57cd8b0d6d0698c60d4b18940e681795
MD5 c89202374c40e62d31587b345f879f10
SHA1 5bce0c4334cdb2346e3984572d7519eba8d7d06f
SHA512 b95f34300045cfe77a72c092ab0b41d1437b112c1108d5db9670d77d94cbb628b8bbdc3a02a48e9cddabb3f1de0c0ed735ecddeca892c405a3231bbb7f98a2ba
SSDEEP 49152:DYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0ZQ/lFTjN4:HySzP2Lm
TLSH
T156066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 a19374d1bf015aa93bdf593252627a1e9f84edc32efe870f48863c9a57d4d341
MD5 38e28acb70cb8c3a2677fbbac4c96374
SHA1 4399c2766a82dc7bb7133d9f80b5568f4fccd8b7
SHA512 3f4ecf4e9d6e018f6ecdbfcc828caae87b41c9f37e69362feed48101e3cf0215afc109c5146478f3e4cd242e10ac13925ee4611ee38f373b1950584385e768df
SSDEEP 24576:j47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AY7nQ/tbw/2Mkjy6Fr7g0op:j47JUQj1irIhCnDHUPfF/JQ/lFTjN4
TLSH
T1CC65AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 36740cd82a38442364f4d7d23f5b63b094bb72afc40599e5a51c0350e8aae020
MD5 e5ba681386017cf3381bd5977901062d
SHA1 0170786851a84850c1dc9fa922c524b0e2e3fcb3
SHA512 271debc6e47ea7fa9d217c1bcca91e0b8ce24f6404df29c940c6fdae56bb803c805ecac9048cd430e3bb7ea038e0e591f6695a4284315c9a2af15cda9e34601d
SSDEEP 12288:/ssf2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWf:TWnQ/tbw/2Mkjy6Fr7g0of
TLSH
T14F65F119E29852E9D02E5275CB828641B3373C9597E1D3CB67C0F53E0F7A2905EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1020KB
SHA256 ccadc17a0a9b96ab48715f1c414a62658fcc1dce370e8e68cffce9de8a0bca67
MD5 58e23e4f672b0529bfc1a61d795e926b
SHA1 d111cdfeba14d6fa77dd9ae7af065641af29122e
SHA512 3cc3d9d84f5c09d91843c274cbcd25584eb97ec96566caeee85eff34636ddd96cf650e9da64795b95102aff64206ff6c58cbbff9004db6df985e594c1fdebb16
SSDEEP 6144:ksBC2nara5XR9yzccbPotMxKEQBU3fUkdEJR0Hyz+5YxSaCrJbCmNPLcL0Nwk5bX:t3qeU3fAQacVbZnOqdNaRMpdOIHc6bj
TLSH
T1E6251840766AD75FC6AD50325E36D2CCA7707D01EE45AB0372C8872FC576668BAF2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 4d9528eafd1786d1907cf934b95030c5ff4f45cdba860d0e9598c0e59c3f7956
MD5 3f27fe40117c4682c094a4dcbe20e2a2
SHA1 8433bc46d61fd67c81a15a29f93726c58da34a89
SHA512 36e5b78f596a232b0e6d7d56c6149f1e37ad9f6095d30fb2b1c34b620cdbef6d2888241014445c4cefd0961e7648753984c5249d3aab05037f99d43000bca07a
SSDEEP 6144:6mFkiLekmF8tvN34EcbVtMxCcbVtMx7VnmG/sQYOqp65i4:ZN38USi4
TLSH
T1E155C6815437A39BD1FB6032476A9B4CABA4EC4277095F2773C8453ED81BB25A0B93C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 8cf5edff74908d4c336b2bbc70897b942fab15fa8bc78e86ba66f2e1ef2c2ca3
MD5 20589933a49e9355bc94f87ab33710c0
SHA1 be0bdd9ecdc49849d6297287a397784c78c5eef7
SHA512 6f68f0975ed5619de6473e78cf1cf7d9ea2335e4ed0a310f907afdaa57b9677208b1fa5403464b68e6ecddd40f74399e0dad04217bde7ae1b12eabce7ea946b5
SSDEEP 12288:367eGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:eenQ/tbw/2Mkjy6Fr7g0ox
TLSH
T1E85523796668F94BFA3B06B048828111673F0EC5AF90D3CFBB082269957D3D41EF6785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 600b87402fdae41bed16af5117dbf6a04dd3dca6eaa51227f8d4617fa7ec0002
MD5 50ea120615ddf99f4c35947ed754b9c0
SHA1 74bce3a35762ea91106a9ecb9dc66ef5f7696632
SHA512 b2f247fab04cf7990c3227221dc3bb83c1ed287211f1448d0f9277ef0cf65eb5f757fd367a370a8894db0b011380b2217f5e691ee6ff23ae9515f55c378c49a4
SSDEEP 24576:Ggb6bmBIi49WNNFpg1rSvFv7bYQnQ/tbw/2Mkjy6Fr7g0ok:Ggb4mBIBhGF7Q/lFTjN4
TLSH
T1A465AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 cc218d8ae479ff54f0a168151554379ab368ef719892c3b19145a08a9818f9f9
MD5 cc2451bd2bc5b6f1837886203678a548
SHA1 2e617e531001c76b66784aabfc19618bb92d7f1d
SHA512 b18d82724c25b7085f1bf5b1136781932842286c46c978bc5e016e41faa77eafcd87afa224acce45d96c92828b6fe40278f07597ef7b1a58cd44c2a176483e65
SSDEEP 24576:zG88u8FpJqH1Qzria7/mLnQ/tbw/2Mkjy6Fr7g0o6:C7ZFPqVva7/4Q/lFTjN4
TLSH
T11885F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 cd8704f7f7734e64c80a964cd0f75e5e619646ce703eb35f359e10a441299b87
MD5 c4a7842a25d7cd9e161e01d8b59af0af
SHA1 2eb8470f0f731ab125a0dcab08363bbe7f08721a
SHA512 5d2f882f15d1a24259bd2887d45e79ec556f1f1520557e29737297c00b42c60db1840e814e3444d903c4b3dd235c749ffdfe53336ad7435a812e75f2916eac8b
SSDEEP 12288:KHvUrBFrEjwaQ/GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:KPUr+NQfnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T1EE65E12F26AC18E5E676A17D89828609F77278521752D3CF02D0817E4F77AE87D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 d9e7b84a20743d94ec209a846e2e81fa2120edfba5f8ca850918456064b52303
MD5 c335aff3360a32320309fa3779dfcda5
SHA1 813b1c0073ae867fcfc9c6305c97200d0fe4398c
SHA512 279337a9d2e72703288205229ed667d7b77048e52846dc1bcc8f09dc37dea98709a334e537c17dff16f2d60156b05f435c108d428f9b43de3b83db873b051ab3
SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjvQ/lFTjN4:SG05lO43bVLm
TLSH
T1CDD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 3c98772dc96724ddb80ffeb42a940e8ddfbee471bfee6bd3b4c15bf0b9e53bc1
MD5 ee123af17543ce7b2f04735a974e112d
SHA1 c5e41913d91061e92d3c526877c576831a63c140
SHA512 6d110c29174ba54c1fa36c3ec71d0f15ccd3989ef0e30e80224d2bb6a877cf942373050e98e824d01f581d7dfefab6b7019825f9a7d1806cb959341ea90fbc27
