floxif | be766d6b90524bf8f37f3323105e7ffaaad301a69a4e5dbdc1f75806e9a126a1

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-29_fc53261e6c8f6959d2ff4690b87ddb55_amadey_bkransomware_darkgate_elex_floxif_maze_smoke-loader.exe
Size 4.3MB
Sample260830-2w2efatwgv
SHA256 be766d6b90524bf8f37f3323105e7ffaaad301a69a4e5dbdc1f75806e9a126a1
MD5 fc53261e6c8f6959d2ff4690b87ddb55
SHA1 915a1e6ffcde29aafecc5057984ba829da9b65de
SHA512 339514af1cf719e2fb80fd37a32c4c140637352b9acaf37bfbb9dc7491789cc702bbca80dbbbc977a686d0463680d0f6b6e6c1b67070f5148da8d2251cae4b19
SSDEEP 98304:a03RC1/uhECAlbtIeod0N1ikH4X5prEbY1Hhk/GILmK:h3RCRSmL0KbY1HhuLj
TLSH
T169268C217BD68029F5B30E719A3D621D966DBD320F3490CF938C0E1E19B59D2EA35B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery floxif spyware stealer trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x00070000000113d4-2.dat	floxif

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral2/files/0x00070000000113d4-2.dat	UPX
behavioral2/memory/5764-5-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/5764-88-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x00070000000113d4-2.dat	acprotect

Executes dropped EXE 11 IoCs

pid	Process
3568	elevation_service.exe
4232	elevation_service.exe
2848	maintenanceservice.exe
2156	OSE.EXE
2668	PerceptionSimulationService.exe
820	perfhost.exe
5436	ReFsDedupSvc.exe
3124	SensorDataService.exe
2024	ssh-agent.exe
4556	AgentService.exe
1932	SearchIndexer.exe

Loads dropped DLL 1 IoCs

pid	Process
5764	2026-08-29_fc53261e6c8f6959d2ff4690b87ddb55_amadey_bkransomware_darkgate_elex_floxif_maze_smoke-loader.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 49 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	2026-08-29_fc53261e6c8f6959d2ff4690b87ddb55_amadey_bkransomware_darkgate_elex_floxif_maze_smoke-loader.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Drops file in System32 directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-29_fc53261e6c8f6959d2ff4690b87ddb55_amadey_bkransomware_darkgate_elex_floxif_maze_smoke-loader.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-29_fc53261e6c8f6959d2ff4690b87ddb55_amadey_bkransomware_darkgate_elex_floxif_maze_smoke-loader.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-29_fc53261e6c8f6959d2ff4690b87ddb55_amadey_bkransomware_darkgate_elex_floxif_maze_smoke-loader.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-29_fc53261e6c8f6959d2ff4690b87ddb55_amadey_bkransomware_darkgate_elex_floxif_maze_smoke-loader.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-29_fc53261e6c8f6959d2ff4690b87ddb55_amadey_bkransomware_darkgate_elex_floxif_maze_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\eb6f416f8f8562d1.bin	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-29_fc53261e6c8f6959d2ff4690b87ddb55_amadey_bkransomware_darkgate_elex_floxif_maze_smoke-loader.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00070000000113d4-2.dat	upx
behavioral2/memory/5764-5-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/5764-88-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-29_fc53261e6c8f6959d2ff4690b87ddb55_amadey_bkransomware_darkgate_elex_floxif_maze_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-29_fc53261e6c8f6959d2ff4690b87ddb55_amadey_bkransomware_darkgate_elex_floxif_maze_smoke-loader.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-29_fc53261e6c8f6959d2ff4690b87ddb55_amadey_bkransomware_darkgate_elex_floxif_maze_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000947c24e1d238dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000093dcdadfd238dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000034066e0d238dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f7a823dfd238dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
5764	2026-08-29_fc53261e6c8f6959d2ff4690b87ddb55_amadey_bkransomware_darkgate_elex_floxif_maze_smoke-loader.exe
5764	2026-08-29_fc53261e6c8f6959d2ff4690b87ddb55_amadey_bkransomware_darkgate_elex_floxif_maze_smoke-loader.exe
3568	elevation_service.exe
3568	elevation_service.exe
3568	elevation_service.exe
3568	elevation_service.exe
3568	elevation_service.exe
3568	elevation_service.exe
3568	elevation_service.exe
4232	elevation_service.exe
4232	elevation_service.exe
4232	elevation_service.exe
4232	elevation_service.exe
4232	elevation_service.exe
4232	elevation_service.exe
4232	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5764	2026-08-29_fc53261e6c8f6959d2ff4690b87ddb55_amadey_bkransomware_darkgate_elex_floxif_maze_smoke-loader.exe
Token: SeTakeOwnershipPrivilege	5764	2026-08-29_fc53261e6c8f6959d2ff4690b87ddb55_amadey_bkransomware_darkgate_elex_floxif_maze_smoke-loader.exe
Token: SeTakeOwnershipPrivilege	3568	elevation_service.exe
Token: SeBackupPrivilege	5436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5436	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5436	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5436	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	4556	AgentService.exe
Token: 33	1932	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1932	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1932	SearchIndexer.exe
Token: SeDebugPrivilege	3568	elevation_service.exe
Token: SeDebugPrivilege	4232	elevation_service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5764	2026-08-29_fc53261e6c8f6959d2ff4690b87ddb55_amadey_bkransomware_darkgate_elex_floxif_maze_smoke-loader.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 4504	1932	SearchIndexer.exe	101
PID 1932 wrote to memory of 2508	1932	SearchIndexer.exe	102
PID 1932 wrote to memory of 4920	1932	SearchIndexer.exe	103
PID 1932 wrote to memory of 4692	1932	SearchIndexer.exe	104
PID 1932 wrote to memory of 1956	1932	SearchIndexer.exe	108
PID 1932 wrote to memory of 4136	1932	SearchIndexer.exe	109
PID 1932 wrote to memory of 3176	1932	SearchIndexer.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-29_fc53261e6c8f6959d2ff4690b87ddb55_amadey_bkransomware_darkgate_elex_floxif_maze_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-29_fc53261e6c8f6959d2ff4690b87ddb55_amadey_bkransomware_darkgate_elex_floxif_maze_smoke-loader.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5764

