07b4317a455124ad852125bf82a60f5e30b78ed190273f2cd33609e2fd2b09ba

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 03:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
Size 1.3MB
Sample260808-dmmb6abd49
SHA256 07b4317a455124ad852125bf82a60f5e30b78ed190273f2cd33609e2fd2b09ba
MD5 93809fe3b4fb1d637cb4fd9420056f46
SHA1 e2c28b3671909a9e32c36c5e18513d01ee98a5b3
SHA512 5acf8ee10689a2cc5d76c7fb6164d971937646d350f893b5d74acbe118f8630d701c70df2c656951a6e3699d4f3c12b4ad3cfddf3b88055af84687de99fd7714
SSDEEP 24576:W6zFhBykJfB+tn7IMwKpLKy0TduSZpUR0GHrVQ1aW4mSOgv3isi:fjykWt7IMwKMykpAHrVQ1/fSNvi
TLSH
T1F255E025FAE1C839E66282B90DF4F739403D5A601F3909C7A7D45A4E6D30AC33EB6D46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
3052	elevation_service.exe
3308	elevation_service.exe
4396	maintenanceservice.exe
6532	OSE.EXE
6288	PerceptionSimulationService.exe
7120	perfhost.exe
3424	ReFsDedupSvc.exe
4132	SensorDataService.exe
1516	ssh-agent.exe
2492	AgentService.exe
1440	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2029b5ca957eebe4.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f26c361fe326dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000073d57d24e326dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000047d26d22e326dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
6992	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
6992	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
3052	elevation_service.exe
3052	elevation_service.exe
3052	elevation_service.exe
3052	elevation_service.exe
3052	elevation_service.exe
3052	elevation_service.exe
3052	elevation_service.exe
3308	elevation_service.exe
3308	elevation_service.exe
3308	elevation_service.exe
3308	elevation_service.exe
3308	elevation_service.exe
3308	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	6992	2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
Token: SeBackupPrivilege	3424	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3424	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3424	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3424	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3424	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3424	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3424	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3424	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3424	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3424	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2492	AgentService.exe
Token: 33	1440	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1440	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1440	SearchIndexer.exe
Token: SeDebugPrivilege	3052	elevation_service.exe
Token: SeDebugPrivilege	3308	elevation_service.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 4716	1440	SearchIndexer.exe	101
PID 1440 wrote to memory of 1124	1440	SearchIndexer.exe	102
PID 1440 wrote to memory of 6668	1440	SearchIndexer.exe	103
PID 1440 wrote to memory of 4904	1440	SearchIndexer.exe	104
PID 1440 wrote to memory of 2804	1440	SearchIndexer.exe	108
PID 1440 wrote to memory of 1972	1440	SearchIndexer.exe	109
PID 1440 wrote to memory of 4352	1440	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_93809fe3b4fb1d637cb4fd9420056f46_darkgate_elex_maze_stealc.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6992

