df471f0af0485a61cf01159d50aac73de35b87838eacf643616f773eb4e28749

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_0e7f2a149dc5beeb5762259510a45489_bkransomware_elex_icedid_maze.exe
Size 2.3MB
Sample260808-eqdd4abf68
SHA256 df471f0af0485a61cf01159d50aac73de35b87838eacf643616f773eb4e28749
MD5 0e7f2a149dc5beeb5762259510a45489
SHA1 def145ec598b6ba044f2012d05d5616f9eb2e5c2
SHA512 b9e50645dd6bfc3a833eb427aec353ef16a6a0c6e154e5ea76d8cbd4cd4df0553a1a93a8ec5a9c6022a5c6e91df46acabe251d636ee29c0547000aefa5719e63
SSDEEP 49152:IDD0FZs/Yl7dYUMQ+fCi6p6O8IFeIL8uxV1XL45NzjSr6xbt:MD0FZs/U73MQ+fCi6AeeA8uxV1XeN
TLSH
T177B5B033F590907AC93313314E9D637C76A9BB710F36428722E55F2D2EB15C36A296A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
2084	alg.exe
1340	GameInputSvc.exe
5208	GameInputSvc.exe
4548	elevation_service.exe
1768	elevation_service.exe
4492	maintenanceservice.exe
3828	msdtc.exe
2304	OSE.EXE
1672	PerceptionSimulationService.exe
5532	perfhost.exe
5076	ReFsDedupSvc.exe
3524	locator.exe
3332	SensorDataService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\628d747be05f6396.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-08_0e7f2a149dc5beeb5762259510a45489_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-08_0e7f2a149dc5beeb5762259510a45489_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-08_0e7f2a149dc5beeb5762259510a45489_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-08_0e7f2a149dc5beeb5762259510a45489_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-08_0e7f2a149dc5beeb5762259510a45489_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-08_0e7f2a149dc5beeb5762259510a45489_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-08_0e7f2a149dc5beeb5762259510a45489_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-08_0e7f2a149dc5beeb5762259510a45489_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-08_0e7f2a149dc5beeb5762259510a45489_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-08_0e7f2a149dc5beeb5762259510a45489_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	GameInputSvc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-08_0e7f2a149dc5beeb5762259510a45489_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-08_0e7f2a149dc5beeb5762259510a45489_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	GameInputSvc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	GameInputSvc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-08_0e7f2a149dc5beeb5762259510a45489_bkransomware_elex_icedid_maze.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_0e7f2a149dc5beeb5762259510a45489_bkransomware_elex_icedid_maze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5208	GameInputSvc.exe
5208	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1236	2026-08-08_0e7f2a149dc5beeb5762259510a45489_bkransomware_elex_icedid_maze.exe
Token: SeTcbPrivilege	1340	GameInputSvc.exe
Token: SeBackupPrivilege	5076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5076	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5076	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5076	ReFsDedupSvc.exe
Token: SeDebugPrivilege	2084	alg.exe
Token: SeDebugPrivilege	2084	alg.exe
Token: SeDebugPrivilege	1340	GameInputSvc.exe
Token: SeDebugPrivilege	1340	GameInputSvc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1236	2026-08-08_0e7f2a149dc5beeb5762259510a45489_bkransomware_elex_icedid_maze.exe
1236	2026-08-08_0e7f2a149dc5beeb5762259510a45489_bkransomware_elex_icedid_maze.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1236	2026-08-08_0e7f2a149dc5beeb5762259510a45489_bkransomware_elex_icedid_maze.exe
1236	2026-08-08_0e7f2a149dc5beeb5762259510a45489_bkransomware_elex_icedid_maze.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1236	2026-08-08_0e7f2a149dc5beeb5762259510a45489_bkransomware_elex_icedid_maze.exe
1236	2026-08-08_0e7f2a149dc5beeb5762259510a45489_bkransomware_elex_icedid_maze.exe
1236	2026-08-08_0e7f2a149dc5beeb5762259510a45489_bkransomware_elex_icedid_maze.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 5208	1340	GameInputSvc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-08_0e7f2a149dc5beeb5762259510a45489_bkransomware_elex_icedid_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_0e7f2a149dc5beeb5762259510a45489_bkransomware_elex_icedid_maze.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1236