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3568

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4232

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2848

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2156

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2668

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:820

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5436

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3124

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2024

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4556

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4504
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2301830172-776172150-2531349243-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2508
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 2948 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4920
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4692
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1956
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2980 2948 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4136
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2920 2904 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1cfefa53d212f662808180c2dbca4804b04775f5fe889538978fc269ba13358d
MD5 f37e05e59dd8a0340a775a2ecd05cdc7
SHA1 68db2cad4a53273e9d7cae1af8c07608b2e8ca15
SHA512 945006b6a6835d20f448f89391680a079990d2c590f4e4770a266fd240d4a6d4355cdf85ba6eb65f9cc4d285f8937452e3fedc5b1628bba97a2ebc9f8e16ad97
SSDEEP 49152:fb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnzQ/lFTjN4:d3q6HjB7Lm
TLSH
T1D8D58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 79fa8ab64227f7c75b7edfe48002b3650810fbbccc4a9f7c8592efacf4ae6a69
MD5 60e9c40009233894a28cf970d137be90
SHA1 9c4172421151dd2d4bb5a74cc3276fcbff7eb978
SHA512 3b35f47cfb54b9b22d35e823a83365d616566f629b1d9b12e094b970ec703e3a29a231f3dc37cbf34aff88fc0f983db68c27fcc4f619ae07cecc58f6dae6f027
SSDEEP 12288:n1XLsswWkxy2lRq2czAEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWx:1XYfDtczAknQ/tbw/2Mkjy6Fr7g0ox
TLSH
T12765F12877E448F9ED67827DCCA28502EB73788547A0E78B03A495295F373D85E3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 8e2dc2cb9dbee6eab4b9b6e1dd3c6920a0b99b31fd17fdcac414daabafb37ca7
MD5 b44e91372e9c59e0e6ccef8a159132fa
SHA1 0a6e95697715b9ec506c908d9dc97bd5d8281c4b
SHA512 b2490a2a3f19440d4b55a573d4bff896c31f46b66ca781adf84d68d9b2c8ae8d8bb1d2f1bdd09d985a4dd4ddc8381aa1cb361658ea174695064943269025f7d2
SSDEEP 24576:G0Le5ji0hmxLrMSnQ/tbw/2Mkjy6Fr7g0oP:GPji0AlTQ/lFTjN4
TLSH
T165859E15F6748735D073C0B9C5D2A68AEA7230825B308ACB4286D77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f740544fe9ae32c8040eb5285aafbf4963dfd67b82b1a975e742649c2ed06777
MD5 03fba4401be8b2ddaaa814e663f839e9
SHA1 b6352ce2ae7a5ad2869a81da38e7fb8afa9dcfa9
SHA512 030ffc23ab852cc7fbda478c2ffce581f24a7f7a15491f4151532021111dedbbb016cfbc3cc66956d44487d5af293c677355132b4e8173cbe1e204da6bbdee76
SSDEEP 24576:ja7/ezSC6vUyD/aqgrvWE6q8wyu8nQ/tbw/2Mkjy6Fr7g0od:O/ezSC6vUzPvxHjyPQ/lFTjN4
TLSH
T1DF755D25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f8074685067a538a5523ebc4952c72e091cdf75f9634eba5c74ba28783e47282
MD5 e433fd0037b4edb2c4e173bbbb3b3f05
SHA1 0f425d6f1790866ab7af51717c37718f75649642
SHA512 b550aba3a1667302ff1ebcc82bdba467898bdbf295b7322732cd3ac8aa7e1db73ec2d47f15ca9e899c4be7f457a3f16b73d82868cb5cb57c5670717431d1a3ba
SSDEEP 24576:TVbqPb88hv/l+65nQ/tbw/2Mkjy6Fr7g0oq:TVO88hXl+OQ/lFTjN4
TLSH
T186559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C2E777E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 0532206937180a1de616ead1e94e7f1b666cf6f1dfb47179cb9e299e00e904df
MD5 b07284c232e6cc23187c82cf9251b0a4
SHA1 a0215cfeec3612a9fb063e0392e86e422aba288a
SHA512 76fd80014d343e7ad471209daf2f8924209737fd2f244ada068116d9741000bb2fe6999e2ef32b5b9fc060124fec2038dd4590d9866b73b110d19c1b3f3fab13
SSDEEP 12288:nz2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWP:nzWnQ/tbw/2Mkjy6Fr7g0oP
TLSH
T1965523696A24F897FF2B06B15CC284826B7B0EC1BFD4A74E7B44362D857C39446DB381
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 f74d60f9303f038608e689c7aba2021d2665d0c6234041255b56167856ae0c0a
MD5 3654c22c375c7761ff38c4151916158b
SHA1 5f617fbb1bf53247bacbe7774ff994d82330ded6
SHA512 0c08bf50ff790956a9a852047f0a3c040a7d140f5dcf877da1cf652deb9ff104ded002602b18cf7a4ecdd1599a358b1bacd49ec1964f94140df35e1fdaa1fa39
SSDEEP 12288:8eBNUbTVO86UhGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWW:8JIUxnQ/tbw/2Mkjy6Fr7g0oW
TLSH
T1B975CF3BAE28FCD2C67E4DB85A918640D77278704F61A3CBD164830EDE276E01E7AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 edc1e7e8ae3fa75d48fdeee61c39aa29b8664ea01ac030f7c9279195595dad2a
MD5 ebd15d926685b814dfd670f99896370d
SHA1 6ad1a9e110371f462a0f20a95c8818e20e02489c
SHA512 a8167056bb0677077055a4251f9fd9054162f378c5141877203a040e7e0ba68c4407e4e9cc8f0fb1bc38b1c76d468ff1621aa468dd508adff90efa7d43199742
SSDEEP 49152:eQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THZ:eQvGAdlCEL8c/yRNw5CPLm
TLSH
T1ED267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 5dc91061f892b3896b759ffeb171c86d5dfa187f890415380a440a4bdd3f4472