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3052

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3308

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4396

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:6532

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6288

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7120

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3424

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4132

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1516

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2492

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1014449518-1831897916-4205727055-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4716
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1124
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2832 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:6668
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2900 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4904
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2804
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2900 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1972
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 948 2832 2864 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 b949d9ed384ff1402ca7b3db0a1e4bcf2d9facbccfdd7b465aa466e26f17b130
MD5 69e6dfa28efc193d5061a0b7ca36b3ac
SHA1 f5ef1f7097aa00095566ef440ca5cffa36eb0c2e
SHA512 44ffad2013c130ac15f8ba7761f8ca74078255ff697773e283fb679044f7c889726d4c998a29c45882c187c7d2e995c0798d000716a38ad6029abbc864cda07c
SSDEEP 49152:rb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnKpAHrVQ1/fSNvi:53q6HjBtpAhQ1CNvi
TLSH
T168D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 8848028cdcff2dd1cc70e516620aaf7302eb822e20bc04c21910c1e06fdb7865
MD5 7461ce479f0c97e749f310d1c127e801
SHA1 07ab3be27ab7dde9416ca65dfcc5817bf054646b
SHA512 f6329583aec5dc9ea2f4719ca27072ad5010b79d78f224b53f827499e860f5b49d2a21e6427a86710ae5570f111efd5b9917504f8b0468534f081e33cee31a2d
SSDEEP 24576:hXYfDtczAfTduSZpUR0GHrVQ1aW4mSOgv3isi:ktc0pAHrVQ1/fSNvi
TLSH
T11B85F12977E404F9EC67827DCCA28511E6327C914BA0E7DB03E4996A1F332D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 9bf798ab4aaac4e1f379aa0237deba38092dce3d58d745f98842635559044e3b
MD5 b09abdf8f1c6577d1a5f373d33d182e9
SHA1 792485ff2cec507c23db93ec787ebe72eeffd307
SHA512 78c3e2c5e451b294bce2cff74fed5c3218dba2b65b921724ee41b22c6d0511b471dbbd7ff1cb2563c60f46c0683f21f9cf031d7f0390fc6deab20528a7623c74
SSDEEP 24576:X0Le5ji0hmxirMGTduSZpUR0GHrVQ1aW4mSOgv3isi:XPji0AcHpAHrVQ1/fSNvi
TLSH
T17595AE56F6748371D073C0B9C5D2A69EE97130821B308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f3932c3aa5621b6f1007aba64f2b23c2d3c00d2cfde22e88e73e90159caa417e
MD5 e4f40dc51ea7593a442c81fd8cc4d0a9
SHA1 d6b79075d60a20533ce5cfaa55d8f7a586699706
SHA512 0bfdee5d63e6e8052503620c9c556ff7aafaf233e2bec5b878f01c351e2d6c6b26637c6d8760ba24c72438439f5cc18e65121af45086dcc6b545a86f7af6f0b5
SSDEEP 24576:pa7/ezSC6vUyD/aqgrvWE6q8wyuUTduSZpUR0GHrVQ1aW4mSOgv3isi:Y/ezSC6vUzPvxHjyLpAHrVQ1/fSNvi
TLSH
T150755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 b6be95819b9835ead3b4f0eee4ffef4b542c0a00573db4a1f8e055b3aed1c72d
MD5 1cd58047da292f82f08c0d948eea5243
SHA1 ef37500518ea8c61009054bf3388fa3686cd8747
SHA512 29243da61453b17233d123247a5f7cc1f50f08d5f6c426ec152e75cc5996783606be6a9f7049ff2521760a7d5991ca3afe6a5560cecc28617bbd01d0a9524520
SSDEEP 24576:NVbqPb88hv/l+67TduSZpUR0GHrVQ1aW4mSOgv3isi:NVO88hXl+2pAHrVQ1/fSNvi
TLSH
T15F559F66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.4MB
SHA256 46bfa9a3b770134077c3a5d461572f0a227f9cba3a34b07f211860f503023eab
MD5 0ccbb9e43e747c9039024c8164fb69e4
SHA1 a2d1f0a034be965b5690178407c1b107a1d2b5e7
SHA512 be3be7a98692f2e66acb4475cf829fed17c5bb6a9b77ef017bc670f22739c8d94db6f1e4cb8dd7289ca5b9915f7c10087d8b7b455855399dfc1d070649d72a88
SSDEEP 12288:CRSTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWc9:CRSTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1B86523C7279920F1FECB07BA0DC998A491315EA06CF81993D6A4799F563E4D0CCAF126
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 46afb23e3f3797ffb9b1a5e933a0e9150faf5e5a6d068bb8ef14b4ffea1ef3a3
MD5 c9fd35945ee7fefbaaa0949ae9cc2a2d
SHA1 ed55292be1875be79cb9082532f52a976cafd534
SHA512 92157f262a76728cfdd1eae749193916f9821e349c6fdb711c61fdd6161c4c687e3bc016caacd1dfa41910df6f921b1a55b1f038ea642ca61e25d886a687e748
SSDEEP 24576:eJIUzTduSZpUR0GHrVQ1aW4mSOgv3isi:eJIUlpAHrVQ1/fSNvi
TLSH
T19385CF7BAE28FCE2C67E4DB95A918640D77278704F61A3CBD174820EDE235E04D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 eb664c49b79233b0438ba350364cf73cbe8f411855186ddd27c2891c16f30b04
MD5 1bd5914fba16f5cf0b9edc3e2d8d9653
SHA1 b9a1b849ff13cb532a872221f800fc1f5e65dc22
SHA512 b402b7424f42a4ad1bfcd87e84da630fac0d098dcf39c5430b2682d2141f99c8a622b6813070762615b851405a3c68bef031c224e273667786e9694b7fe86cd5
SSDEEP 49152:KQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THX:KQvGAdlCEL8c/yRNw5CUpAhQ1CNvi
TLSH
T1F1267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 072c70df4900887cb36d36412333e67b5a95652bae170f02b4914ba1da673d0e
MD5 1acb4fadc36e69c530bbf504c8cab1f0
SHA1 88829c06ca62493455cbc63197629d0829cd8238
SHA512 231225c9e218c6ff38dce63ddb70d9173d540b8222ffdea75f63ff3faa0a94e29044b6c5eb10bfe5c4619d4a5f8daa9fc11597f61953909c0f2874b73761ce36
SSDEEP 24576:pdewsAjpTduSZpUR0GHrVQ1aW4mSOgv3isi:3ljXpAHrVQ1/fSNvi
TLSH