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2084

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5208

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4548

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1768

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4492

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3828

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2304

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1672

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5532

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5076

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3524

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 af91af0bff51692d325c944252483d291716d3ef8c6f8adfc11f096d98c2f96c
MD5 1baf16377c5889e6d68996769db857ec
SHA1 fffde88355273619132f49a347e4092ed0fb08de
SHA512 355653fd1f77d291f2dcad221595607bd9c7a0d1cd0971f3431083fed825615611b7f5dbc312ffef1862515ad0a484e9292d5abdf3613b09cdd371eb846f9f9d
SSDEEP 49152:Cb+632BuPkFKRrdE6oh7stBhuXjfS4LWxntNzjSr6xbt:k3q6gjB4N
TLSH
T177D59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 896cb18d4f241c33dd7b21386ed8732bc39e9859b9664c65aad13f2e415cf697
MD5 7a476d942191fda0a3413188dd0db3b8
SHA1 a31e27c09e82f97729df984b64fb70c61b182951
SHA512 ee1ac825df1550871b594de3e5e6dc52486287fd16c802887645a554251a080a54371d040ea80f25ad9870bb871345c1945e47a599ade592fd2d7b8a02f458cb
SSDEEP 24576:/XYsctczAsKINWE4aH7YBr69CyjQJUrBbbZtB:4tcDNzjSr6xbt
TLSH
T181050129B7E008F9ED67923CC8628512F673785543A0E78B03E495A51F332D99E3FB91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 376858926b2f5ec0456123b68f130c2d4fabacf7545695b245dffb6fdb9f3690
MD5 4c3ab77bf16f031f1191d9a8c9bd7f5a
SHA1 cddad168b818efa2f50ff6c22de59656292ef825
SHA512 a1cb9d2bf18441044ab5e88775a278f22feccca78999e41687183445979c0a714cc57fae2e62837d54cfcfa69afdca8e788ea627fdcd00aed749f094143617bb
SSDEEP 24576:P0Qe+rR0hmxOrMfKINWE4aH7YBr69CyjQJUrBbbZtB:PxrR0Ao2NzjSr6xbt
TLSH
T1E435AE56F5748335D073C0B9C5D2A69EEA72308257308ACB4286D77C3E67AE6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 532da59fe0c6986d9065aa5c28201ad82979aa0067dfbdc69c2d0fbd01550c69
MD5 92da02710a8b92dc8251ce16c8aaf780
SHA1 67ce3a113fcbfc78818f7de4de2e609c2e549195
SHA512 fed05ff9594726b093de034a83c16e018e503fe1667b424b2f0da014fdbd6f0ffd88941d913e67c2e3f9b39b97dc3db4c9a211d71ca2fa27aadb28fa2abfbb45
SSDEEP 24576:6Mv/ezSC6vUyD/aqgrvW/6q8wyuLKINWE4aH7YBr69CyjQJUrBbbZtB:f/ezSC6vUzPvuHjy0NzjSr6xbt
TLSH
T17F756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 1fb820e8f49592832c2be09680db49434128f092643acccc5db6c4a2c6eba2b5
MD5 9f4ddd84af6ccf52122e3f9ebf2f7019
SHA1 d228ad9fbaeeb45fc30a3d367929932de21dc5c3
SHA512 9b6145e968241d612570d637c3d0a041f15293a5bd1fa13b3efe34547b108b790e723770708ef74bd15e5615ba49eb985e8d71546bf437c14690a9f74de70b72
SSDEEP 24576:eabRPWepVv/l+dsKINWE4aH7YBr69CyjQJUrBbbZtB:eakepVXl+eNzjSr6xbt
TLSH