SSDEEP 24576:8fa5POZ3dpFWVM50JicR2hG0lasx2+47eidnZnQ/tbw/2Mkjy6Fr7g0ou:ka5POZ3+Jt2pasx2+mnQ/lFTjN4
TLSH
T1A665AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e32334ffa3d81d949f280b695e2558743ff602cab9d9301946ae4beac03f86e7
MD5 6c82a2e2396d77b731618c84984a3c17
SHA1 b97c7c4c790f53e4f9c3cac78228e511114ebadf
SHA512 ff730191e80d31f441950fb5937ed4854b25795b3e6b7e673ebeb6dd84b78a23eeaa4b6f850f7f9f67fc81d2a1fbf095419b1f57742fbae2e43201a4096b3e29
SSDEEP 24576:hNcwHdjbyQ4nLC18lb/EOjowL7FkDnQ/tbw/2Mkjy6Fr7g0ov:hNc/zEOVHFYQ/lFTjN4
TLSH
T181858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 b907a81cc87d19dd28bed6bb9fb37a630362f06708522bdd732ed3f7b56b21c3
MD5 54d24bc551738bdf91d656c8e5ad74d1
SHA1 84997a3467e5e52b1c26dbdd04aa0d5d29a9f879
SHA512 f1acc58c2adefa29b516fc167fc1cb41b36d22be50e191a892053ffdcc3d65b304c081df2df4a5999c0bfa2dcf840b631296b9304d82181b771bc01dd8b79a7a
SSDEEP 24576:y8kNvNnaFeYhJNtmZBm1nQ/tbw/2Mkjy6Fr7g0ob:y8MwBtOm1Q/lFTjN4
TLSH
T17D55AF2EBAB846E4D1BEC6B4CD238512E6727451173293CF5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 20d7bf5ebbae9d27fa03ae58c7a76dd8ea54073f19119623f07ec75befff06d2
MD5 bf9736e2b8067e5d4906aec1450494c1
SHA1 ddb234af899b0a24513004275ceea2c295d0fefa
SHA512 1e5df0acd5a6fe71b9187cc5118757231d3a902da8261c4b0b1ac9159070c7af903607c67d499e54d9cf53c766d5122cd603847d968400cf78dac280d9eb6154
SSDEEP 24576:6D3FHshBIYQgAKnQ/tbw/2Mkjy6Fr7g0oN:6DVHeBIAAKQ/lFTjN4
TLSH
T1A175E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2216-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2216-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2216-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2216-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2216-140-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2844-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2844-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/2844-327-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2844-88-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2844-94-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/2844-309-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3044-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3044-141-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3044-148-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3044-142-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3444-64-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3444-66-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3444-307-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/3444-72-0x0000000000CA0000-0x0000000000D00000-memory.dmp

Download

memory/3696-99-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3696-106-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3696-100-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3696-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3696-312-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/3696-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4124-1-0x0000000002560000-0x00000000025C6000-memory.dmp

Download

memory/4124-6-0x0000000002560000-0x00000000025C6000-memory.dmp

Download

memory/4124-7-0x0000000002560000-0x00000000025C6000-memory.dmp

Download

memory/4124-0-0x0000000000400000-0x0000000000663000-memory.dmp

Download

memory/4124-86-0x0000000000400000-0x0000000000663000-memory.dmp

Download

memory/4172-60-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4172-54-0x00000000008C0000-0x0000000000920000-memory.dmp

Download

memory/4172-53-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4172-292-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/4400-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4400-138-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4400-134-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4400-131-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/4412-113-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4412-311-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/4412-120-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4412-114-0x0000000000C40000-0x0000000000CA0000-memory.dmp

Download

memory/4516-39-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/4516-45-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/4516-38-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/4516-49-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/4516-51-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/5448-76-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/5448-77-0x0000000000780000-0x00000000007E6000-memory.dmp

Download

memory/5448-308-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/5448-82-0x0000000000780000-0x00000000007E6000-memory.dmp

Download

memory/5772-112-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5772-22-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/5772-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5772-14-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download