e735a3a570a8d4ddd2ad5bedcc714cfd715de1bb5afd08f170140caf1cf75e56

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_f4a3559f3e5479b88ad804fe62d516c1_bkransomware_elex_icedid_maze.exe
Size 2.3MB
Sample260714-c75hssez2s
SHA256 e735a3a570a8d4ddd2ad5bedcc714cfd715de1bb5afd08f170140caf1cf75e56
MD5 f4a3559f3e5479b88ad804fe62d516c1
SHA1 708db61b7e9c92e5eda356d3975e0d1011aaf332
SHA512 b55470ef6a55e5fa565c82948c6f1c20ed9ff432105ac5cb33ec98ce51f494a60db786049cfaba4a44adba6231f9021de7f43314566198d00acbd9b06dbd4855
SSDEEP 49152:0DD0FZs/Yl7dYUMQ+fCi6p6O8IFeIL8uxV1XL4p3+qyzXnN9m:gD0FZs/U73MQ+fCi6AeeA8uxV1XK3A9
TLSH
T104B5BF33F590907AC93313315E9D626C76A9BB710F36428722E55F2D3EB05C36A297A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
4360	alg.exe
4568	GameInputSvc.exe
5952	GameInputSvc.exe
5376	elevation_service.exe
4272	elevation_service.exe
5572	maintenanceservice.exe
5108	msdtc.exe
4904	OSE.EXE
4988	PerceptionSimulationService.exe
1696	perfhost.exe
3236	ReFsDedupSvc.exe
1484	locator.exe
5276	SensorDataService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-14_f4a3559f3e5479b88ad804fe62d516c1_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-14_f4a3559f3e5479b88ad804fe62d516c1_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-14_f4a3559f3e5479b88ad804fe62d516c1_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	alg.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-14_f4a3559f3e5479b88ad804fe62d516c1_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-14_f4a3559f3e5479b88ad804fe62d516c1_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-14_f4a3559f3e5479b88ad804fe62d516c1_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-14_f4a3559f3e5479b88ad804fe62d516c1_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\61c118ae8f8562d1.bin	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-14_f4a3559f3e5479b88ad804fe62d516c1_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-14_f4a3559f3e5479b88ad804fe62d516c1_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-14_f4a3559f3e5479b88ad804fe62d516c1_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-14_f4a3559f3e5479b88ad804fe62d516c1_bkransomware_elex_icedid_maze.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_118343\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-14_f4a3559f3e5479b88ad804fe62d516c1_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	GameInputSvc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_f4a3559f3e5479b88ad804fe62d516c1_bkransomware_elex_icedid_maze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5952	GameInputSvc.exe
5952	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1004	2026-07-14_f4a3559f3e5479b88ad804fe62d516c1_bkransomware_elex_icedid_maze.exe
Token: SeTcbPrivilege	4568	GameInputSvc.exe
Token: SeBackupPrivilege	3236	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3236	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3236	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3236	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3236	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3236	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3236	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3236	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3236	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3236	ReFsDedupSvc.exe
Token: SeDebugPrivilege	4360	alg.exe
Token: SeDebugPrivilege	4360	alg.exe
Token: SeDebugPrivilege	4568	GameInputSvc.exe
Token: SeDebugPrivilege	4568	GameInputSvc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1004	2026-07-14_f4a3559f3e5479b88ad804fe62d516c1_bkransomware_elex_icedid_maze.exe
1004	2026-07-14_f4a3559f3e5479b88ad804fe62d516c1_bkransomware_elex_icedid_maze.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1004	2026-07-14_f4a3559f3e5479b88ad804fe62d516c1_bkransomware_elex_icedid_maze.exe
1004	2026-07-14_f4a3559f3e5479b88ad804fe62d516c1_bkransomware_elex_icedid_maze.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1004	2026-07-14_f4a3559f3e5479b88ad804fe62d516c1_bkransomware_elex_icedid_maze.exe
1004	2026-07-14_f4a3559f3e5479b88ad804fe62d516c1_bkransomware_elex_icedid_maze.exe
1004	2026-07-14_f4a3559f3e5479b88ad804fe62d516c1_bkransomware_elex_icedid_maze.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 5952	4568	GameInputSvc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-14_f4a3559f3e5479b88ad804fe62d516c1_bkransomware_elex_icedid_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_f4a3559f3e5479b88ad804fe62d516c1_bkransomware_elex_icedid_maze.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1004