T17885E031FE74E032C6BB0DB61B26C716543C7A604FA119C3E3A89E9E59341D2277AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 8b88d08d775adb6671e24f9657fb88c77d92bc8b10a4c43aa1454190331ff537
MD5 4f5a519480bd1fc60232ecd4db95ec8b
SHA1 c843db88825ab9815869a90de9bdef2de391324d
SHA512 933c09bc2a8d358253e1a84721f82b57753b0c9a70864346ab5786cae2dfe4ee109ed041be0b37ea5084762fc812aacb674e5b27685b7c7c0162a7bc7002f63b
SSDEEP 196608:3UEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJH9Ui:3UEtQevvqc2W1cpV2EI32G
TLSH
T1A7474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6d7a5d6b049ac45c211e25fb0a640f3b8cb16d504899f89c49dd76bf6a9e7112
MD5 8c76d5bc92158bb9f758846d26714765
SHA1 3961fba98ec7b4778588458b053c3489124551d2
SHA512 8b0478280220639cf83fb3e0d9d5a56d8b1ac6599e744605756839035323a918b802d3c95343489949e99909af21fe49480aba64622281991c5c3ce97f6ad86e
SSDEEP 49152:BCbRquA/m2yL5zLfFiV+XenmE3/z3pAHrVQ1/fSNvi:uoq2VjnmYpAhQ1CNvi
TLSH
T1E7D58D0976B8C1E4D1F6C77886A2C647F37178154B34ABEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 969549b8ab573bedb0bfc5ca856f8c5644fba5e195fe7595aee2e4be5839b8ee
MD5 dc8c03a637567190fe93bdc1d80bc037
SHA1 7d907ade72f6dd5634d189132687b13774a602e2
SHA512 c786cad857d66cf29b0daa347d6a1fc8d40433f2fafcddba0fc3e5c73c3aec577cdaa74a68ab71826775935bca17e9844be981a48a974b36aff01fa8cf820e47
SSDEEP 24576:3AhGLJIFoiwtA5l7S534TduSZpUR0GHrVQ1aW4mSOgv3isi:3AMyFoiq5opAHrVQ1/fSNvi
TLSH
T1DE359D81E7F955D4F5F3AAB899B68570EA76BCA65E30C20F2160D11F0E33A509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 7ffb02951cc7dcdac1a97349b1e1b4a1e5df2795dd7580c9b8d9adcedb5e2031
MD5 236f041fafea677784de3fee73908083
SHA1 243642513710deeade84894f6230cc352bf06e15
SHA512 3103144ed13049c9f3cabe720a60baa81c42757a71a5d189400613ca96bbf2fe38ef9c08fb13681e975afbd78ab968507334a7a651be1a41643d0a61b538513d
SSDEEP 24576:9wuoOWtTduSZpUR0GHrVQ1aW4mSOgv3isi:9wDOMpAHrVQ1/fSNvi
TLSH
T1B885F18637E41CF9E9A742398987C135F3B2BC112A749B1F0760C65B5F37261AD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 b994833216d770bfc1c057c25b7eed932a041626257ea9704e4bdaba115f7d8d
MD5 9b40b390ee8a3aaa5403aa871730a18b
SHA1 c11b715fdc790b643ef7f1dd95e7c5877631fc04
SHA512 0d13fb2d010a94b524592cfc1f9b3a70739ce7a5e173d1cf3b5c60cd187b6d2fdf92bb066e4d56a16626d8bd5f506271de0bd941c747b39fc7d7e8ca41c03431
SSDEEP 12288:oBZ1IyZTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcR:WZueTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T12D75128A33E830F1E997427D8DE54A44D3727CA22BB503CF5664526E2F37AD14D3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 90f6ca4f54d88a1f5970260e81f76d24919de734eddc6f980cf782c765848517
MD5 754e5152db454b7dc42e880873df96ea
SHA1 3f205b92558fa28756f12def4615f86474feb797
SHA512 83c098c582e55e7e1da15f3cb2bb712ec81f20288e6f3efeaf7fa71698ca8cca62aadf6f9aaa86c2e4e4c99f19a065817acd4c6f8923d8fc9e0087f1728dfee1
SSDEEP 98304:cQRQyi36YOcPQLvw2gAf+PN3ppAhQ1CNvi:DQyiKayX+PNzUi
TLSH
T1A1667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 7d6d915517471ad9fa48450abd5ba073d727919e428b6a793c51b86ef5cd4280
MD5 9b675edcaead0412123d4c66c72f66cb
SHA1 cccade01501d964b67df9b3769a8b4f4e95ff495
SHA512 01547c3c95fc7a1ff8d39fa94de3f9c1cf8c143d2f2bdd6b22c50e99314891914bfa54de78d7e64f409780fbf36e8387a51f64a46cf6f42d4f1f479be630f07d
SSDEEP 98304:CQRQyi36YOcPQLvw2gAf+PN3ppAhQ1CNvi:ZQyiKayX+PNzUi
TLSH
T137667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 64653023fcf9270b3ffe74bd1fe83c20d40b03335bc3a624d80d3da1464a0d40
MD5 86780e19e7a340a488113cc8f1124a9a
SHA1 9d6b7582c6dae5f49cffea2379b2de7a7fbdface
SHA512 93b3cc4c9a8c589cc7dc3f80f844b8cd957ebfcb2a9373037e42a5fde02b3c80e0a926debe1c32a2a6f3398555614b9eb98184c9e0b2347deafe7a5f93c8d56f
SSDEEP 49152:G68Qg55nhheWu7PNU3/HpAHrVQ1/fSNvi:kthWRc/HpAhQ1CNvi
TLSH
T1E3B55A33B2F600A9D44DD1769F4A873196E17C718FE0E3DB8515720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 17f99a966a5d0221e21b55ebbab5c2f024b6b9f00b72f501742c04de108b57f9
MD5 2f236095f4de8d8c428171a55c196a1b
SHA1 efbb5872343b7a73db8f323e9c030b6ab73ea392
SHA512 ea04dfd143adc96758c3ab099a92ec534b1593af7625e6e170750093cadef5de62900cb415809a44d602f962fbebc18b3363caf761b2ac50f7ab01803064c911
SSDEEP 98304:3y5112gYy5azzVvL69nLKnhZupAhQ1CNvi:KLIHmWhmUi
TLSH
T116167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 a712f5f867e86bf8505053af13426cc8dcbacfb69e73417067caaa31f4757a4d
MD5 d01952578f4dd2c788132c2462ee849f
SHA1 84daf1d3a7ad2ef244e2ca78305d4faa77567cea
SHA512 22708b16dbfc12732303f89905284d7df736159811043e0e085f890d3c9fbe5a5bc68db54b5678f47b664c121ffd4ed5c0f6fe85e7619b4ae431e36d7f057686
SSDEEP 49152:TB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glRpAHrVQ1/fSNvi:lu6JmVxd2dRpAhQ1CNvi
TLSH
T1F3D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 91c94ef35defc3370718b628f132dc93f55879dc34b9e3a0381097468b2ce400
MD5 f76bb4a4f0fd39d4e81e55a849e17bd8
SHA1 33ea65a8ebb261ca1fa9080a44b3037543bfc127
SHA512 af8411d323e639c7204edd13ae690e74cc983b7233acefb2b8916409763ee3fd4554c9173a00ee428d5bdb0a462a870d83a02ce275b3de1a162ab49d74b1998f
SSDEEP 49152:c1hpsNoJpF1A6UU44CwH7R4xFpAHrVQ1/fSNvi:cmifPbRYpAhQ1CNvi
TLSH
T1D6B5BE13F2D900E8D05ED17887569632EA72BC460B34B6DF0A90B7961F7BAE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 e7f16d6588084df925252854dbd18536ec70c3ceaf6b1a28e6bcda4961da285e
MD5 50c9cd533309a1824e344421178a9cb4
SHA1 8fec37b96cbed2fde9f7c6072a37a1b6c1190496
SHA512 eae448b8e393612490a2ae5ac528c298c2cbb85cb7f8f66b035865eff8b4f4e9bce2dff4753321fa2c8d0c00d615535141a6b1d1407bb45430121d2f712c7bbd