MD5 446e3992320af9a2d301652669ddfaa2
SHA1 34203337c8da4823a66290a5d97da4de88c7c934
SHA512 42ece2ee50ec3011e49a106b8a6aea342fa501d5afd976d92c1d6d997657e878db5f1d041734e2e1a158e91b69e04712ccdfb15eb5a859e73844672b2f7cedc7
SSDEEP 12288:HAwSfxL/2Dc39DLLmt0LDQewsAjTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsgj:gQewsAjDnQ/tbw/2Mkjy6Fr7g0oN
TLSH
T17675E031FE74E436C77F0DB21B26C706583D6A604FA11AC3E3A84A9E59342D22776B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 be13e8889b5ba843a41fbec8546e770b06bd7fb2675f2fc8033a6ca9c9f8e0f8
MD5 968469b240f6214b1a2826881c9610df
SHA1 99c56fc168f34c9f2796d233a54edbf54a82e0f5
SHA512 0f63921b15f855f980f8ccf621d66c22bb682f3d50abf23c2f7bf22c8f262a4a299b6eeb90f6ece6130d6791686e404f17c33304a098b0a0c6d576606d9cee99
SSDEEP 196608:vUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHgL:vUEtQevvqc2W1cpV2EI32
TLSH
T10D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f7ac7b4f0c2319332e941d3620373a705cb7efd583222086a37b09e5bbd7ad50
MD5 ead4f972ff8b094e9f636b1c004f0787
SHA1 64fb5c85b351f9b2c41e72270719c18d22ee2325
SHA512 f3e69a0f59153b5f180c05ab70204436396e3c50dc875aec7ccd65ee9affc3d6c9aeecf82fe2461f663f85e346cb74f9980eac731911b933939a502106e7a33a
SSDEEP 49152:aCbRquA/m2yL5zQfFiV+XenmE3/zjQ/lFTjN4:voqtVjnmLLm
TLSH
T130D58D0976B8C2E4D1F6C77886A2C647F37178154B31A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 9c604056ea0078f864039507fdea26481b01803266eac4101974ffaf445d36b5
MD5 29c6220c2fba683314b9679434c8947b
SHA1 c3f3d569554b84a26e6d50c0786bf6188005e642
SHA512 84c781e3ae676ed5720ebff7c1c3e78f68ebe4dab1fa167f1b57289630df760d9b1c4895f33cec583d5a99f2de0ba2adf67dace2ab317ec0684f4d9dcee79a7a
SSDEEP 24576:ZAhGLJIFoiwtA5l7S53InQ/tbw/2Mkjy6Fr7g0oT:ZAMyFoiq5YQ/lFTjN4
TLSH
T13735AD81E7F955D4F5B3AAB899B68171EA77BCA65E31C20F2250D11F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 4d5687f20e4a7cc471ecc4f9a461e55268f3463ca8697d149e6478f21bd260b2
MD5 5a4b57970a2633f6afa6de3e3daf294d
SHA1 ddcd43323ea4ed6b40b3b1265ca227bc517ab1b4
SHA512 b7451a6e36303f7e34cec1629e515aed1550c41a4a8620135bbe8f3a6956056ae14a03a99d6b324c617cfe74d7176c1387cb6b9680b30223f422d024fd0055ed
SSDEEP 12288:Pmw5HEjsChN2BFgl0WDm+CNGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMT:uwuHOWOnQ/tbw/2Mkjy6Fr7g0oq
TLSH
T1B065F14A36A45CF9EA6742388993C136F7B3BC422A61DB1F1760C65B5F373606D2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f30389173aa42f100e97628be73e5c0fdec53dd010f81cb432e8628834200873
MD5 f242b7ea00c11ddc0b6c877bf5ddcbc0
SHA1 1049858c7ce312c9f4b64f9b5880623d8c4792db
SHA512 c1216bc8a7d32a7828800353371fb27868e5a85b0ff052a4fb5f183da0b38d0d2413fd819e8d7800062d03e8d46221288370a90f9bda869940e23d94587863b9
SSDEEP 12288:OXZ1IyDGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWC:eZuqnQ/tbw/2Mkjy6Fr7g0oC
TLSH
T13055126933A4B0FAE6674278CCE28646E773388267B183CF275402695F3B7D11E7A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 e3f4f8df91bd0ce1388676de6ffc6c7d84049e16e4297c7caf172681ecb1f3d6
MD5 c7e066d605947d4085806fe52f7fa62e
SHA1 ddbf4f4e75acb3afcec42b1fc855a65cbdaaa37f
SHA512 5326d72ed9ed154f298735dab004e4b6b1baf7aea8bd5be22af2ab6ac4878a819d93f7fc76d9ba45ece3e0460a5531d78a15a88d0cd9ff8f58a374867d1d5cee
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U1:WQRQyi36YOcPQLvw2gAf+PN3SLm
TLSH
T174667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 08e02a0c16fb2afba2fe38ffd4dc6572846ae676fb67d26eafbb20b50de33ea5
MD5 6591dd18e45804b49b916c000e0061a4
SHA1 306bee0cfb82540aa723ca66bdf80ab6db25aa5d
SHA512 bb15b0bdd6e02051eb861eb9ffa0083cf3056422afb89e9b87cacc8ac32059f140dd928582fe52d01de16ba39aa788f5d0035a5c6dfa2ace28e6b846f397dd4b
SSDEEP 49152:7j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U1:qQRQyi36YOcPQLvw2gAf+PN3SLm
TLSH
T133667C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 2a7fc3bf8b8de9ee73a91fd39b3d0d726b76f346d93869316abc2f0655e0dec5
MD5 74076c6604b7ec80e923ed2692488ae5
SHA1 9d9b20f5a0c432b432f19913c58be15e5524853c
SHA512 5d4d110df0032a7e7ee05d398040f862428b2b4c6249d1f2c91b5e34e701084ed27a14edb012d93dd96af34ae0cfd0a338bfbff3df129bd484c7f1bbca4a97ee
SSDEEP 24576:lwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL06nQ/tbw/2Mkjy6w:B68Qg55nhheWu7PNU3/TQ/lFTjN4
TLSH
T165B55A33B2F600A9C44DE1769F46872196D27C75CFE0E3DB8505721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 d31436776ccbfc430a387fbfb64492218fc9b5ba4391b0edca579efa8e4c4777
MD5 c6bf59855ec0cc12906fb0aa4398a274
SHA1 e8a51e344f1927b23842f3279ac85fd58597f47c
SHA512 fa6ffd0f34b0a98a592dc5cd89574e2045da52f559ce18055b2b6f335738a6f16cb949b55753d6fab840c48c8ef06ca98fa2866c2eac1617ca1f60d10508d83e
SSDEEP 49152:x3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk997:Qy5112gYy5azzVvL69nLKnhZhLm
TLSH
T101167B13F29910E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 f1e51b212d78983ba94c61c2e2012ca921bb29d6ee05bd3c27873468de8c05fe
MD5 d81548655fdc29ea3fa06f8f3dcf7141
SHA1 ad56992eb31091c280e409c45193fbd71f8b5fd0
SHA512 96b35fc8fabba52ec6ff14e99506eacaf20fc296be8ba9b88d14e9699048055bb7bd78792d4c5cbd335ad08a89ee15c4a31064437154c399fabf22f6bf2a3a01