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4360

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5952

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4272

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5572

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5108

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4904

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4988

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1696

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3236

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1484

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7526fd1be75737e77076feb8b424c756ef804cfcf09a3dec323171c3f91cbfdb
MD5 0e43f257f9d474fc80453057dd95a648
SHA1 69ef48d387a411f19a7e90d30266735419996fbc
SHA512 45498ea7f8285fdfb389381dda9c02a1be1e738c1638513f2ccd9b0138c0d84b7f9aefe5196a73097944d6682224f9e72da656452f798c2df11d422dae97d9d2
SSDEEP 49152:Jqu632BuPkFKRrdE6oh7stBhuXjfS4LWxna3+qyzXnN9m:u3q6gjBn3A9
TLSH
T1D6D59D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 57113f86614a4635eeaa0cb7dd3e5e7270827899789bcb709219a98c0ec0ac91
MD5 794316893c20f9f826fbd184be329484
SHA1 d4be1e567b78118c8fbefce91b1e1bcb07c39ce3
SHA512 e24520925bbd83d5a7383388cd3fc772d16593e52b1d2f50b514ddd984b0e77acdabe94976f19f78d6b084931baf29900e321734520f6024d1367a2a6c628df8
SSDEEP 12288:X1XLs5IzHxag4TT2czAAmZ337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:FXYONhczAAmd37yt8UTnzXndAns9m
TLSH
T1CF05012967E108FAED67823DCC628412DB72B85247A0E74F03B486795F633D85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 bda539c745dcd497f3fcfdddb43c31e2fe9b6cbdd504c11c96a6c82c4f6ef664
MD5 8b1e51978c50ef8553212df2d5178e48
SHA1 390571293e96376ec046642dbe06d39a4aed6260
SHA512 60a171f27d2d90d9d0b68ae025e70764a7d0b1cc664c4e55dc337a430060b94a78b9dfddf50be5035259277b8e2fd1ed46ed5d1d96f762c6461049ca6bf212de
SSDEEP 24576:j03es0Q0K/xOrM6Fd37yt8UTnzXndAns9m:jy0Q0cohb3+qyzXnN9m
TLSH
T17845AE56F6748731D073C0B9C5D2A69AEA7130825B308ACB4286C77C7F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 486c63c5cc2cf7e32cb3093b143ffe831136f83a718af71806c24bf3507d6d04
MD5 7ce37f3f93e14192fc3dd3f68535218c
SHA1 33413241c16f4a9b51389317e4014b5067ae5b74
SHA512 09fcc4d1f9aa90a37d987abc54c753f34fedf30e184a616bea3410ae9d1d86073fc857c075f1c42b5df2fd191e2957deeadab04a78656771d4a29ce4528a8a20
SSDEEP 24576:8Av/ezSC6vUyD/aqgrvW/6q8wyu9d37yt8UTnzXndAns9m:J/ezSC6vUzPvuHjy63+qyzXnN9m
TLSH
T12F756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 bc9c28786561133ec5616cbfbc61f78dc30a6a66e57f629acbf9394267de1d45
MD5 b985389e1c85f09bcb65b7d18a1c442a
SHA1 6b5adaff3d80c4d1f7e8ad6a67fa8a00966357b6
SHA512 2b160200470e484db40524d70fa5b45d70d2db09f578fb4e5a4d24a4bc954a860298ae0d60c931bfb8a802261fea2adf18278ef9c1a7ee4125b1a7251d242579
SSDEEP 24576:tabdPsMAsv/l+dGd37yt8UTnzXndAns9m:taSMAsXl+E3+qyzXnN9m
TLSH
T17E55AE66F5748331D073C0BAC4D2AA9AEE7234424B318ACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 1274ce4529eb44f4972e1be176d5422bc6c6160825eb6cd062976887f58aaab8
MD5 78c392a4c1ce5605dc1545cd3b4eb4bd
SHA1 4f5471a95f2ca1f01041b05a16cc6c39f25a875f
SHA512 d8e5fe88ea4e730ae1dde24a5483aac90b15bae7eae1a66d996880fc84fbfdd8f6b07ef6316abfe9966dbe980efb1b3721b67c9fec0c9a6cabaf79ccf174c189
SSDEEP 12288:AJ0Z337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:AJ0d37yt8UTnzXndAns9m
TLSH
T1B6D423CF89215CE7FBAA8D33552A283207F4BE334495831F223253EDBAF5190A52B655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 80e4dc134a95c6f9ec108a035493106048cac862726195dc0c9988a84758c29e
MD5 9c9c1ab8b4ab48fce26d9e3fdec929fb
SHA1 688fd8cd77c716b0a0a7c43dc2e5a19bf9d95e76
SHA512 902fc8ee0c856e3885003dd33ca00940343274906ecdbff04e61895f3aef16537494b43adb3dfab5852fb9d209e341b9984bab1682c8483748ecff0b2d33589f
SSDEEP 12288:BeBNUbTVO86UWZ337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:BJIUWd37yt8UTnzXndAns9m
TLSH
T1D015DF7BEE28FCD2C27E8D795A51860097B278314B6293CBD175830EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 387eea13f216f12fef0155e515cd257e93412e1a2246bc74ad06a7867f246e85
MD5 d2e84e400fc9ba05c7056570e8e3954e
SHA1 9953ee099430efaa742b5b8d3133cf6b4294e3ad
SHA512 7de3a00ae72be70668a500f0fc943e3ae7f690b19b0703e9c9221e0b5d3c505e404e3ccdcbf0cd9f2c4fc60fd8e2d2bc012caf8293e7a3a76a8320e15b179c1d
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJ99DN5J8NRV3THV:jQvGAdlCEL8c/9RNw5CC3A9
TLSH
T17F366C656BF880F5E0A7E138897AC5B2F7B678520D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 094df6535c8d2a7a9dca3bce31368944ffcef3c8c67bb55c22b8a4ed8f41b661
MD5 e6984773afbf7495c2d7f59344885f76
SHA1 86ec2a1f7afae234e88029fe3c92b9add2e94311
SHA512 666e7a48adfd8f2c2b39151155827ece02ced97610b489b395d82abf698a43cda2db120fe23baf1a38d58274f53a2d2eee1fc234b5bfaf1e961a6a5f34f47eab
SSDEEP 12288:IPwSfxL/2Dc3bDLLmt0LDQewsAjTZ337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:OmewsAjTd37yt8UTnzXndAns9m
TLSH
T16415E031FE74E436D3BF0DB21B36C716147CBA214B911AC3E3A88A9D59702D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 c1b2cfbccf49094264216a3a63603b62c0d41758d0f04ce9d48f4f1ab73c5fd5