SSDEEP 49152:rSuZQIY0Be2KRRVtOnks6NMHqapAHrVQ1/fSNvi:55dKTi61apAhQ1CNvi
TLSH
T1C3C5BF03F2E941E8E0BED6748B659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 eb9ecfaa9e565d129cdc2945753ed28f534df186d4d04f4f479a8f91175b794f
MD5 51c13a2b2efd17fad59fc773c5d63ef1
SHA1 a76c103abab716c4b0ce83f8bbcf804691bb76d4
SHA512 28c286bfe906d99fbfe9080953c4337b2468c1b4cc122cb1cacb62029f22a71f55a8be60d92c40184fd706984d723185011a74d6f183b23c80f2129b5751246c
SSDEEP 49152:7htSn8EApI0figngiDn0AP5whpAHrVQ1/fSNvi:aX2iyphspAhQ1CNvi
TLSH
T1A095BE13F2D900E8D05ED179C7468632E972BC150B39AAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.4MB
SHA256 fb6ee568d9e816d5fed000cc54d5edb65f71844811cd5adbb3449135bc6e6d0b
MD5 54eaf8cd20039bed03ff7db5567165da
SHA1 c5db45a804a3a2b4739d83401203b7b4faa84e2f
SHA512 89a815436eeaff79dc4eb386e6029a4ffbc1ea780fd9b83cb0bbe7123b7957f9fe14ee85c3166f3c428cc9405977e5eb1ef6d80ddcfc4b25444ccaeb9cfad6c0
SSDEEP 12288:MKTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWci:MKTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1166523CB27AA21F2FC8707FA0DC985E4D1705EA27CF81497A698641F673B4E14C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.4MB
SHA256 ff41e6036bbfc9815d53ae563b0d06867045183db6576a2a7ea58233042d34fa
MD5 76eda694d99274828c6057bdce567be3
SHA1 72140aa12226d238e42d4e97745d2a7d2ce627c9
SHA512 a682e9583d54fbe37798a3d93cce1e2f627cc8666e184014d7215f3d5e273c951fb646996bd7665e1434c4ff357c5e114277827777a4d332d9c64b7af8ce9386
SSDEEP 12288:aVTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWc9:aVTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1A06523CB27AA21F2FC8707FA0DC985E4D1305EA27CF81597A698645F633B4E14C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.4MB
SHA256 f93c4dfb12ed1f5a4fb900ddd279cd6ae1bf4618820fe394d8077a7c7d5fcf0f
MD5 7ccf86135ced354ecb86e389e6213414
SHA1 e8bae4830e975579ff84c8c339039ed3d5c1c42d
SHA512 1cede592b362951fde7aef5ab43c215ad6959d9508b6e9b42c241f25724a59884830c60506bd58490e552725dd26d9cc45f15c4b2021fddbd994bdb1beffe72f
SSDEEP 12288:PLTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcZ:PLTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1026523CB27AA21F2FC8B07FA0D8945E4D1705EA27CF81497EA98641F673B4D04C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 4b843161d68092a373394f47d74382482752b863c535f0777956e9c17150bf90
MD5 4f13bde68225aa47b09d7742b846e645
SHA1 49e6075e7b6265b99a414ec0b5bdc8a7f7bfb765
SHA512 ff137da2f2fba4d6aaacd1a84e0e60a8006640f1f45778c2e3e0d3040a6b904c19b974f562cdc540ddd0a42d5356d3719b7a77b71e28ebe8013f9f7bbe004f74
SSDEEP 12288:nVYTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcQ:aTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1A465228727AA10F2FC8783B98D9584A0E2717DA17EB416EB9A54144F1B372D08C7FA64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.4MB
SHA256 2424954f16b86358970f224a348f80aed1285e7318695004e1f7111c455cefd0
MD5 d1166c81662c3bf1c3e1c75199a7a94a
SHA1 be94f7ebd40d7d58d185eefa0094d33b85cbca05
SHA512 742b686f8f8cae4f457a3e0b00b5f09122a4ee94a884c8936ed9fe36c685c2d481b72ec63cfdfd7d45d82cb70f1847df7b1c7be875394211570c9ca02b350ef7
SSDEEP 12288:lgTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcS:lgTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1576523CB27AA21F2FC8B07FA0D8945E4D1705EA27CF81597E698641F673B4E04C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.4MB
SHA256 0e5e8960ae1a17294d194e640f04605b20dbf549eafc11168bb2df6e72788ca8
MD5 2a77daf7860a71d2dfb1cf7f5d750b89
SHA1 8f5e37a60b0d85d92f5c2151dfc3a226de55ed49
SHA512 e27cf2abca8b931ed9a42d91bfe920ebf49fdfe039110dbd37f5f27c4d7a6c65bdb3a46828cf9c19ef5d22ad628829d35602eeb3abc5a1bfb956fd43596cbaa2
SSDEEP 12288:khTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcq:khTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T17F6523CB27AA21F2FC8B07BA0DC945E4D1305EB27CF81597A698641F633B4E14C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.4MB
SHA256 08e9a713d02fe49e19458c87f384cc75d969eed9a031785228f66341d582da07
MD5 44dd77d6e55afc86ea1ea419f6aa837b
SHA1 9038b1f030f479b8b52845ada3e1c31473165992
SHA512 e50f6c31008f8bf31bd1e8ced2e6db5d4ceec1d9731cddd331646f5e597391fb61476122b2f03db11e5d36bde82bb9579da4b474cb7bddb5d2bb07c665fecc01
SSDEEP 12288:q9TduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcl:q9TduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1336523CB27AA21F2FC8707FA0D8985E4D1305EA27CF81597E698645F633B4E14C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 2a957775420ae42f9215f2754d094d2e7b89c228263fa0501bb347d96d9b4f7b
MD5 c70f09ed6dc3e2c078211671af918f0a
SHA1 071ccaad7a82d0d40df017963a184137a4c9ea01
SHA512 43256425d51756f457852533a44f628cd7ea1cbf9be9bf3d49a9de9f0aba06d5adfce754edc92944f8e2d2fab93225f810eb9be7081103a9ba5ceaa2476b1ef0
SSDEEP 24576:+ZMSzFVSO1TduSZpUR0GHrVQ1aW4mSOgv3isi:+ZMSzfvpAHrVQ1/fSNvi
TLSH
T135850195739018F4ECA7823ECD558915D2B27C661AB0C65F13E8366B5F333A10C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.4MB
SHA256 d7396d0af8bd70725cb296c884573cc38460b9e3b78a4d89080ed93366d61325
MD5 1a2089eb68351f7ae3b9373e218ac15c
SHA1 1391e515592cb95c25319fce9325aaa154558ec8
SHA512 0071f5eaf88ef7651166a4fdbc9f5898b0c023f3e51353bbbb00ca157ada85448a898d4c242ffde364704ac994f06db529b2d136507b95fa57d007f8a1bcb21e
SSDEEP 12288:GOTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcf:GOTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T14E6523CB27AA21F2FC8707BA0DC945E4D1305EA27CF81597E698641F633B4D14C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.4MB