SSDEEP 49152:7B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl0Q/lFTjN4:tu6JmVxd2dnLm
TLSH
T1DDD59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 499f9bf796a6084779203d3b28cc67e0d48466e0009123a57f980c157886497a
MD5 62adc6e6fa8e44fbe7158b09c23bbc93
SHA1 e68c97dc7af7a4629ed11487dce0cc942fa7555b
SHA512 1dae6f867ea848e5cc28ceb36a26bfa2385894cb483130c7569ab94eed563ad9d1d4aaf452e4080ba279e1e342b32b2d48de8bcaa5aacfdb7780eae8ea30133e
SSDEEP 49152:21hpsNoJpF1A6UU44CwH7R4xRQ/lFTjN4:2mifPbRLLm
TLSH
T1CEB5AE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2cdc796d1e08fbdef436f28b3e67275b550d00d944cfbf223dca936f84e2674a
MD5 6c3a3a87edf7275f6c27d373769c88a5
SHA1 d90a7bcaeeaf3fa5a49b5ae5383a6b7e4a483851
SHA512 16f82d69f7c1f253c6868555d649dba342a062b03739b0a89fe0c0e2f684a50a50f73429e846c2a49011fe0cd78883030878b5d25879d1fe006b45e02fa841bd
SSDEEP 49152:xSuZQIY0Be2KRRVtOnks6NMHqqQ/lFTjN4:f5dKTi61lLm
TLSH
T1B8C5BF13F2E940E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 1154641e3ed14ea5d735e387c2c8ac7e07bc57d78e21976a8bfe10b31157a557
MD5 d678d7723b826e1de0e582acbfcd5255
SHA1 00bc2e8e8fb60d997e6be7fbf30852683a1d86b4
SHA512 bb505ed8a7bf39c32d3f4bfddab797b4587d0dddd83762baaa590f636464d6c8786f209d16604f332e145c6598dd547226cfe64c69f01fa040be9b48b6706b60
SSDEEP 49152:AhtSn8EApI0figngiDn0AP5wFQ/lFTjN4:RX2iyphnLm
TLSH
T1BD95BE13F2D940E8D05ED178C7468632EA62BC160B35A6EF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 bb8689861e31272d20585d45aa7b9e29ad8d28df99ace9408cea171896ea802e
MD5 3eee637cc530ecdc817c47b1ddebde7a
SHA1 b78e084c7c105a6b95af13ceaa1d8f164b2c20d7
SHA512 1e0479260e056b8c0d02708d0b345e03eb3c0df890295636df818869aa69d205148562ca1a40cc057737a2789d83b1085c238fd206ceda2a089bd1d3cb2abee5
SSDEEP 12288:DOGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW2:DOnQ/tbw/2Mkjy6Fr7g0o2
TLSH
T1CF5523697964F98BFB1706F18C828182A73F0EC6BFD1938F77482129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 0a3dd4d601ad83462544dfe0e3ef37309417a5353c7837c3623aa63e5d23d204
MD5 167cce769dcaa2df8271d7774e7c0f9b
SHA1 fe89c85e5290796354c6d62d7def7c0bc42a5fd6
SHA512 03da0d207fdb786b84e87ba96f86787df98e17f8d9026833716114a6b0a95927d2a23560c00a75cec301e3429dac6eb1d9c9a862393cb6cc16f5b610517faa78
SSDEEP 12288:y3GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:yXnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1A65523697964F98BFB1706F14C8281829B3F0EC6BFD1938F7B482129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 3e6c05900814cba98e5925bfaf3a6a1cc9390e83913b6d4697eac2a231b3eaa4
MD5 5a7103a60341fb7f431b338072507355
SHA1 7f90686b5b22e81a1f5e3a7b2646fa8cc382313f
SHA512 4fe00740b5de5576037b154e563876e881ab0a65490a9d9a027bd6f0cb0422501c73379fd20823680c437a5d2d98396989a9d99dadeedfae8fe2c6f004f571a1
SSDEEP 12288:k5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:kJnQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1845523697965F88BFB1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 582e0ce85111d1400fd993dbd40ec31850414f38420abef0663a5bc1f2056c42
MD5 0f3c955f2d3f9d044b852e4e72f75d50
SHA1 5bc5f15bf9f9a8399b3ed04536942a73d3b6078c
SHA512 05c4ca4fac4319cefba371704e1c9d4fc0ff89b2cb70204bc7cb3a1eb500f0e60540d05c9c880346e922c453d26c6406f2f120e0ceb3814f21349c005af21f4f
SSDEEP 12288:BVoGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWA:snQ/tbw/2Mkjy6Fr7g0oA
TLSH
T15E5523693A69F4C7F92742B4CC928142E7BB3DC5BBA1A38F6B04111D4E793D419B6B80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e5a9849989b717d7802355ffc78ff630391d1bcc6726e27e4c1a22ad19262953
MD5 e60f2069b1d0b998c0710153c7e3fbd8
SHA1 0954e072263b49f30523c4763292efb80901e473
SHA512 ab8731eb102a328589e7d3a0e627636dd4cf02f3124da4a715fb6c7cb2337b6d9e644cf3480e6b27b2ebf2d28180ea3bdc3588eb87cb5277e85c52fc063bb8a6
SSDEEP 12288:2wGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:2QnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T1AC5523697965F98BFA1706F14C838182973F0EC6BFD1A38F7B482128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 6c94dffba24f1d958515b4d8936483f0cf1270dd2f2124b96fdf616e8428a56c
MD5 bd81a9149cfa08f30ea666aacd0e0201
SHA1 66a9a4b049cced53db3f04a973e046817eac3704
SHA512 d8b02d42b189428c55c5e01af16797317e0a05b007ab2ae4d349d716781941e4d29b5fc9a1fde36d17e829e52c34c6a1838750eeff070ceb2e48775d2484994d
SSDEEP 12288:HrGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWU:HbnQ/tbw/2Mkjy6Fr7g0oU
TLSH
T10A5523697964F98BFB1706F14C828182973F0EC6BFD1A38F7B481129967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 9582954e577c3f0b0f3bd0f82dff9c75ac37d4d6223616a99464fdad5db691bd
MD5 989dc65211ea7e83e713203c0d992111
SHA1 c8c2397231aa482b0da590a7ba4c8ed991166c3b
SHA512 86dca1367a8f2d536223b075af60d47b4eeda3cf5c208d5a574752f68b052f68248844634fa2c66a468a83582088a38db33a467cd0343858f945b7072eb98256
SSDEEP 12288:pfGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW8:p/nQ/tbw/2Mkjy6Fr7g0o8
TLSH
T1395523697965F98BFB1706F14C828182973F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 aad77dd22cd9f2deeae5ea0b226964eb949353e4b428c0ead3514538b8ab743c
MD5 56d6ead3343c8909b22d21f5e639a5bb
SHA1 8279614c0e66cd19260d2e2c4579deb7edd898ea