MD5 827345257c345ca0ac253a2a66966fef
SHA1 d088d01228d2a62a246c20fd515895516b3d743e
SHA512 6081a8217a96540906261715b31fb33bc2fb42855eb273c8c21c6918564d8c18bc01e090e2e3279ebbc34334edaf4512b6f9aa1c949d3495624c93e253ec5c0a
SSDEEP 196608:lUEtQeTbvf2zlO12sJTv6Ja1cpVLyXFldPlbuJHw:lUEtQevvqc2W1cpV2XF32w
TLSH
T1C0474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6ea84e45bfb904003d93561ac12cc9aaf0eb3b2f98cfd117d5643375cc956626
MD5 d41a212637d08f863d978ec34f3b8040
SHA1 4ef739c80f10e654ed22ca6e0049a27c54311a21
SHA512 fcf65a6df7d8276fc37c7126851d00013c04b7e20de70357fccda29e82ae4eb3784e46172815b49817006558064c5bf7f182893f8f1464b4065457f4706c04c2
SSDEEP 49152:OTbRquA/m2yL5zMfFiV+XenmE3/z73+qyzXnN9m:coq1Vjnm23A9
TLSH
T18BD58D0A76B8C1E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 0bd6205e28145f03a800c6cb1e0ceca5cd1c3f6feaeccb7f3858f86231c7a379
MD5 4c815cb9e3664ddb8dca18663a34f1e8
SHA1 024c4a2ff42ebbe699586fcbf971d3220b57535b
SHA512 2370a2c923c32e943665ea9e8cd3409d57fc45c3b5e88fc4e44a325e2f2160fd0583c11d8437c720c4b599ab4211480bdaf2b292432452c7227f643ea950c57b
SSDEEP 24576:RAhGLvVFoiwtA5l7S532d37yt8UTnzXndAns9m:RAMZFoiq5i3+qyzXnN9m
TLSH
T19F45AE81E7F955D4F5F3AA7899769471EAB6BCA65E31C20F2120C21F1E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 2288ac9df5bfee564aaf90879519671e64aa4c28161db7d98043f81f43a2e72a
MD5 59ece0110871ad2faf4033db5857232a
SHA1 fcafdf67862c29f88a9fed2b24f7ced43e00facb
SHA512 41efd124e2928a85dfd6e3c30dca04fd7270dcac4f624c27874730c38b0d62f2e3b543bd62628eb8d388e164783cf702fb63d2366e25c7a9511a61a9ece74885
SSDEEP 12288:Pmw5HEjsChNXBFgl0WDm+C5Z337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:uwuuOWOd37yt8UTnzXndAns9m
TLSH
T10305F14A66A41CF9E9A7863985578432E7F2B8122A25C71F1370C35F6F773607D2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 c1f4577f4b9d515630186dc833d5dc4a5dc4aa1b5e6839a2a98767af883c704b
MD5 26495a8779c8a7368d95c773e36ffad3
SHA1 cefe01a9fca80f6b9dda466d48dd84ba885f3302
SHA512 730a24fbe3c1dd21795436633b4e593871de5af3430af18fc8388ec6855b8007a2003f6a66a31e636ef13abab047bac38989d5ed3341b6384677872632baf181
SSDEEP 12288:lVx1IAdZ337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:bxu+d37yt8UTnzXndAns9m
TLSH
T1EBE4128F16A424FAF2A78A39C8A51912C7F17423177683CF123543AD6FB36D12D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 69c0353e5efd875ccfba04aed5ff6b5850fb25a73a5ec7d84fdc7ae836836a91
MD5 59ef4598a4de941d3df6f3bbbeb41239
SHA1 5e32b1bfc96f3e3378e41908f65dd629bc9be208
SHA512 01b4a72e788f0551ddf5265807cdfecfbb90a1d85bc3a6f1b43591e99d9e705c8b3362313686c876abcc01b70d6c74388e7b6f85350a8f366c26cd05641d4d19
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Uy:WQRQyi36YOcP8Lvw2gAf+PN3w3A9
TLSH
T136667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 0ecc46f4442a1a748bbd80617fa999972c16c4559ee0b4afdb0a84c2a9dfea95
MD5 a4268b794c88fe29b6521d864a972e7e
SHA1 847bed6cd24d385792841cd9be27f7692c8c1a2a
SHA512 419bcb4b27bd26a5639f2427d9bc1abaeca75f9e74c75449460b93347ed7af5dbee8918e4d9f291688a9913634a4513c3694254b12d6913fbe8d5f331014f79c
SSDEEP 49152:nj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Ut:WQRQyi36YOcP8Lvw2gAf+PN353A9
TLSH
T1C1667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 9bd62d7496925c7c856d836a1ae46b20a17812fcad11e09b45ced57019a42090
MD5 f415e082fd1acc33b51d2bcd7ccdfbfb
SHA1 15db93c4676a640398b90beb3f41cc0d1e2a146a
SHA512 eb2bddbce65f2a45012511686caae540448ea401e85400729fb74ebd49faea4b22fa7ff6af8839a214fb476c312e1641d6ae31c58d2152abe090a462c1dea570
SSDEEP 24576:7wvDHf6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0pd37yt8UTnzXndw:k68Qg55nhMeWu7PNU3/c3+qyzXnN9m
TLSH
T174B55A33B2F200A9D44DE1769F4A873196D17C718FE1E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 da5075f1d1800eeb46abc13bc6526f0bb3bb53d3a1bab5316b33e01b4a6f914d
MD5 af140fa7230124bf8f5bc6b2c6d1164a
SHA1 0d8472a18fa107cfd308b933dae8b5c69f26e57e
SHA512 b46ea90bf0c67a488293fb0217fd5d91461825a6eebe0c917255ce74521f01d7a67c3fc35b22963eccb9a90d681091d1ce6c737cdb45e47cc9e6e8f473e1434d
SSDEEP 49152:o3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99D:Fy5112gYy5azzVv569nLKnhZQ3A9
TLSH
T121167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 b71d7f94d28761e8fb268a307ad1bbdb162e21acb2b9b3760c002f3b6821ac8b
MD5 5ec510edfaf5a0daf727547ad02358fb
SHA1 b359011d40ee35e9d21df5b5752af9d69e333f90
SHA512 f7dbd097d7171b88073c24d80f08f21afd888090252d03cac90d7f2a6b03b93ddc4c740534f382a6e41328ea7e03ef34e3da2c86600a1b8d97d5b515979661ec
SSDEEP 49152:kK+taZ3usBWOBr4tEGp0bqx0z+n217aau1glT3+qyzXnN9m:Bu6JmTxd2dT3A9
TLSH
T159D59D13F1DA01E8D06ED478974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 38082d264f28e07ccec2120dbb3fa8154ff3ac711ef5b15fa77cc57d325ab5db
MD5 f2ddc2628100654ac5ce824ef52ca0a6
SHA1 b3c9c368d8de5b6e45670084926aa5a27bbbe2eb
SHA512 0f7230a012bd30d22e0044be3d44ec83a88935fee02572b785fc019a02218e6232f05ca0a86f1c1d67facd6d1908d254abe1834f0ed36c62fe6905a55ad7fc01
SSDEEP 49152:41hpsNoJpF1A6UU44CwH7R4xL3+qyzXnN9m:4mifPbRc3A9
TLSH