SHA256 03ea8a20c361c24a3f616063bf45ebd610edd202d272fce76095dd49e6485fb2
MD5 ab3829161bf988d55b4ee9444cc794a4
SHA1 d9bc809a6aca350165ca2978cd17c1b59c6bc867
SHA512 90505cc40a277255f77d18dcb379b23835ac6afb1b3f04d8e9b89e756d979f38e9e8f4e9dd6208c31d50d124bd6819cb17184254b0d5497b6503c10c545847d5
SSDEEP 12288:oCTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWc3:oCTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T14F6523CB27AA21F2FC8707BA0DC985E4D1305EA27CF81597E658651F633B4E14C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 5855e9d6134f3846c32d3afcf095ebe7f162847d785955a5c1d763dd8518305a
MD5 ca448493f129d902da9447fa87fd28ac
SHA1 d144a4410c9121e1b16ed0d3f8063085059e6fab
SHA512 9016026305df6a99bb1441835c72332b2ec0314641e6f0c698a20d7ea841c41fec4e5b6d8065ddaa2f263998f0e56010e6c7bf00fff6e26a777f6d5f13997ca9
SSDEEP 12288:1yPz5L8ZTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWc+:czyZTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T18375014733A530F5E867827988920A51E371BC721B744AAF57A4067B2F376E09D3FB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.4MB
SHA256 17988bda92033db8ef4fe444f2631501851ec6f68e0e5aea239cd7be4308f9d3
MD5 5b243e65edcb9e60d2b9ab376eeaa0d9
SHA1 1b24a971b3e88572c59888cf8872ba9414aad037
SHA512 349f0ff55b5a503d9c9003bba7343293c67d5f0548f039e1f794183e92fa53e40298c0b7cccc24e62af370d4db002906834227164581e3f15b1b868279ffc678
SSDEEP 12288:9OTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcF:9OTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1736523CB27AA21F2FC8B07FA0D8945E4D1305EA27CF81597EA98641F633B4D14C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.4MB
SHA256 11ea55704563ebdd16bf1d974dfb52f746002ccb070f328b8b7788913326bbd7
MD5 6da4bb284557ba86d0bc3c318481c841
SHA1 759bc4e3ea006b85f48b37577a93f9e58e1c1927
SHA512 d24ac287339156930edadd8c3cf6941c7a54e63f7ff8094c7127d066ee51870c2b25075994b929084441dc161bc6100a6fa6e5e155755df365f712b9a435dea5
SSDEEP 12288:SOTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcu:SOTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1F66523CB37AA20F2FC8B07BA0D8945E4D1705EA27CF81597E698641F673B4D14C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 b39a2e57e7fb20eed9a678c15445a91a20bcd75be2d037466a38556512e89b7b
MD5 201c86711f5e3004d4325de2101acd7e
SHA1 cf425a5de3259251e3a5c61a2d849251fba3203c
SHA512 be3551ac4ad18e1c090134878db3e1fd38b0017646d7656e56127855459c5abfc6a96e34fc334f821058551cfc63534e586d1280211c26f61a14244d43f95e7b
SSDEEP 12288:ByPz5L8ZTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcA:QzyZTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T10875014733A530F5E867827988920A51E371BC721B744AAF57A4067B2F376E09D3FB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 fa44e9a36d68247836ba5b716167cc36eb88abccdb9f10b6e11c36eb97096668
MD5 bfcb76eb1d148580729b680531b55290
SHA1 81d6fbba63e0f297ef2953e44f52a9495ec5b9d6
SHA512 23efd505440e1dce6ac8d673b504ebf36d4ad3cdb4703e1bd0eb535dfd4d65fc9a9d6d10408b2f9cbc11e995748b7c4f23944d2afab71ee381d03eb73d96dc82
SSDEEP 24576:ATHaLl3z0zDbTduSZpUR0GHrVQ1aW4mSOgv3isi:AT6LljEpAHrVQ1/fSNvi
TLSH
T1CB850195739018F4ECA7827ECD558955D2B27C660BB0C65F03A8366B5F333A10C3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 bdbf9b6feda87325b2d16f8b0727b88377884fb49d0c6bfe7cb02b95907a6cfb
MD5 2cdc042765c8d10d030bed9d2d5a4056
SHA1 a0dc969ea2f53f503309e60fc94fbb8ee154b961
SHA512 4e26539af9fcd1e1deb0ed2af70d075c370f341ce4c4de85f63aba306149ec22125a8048947c7f3106f1d9224941f2f23705c569ad3402557c0e8e4f66083da4
SSDEEP 24576:J37d9CHKy7GZ3TduSZpUR0GHrVQ1aW4mSOgv3isi:Z7d9CHKyavpAHrVQ1/fSNvi
TLSH
T14195CF91B3E410E4F4B78A358D764511DAB67CAA1B71DE8F03A8261A1F336D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.4MB
SHA256 76195d977544e772c7e821202ad39e931eab91865f0c60ec804fe5f59b29c271
MD5 d238cb34748f412e099e9089e4cebc65
SHA1 bcabb103ae04f55cf6577b754fdfb01c358528dd
SHA512 6fa097e7c0ce4ffa0e136d7faf74fb8c225847f592523da4fcf9b2dac879a6021103a144018d8fb340e376cae912a75a5829699e3b1e0574997da45b3723dd39
SSDEEP 12288:crTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWc3:crTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T15A6523CB27AA21F2FC8B07FA0D8945E4D1705EA27CF81497E698641F673B4E14C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.4MB
SHA256 5ee16e56052f42122d110cb15e10f22c95d946bbff1367ecef900e65ed94e978
MD5 bbe82da3a031a5c73dc019d1028752b0
SHA1 76aa7c197b0932a41f01871d326d42b3b9c61297
SHA512 59bad3314614ce37243a92409225750226054a2a496ba9d0450106be11656c0597e4165b9df355c211fe62e723683718cafa75090b06afb95a65a83420f9dea9
SSDEEP 12288:S5TduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcy:S5TduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1FB6523CB27AA21F2FC8B07FA0DC985E491305EA27CF81597E698641F633B4D14C6F469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.4MB
SHA256 96f76712bcc53dcdfcdfa4dac4426c461e9d0742f8eb84e8e0b843738551295a
MD5 f3cc1cbacde42fed17e68266bfa195ac
SHA1 4934ea848bb5c6299f61b69d54c84c8cab27bdb9
SHA512 8a93bdccd2243d5e42cd26c894fa382234f44832f26c6a97ef94c1247c07775c0309ae9a164d16b78140b4773cb53d547dad643d8ba0483dd516543da364423f
SSDEEP 12288:b8TduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcw:b8TduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1E16523CB27AA21F2FC8B07BA0DC985E4D1705EA27CF81597E698641F673B4D04C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.4MB
SHA256 c36b9c87aca478736b9a745fd8deb10fae4ab4a476c0d2350cded9f6eb23e562
MD5 fa6ff9500bf0a39402fe89d00d57237d
SHA1 54bd7e3025efc2c82d2b947a3a3ab71374ea4301