SHA512 9b41a76693a7a5cb31631d5adc79243ddf83c98e42da4baaa2606be99d86f5141ddda1d3163cc5cb83ff069e8327294e23a57dbd83d5e7dae97698101bd45f1e
SSDEEP 12288:IiZwbDzzFEoS2cPvyXGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWK:LZM3zFVSO3nQ/tbw/2Mkjy6Fr7g0oK
TLSH
T1E47501A5B39058F9EC67427ECC528906D7B27C5A1BA0C70F13A4362A5F373A01D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 d0c6f64572c618f7f401f13f3267ef8f23f4375dbc21e024dae4f11a7853415b
MD5 c922357e10d38439367ff334bd999dbc
SHA1 b2479919add4962a60d95948708cc2de8da6f220
SHA512 9b1014b8640d1e4b5df39c0466126d4f99d8e0c37240f1ae493283076857f972ca075e565a4bb6bf5741b48843be7903a8e8acd4171519d048ada2ea2e40362e
SSDEEP 12288:daGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:danQ/tbw/2Mkjy6Fr7g0oY
TLSH
T12D5523697964F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 15e1b468367b4d7992604b435c00a6940558077f453757b938c4a3fdfbff8336
MD5 383d2d261787f2b18ca0c7a6fd16eec3
SHA1 87dabf87b49e35c15e3fc8e3b5a62bb92dca8282
SHA512 b42d7f48375d4fea66ff3d45785c7aef1333a88136170fd5041e8b5626eefec0a3ead356f335c7fd1414b1ae140c47f5c2d4b7a5c446c824310da580809a560f
SSDEEP 12288:TmGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWY:TGnQ/tbw/2Mkjy6Fr7g0oY
TLSH
T1275523697964F98BFB1706F54C8281829B3F0EC6BFD1A38F7B481129967D39406CA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 2c4c23ea09ab685f25b9b1381d7c04a37c647e0d4ea2289a8e5a2ab5e19f7aa2
MD5 f4017e1426126775e0bd572117764ab2
SHA1 a167ad3c277e81527ce8fa2fef6923a2c5fddf07
SHA512 967cb78533be40c136a5100b7a11aa467ca3c173448227ddb3aeab32be3a28f6cc8b5d8e0b8d2d04918c0e5e620891a4991d0c9096646c7596d8cd1fd4b14ef9
SSDEEP 12288:XyPz5L8DGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW1:azyznQ/tbw/2Mkjy6Fr7g0o1
TLSH
T15A65021773A570FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 09510b46f982b2885ab2db845fdaa28e2ea771a88b3fa934309ac51bf8ee0c0f
MD5 1768130c2764de25dcb9ca64980dd9f8
SHA1 065c4316bfd93c2fc28fe02bff27464a72fdcf01
SHA512 f005d9f67797331faab105cded14e71d1215476bc16db83ec6fef810b63bbe018576b75dade97df566867b62a93187148f5ccb1cf00a0e4f8e455c6482cdb42f
SSDEEP 12288:CaGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWo:CanQ/tbw/2Mkjy6Fr7g0oo
TLSH
T1105523697964F88BFB1706F54C8281829B3F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 85130c9d621b27150b570416b1180bb8a217084ed973feb72a4cb1998b39a3f9
MD5 a475c644fdecb8cbf9b997f41ea52917
SHA1 f4bb5804f8bffa4d760896f804c1d51307b0e90a
SHA512 ed6fb42fa77fc5045c917584eb84c0308bbf0f71253d106f1e490ca43808ddc3507b191895c8aec401d1d54768c67930547477aad5eb8bb927ba606c3b1139dc
SSDEEP 12288:/aGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWc:/anQ/tbw/2Mkjy6Fr7g0oc
TLSH
T1C55523697964F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 1904a443a02ce6bb5c0754cfaf3a65cae5c8dfbf11085e853fc9eaef0cb5dcc9
MD5 19007c2bd30b44a13be38e620f22488e
SHA1 cb529b215d22380720c42357dca2459e6a71558a
SHA512 12f72a5d6c6bf740577aa02dc1960dc865012f2c1e4b38ed5d54b04120f224d8eb7801b4ddb07224a941678a9cdf2fb4169f7f8760eef03b2f938ed6ca13310e
SSDEEP 12288:eyPz5L8DGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWe:DzyznQ/tbw/2Mkjy6Fr7g0oe
TLSH
T18865021B73A170FAE537427888920A02F77678725B609B9F2754037A1F3B3D05E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 2cd17e23c9e90179397da14e0a93e85b465f2d048f6f91f80a2d802702f9bc3b
MD5 71afa619f5faec59d1562a5b39d2156c
SHA1 213ffc080d6e7e32061833ca82bb2c6279dee9f8
SHA512 e0bb1e8a88372462bd6734db5636fe8896d9487fe3adb68b9c0a7f3a8ae9b993107170897a6353a45224c7e0b1ece753f450771dbcc3461e39b59738cdd8bd1a
SSDEEP 24576:UT0aLl3z0zDZnQ/tbw/2Mkjy6Fr7g0oj:UTDLlj8Q/lFTjN4
TLSH
T1167501A4B35068F9ED67417ECC528906D7B27C5A0BB0C71F13A8362A5F373A01D2EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 4bff2ad8e6db68f9616b4022bbb99aec550a82336fdd0b1a038a8f7520e74c40
MD5 db8b210f995a6c04a10e93ee66bf8ebf
SHA1 a3165f7e50b7171d3f4ac66a3023fdfbe7a45c3a
SHA512 36c5606b091c3c478c6329668dbdc4148c8d12dc18d7b720bc4838e5bdff775d49f1c3c93e0f692abb1d8ac8846fe1c9c1195db214add6e73474ca8bcde4ad23
SSDEEP 24576:431d9CHKy7GZ9nQ/tbw/2Mkjy6Fr7g0ov:C1d9CHKyaLQ/lFTjN4
TLSH
T12E85CF90F3E414E9F1B78A358D724512DA767C9A1B71DA8F03A8261A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 777fece9466445fd5fd5ab9e8fdbb9826b128f967ea2e5877bd6752f86fd49b5
MD5 20142ee2d829a2f2123d2186787eab5a
SHA1 c6cb76916f3f40679b401a59d9526eae0778e07c
SHA512 1393f7b30fc6dc91088253b682ee432917f60acbb8cd79e715ddba15d04835f16381fa920fce96f875caaca3d6238a5c52f947ca0680955da117cc3bcf44bd57
SSDEEP 12288:/ZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWj:/pnQ/tbw/2Mkjy6Fr7g0oj
TLSH
T14D5523697965F98BFB1706F14C8381829B3B0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 d538b3a942b33000271d2eb48c0c523efe9e20c381ccb9f612094d66e47271bc
MD5 4ff1d9779b62a27f98c71dd5c0b10999
SHA1 c984a5c1f12d96851001a483a50517cb2f882817
SHA512 e4bedcf534c282d8d950e9a4bf88335eadd4d059a340008383fc9f69df3e19b7513d60bb0dc9940c3da05925c1d18e9e53cba25fad4baeace111f7db2e695490
SSDEEP 12288:ujGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW7:uTnQ/tbw/2Mkjy6Fr7g0o7
TLSH
T1555523787964F99BFA1B06F14C838182A77B0EC6BFD1938F7B481129967D39406DA384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.2MB