T12CB5BE13F29900E8D06ED17887569632EA71BC460B34B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c10c27d8324f2397091c8b6ed500ecf3613ce7605921d2126c37b3221434bdfb
MD5 9fd1143e87f8b285efc6d8e8818db329
SHA1 19c67adfa8ee42730760605e7252ae5f7b00bcdd
SHA512 8a8c72ec7b11d4572e86e76033b80d206289d33a761a9e151f8226bc64a27527e0204bef2a440075ae7adcba42c0ea5b4cbf9dd0598144dc45f07ed176b71c10
SSDEEP 49152:+SuZQIY0Be2K6RVtOnks6NMHqN3+qyzXnN9m:Q5dKoi61N3A9
TLSH
T1CCC5BF03F2E940E8E0BED67487669632EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 59a4d1794d758295a3de23f3189a84689f393110462a35108a3f6bd76d8cce73
MD5 98a2de927a3b3e466a72e8c7242833bf
SHA1 b46436efe9a8865a35e90535b093b5c8b1940afb
SHA512 58e2a235952762c4e561235d010cf23813407575f415ea66d65b4d4150b7fb4e81ed3efc24e3f3d0d9b7d964bec1691de1109391c89319a9fe31a3b37cc6e83f
SSDEEP 49152:ORLSn8EApI0figTgiDn0AP5wp3+qyzXnN9m:JX2iyphy3A9
TLSH
T117A5BE13F2D900E8D05ED179C7468632EA62BC160B39A6EF0A50B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 602KB
SHA256 bb1fadb1421777399db74980ece727b48ed7e4b157056a1a279e77eacdd896a5
MD5 a8f4344ac05404455937af0ce77b2334
SHA1 b18e45e615618c79756bcd33bdf5e326c196eb7e
SHA512 37141811d71e0034aa3e229785afadde9b2a0ad9e8987b4de48022f4c98810ca3ebfb83290e9031775f757df0236f319ef1068f5fffd6496449177db01e7300d
SSDEEP 12288:zmZ337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:zmd37yt8UTnzXndAns9m
TLSH
T101D423CF88725CD7F6998E334526283246F8BA339496831F373643ACFBF5194252B694
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 602KB
SHA256 c5e94fb096df765e249686f99ce2028bbceb5eee6f2261702a8d6eaef7e0283d
MD5 1a107e5e4c33acf3992dce122f6bd416
SHA1 b916cd6a84b3ee065a7bcbd540b56b1c92eaa076
SHA512 d91bd7c6b052ade64a91f20fbc95d2aa042781dee2bf574c41b1d67fcbc9df9f558f577cbcbf1cef5a80d12c419d7fd995999ed825734c8d95d7ec0c2a9e86d3
SSDEEP 12288:ZpZ337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:Zpd37yt8UTnzXndAns9m
TLSH
T15FD423CF88364CD7F6A98E33451628324AF8BB339496831F373643ADBBF5164251B694
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 602KB
SHA256 b8aaaf5b343078a76d6af963e88e4bdc9b586e7761345bd44086a86b3bfe6cdf
MD5 4c725b2f451f921de47cc14ee50f48fa
SHA1 1e1f3922ca962c9b05522541d75ad160b91717b3
SHA512 72ad9ff8c88feadc94bfbee521ce3785971a8bab1f5c14b786ff6719c31e9c6861081b48848028b7d6d4a7f0221c7ee52a549449854b3550bfe4ec5b53ddf320
SSDEEP 12288:7LZ337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:7Ld37yt8UTnzXndAns9m
TLSH
T14CD423CF88365CD7F6A98E33451628324AF8BA339496831F363643ACBBF5154252B794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 623KB
SHA256 4ed7216bf3e90e187ee26a07803d7b472b6d4d91365b46103a5a0dbc61cdc6d2
MD5 45731e77114b32f82693159f6c910da6
SHA1 8c4db2ca7b8d98afc0759fd0ff3bb7463ddc31ab
SHA512 d628a3dd5531901c4e24920e67d26282cd055f26a4069e0b6215817af7761ef1f323dee2885ad5e964ba40ff34389be95f0cd3127ad9c6b95bc58a0568d0ce2d
SSDEEP 12288:5lvbZ337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:Hd37yt8UTnzXndAns9m
TLSH
T1AAD423CF497648D7F9A6CE328926183287F8BD339576831F272103AD6FF1354292AB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 602KB
SHA256 83fab633ed22358fbf2ab74f5ad097d178635389cc5e190936ef0309aeb7cae4
MD5 3b18adfabf9927df6a3e6ef7916f1149
SHA1 8d8662249ff9cefb70619847d8f7dcdc687d53e3
SHA512 442326a33d7911124646ea09c2597a8430d4fb02e40012caebc3e3807e0a662fb19a284e2ac373e207a563657ba81bd1025ed6af2f7120230dd767706f7ba69a
SSDEEP 12288:6opZ337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:6opd37yt8UTnzXndAns9m
TLSH
T114D423CF88365CD7F6998E33451628324BF8BA339496831F363643BCBBF5164252B694
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 602KB
SHA256 8363963f0ac96cd1c74138639c85ef80a7a60ec18ad67a73c739ca98ba17e318
MD5 f508f7563f6b30d91632571399236d35
SHA1 fb7194500af2d2af8e46f798897205aaabb509b7
SHA512 71cefdf6380ae1f69313c037fc7e671df8304e73dd63c5079980fe1954bf872a568ac23aa88fcd996bdf3a3951fcff4862b51876d5192adf5d6a228800e7f0e5
SSDEEP 12288:xbZ337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:xbd37yt8UTnzXndAns9m
TLSH
T1E2D423CF88325CD7F6A98E334526283247F8BB339496831F363643ADBBF5164251B694
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 602KB
SHA256 3d1e7cd702a1603d10bfdfcf81d7391612e66baf5c0e767954ae3e7d8c9baebf
MD5 08a4177e2f76da7e36a7f3b26eba035d
SHA1 8059421d507bb1b63ce0b5cd7d9b7abafe1370c2
SHA512 0002519e9cb46f06836a33bd612b7971c1b51c8d28671a76774551b63a4dcbbe8ec12eaad350da904e347d7efcc8f8d4f33582645e3942e0d3073123a082c1fe
SSDEEP 12288:CeZ337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:Ced37yt8UTnzXndAns9m
TLSH
T12CD423CF88325CD7F6A98E334516283247F8BA3398D6831F363643ADBBF5164251B694
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 864KB
SHA256 368360c97b03dd4940d0f791c07402986f7abdcbd6dac3138c7ecc1fd0a07f66
MD5 a6ef9cc76864a9194001e8b4297c811a
SHA1 1f0dc638ad14893b3efb9476e5cf2cad47d85eaa
SHA512 4049b999806a81466821b3766f538329200482d42ea8d2ec6310c0690afd07ab53816a912ad87cdf48668e9de3f527d6b8bdfcef0316de201dbd6a89f8f0c678
SSDEEP 12288:uiZwbEEzFEoSzcPvy6Z337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:RZMPzFVSD6d37yt8UTnzXndAns9m
TLSH