SHA512 af87015f37c42702089711bfb942f8d645b92b097b21f8b8d0c1d980ef66efbb4c746c5413a523b1c10013905fa2b2045b70c42ab990dfcc187d9a944cebd20a
SSDEEP 12288:3OTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcZ:3OTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1896523CB27AA21F2FC8707FA0D8945E4D1305EA27CF81597E698641F673B4D14C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.4MB
SHA256 9a0b79982c6ee8eeab4435689cbb3bd22d0dc91c55b52a584671f5617e2a66ba
MD5 337d6eec002ee8f93422371345e3832c
SHA1 50073ea57101c1f62281898b8baea2955772c4ec
SHA512 499cb5e70c23da880d66ef668809d9685101fa07e002b9c7a7873bd003e960d01aa3ed205847b1f4daf5cd5f0f125f51f187f710e7664eb4e5db5bd4bc608f2d
SSDEEP 12288:RrTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWc1:RrTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1966523CB27AA21F2FC8B07BA0D8945E4D1705EA27CF81497E698641F673B4E14C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.4MB
SHA256 ebf1b177434f2613799dfd5e0465ace8a70a37b086e101f4601bbfbd7f5bb378
MD5 6346c97a504abd9546c1ee5d1328a2a5
SHA1 cf5ff5d271d292cbe1a8c54b76d96c9a572d4f29
SHA512 5f22da29de9ea87f0482ac27334e7799fafabc5d5382f3638d90dcec7e45ac133eece1a4350e19a15a6a276fc91908e8c6e0e65961e71b6d442740de150d2b65
SSDEEP 12288:7WTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcy:7WTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1E26523CB2BAA11F1FC8707FA0DC985A0D1745EA27CF81597EA98650F633B4D14C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.4MB
SHA256 97b2baf0c22ec1710589b954a3bc4f91589335f4d1e7e510ae142aa5b384ca67
MD5 900843df974550ee3b20fbc5a17fa5e2
SHA1 c9f9d8e0e9e0742ffa18ad03c3d1c239c1382c17
SHA512 ec6f267b4026de21427dc28c7c2083244d33785bd07d97661770ea6a42b49a5cb1b009c1f207fc3756e554d73406d8d0fc19c33f1d8957fc31e0fff7f1a21f04
SSDEEP 12288:5gTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcN:5gTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T1506523CB27AA21F2FC8B07FA0D8945E4D1705EA27CF81597E698641F673B4E04C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.4MB
SHA256 11e72f316f4fbfb03508b7171b344572607b5aa8f021af7a3c5a04dca309038a
MD5 962c2841c73b38ce2a9aa102ab7ca1c3
SHA1 bfc49028bd06231e03518917952aad8e016a826b
SHA512 f04984fc56094952de051a40d3cd9b427f73406a595200bb65afd0c32d80c91c79f031ee22a46996df46714aaac4b6293c3421819b856418b08e6684ebdd652d
SSDEEP 12288:hjTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcK:hjTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T18E6523CB2BAA21F1FC8707FA0DC985A0D1345EA27CF91597EA98650F633B4D14C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.4MB
SHA256 e75df7513a357604591a2c080c30ee70a3d497055143fc0378432914d1ddae37
MD5 9b591d766bcb2bcec1fbb9805f9a1f28
SHA1 1798a1dd18147971f0d8a75790d430cc36530a62
SHA512 b90ef89990b2c355618e935d02a09ed0c6b6a75d1528a33a04254ec879b7719b31307b8afc7856069113c269413e208c58ad2a0d5303697648cf5e66f70caa7f
SSDEEP 12288:bgTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcq:bgTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T17B6523CB27AA21F2FC8B07BA0DC945E4D1705EA27CF81597E698641F673B4E04C6F468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 25fbc73ba663b307a9366e3d674a49c71ac80593e7e3f887d6025441107c5f32
MD5 ea39f154e39705342c8f883226c5a3fc
SHA1 d307d833ebc0134caae1f6e3a490cdb51bd9a9dd
SHA512 e2d5d6f17bb660dede876d4d527c463323e0efab03a98ec00aa7f409f3665ecc5912e8c2b781f3e5c9d3f69781bdb68be0d4dab9bd98c36a8d66be59778c6666
SSDEEP 24576:yfwvok9RX6wkyAIyTduSZpUR0GHrVQ1aW4mSOgv3isi:eMnYIOpAHrVQ1/fSNvi
TLSH
T12095D029EBDC04E1E1B7923C8DA7460AF2B178691B71C6CF1299536E0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 b7d874576d1e2cf7b4f64fb9c508bdb8e0e832a1ebe2efb9998f6323c35c5315
MD5 8abbf56eb1bac4ce431c8c33c76921f8
SHA1 6dc32c1d86b569b02012f7e776ee762e90cfdb4e
SHA512 8e08af9af1f1b6d5923d1cb88445c6dac9bcd27298e876d9220437f83ac6fb5f9856712fbbd0521ba8f07a74fe2111177dd5844a95e17f3c8b7910bfbfed805a
SSDEEP 49152:vYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0BpAHrVQ1/fSNa:rySzPJpAhQ1CNvi
TLSH
T162066C96A1A801D5C1B9C1B98F0BCC1BFA7134490335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e0ac5b428a774cbd78fde96dc789ca5217e65248ac66eb5e0edd3443a722573e
MD5 37561779f0ce4b8a2cf3387303bdbc20
SHA1 68fc21aae25618edadfc612dea7f0e99f76057ff
SHA512 59424dbecfc776f0eb7242855c3822ee02f3965f24be3ca5167b6667e101210c815efda4b78a65f5ded011e521af34d585b55fa3f367e1d1a34f078ce48015f3
SSDEEP 24576:R47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYlTduSZpUR0GHrVQ1aW4mSOgv3isi:R47JUQj1irIhCnDHUPfF/RpAHrVQ1/fn
TLSH
T18865AE1EA3EC01E5E1BA827885554A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 41febfeead88a936f7e6eea6c0b45610364b91d48efe22f0cf310f04f9dae63d
MD5 16a7c9f1e9721a2c1040697c3675badc
SHA1 d358ac5d8a719ea795fd18f897dec1d89c4d1c07
SHA512 f4b127df22471e584ee19ff6a74453a1e256b412131c086443e9c0f9bf37663581a4398351f7921ecd49a01ab381342e8134a13d0b56d61efc968a4d055fe693
SSDEEP 12288:cNsfeTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcj:NeTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T12C75F04AD29812E4D49E5279CB864A40F3337C619BF193CB52D0F53E1F3A6D09DEAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 7255a9e4327efaad6814d49817a156b704b17683e259867056b387b1b2f26536
MD5 edc70201665f05fb45e2a09959f622ed
SHA1 6921f5e21c405d31a1cb069aadeaa24b98fefd1c
SHA512 a1d8f7cee4bb86959a409b6fff8cd302b43ceec8193ab302f4eeca19707cd3735f047369ad1d18d288ef35dd1b3869415bd2d79853bc828d2e4f55934f72a81f
SSDEEP 12288:QLBQQU3flvsUEBWWQ5PT/QKFtgiLI9Ip2Gw67aRegaO1UXuyK:QL+QUP6pIQWtgAp2Gh7aR/beXe