SHA256 89a6bbfb94a90caa2629608d4e36f64ba6ea26905e3ca47b80d84ce3f4b14696
MD5 f7f94b0ff06776f91f4b45ecc0e027b9
SHA1 233d0d4c096c2240f9e09c6e8264cd911a284dcb
SHA512 d2211620fde623245214286c496ee4d63ea8ba4c5dcec30d6a3a828f67b46042d9d920deaf369f3d75a573e6a009bd0abd842ae3ea4f9b590de1ea8b0b8bc58b
SSDEEP 12288:QEGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:QknQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1B25523697964F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.2MB
SHA256 54a4993a46990da6c66781785e40f0fe00b9dac3dad00a51288498f37e00bf69
MD5 f2c01767ec13d7268af667101750ccda
SHA1 bce26b67eaf7866086823284da1e2c33ee0b3883
SHA512 dd3849cc264aa830c873457927cceb8e0832da3c132a4dad4b0bcfacc98fabe3a30e5dde9188913479564c39479bd5d94e7a70e04f40d34e1b30a1b294d68d1b
SSDEEP 12288:3aGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:3anQ/tbw/2Mkjy6Fr7g0oB
TLSH
T1F35523697964F88BFB1706F54C8281829B7F0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.2MB
SHA256 2b1470fb96ae7876bfefe52a7e9c3d7628033c8dda0f44a0e2f43dc670498f3c
MD5 91155b010392558bf5eff8842873dd8f
SHA1 13040a24efb9f4bce8af8d79fa2809efff9471d2
SHA512 594d674e7f0a2b520029d12b433df0c5db546dfa903b4678431c36ecdf638aeb7b7dfe2c6f3940cee506e14b1e4478d279a5909eda5eec3d93d171d4322b8698
SSDEEP 12288:mZGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW9:mpnQ/tbw/2Mkjy6Fr7g0o9
TLSH
T1DD5523697925F88BFB1706F14C8381829B7B0EC6BFD1A38F7B481128967D39406DA7C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.2MB
SHA256 e007327bf028e58a7a98a5025d93a74e1e4e9d353c9949b7afad5e87bd63e44e
MD5 25c5be9f1edd8eef5cfffbf3319bf767
SHA1 e07fbdaf70bbaccaaa19ef03ba44dd3402933f25
SHA512 a6d61e0d240b4cac5d98824b32782b08528865f3c192436c7099cc0dbf7389f037d9fbb44dea34252b55d8ebac5d2e312ff23426c9b309ed07e308fcc8b8173f
SSDEEP 12288:YiGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWB:YinQ/tbw/2Mkjy6Fr7g0oB
TLSH
T16D5523697964F98BFB1706F14C8381829B7F0EC6BFD1A38F7B481129967D39406CA784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 402e087302bc4c900e7261ec88e38f8efee4a8a7fcd59533b7b3dec24d716bcc
MD5 5f4482f9da2e712a400898ac8cbd0d43
SHA1 81d71652c5120a44828f3c19b6f9cdcacf1f3236
SHA512 ef8f16a7561bc456721dc69b07f639b36e9dfd46cb8158b43bf9d38efb5c48f3ea1a7852fdc7bf5e7778285850e8b3b8451768febacb86512bb9a8950d6cfae7
SSDEEP 24576:yfwv/k9RX6wkyAI2nQ/tbw/2Mkjy6Fr7g0oS:pMnYI2Q/lFTjN4
TLSH
T14B85DF29EBDC44E6E177923C89A3460AF6B278591B31C3CF129A536D0E37ED45E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 764dbd909883ca66713bd7f558a4911797fa3a20e2efeebde950deb9c129bd75
MD5 fa40a9adaf6fd3679a39aaf2252f8caf
SHA1 a7bf2012237bc65a1599e2e9dca6bec129bbaa70
SHA512 42c7c6b70a5ffc00b781c7884dc1fa3ecdd8df71cc223869445c2de713772802ef73ba134f273b19d8940c996ccef0e6ef5dc0c207132a646df9e00ac3cac9f5
SSDEEP 49152:RYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0lQ/lFTjN4:5ySzPyLm
TLSH
T16D066C96A16841D5C1B9C1B98B0BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 e548e784f078487a3a0a7d2dee66dcf97cd50e9971140748d0853c9a2437c5a1
MD5 30ded160284a16db89bb074c8408c68a
SHA1 f516c7d6f9e526414fc1bc8c90fd6a9a32c54618
SHA512 79c701e6d204eb3ed8ae5a20d58233c3e682de95777738515d458cc5fea993c3eeb9f7a206afa2a65473fd35f5d7946557279a9fa5c20215bbcf45447c9c2c84
SSDEEP 24576:V47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYnnQ/tbw/2Mkjy6Fr7g0ol:V47JUQj1irIhCnDHUPfF/VQ/lFTjN4
TLSH
T11665AE1EA3EC01E5E1BA827885154A5AEA71782E1F31CACF2270437D6F27ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 7395369eb4d7293c0ee70ba13756e4fe4d7c96f2a5074789871dd4031c14f31c
MD5 49443924bfdcbc819c0f1f3b56065e8f
SHA1 9895bb9ce38c71f1e1205b1acbcc74d561415857
SHA512 55f085097acfb5e12939eee1e9bde284f9fd493e1a28b2011a15a2d387359c7052cd7d888884da9655bf3518c5a170c69a3311d577843d5f0d6aff6b2cd229f7
SSDEEP 12288:ZssfqGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWs:xqnQ/tbw/2Mkjy6Fr7g0os
TLSH
T10E65F119E29852E9D02E5275CB828A41B3373C9597E1D3CB67C0F53E0F3A2905EEA743
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 6f4bcc004057a5f3207d192f516dc20e761804b2d1b1e225fd023707cdf49df2
MD5 5c345720a3652ffee29a599429812627
SHA1 cd9f28873895b71cf300b5f21d9c8dbe9150d44a
SHA512 792677a9124ab52e092736d06cb8df39c1a2331ee1d94df21c23a2ec1e88537e6d2d39db7e33bb06a11d005369beba2c007263b071fe770a156d55384537210c
SSDEEP 12288:Qxv0gU3fvyTYJSdYfzYox4MvsREOHBezXiovVEvbo2Wmd:QVdUPYo0dHBmio9Evbozmd
TLSH
T14B3518007666C74FC6AD50321E32D1CCABB07D01EE456F0773C8873F95B6A59BAE6292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 c6f85ab18a6ef15d9cc953ebca83fe83702afd5964a251c56ddf484b92f88b26
MD5 9c16c4968cd69000c830e6324d98d337
SHA1 292ff5ef4a291db458c0ba931e263a8207fbffea
SHA512 6cf1410c8d37229ee22c8054b284761c8ba5e1826151ab81590f116bdff38eb72a7c09dae1d5378607be20eb70c494a541f044ed2fad2a887e4d1838ba321339
SSDEEP 12288:lORBDpuaJSLAgpur3puWmOsixHf1tJQf+6F:YDXsi4f+6F
TLSH
T1E265C8409537E38FD5BA603107265B8C77A4EC16B7096F27B388453AD86BA16B4F93C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-29_fc53261e6c8f6959d2ff4690b87ddb55_amadey_bkransomware_darkgate_elex_floxif_maze_smoke-loader_PCULog0.txt