T1AE150199B3601CF9ECA7863EC9155812D6F17C260AA0C71F13B4326A6F733A11D3EB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 602KB
SHA256 fe0dde7ddd9dea78bd8035c7a51b18dcae6a752d62c069184fa2a9c812ab1437
MD5 cfcc095613605a8ae8625e22ba25244b
SHA1 674e2693c7fe06aa91ea8ba300640c6e1a4e4b59
SHA512 87014ca8b006dff36db8ac3dc394c6f79a3837f59fca95c99c20897cd67f3d4af9432e981ff12d5765a5700ae041c98f7c1bc7393b42c7ab70f0f6d283d779ad
SSDEEP 12288:9FZ337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:9Fd37yt8UTnzXndAns9m
TLSH
T150D423CF88365CD7F6998E33452628324AF8BB3354D6831F363643ACBBF5194252B694
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 602KB
SHA256 4031960e58eb11792c18e0f05c01967256cb24ccf1f12138a73b813218bae36c
MD5 89d8e8b829e830b2e97a73f8d6bf936b
SHA1 b02ef02a19e294e56682268afefbca665705d5f4
SHA512 463284b434762b9c5b1fe674ca7866e9c1b36388fd45d9390a1886dac501a33e64c71350474c1262735957fd92dd842b256b36865b482f8f9620404fc012f459
SSDEEP 12288:P3Z337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:P3d37yt8UTnzXndAns9m
TLSH
T111D423CF88724CD7F6A98E33451628324AF8BB339496831F373643ADBBF5164251B694
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 740KB
SHA256 028a7f420c9afc6903d4f7c60314ae099c9bbed8d185b4e7676e8212a11aceaa
MD5 7731134ad9959771f3e84a3209fd7af0
SHA1 93e8d75d59f91e3f7db4f2b63c696985edecb460
SHA512 425e0f20345d6b55e58e7aee830660d4f0b458c118a228d0afa1573c45bb07820a8fb9089d9b1a579167aae5ffbe504103400144659243b363d9ba2bd918122e
SSDEEP 12288:7nPD5LsjJZ337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:LDyjJd37yt8UTnzXndAns9m
TLSH
T16FF4124B667130FAE1768635C8621D12E7B5B83347648B2F236443BA6F772905E3FB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 602KB
SHA256 923e3f711a20baaf8831a6b289f49168bc4ede4f11e2d64f93a899b1fe962625
MD5 fe35b3ddfeddf1d83e13478f2a4eec83
SHA1 cd1e51e99a4ee2763df9b8ec68577ee031618ed2
SHA512 6a4a086f3660f1915d17fd543abc836fc88c62deba7c5d2bb12978fd207661b7447f2d1b63a83bc485d3fbb6614d60c8badbe3c399a40ac1f36ed8bd4d5a6508
SSDEEP 12288:JPZ337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:JPd37yt8UTnzXndAns9m
TLSH
T102D423CF88725CD7F6A98E33451628324AF8BB3394D6831F362643ACBBF5164251B694
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 602KB
SHA256 51315bf9493d7b85ee4fc1e6e2aef207d80d80cd8bfa10ac240d0aa502f172e4
MD5 303b19b593cf199198525583d0910384
SHA1 02b9456172ac7594fb1db335b386d1c94e5f94e5
SHA512 8f7fd04b16bb327524463e4014c878fbe713d200325dbd27ac6e0c0e2d8e6fed198f2e539e43c8ac2b2ff8dfb9e91134d7fe9e933c6125abfb4bbe25e4daf1f0
SSDEEP 12288:9ZZ337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:9Zd37yt8UTnzXndAns9m
TLSH
T197D423CF88725CD7F6A98E33451628334AF8BB3394D6831F362643ACBBF5164251B694
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 740KB
SHA256 15848a3091495a1c243e19db966902f8c396f34bfbedefc4d9cc59668568eed9
MD5 4d79ae135e5934962908fefacd96a13b
SHA1 6b5f44bff4963a59d7554d2f81d292e4073d1fa4
SHA512 a83bf84e64ba1f26457a362c6bb650daa7f0d678c13c23dfb368a83c350f3ddab8cafe1d329578e417b1f70365c4894b60ccea8ae6b0f9a4959b8871ce5a8338
SSDEEP 12288:GnPD5LsIZ337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:CDyId37yt8UTnzXndAns9m
TLSH
T139F4124B66B130F9E1768635C8621D12E7B5B83347648B2F236443BA6F772905E3FB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 864KB
SHA256 0b1dbbfc2c85cce79af2edd35b7da24f368f109a4c510d62cb79f4a901090ecf
MD5 2aa08d768362d4a03769a4d5500c8696
SHA1 bc55bf140ffb0776c0ba3ed21fa73945b60bc396
SHA512 3a2874066fcda6adfa0be80989d816779e4cc1149ae3ccd7ac8a54ebc1a2ee3ad5701b86a01979ccf4d172e53ff9aaf688cd18c200ea1393aba9d0d6af4996cf
SSDEEP 12288:RCd9gScoaLHF3z0zJ4PDvh5Z337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:sTNaLl3z0z85d37yt8UTnzXndAns9m
TLSH
T1FA15F199B3601CF9EDA7853EC9254916C6F1BC2706A0C71F13B4326A5F733A01D2EB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 5d5f06521401376072b70ef87d62398b498f65d8aa646f681fb589057274d3fe
MD5 467584b68e122bb7c1cc16f7e41db9b9
SHA1 a2135f14ce943977e4a75445ab67b23874b7ee29
SHA512 9058891f3b6cf0c57be9d6f78c74298c2a39efb87c5799d32c643485bd57de5c4150336e67c6752fb57d9d61cd7ab5bfbe6e653fd799b612199d2684192bec61
SSDEEP 12288:ii4e7+Hd5fgwCHKy7F4bbdIvIZ337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:i3ldPCHKy7FUNd37yt8UTnzXndAns9m
TLSH
T1C435DF91F3E414E9F0B7CA3589764512CAB67C6A1B71CA8F03A4265A1F337D18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 602KB
SHA256 e3e43c0cfa24721cc0cc9d8ee778793c04ba1067b86383d1e6bdc6afd8c5d566
MD5 3eb606b71d7d7ed2b4cbc8abfca020a5
SHA1 b7b5775305bd29b90e06b8e02f06ae72afcfc9fd
SHA512 e05081fd9c70c64b2c8db6028239a5ad57c9453762c155cf9722fba8dd881d285f03845a732d5b51cee6ac78214fac2957cf5bef420bf88c07fd38fc44614d2f
SSDEEP 12288:NkZ337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:Nkd37yt8UTnzXndAns9m
TLSH
T123D423CF88365CD7F6A98E334516283346F8BA3394D6831F373643ACBBE51A4251B694
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 602KB
SHA256 bf20050fdb5556c5e72292c7dec2048541b50752d60b051374a2bf9f4edde15c
MD5 8c367de8d67bae9b2732eb485dace766
SHA1 8a43128a2fd74099728103f68334e61da8125c54