TLSH
T1FA452840766BC75FC6A940325E32D1CCA7707D41EE44AF0372C89B3FD576668BAB2292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.5MB
SHA256 af3189971eba0e53ba603490eb3a12eeebee7b97f49cd717f53ab6a1f687c911
MD5 747e87f8a7328bc64e3b9ca9b1c8c10c
SHA1 ea42863900b59ec4844bfdd47d6ab393f7acec4e
SHA512 ab4ee2f10347f3fbc8a6aaabf00576276acd0bcdbea41e2fe54c508d5980a241c6f594f2dc003f07bed49593c6a9e837172e080ae154f2926526d7cf26dee927
SSDEEP 24576:XAECZjpyX03wkPLj2eGBpqwa+DwYq/bU2KeEALHyWFDkLaM6dJk/j:XAqlh7
TLSH
T1D1751A819537A38FC1FA5072073A5B4CAB64EC46B7456F12B388483AD82B725B4FD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 60b6fdeab0aa1b6028cfb5a5f5059e3167003014791ff925a1dcc6856544dff0
MD5 1724c97f92bff45af212722511a68afe
SHA1 0211af481bb8f3784aae2228508c8e0df497cf23
SHA512 09019fa1f8c0cb517388e1dfe7f3eab08e9e96f4128cf484dada74423724799bf4d718f8951bd2d10f3ec4c6c481635042caeccbd599cd76786906c5041e7912
SSDEEP 12288:yF7mTduSZpUdxB30GHrVxGnXQSaWt+DNISOgv3isiyWcT:umTduSZpUR0GHrVQ1aW4mSOgv3isi
TLSH
T17D6523C727AD20F2FCAB07B90D8A8570A2356EB16FF414D3E658618F663A4D08C7F519
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 70dea9686589fddacd82a7559988347daa0bde032de5ff778743fdd12f8d17a5
MD5 a6035f1d73a7fbaee93d9714151b3e5b
SHA1 fe751e5cab97623743c03007f43862f6339c80d7
SHA512 620f636412e8023b992873c83979036a229392e7ee999f40c1733dbf4f8073df24c161464cb11b07db31a7eac3e28d1c146633cf647d311c54e48bca4878dfe9
SSDEEP 24576:igb6bmBIi49WNNFpg1rSvFv7bYUTduSZpUR0GHrVQ1aW4mSOgv3isi:igb4mBIBhGFTpAHrVQ1/fSNvi
TLSH
T18F65AE1E22EC02F5E0FAD2B88DAA4417D6B278161731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 e50d29ae63bc94da1c6b2dca699969ebe92826a35c771bf20024cb5fc90f276d
MD5 0dd3a2be8d23e2e4cb621d717489c9de
SHA1 068b3dd0fd6213e44237ece6d76fa5ae56129279
SHA512 932fd36e44e4bacbbc2bd3a67d28ccf49eb36bb5593671a04b5565f78bac7ec56d678d04e8720c2d0a4cdb1efa3afb459263c12f21be4a6b4760523f5e576926
SSDEEP 24576:IG88u8FpJqH1bzria7/m1TduSZpUR0GHrVQ1aW4mSOgv3isi:r7ZFPqVea7/cpAHrVQ1/fSNvi
TLSH
T12695F16577E101F0D47BD13889864663F6B2B8211374EBDF07A88A561F23AE14B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 9cfa77af38d70f7813f775e624cb5b9636f4381273170014092c3273739f8dc3
MD5 1f3886e92d8e6dc5d3d7be82f6079179
SHA1 e9ef19a4d20e4e8bec898e2a5cf7fb752b49c152
SHA512 f5a54c10eb53d625109af983955cb7084ebc346d21d857a52237dbc46350f973ccf165e5ae90aaa3ce44ff40d3df0fcda896179ef2a3b0701d930ef5adcb4a7c
SSDEEP 24576:3PUr+NQRTduSZpUR0GHrVQ1aW4mSOgv3isi:3JQvpAHrVQ1/fSNvi
TLSH
T19F85E15F22ED18E5EA76917D89868619E3717862175192CF02E0817F4F37DE8AC3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 ff8bfb0ecd30d54d5ed1fb9b04a44864ba9508a90207c6bc268e20fcb1507320
MD5 28a1c676d1f012d70da8c4bd067a2c9f
SHA1 f1db70ed3858a58854a98118b126789641058fcd
SHA512 d2a46f6d75314eee95f20b129a7b5f562ce124e987149164681eb9645537a589a534284f83bdf04621411be803b914d0466fc0ac760a2caff3b97bb4a39bb1a7
SSDEEP 49152:nBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjfpAHrVQ1/fSNvi:YG05lO43bGpAhQ1CNvi
TLSH
T1CFD5CF6E62EC11F5D1BBC17CDAC64A0BEBB23825033556CB02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 bd91719c622fcfdbf32e47f0113e05c99176e4d834801db730ccd6bc42387458
MD5 4ecdb142dfcd6b2e18a9ad90cb42aec0
SHA1 8d438628b5a32504e525e5993a2b22cf4dcbb5cd
SHA512 c76e9e665909dc884fd7cfd611e4ebb22048ac000c0dbedfc38d356f1687ab7a011cf31b34060066c9960083eb77fe83ccc0adc8a244583ba02917fe4b37229a
SSDEEP 24576:Bfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn/TduSZpUR0GHrVQ1aW4mSOgv3isi:Ba5POZ3+Jt2pasx2+mHpAHrVQ1/fSNvi
TLSH
T1EE65AF5EA7FC01D5E5B9D17DC583861AE5B1342253315BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 14d59f205f251384dcbfb904748665d73c1ac16a860f5996d88244c6fd54e0cb
MD5 2f4dd5d2bb409504fb109e8eb1dce3c9
SHA1 9b83560764ed9eac572d5a95f507aca1ca8949df
SHA512 f03f596b21453279426e9860dcc43d62a89801fe189963a2c60a3905071bcde04a9fd98c3ecd24c29a2b3056faf4146860108ca24aab89357d39332e0094b6b2
SSDEEP 24576:WNcwHdjbyQ4nLC18lb/EOjowL7FkNTduSZpUR0GHrVQ1aW4mSOgv3isi:WNc/zEOVHF8pAHrVQ1/fSNvi
TLSH
T1E3858B1623E901E4F5BBE1BE89679546FAB1786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 85ced4de18b1d9c2927d9679dda0f928505940a8d22340e326f30dc9a80c393c
MD5 fc68cff669dbfd9cb3bfaa82da14b11a
SHA1 82259ef10463bc498acfcd95e765ab6dfd691c69
SHA512 652260a88a1f4a0ab299d2074b63b2f8a77894cf52b2a8d6609a53954ff6f1873d7659062d1955780eeb2f50f4abbf1b4caac75b120561e299724564fe022ee9
SSDEEP 24576:R8kNvNnaFeYhJNtmZBmjTduSZpUR0GHrVQ1aW4mSOgv3isi:R8MwBtOm1pAHrVQ1/fSNvi
TLSH
T14955AF6E7AF806E4E1FEC6B58D238512E6727861173253CB5290C13F0E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 cdc6e141349cb6cf66943f67d8de9f593983c78dc9c81ca357d005f6ebadae8e
MD5 f3da7ce43326609b89ed7e789c4abb53
SHA1 1ab5206343651f9537203652d275c660758248a9
SHA512 53f685a4485bbc680cda8d5c1f77c7fdab336ada58d5fba077a79085ea08a413116ae29349e5f72b58071de803056c67afcbbec1f81e7ef6a4e3b1bef278ab09
SSDEEP 24576:LD3FHshBIYQgAqTduSZpUR0GHrVQ1aW4mSOgv3isi:LDVHeBIAAWpAHrVQ1/fSNvi
TLSH
T1F695E17EE79C00E4E57BC2BC8A538906E37138A9077155DB069481BA5F2BEE46D3EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1440-367-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1440-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1440-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1440-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1516-120-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1516-365-0x0000000140000000-0x00000001402FD000-memory.dmp