T10A559D66F5748331D073C0BAC5D3AA9AEE3234425B318ACB1246D76C2E677D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 115e5702e878bd7ef3ffa1d3c93bf96d027d33c41816589894b3bdb33e9cf882
MD5 f58544035ca28efc8f6d51f76e88a0eb
SHA1 763993c8674d276c9f0f731506ea8f58000dc5c5
SHA512 9b6d49a80ef05e55b781926b44b04c40c44f27aa7c7de5055948a1101e87ae38dece8b2a159cfda29825fdba553e4da91f2df56707060348c980e15c547a383d
SSDEEP 12288:QXYKINj6EzzgaGwn7YhPQOaP66lPCyjQPJT7l+rBbbb8GTtxZGAS:QXYKINWE4aH7YBr69CyjQJUrBbbZtB
TLSH
T1D1D423C2A8607455F3587735953B0ABB7247BC66A2DACB821AC635C92DF3083CBD7C91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 463522ed83f9ba6f18b92a43fb62b80aa604bdaedbf131516f1c03ad8754c266
MD5 3c6400a736c3c922c3a8c74cf9513247
SHA1 ee59b2a21a2a90d8587473a81d0a17f5f66b6307
SHA512 56ed54f25f1baed8260a68c19de352d80c837ed329af58c2fe4b9368300bfb8a87a63e3a8ae83392c524eadea731819a01a1249b2d610ee87660bf390c3de362
SSDEEP 24576:uJIU5KINWE4aH7YBr69CyjQJUrBbbZtB:uJIULNzjSr6xbt
TLSH
T1B815DF7BEE28FCD2C27E9D785B518700E77278304B6293CBD165824E9E235E14E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 11689067521dec3aa4be04b03ace3247887a9670bb4ffea92d9c673de1496471
MD5 73570fcb02ab9a6bdf835e8b451b7f4b
SHA1 9e75ae69ce8abf9ce08bf7980a38d9fdd5b2f43c
SHA512 6657813c266fc8c74d745647ac47b8fd1bf8938aa337ea8bd0e314520595b7fd5c6d1a5394e38799e2f6beed9af42f450c3ba207c47195235f546e7c84dcaa35
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJa9DN5J+NRV3THj:XQvGAdlCEL8c/aRNa5C0N
TLSH
T1F3367D656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 84f6aa07e8e5b8138d4f6b88e79325211de1d558dffa7f0ec391e38df1b924af
MD5 1670f60b3b55d91f461184930dfd4cee
SHA1 53777a75259233418e2b8aab35390b8a6157880e
SHA512 c2b35556978f800720beea490f25d34d740550dd0b0bc9a3b9976e0ba656162e7ea6157958c3ba0ae1c126d2a0ce20bf661393ff720cccdb1f66550116e328cc
SSDEEP 24576:CmewsAjaKINWE4aH7YBr69CyjQJUrBbbZtB:pljyNzjSr6xbt
TLSH
T1B515E031FE74E036C37B0DB21B36C716246D79204BA21AC3E3E85A8E59712D26776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 cc0b24bbf87ad7974ff041f92426b2c7fa7c5374bd8f48b023528ce8298eb2bf
MD5 d4c92c465a31a6a1ba7e8c035e9fda14
SHA1 e40c75fdba95566c732d591ea269aef70ee379cf
SHA512 57565f41149517064c8e7187cbb38a657f5f038fe30301bcc440df95e0cfc93c3fbdf3a93a29550f2e56ef3fe3b28af4662d058725d3300bb8741e7c770b0db9
SSDEEP 196608:xUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrqdPlbuJHw:xUEtQevvqc2W1cpV2Xri2
TLSH
T147474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 6434d73ef1b81446df3595ac9fc943261c48cd83e253be17c0bf2cedb44d1419
MD5 490f8e95c600514f07d900184e6d514d
SHA1 0d8c2b78e4e8a1f0b2caa3cc57be2c133d017fcd
SHA512 18add5feec4f3b910a709c840127de911b26770bb8c876d5f86966c95741a108c513d88ad111f4edf873c205a9fe4de8cf7427c395d1c91eda83d460aa4f5911
SSDEEP 49152:JObRquA/m2yL5zMfFiV+XenmE3/zMNzjSr6xbt:WoqxVjnm9N
TLSH
T154D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266464E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 ee249b846efe04e510e63342b35d34ff36afee7f2e3b979cba4671cba68141a2