SHA512 6fdc466c777ff8cf85ac717345adeab1f2d8cb401dd6ca396fd1a46c1a8ce260aaf4f19e818c9569ffb96aa47a557ab778582eccf75022553ced50185f2420de
SSDEEP 12288:vdvZ337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:vRd37yt8UTnzXndAns9m
TLSH
T1F3D423CF88325CE7F6A98E33451628324BF8BA339496831F373643ADBBE5154252B754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 602KB
SHA256 e9d12a33ba1c04ddf4e96db996e5841666e1e911fc18ee447f52ce7e2402c358
MD5 728f0e084548c0eef9a53cf906d65654
SHA1 281da1bc193b3af600db3250e33c8a25b500e923
SHA512 b45a3d748b5cbea8a56b0f322dbd10e27a8dbe94f82940244d83bbb12e94dea262e0fb72513ba15216195521a9b28e75a9875cfb0504a97ea6211586aed1aef3
SSDEEP 12288:YvMZ337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:YEd37yt8UTnzXndAns9m
TLSH
T153D423CF88325CD7F6A98E33551628334AF8BA3394D6831F363743ACBBE5194251B694
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 602KB
SHA256 efeac18c1715b30b2aaf8caf886179e9f8a4670326cdc6f07b956e29a54365f2
MD5 fa82ca7ea37c287fea3971514e910b87
SHA1 9e3fa7e178a76bfb0228dd69e150efdcb4a646e5
SHA512 14a442b5e387daaf538c68cf41105d55b4c25a90f7d81675eba7d1173f9c3f2bb3556512b5254ea3c873f896d4438b0f511c7e389d2b0f35e79fdb10efabc4b7
SSDEEP 12288:n6Z337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:n6d37yt8UTnzXndAns9m
TLSH
T19DD423CF88325CD7F6A98E33451628324BF8BA3394D6831F363643ADBBE5194251B794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 602KB
SHA256 9a5b8ad9c9c9a493fd70cb37ab66c0ce210bbd12fccb00ae9ec6c23e51332489
MD5 8578b1e9fc157bec03fbd8d310146d83
SHA1 dbe30788af51bc2246b3f9ce3069a1dbf0b8ee96
SHA512 d37bedd3929955ae68b2da7e5cd86250ec9d11b702c1ec52956747a2bf0e14cafe6c2e30566d6596aa7aa99f2419d7fcbad95bafc9fbb84d98b9e1c2df4d49c3
SSDEEP 12288:fCZ337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:fCd37yt8UTnzXndAns9m
TLSH
T13CD423CF88365CD7F6A98E33451628334BF8BA339496831F362643ACBBE5194251B794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 602KB
SHA256 3517c9b49475c3065b7024f6e5a3ad6a137d4429eb192cc5d4fcbfcf2005549d
MD5 aeabcb61405aff0ff267436bb185c285
SHA1 47c024b49e660712dfd1d46f8aced89ac607898c
SHA512 a80046e706ee4bd776c8aea0db7e8cb3007b7600db8e63a9f3b38390c91d802643f075a2991d07b1a0b03e291a94f231dd0d24162a93489720694a685c128929
SSDEEP 12288:OjZ337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:Ojd37yt8UTnzXndAns9m
TLSH
T117D423CF88325CEBF6A98E33451628324AF8BB3394D6831F372643ADFBE5154251B654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 602KB
SHA256 691216131e107258c0a18de405907ae4b29bce2a47b24ecc575a200ede223016
MD5 b148eff8e803abc1e2122d3ec01cc6fe
SHA1 ceb4d0a347637194420182bf113d5a1613160dbe
SHA512 8c8f89b1614ddc6022de0c8fcfab5934c2c2205941d12aed4b147424eeedb74ce830d46fc69f4ee85cf238e304ed151dce6dc0ed433639a48f96bc3306735c64
SSDEEP 12288:vSZ337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:vSd37yt8UTnzXndAns9m
TLSH
T17AD423CF88325CD7F6998E33451628324AF8BA3394D6831F372643ADFBE5164252B794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.1MB
SHA256 9e4ca1b852367719186a67b768abd4693799dcac7c977103385dfd20ebb34e3f
MD5 daa7d38c7dc939a133e7ad25a255f931
SHA1 acf1fd670330b1f91428f30adf3846abf064e685
SHA512 46d928f24a10c4c6ee22490b0c6b23d6c557accd98b504a7145800cb50a1b2e7baf9f8bf487bf78f52b2e48c495b4759aebb7690b812d2970514542ff55cb337
SSDEEP 24576:y/wvtk9RX6wkyAIGd37yt8UTnzXndAns9m:bMnYIC3+qyzXnN9m
TLSH
T1CD35D02DEBD848E5E1B7923C89B74606F6B178291B31C2CF125A53AD0E37ED45D3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 48042d6a5778762886b2c5e914d51b7784cc6e430e1200790b8588b45ad59c6b
MD5 1dd1313bd79807d64ea232f4d1b97279
SHA1 ecb07b16ce01c3ef1daad909b3a3d8a246098862
SHA512 4b8169b0f65e36daeb97ca3561bd83c4ae926099455f1089b27dbd2b122f8e7ab4b2686fc388f1235f0c3517fb6d0e50d6e8d0a9f6e74f55359ab3b798d554d9
SSDEEP 12288:dgdfaZ337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:aad37yt8UTnzXndAns9m
TLSH
T1EFF4014EC26405E9D1AE9636C7165911B7777C2286E1C38F23D0F27E1FB62906DEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 4c0adf5f77177f8e2b367ee688e1b968d8bfe35e848b7b167fae7a75b91b3484
MD5 47bacaf99cd1d4f2cf1ed259eec1227d
SHA1 badce111f8c70a60fc4530a4dda098bfffb2da99
SHA512 7312693a5c82dd6b5767351eaa655ddf01ad1f8d137926711df973a7951098337e148a70b0abcff0ba0ef89ca2e60996c67d14cb8530ebd8becfd3e2dd698d2a
SSDEEP 12288:R+7oZ337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:sod37yt8UTnzXndAns9m
TLSH
T1CDD4238F89265C97F9B98E32442A543206FCB6334B95C31F722643ECBAF55906D3B709
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 6f5e7a40d465416aec7d0cee9665200e8fc0ea79af68d3b53990fcce67d8de53
MD5 95542bec99b1827f65ffe032bc632614
SHA1 62c25a3b7578f889811fd3a2514c22480d817de5
SHA512 5c634fa9ea53615e014116ce7ba4ffdef1f5e862a452ecf8001ac9ba3fa1a45ee739240b2d77f8aa28e9fe1208ddbc4b35f807d63a07af11e7ec59544f0cc81a
SSDEEP 12288:VeGhcYZ337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:EG+Yd37yt8UTnzXndAns9m
TLSH
T100E4229F04B638D6E97ACA36842618336AF07633475443EF15A182BDEFE55E0363EE44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 4c88ff6dcab4870225061573eea97f7f0680e930aea99326ec8eb402f102e556