Path C:\Users\Admin\AppData\Local\Temp\2026-08-29_fc53261e6c8f6959d2ff4690b87ddb55_amadey_bkransomware_darkgate_elex_floxif_maze_smoke-loader_PCULog0.txt
Size 771B
SHA256 8fcb9dfe86aebd79fb34e629e73744f58996dc8335740522af2cdce11b6d0952
MD5 44a96becc5f791fdf0d6121c76edbb05
SHA1 bde86bb80f5da3b6982d893a7c50b25f5afe2840
SHA512 e0bf49e50bb7f01ff016db8e168fd21eed5cef697967510793968d3b7617010f5842d5dd68f0b4ce9519dc379d40747517d8732e11720c9f0d582a2519b4f949
TLSH
T1C6017C029ADF8E911F214403F298D5C8F3E8616997DE97AC6FB1318BB1AC15FA386D05
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 f0da8c0d2a5c6296ca2cf6619d2ef3a53b62ccf383cea591f08f9d5fffbb94cc
MD5 e4c21db0557de5fd60a5ba9f64f53762
SHA1 0b80aaac4cf11f158ef95a7126e33b6a275856f8
SHA512 57eb8244d74a743a66384202808be30e81a6f79d00823f03e0f823ff42b65a386688df77af5cd5482f0cbf64f986a2e13b447f357b58aaa5c213405603a26c02
SSDEEP 12288:P67yGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWh:GynQ/tbw/2Mkjy6Fr7g0oh
TLSH
T1C45523656668F94BFA3B06F058828111673F0EC5AF90D3CFBB082269957D3D40EFA785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 75889d197c134456dc078843890654775b8084abb42e368f7b555cc68dfa10b2
MD5 a29031b0662ede97a7638e210b7638e2
SHA1 75493ea133407252cd4dec9f4025cd0f86d040c5
SHA512 d1315ca5a83db6c78e42732df16a9489930cb87a5188d7d6fa561e6b4abf5673669e6feb826f796996cf06123ad909f4cd5ad7c0dd16cbc157ed0cb664609800
SSDEEP 24576:Jgb6bmBIi49WNNFpg1rSvFv7bY8nQ/tbw/2Mkjy6Fr7g0oc:Jgb4mBIBhGFnQ/lFTjN4
TLSH
T18265AE1E22EC02F5E0FAD2B89DA64417D6B278161731D2DF1251423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 8b51203810b94265a887685f0565bcec8a0f668a46b13c8e45039d139ed2603d
MD5 3fea71f337112514047fdc04d5e773a3
SHA1 7fe46bc3dcb1ad8982e80a63ffaa262d3541862d
SHA512 641cddd3f0a6c088a2fa108fae7f3d4e550a165986e8d7a9bdaec88bfe24c032469afe0ae2669517dddbba6eb7073f5dbbbc0a328ea00043b04076d4120dadcc
SSDEEP 24576:FG88u8FpJqH1Qzria7/m3nQ/tbw/2Mkjy6Fr7g0oW:o7ZFPqVva7/EQ/lFTjN4
TLSH
T1AD85F16576E101F1E47BD13889824663F6B2B8251364EBDF0BA88B551F337E40B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 2d0b95100e25046cf3352f9b11422e140d51f78ee997e42976f74bb204518dd0
MD5 290cc66e8e59554f51f431040816e758
SHA1 96c7eadad4816e32d3bdd392ec7057bf8ce86e5a
SHA512 facfbe60eed44e914938dcf0614f1a3c93373ceadb0fb031ac9a25ad2f4ea39db9829c588c7f497b54862e7c84aae842b35cf74a03ad0e9cd2c6edfd84ec1a64
SSDEEP 49152:VBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjbQ/lFTjN4:eG05lO43bZLm
TLSH
T15DD5CF6E62EC11F9D1BBC17CD9C68A0BEBB23815032556CF02A486A91F27FF4597E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7cf2f7d624921b6bf3a3c16604835d467f7b9b63a167853b5b6d037d7a919efb
MD5 0aceb30897c41e396ef432de64e7fb52
SHA1 1a478156ddcb0195548a76899ecdaea999a7b5fe
SHA512 9de5ca461e9c35400079c734d9da3279acf1e3a2cd42eedaeed7c8d328250a5b393916f47c5abd874ad0dae1a2ee67a90c6f94565ac6d123341c509e2e94ba05
SSDEEP 24576:ifa5POZ3dpFWVM50JicR2hG0lasx2+47eidnlnQ/tbw/2Mkjy6Fr7g0of:qa5POZ3+Jt2pasx2+mTQ/lFTjN4
TLSH
T12B65AF5EA6F801D5E579D17DC583860AE5B2342253319BCF122182BE3F37EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 51490cc6486f169cfa7e1e27082bd88d2a3cd7b978018c1992f9e539d2e9063c
MD5 bf94c62df22d68a4d9ef17eae3f56071
SHA1 32da4a44ddd7bc62c3566e5770b783c7411e6738
SHA512 3b60ce5043246c7ddccbf58ba0ce21412afbab8e31da2edeb97a8e6ae8be36e37a04b0fe3c73a841bddebc4b8952c3d5fdd25c7501bf4808a871318f8710faa5
SSDEEP 24576:jNcwHdjbyQ4nLC18lb/EOjowL7FkPnQ/tbw/2Mkjy6Fr7g0oI:jNc/zEOVHFkQ/lFTjN4
TLSH
T1B7858B2623E901E4F5BBE1BE89679546FA71786517308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 29d8bc7e96676476247563249d1c73a9c88a1b2f3b6034c38ff8938a62e3b8dc
MD5 b233b71a016cc4b5d849d60b366bd3fb
SHA1 2ce6c4967e86f20e758bbb9b9435cf70b292a5b2
SHA512 5d796a864671a9e7393ad040e635048f9fc7afa6278929ca3aa886e6c1504738e6a1bbe89b11a0c02622847223a6adcfe4a3c50aac1efddac74bbc145236a111
SSDEEP 24576:18kNvNnaFeYhJNtmZBmwnQ/tbw/2Mkjy6Fr7g0oA:18MwBtOmwQ/lFTjN4
TLSH
T1EE55AF2EBAB846E4D1FEC6B4CD238512E6727451173293CB5390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 418464a171ce744c6eda4b3efd44d9beb66b55a323301c36a712d8b984bdd380
MD5 15ef1e13be4aa630a2c59210057644b9
SHA1 0ac87037857c7c80ce8d069024e8235db338b04d
SHA512 3072e2373b6899521834cd8459cf28b540b284cee83aecd0581dafe359c81d4850cf238515465e6458f453774110304d53e4b5ed58f11b55b68d256050216829
SSDEEP 12288:OHvUrBFrEjwaQbGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWz:OPUr+NQLnQ/tbw/2Mkjy6Fr7g0oz
TLSH
T15965E12F26AC18E5F676A17D89828609F77278521752D3CF02D0817E4F77AE86D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 5ebccdc2b8295c7acf58d433a1b2d2676ff28de93c64f14e8f1fc802e8bb967a
MD5 2447678ebc75227dc0f3567356650c73
SHA1 8b038b6b5696ed90752243d3cb3ddb8abc73e439
SHA512 56e23d0d59a4646726ec92c9e7d188fea89889a92f927263c6b2b139f652de696e3014c51897cbb72aedb675790929f550c3da6cdf344b5ec0e65017a551eba7
SSDEEP 24576:nD3FHshBIYQgAunQ/tbw/2Mkjy6Fr7g0oV:nDVHeBIAAuQ/lFTjN4
TLSH
T15475E17DE65C04E5E57BC1BCCA538606E77238A9032266CB129481B95F7BFE42D3AF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/820-111-0x00000000009C0000-0x0000000000A26000-memory.dmp