MD5 8c540fd1962397b877adf1462096f862
SHA1 076b62e2fceeaeff9515de111240221388b41b86
SHA512 3b22872d6c41bd4e60aa37614ae9360b2cff0fa9a061bc4001fc59d1ac153d33925da5a0751208ef1252a6081f2f3342659ae6af19c593e4f51bc96b33a042a1
SSDEEP 24576:BAhGLv1FoiwtA5l7S53HKINWE4aH7YBr69CyjQJUrBbbZtB:BAMxFoiq5BNzjSr6xbt
TLSH
T14945AD81EBF955D4F5B3AA7899B68171EA76BCAA5E31C20F2150D10F0E33A40DD25B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 e4493f6610bb4bd5d6952eff77e06c01ec3058bf6b896ef098f0b285d28965da
MD5 75e5e12ad5e0b23b590ba91fc8dd0de6
SHA1 6a3edd75eaf78686f5504a3c23242bdd122d6884
SHA512 b1c1a423d85894c790062695e2909f60fee042ddb17d5c3daff1b6c2bdf60ed5bcac12b7617451ac75708bac670772e0194619b7dc33c01618fbb38cc7e7dc06
SSDEEP 24576:lwuROWdJKINWE4aH7YBr69CyjQJUrBbbZtB:lwGOYNzjSr6xbt
TLSH
T1F005014676A41CF9E5669238C5578536F7F3BC022665C71F17A0C68B2F33252AE2FB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 675KB
SHA256 04d3dfe1ea98db3626cfc7d0084d118b526adc9b2d3b899906fbbbfc1d4057e8
MD5 967556383d2d799b7c7c369814329c56
SHA1 6a422377aa6e3f1be1e38df56e66323fe78ca01c
SHA512 5ac553f04340443e74184c3823fe204027ef3a8a92d0c179b0f7736d296ab99d3ece1d57fcad2b6351e36c5fc469f9071eb2b5ed9ff02f937a36ab4a7180e536
SSDEEP 12288:FXP1IvuUKINj6EzzgaGwn7YhPQOaP66lPCyjQPJT7l+rBbbb8GTtxZGAS:pPuBKINWE4aH7YBr69CyjQJUrBbbZtB
TLSH
T1A5E4128636A430F9E2566238C9B60656F373746363B683CF169512C91F736C38E3BB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6c7c90b20431408e74ed282e68aa50e17659cbf1779c381cd6133bd0f5ca14a6
MD5 bb2a45efb7ce9285a2a88bcfff888997
SHA1 1c4b74a0e3635495642742b923ad734ebd58375c
SHA512 c293fd167bb50ab78f4fc32d9236defd536add90314edf86f8a736295e1148629b441c2558f4c8bddb0700f6795fce8c6c61311752c937f495c8ebedc7d890b7
SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Ue:JQRQyi36YOcP8Lvw2gAf+PN3YN
TLSH
T1AB667B43F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 543fd28cc86e215dd6bf97b23ba8b434a88213427600b5ddf7995db428857024
MD5 d301eb4f52d0790adda272a2e53f6591
SHA1 a461a0bf652e37ab9fe03fbc9d8c522fd02ff048
SHA512 78fe88054cda62b1387cf05310e49e049d0f3ab9e4e679a431696803bfa674a8275d31355a27b9cbb5fc91e91fa1c2179cbf4b73b577f3324957b4e1f4a50225
SSDEEP 49152:Kj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U0:JQRQyi36YOcP8Lvw2gAf+PN3GN
TLSH
T107667B43F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 50354b4288981de40e0cdcb79ecb9ce01a310e004aaef4b6e54a6a537fed695b
MD5 249b620ac3c0b2299cc2da7fc1a5a053
SHA1 ff345479b1c6d024b6bd2453e5399273401f290f
SHA512 04cb92d6f05dab01b5b536c14940887c1dc2e334c0ad63679c591ab9b65291e19ec301f359b824890f486326ede559c313e2b22e72e59513a4aee12bec6549bf
SSDEEP 24576:qwvLof6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0+KINWE4aH7YBr6p:E68Qg55nhMeWu7PNU3/ZNzjSr6xbt
TLSH
T1B5B54933B2F200A9C04DE1769F4A873196D27C758FE1E3DB854172461FB2AD06B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 033c8480e85ff46e8c19b4cb4fc143a7f2821048a380e29d069aff1446959274