MD5 9207ae53be2b9300983653db6e771a7b
SHA1 5535ecb29074922fddaceeebbd174ea43e750902
SHA512 2d80b5a8dce8e2c357ca582c659b4263f8aa371d03835300deb3ca7c34d91fde02150a65dc328a6010e653a69a5bb9562bb94ba34ff5a723b0d8523525062be8
SSDEEP 12288:60Z337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:60d37yt8UTnzXndAns9m
TLSH
T13FD423CF88265CD7FAA58E334426183207E4B633579683DF312643ADBBE61E4253BA54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 4dda2f807bcd0b9118a29bd9e17435cc756b0f700efd966d18798156a57c82ca
MD5 85eaecba1a9f2245fd9112613c40dcfe
SHA1 23e01b5f7d2b33a477a2d503d13f89b771f21016
SHA512 ca91a1f1d74ea8c72e632c13214534c95ba1e6f7d4c6e7e78bd8d96b6bb8807dda7d5203f8e7862630615d4500b4ab07f75e91a0ca31ffd11de5e9efe41c07b3
SSDEEP 12288:WHvUrBFrEjwaQUZ337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:WPUr+NQUd37yt8UTnzXndAns9m
TLSH
T11E05F15F22A91CE5F67AE13D89424619E771B4630312D3CF02A1817E5F67AE8BD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 90f6ac3ec0b79a02859c9c697b6c82659509dc17c100ebe08ecb7e974b86be3a
MD5 1c2e1744a6bfad688fb41ad51d2a9ef3
SHA1 e9c1c701263fd9010e7a7ec2818313cc863920f1
SHA512 87687e0a69297d54354b99bff0561710d1823addf441b531eeb63b4084ecff2a7cf8c26563efd718090de7a9d6407196b6a8ae42477677178d2636655a2e121e
SSDEEP 49152:yBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjk3+qyzXnN9m:9G05lO43bX3A9
TLSH
T180D5CF6E62EC11F9D1BBC17CDA864A0BEBB23425033556CF02A486A91F27FF4657E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 106c978e7c8cb70074f466ae978d3303861d5278694260e61828b7f9e8e2a6dd
MD5 dd774057245f55f1e38494719f3405cc
SHA1 23ef23e918121d3bca5abf66945b54a0ed2982d9
SHA512 1af2b1cbba702044a2f41d76b8e6588296219f475d779e74829e7817246d30c6876fecb076f8196e173abc5a149feb95ba3531f87caa9610ba0a44e60faccdd3
SSDEEP 24576:5NcwHdjbyQ4nLC18lb/EOjowL7FkXd37yt8UTnzXndAns9m:5Nc/zEOVHFQ3+qyzXnN9m
TLSH
T149858C5A22E901E4F5BBE1BE89779546FAB17865133086CF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 e24a1b4a675a51fab93544cf317e11a2817186f4ce09deb0c9aac034e954f654
MD5 d61e1dfddbae30223f1b0c2df9f6cd69
SHA1 12eb43f2353cf8cc02a9709c9fba087713a00556
SHA512 b1540a7407336a36ebd8a088f3ada96d0fea54d74d5ba9ce4f48abd045fcbbd807d5d1983f787cafa00150eb5d88e2f1c5b860a37a502b7780fa82b5121fca15
SSDEEP 12288:i0Hck6j5ZI7zZ337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:v6DIXd37yt8UTnzXndAns9m
TLSH
T16605F15E227A10F6E1ABD03E85430412D2F1B172876256DF16A4C2BD9FE3ED8B93DE41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 43434b70988fba25f425f0e85a46df95dd8337f024f0418a6cb0f0333e278fea
MD5 3722a928a017b1737a4169000bd2f006
SHA1 0eb0d188cb7b79b4f1712533d1ca5b61405ffb19
SHA512 1ee1123dc5c5622f6daa1603410db6fb934914e0562b0c607227b71bf8621ce714c9ad25504a2abd0d384963ef5f5f95d67674ae255da35e834bea3ce5d780c7
SSDEEP 12288:fG6kywZ337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:utywd37yt8UTnzXndAns9m
TLSH
T192F4124A43A468D6FAB94A35892340718FB4BC325B2183DF21A1D37E7F767D07936B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 02f1e883774ba3d8c77debfc174ce6757d280e19bd9c6e4f124be1a8a4536c2f
MD5 b59f21e701ae37734c52a21de551b6dd
SHA1 270211764f771d42dfcfdfb047b141ea87eed7d4
SHA512 be0025ec18a411d8b08a567b56a0228d8dca001fb47ed9b58602f2a18a9dd6b558c511e2ba5553e0d7d667a9a43db6fdaf7ef7f1516f30986f6d2c0758176e31
SSDEEP 24576:JTkNvNnaFeYhJNtmZBmnd37yt8UTnzXndAns9m:JTMwBtOmd3+qyzXnN9m
TLSH
T1AA55BF6EAAB805E4E1FEC675CD238512EA727461073293CF5390C13E1E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 630a2a377b4bcf085ee739257f446d05fdabcd399b160e98ca94a8b754bbd1f9
MD5 1462c93a0c246be288071f937f21df19
SHA1 3902f6805fd925d5bd8a8c4b16a36778ef249e86
SHA512 92d2db0597b7338f1242083e06b66f1273b8621121ce16cb620562b73aa56b398a9429777d7a9020ce62d9f2223796d5c305160618b69449ab21d3cbe554aea5
SSDEEP 24576:XD3FHshBIYQgAod37yt8UTnzXndAns9ad37yt8UTnzXndAns9m:XDVHeBIAAU3+qyzXnN9O3+qyzXnN9m
TLSH
T1BE75027EDA6904E5E57BC17D8A634913D7B0387A032256CF129182B95F6BEE43D3AF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 056a508d1e9f53dd26d9744b3165b69df97d4cceca0c636b7c272cc8f80ec26c
MD5 995745597bd1b63a83c5da15e5dd4350
SHA1 52b4fbfde48f0bad9665ee8ad1b0e3ce020301ac
SHA512 a9a0687fbc690af0b3d5a66f044e5d71d5cccbfb7ecbfa5467e3a965fc0f8600d8fabea781826cbbc192a55690ba4f8190eb9704da188de6f1c96dee17160dfd
SSDEEP 24576:8D3FHshBIYQgAod37yt8UTnzXndAns9ad37yt8UTnzXndAns9m:8DVHeBIAAU3+qyzXnN9O3+qyzXnN9m
TLSH
T12875027EDA6904E5E57BC17D8A634913D7B0387A032256CF129182B95F6BEE43D3AF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 772KB
SHA256 adf2fc634695a35b7241468a5495748fb20890e77b731b9729b60fcd00c0fdec
MD5 c82cc41e14c8d1af5a4f75c93b0d6b28
SHA1 a07be0e2eb171be6efaab103150c5bcc4253879e
SHA512 d32fc5d74ee75bc2b418d66eb813963ee407a194e893f2c6b258b3a68e1a65f476c1a710b02921d2689626de654cb7828517f959a09bc4689382527d18d211ba
SSDEEP 12288:xy/6b3IkxjbBzGZ337fq0xoOWXPRGUiPeOOyyXDg1AuqmVns9m:i6UqjpGd37yt8UTnzXndAns9m
TLSH
T1F2F4128F46A468E6F47986309926403246B4BD3317B582EF32D483BE9F76AD4953FF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1004-6-0x0000000002930000-0x0000000002999000-memory.dmp