Download

memory/820-335-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/820-106-0x00000000009C0000-0x0000000000A26000-memory.dmp

Download

memory/820-105-0x0000000000400000-0x0000000000542000-memory.dmp

Download

memory/1932-170-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/1932-177-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1932-171-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/1932-342-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2024-148-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2024-142-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/2024-140-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2024-338-0x0000000140000000-0x00000001401E9000-memory.dmp

Download

memory/2156-73-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2156-89-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2156-77-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/2156-320-0x0000000140000000-0x000000014017A000-memory.dmp

Download

memory/2668-101-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2668-95-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/2668-93-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2668-334-0x0000000140000000-0x0000000140176000-memory.dmp

Download

memory/2848-61-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/2848-67-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/2848-60-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/2848-83-0x0000000001BA0000-0x0000000001C00000-memory.dmp

Download

memory/2848-271-0x0000000140000000-0x0000000140180000-memory.dmp

Download

memory/3124-341-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3124-337-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3124-339-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/3124-135-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/3124-128-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3124-129-0x0000000000840000-0x00000000008A0000-memory.dmp

Download

memory/3568-127-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3568-37-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3568-38-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3568-39-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/3568-31-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4232-169-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4232-53-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4232-44-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4232-45-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4556-165-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4556-160-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4556-153-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4556-163-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4556-154-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/4692-353-0x000002086D670000-0x000002086D8FB000-memory.dmp

Download

memory/4692-430-0x000002086D670000-0x000002086D8FB000-memory.dmp

Download

memory/4692-431-0x000002086D920000-0x000002086DB68000-memory.dmp

Download

memory/4692-354-0x000002086D920000-0x000002086DB68000-memory.dmp

Download

memory/5436-358-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5436-356-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5436-115-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5436-336-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5436-122-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5436-116-0x0000000000560000-0x00000000005C0000-memory.dmp

Download

memory/5764-88-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/5764-0-0x0000000000400000-0x0000000000840000-memory.dmp

Download

memory/5764-14-0x00000000033C0000-0x0000000003426000-memory.dmp

Download

memory/5764-87-0x0000000000400000-0x0000000000840000-memory.dmp

Download

memory/5764-7-0x00000000033C0000-0x0000000003426000-memory.dmp

Download

memory/5764-5-0x0000000010000000-0x0000000010030000-memory.dmp

Download