MD5 a60d38a4bc3f85638e524e07e9c44bda
SHA1 18e62e53171a5f82338a6d21c6d2d581ba6e61d4
SHA512 7fdd1f38c9b650fff54de08f3eed254ed4431dec6f307c0a602470ecc7c54c2af88acd7b48917a9112a24140044e328254e44d6277a2f1a8de35b70df0a47ae4
SSDEEP 49152:63aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk995:ry5112gYy5azzVv569nLKnhZtUN
TLSH
T1D5168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 20ba79152cf105506a71216d2b987f8e088bdb2d2830386693e4265ba341b467
MD5 09004f5d30abfca58f71d1400ed3f0be
SHA1 0a2f14050aaa97914eae65fdd86c23911c310ef4
SHA512 45dbdeae439bf8e051d88e35b9e8649c8485d214bf1b80ad7f57fc42bc5accecbb0e7da278fb997fddc3cfbfc80ea8ebd6235260f5cdd814a0a2d6a15f133b22
SSDEEP 49152:qB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glPNzjSr6xbt:4u6JmTxd2dPN
TLSH
T126D59D13F1DA01E8D05ED478974A9233FA62BC490B35B6DF0A9072562E77EE4AB3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 aa01454c4daa46f6a16658ad58e88200cffed20a82ffcc6d9f0dba44d7290319
MD5 e52853b7e476e035e178f014b2fd1ff4
SHA1 e1ea7d80fe75b687d9091080be2cd5d2b6233f71
SHA512 1e4a04458ffbe4efd7d7e87a6c001c93a8e5ac9eeb63087a2d72fb963870f36ec52b90468b66b68eb4b60cb04b0408e7fd4934482faeea2939c268d5f5647b6b
SSDEEP 49152:21hpsNoJpF1A6UU44CwH7R4xANzjSr6xbt:2mifPbRzN
TLSH
T17CB5BE13F2D900E8D05DD17887569232EA62BC460B35B6DF0A90B7962F7BAE45F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d2e37d30ed882bb2ba8ff08cf87bef27fe082a3d30116967d649126dab3499a2
MD5 d6105c33ac67f0375e5d355ec2ff8f71
SHA1 fa315ce0fb3bd0820ad992a74bc85af37928f031
SHA512 81d54e127aaccfc58309f699b1487f5a10d0679004c574fe5d6b53245f36b259e1100198067b1898394bad5f42fe2f4d4b4e65b73c65d4e4e32584a4d6b35df9
SSDEEP 49152:gSuZQIY0Be2K6RVtOnks6NMHq1NzjSr6xbt:65dKoi611N
TLSH
T1BBC5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 73b655c978e6ebb0669413a0b14e65063b685682da0ec7297a9af3d4a7abb86d
MD5 5f26c703abbcb214a3e412df14958d9d
SHA1 3840571ae89353cea9ed41c6bbcc813c4d581fba
SHA512 116d60fac30b05b563a830ae649156e1e496dc52fb31ba0bf633bbfd4f843800787fb081e768248caaac5b91fce1a0f4d66395ad242bf1523e3d9890bde00c48
SSDEEP 49152:LhtSn8EApI0figTgiDn0AP5w9NzjSr6xbt:KX2iyphON
TLSH
T14CA5CF13F2D900E8D05DD178C7468632EA62BC160B35AAEF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 598KB
SHA256 adbf7f017cfdb0ed07f42d052afb46c8690616eaf1bd014a10f528c29c0c7b26
MD5 2bbbf3e585adbd795f95cc8785b693f4
SHA1 773b8a1f8e932c4aacbf3b248ce5d5472b732fa6
SHA512 4acc1f359a06a98bb9b242cbaa485a8d79f00b0978d93a116d266241841483c7a4f409840cde363594017444e19f05efa51f6ae6c9f2c1fcd6c03a9fa1dd10b6
SSDEEP 12288:RMKINj6EzzgaGwn7YhPQOaP66lPCyjQPJT7l+rBbbb8GTtxZGAS:RMKINWE4aH7YBr69CyjQJUrBbbZtB
TLSH
T1D1D423C6B8616559F3087735C12706AB724B796BB6D787822BCA30C52EB3083CB97CD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 598KB
SHA256 773240325bee3c42e8d921788792737899c9144222ddc274959bcb474ab0caf8
MD5 5aca26a5056415e6d1b569f9a418575b
SHA1 9f79589058d063268eba358f3bde45030a921748