Download

memory/1004-0-0x0000000002810000-0x00000000028DF000-memory.dmp

Download

memory/1004-1-0x0000000002930000-0x0000000002999000-memory.dmp

Download

memory/1004-7-0x0000000002930000-0x0000000002999000-memory.dmp

Download

memory/1484-125-0x000001F9BFEB0000-0x000001F9BFF16000-memory.dmp

Download

memory/1484-161-0x00007FF6EE920000-0x00007FF6EE9CE000-memory.dmp

Download

memory/1484-124-0x00007FF6EE920000-0x00007FF6EE9CE000-memory.dmp

Download

memory/1484-126-0x000001F9BFEB0000-0x000001F9BFF16000-memory.dmp

Download

memory/1696-102-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/1696-103-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/1696-108-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/1696-159-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3236-160-0x00007FF690360000-0x00007FF690AA4000-memory.dmp

Download

memory/3236-116-0x0000024263B60000-0x0000024263BC6000-memory.dmp

Download

memory/3236-117-0x0000024263B60000-0x0000024263BC6000-memory.dmp

Download

memory/3236-283-0x0000024263B60000-0x0000024263BC6000-memory.dmp

Download

memory/3236-285-0x00007FF690360000-0x00007FF690AA4000-memory.dmp

Download

memory/3236-115-0x00007FF690360000-0x00007FF690AA4000-memory.dmp

Download

memory/4272-53-0x00000179690D0000-0x0000017969136000-memory.dmp

Download

memory/4272-54-0x00000179690D0000-0x0000017969136000-memory.dmp

Download

memory/4272-52-0x0000017967E10000-0x0000017967F8D000-memory.dmp

Download

memory/4360-18-0x0000022F4AF00000-0x0000022F4AF66000-memory.dmp

Download

memory/4360-17-0x0000022F4AF00000-0x0000022F4AF66000-memory.dmp

Download

memory/4360-16-0x0000022F4AF00000-0x0000022F4AF66000-memory.dmp

Download

memory/4360-92-0x00007FF79EC00000-0x00007FF79ED23000-memory.dmp

Download

memory/4360-15-0x00007FF79EC00000-0x00007FF79ED23000-memory.dmp

Download

memory/4568-27-0x00000253A39C0000-0x00000253A3A26000-memory.dmp

Download

memory/4568-28-0x00000253A39C0000-0x00000253A3A26000-memory.dmp

Download

memory/4568-29-0x00000253A39C0000-0x00000253A3A26000-memory.dmp

Download

memory/4568-112-0x00007FF65F160000-0x00007FF65F229000-memory.dmp

Download

memory/4568-26-0x00007FF65F160000-0x00007FF65F229000-memory.dmp

Download

memory/4904-85-0x000002AC0EDD0000-0x000002AC0EE36000-memory.dmp

Download

memory/4904-86-0x000002AC0EDD0000-0x000002AC0EE36000-memory.dmp

Download

memory/4904-84-0x000002AC0EB30000-0x000002AC0ECAD000-memory.dmp

Download

memory/4988-93-0x00007FF7B23B0000-0x00007FF7B24FA000-memory.dmp

Download

memory/4988-95-0x00000207D9160000-0x00000207D91C6000-memory.dmp

Download

memory/4988-97-0x00000207D9160000-0x00000207D91C6000-memory.dmp

Download

memory/4988-158-0x00007FF7B23B0000-0x00007FF7B24FA000-memory.dmp

Download

memory/5108-157-0x00007FF7E3FE0000-0x00007FF7E40FA000-memory.dmp

Download

memory/5108-73-0x00000263CCB10000-0x00000263CCB76000-memory.dmp

Download

memory/5108-74-0x00000263CCB10000-0x00000263CCB76000-memory.dmp

Download

memory/5108-72-0x00007FF7E3FE0000-0x00007FF7E40FA000-memory.dmp

Download

memory/5276-133-0x00000235E7C50000-0x00000235E7CB6000-memory.dmp

Download

memory/5276-134-0x00000235E7C50000-0x00000235E7CB6000-memory.dmp

Download

memory/5276-138-0x00007FF73AF20000-0x00007FF73B337000-memory.dmp

Download

memory/5276-163-0x00000235E7C50000-0x00000235E7CB6000-memory.dmp

Download

memory/5276-164-0x00007FF73AF20000-0x00007FF73B337000-memory.dmp

Download

memory/5376-46-0x000002103D5F0000-0x000002103D656000-memory.dmp

Download

memory/5376-44-0x000002103D3A0000-0x000002103D51D000-memory.dmp

Download

memory/5376-45-0x000002103D5F0000-0x000002103D656000-memory.dmp

Download

memory/5572-61-0x00000204F2690000-0x00000204F26F6000-memory.dmp

Download

memory/5572-60-0x00007FF690B00000-0x00007FF690C68000-memory.dmp

Download

memory/5572-62-0x00000204F2690000-0x00000204F26F6000-memory.dmp

Download

memory/5572-68-0x00000204F2690000-0x00000204F26F6000-memory.dmp

Download

memory/5572-70-0x00007FF690B00000-0x00007FF690C68000-memory.dmp

Download

memory/5952-35-0x00007FF65F160000-0x00007FF65F229000-memory.dmp

Download

memory/5952-36-0x000002AFCA3B0000-0x000002AFCA416000-memory.dmp

Download

memory/5952-38-0x000002AFCA3B0000-0x000002AFCA416000-memory.dmp

Download

memory/5952-37-0x000002AFCA3B0000-0x000002AFCA416000-memory.dmp

Download

memory/5952-123-0x00007FF65F160000-0x00007FF65F229000-memory.dmp

Download