Download

memory/1516-112-0x0000000140000000-0x00000001402FD000-memory.dmp

Download

memory/1516-114-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/2492-136-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2492-127-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2492-133-0x0000000000740000-0x00000000007A0000-memory.dmp

Download

memory/2492-125-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2492-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3052-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3052-21-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3052-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3052-20-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3052-13-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/3308-26-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3308-124-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3308-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3308-32-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/3308-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/3424-378-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3424-87-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3424-93-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/3424-380-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3424-96-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/3424-348-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4132-108-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4132-366-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4132-363-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4132-100-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4132-106-0x0000000000820000-0x0000000000880000-memory.dmp

Download

memory/4132-359-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4396-48-0x0000000001A20000-0x0000000001A80000-memory.dmp

Download

memory/4396-45-0x0000000001A20000-0x0000000001A80000-memory.dmp

Download

memory/4396-39-0x0000000001A20000-0x0000000001A80000-memory.dmp

Download

memory/4396-38-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/4396-51-0x0000000140000000-0x0000000140294000-memory.dmp

Download

memory/6288-72-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/6288-266-0x0000000140000000-0x000000014028A000-memory.dmp

Download

memory/6288-65-0x0000000140000000-0x000000014028A000-memory.dmp

Download

memory/6288-66-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/6532-60-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/6532-236-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/6532-54-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/6532-53-0x0000000140000000-0x000000014028E000-memory.dmp

Download

memory/6992-86-0x0000000000400000-0x000000000055C000-memory.dmp

Download

memory/6992-0-0x0000000000400000-0x000000000055C000-memory.dmp

Download

memory/6992-1-0x00000000022D0000-0x0000000002337000-memory.dmp

Download

memory/6992-7-0x00000000022D0000-0x0000000002337000-memory.dmp

Download

memory/6992-6-0x00000000022D0000-0x0000000002337000-memory.dmp

Download

memory/6992-274-0x0000000000400000-0x000000000055C000-memory.dmp

Download

memory/7120-77-0x0000000000B10000-0x0000000000B77000-memory.dmp

Download

memory/7120-82-0x0000000000B10000-0x0000000000B77000-memory.dmp

Download

memory/7120-76-0x0000000000400000-0x0000000000656000-memory.dmp

Download

memory/7120-332-0x0000000000400000-0x0000000000656000-memory.dmp

Download