SHA512 9afbbfdc1eb85cb336ce515f4d742aaa5e8b47e12e244b4902f6d25694c4b03c71f0dae0a401bad810b655cd2e852c0883b84d6ec12ede21276983e3ea45a063
SSDEEP 12288:jgKINj6EzzgaGwn7YhPQOaP66lPCyjQPJT7l+rBbbb8GTtxZGAS:jgKINWE4aH7YBr69CyjQJUrBbbZtB
TLSH
T1FBD423C2B8616559F3087735812B06AB725A7967B3D787862BCA30C52EF3083CB97CD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 598KB
SHA256 63d1fe912a1e64214c315bc7f46c090c5e3a12ba6525df0bb356f44a495232e3
MD5 b234fc8f1cdb4f15486227a6b65f7307
SHA1 831c755cbc14defa9fc07c35a2e76f37d512efd1
SHA512 78cd17e4047b49232858aeb64511269eed631328fe9a0d1f796590e08718b071376ba575115fa64efb4ccea481931fec29fab647c06e816016b10714e7b9677a
SSDEEP 12288:VpKINj6EzzgaGwn7YhPQOaP66lPCyjQPJT7l+rBbbb8GTtxZGAS:VpKINWE4aH7YBr69CyjQJUrBbbZtB
TLSH
T1FCD423C2B8617559F3087735812B06AB765A7967B2D787862BCA30C52EF3083CB97CD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 619KB
SHA256 b8e2dc8631c1629da6d5dd4f4ca5f8f9049c3d800d3f62f00f347edf4d4b05f3
MD5 81d2cd8331eaf003c42635e0c1c8ade8
SHA1 1c74e8cd6f24ecd841fbf88924750218fe892b24
SHA512 69af202e162fa8abb4cd187d700943f3f84d84a4b9e7d4060c0ddc839aae3bcd4269f2dbf45dce25036d283424f773755013a95b321e8667b0370b4c4abbdf12
SSDEEP 12288:+lYKINj6EzzgaGwn7YhPQOaP66lPCyjQPJT7l+rBbbb8GTtxZGAS:HKINWE4aH7YBr69CyjQJUrBbbZtB
TLSH
T183D423C2796560D5F214B335C5370667B3A67C56A3F6878B1B8620C91EB3283CFA7E90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 598KB
SHA256 2dd8eb64203d3513c1dc8f78b3d3426ee894bfdae327e2db32b57815da7d36f9
MD5 a16d568c4375d98ce1f3bdb6002823fe
SHA1 25eede4a5e5bf1f83f09f5a54d1c3bbc21a6fbc3
SHA512 cfc8699e153a37a67dc9a5ee31ee9dbce1b028e75d61ded37672ad6038d45270ef5993eb077ba30e0ff253ec16cb3ef2eb649cf0c27efb396302fbd26ac8a4c6
SSDEEP 12288:kjKINj6EzzgaGwn7YhPQOaP66lPCyjQPJT7l+rBbbb8GTtxZGAS:kjKINWE4aH7YBr69CyjQJUrBbbZtB
TLSH
T1ABD423C6B8617559F3087735812706AB724A795BB2E787962BCA30C52EF3083CB97CD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 598KB
SHA256 82a678e5618663f6f5e016c13dc1c0623ae383ff580434c19c5923f936f5d03e
MD5 01e610bc40e6946814fe5ca76bf7ac1c
SHA1 fdbb1e5c8aebebb4bfca0b472bc645928e7f1413
SHA512 a4b8c2972abd7babd606a51d17df88bbddc842f4898804cdfd8a0624c706eab67348a99d856eb4e9415ee49c22f84f4e29f1a5b60f471303fcbc3f5bf4460f00
SSDEEP 12288:PMKINj6EzzgaGwn7YhPQOaP66lPCyjQPJT7l+rBbbb8GTtxZGAS:PMKINWE4aH7YBr69CyjQJUrBbbZtB
TLSH
T1C1D423C6B8616559F3087735852B06AB724A7957B3D787822BCA30C52EF3483CB9BCD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 598KB
SHA256 98750dcd1f4a7fb3c2914968b40e13f76ad0b1658d6b20679576c2991c45947f
MD5 71cf5d624f05f0b2c927565420cd9a10
SHA1 ac25f11c1e6b9a1d4e0f8689e45edb8e845a762b
SHA512 84f2c809c6e2fd796706ff053b611a92c1a601098e7e64c2ba8faef829712be93c2954fa50cfcefd27b7368743b6483c0889a01c8a4ba6874abb7e464a23c843
SSDEEP 12288:06KINj6EzzgaGwn7YhPQOaP66lPCyjQPJT7l+rBbbb8GTtxZGAS:06KINWE4aH7YBr69CyjQJUrBbbZtB
TLSH
T10AD423C6B8616559F3087735852706AB724A7957B2EB87822BCA30C52EF3093CB97CD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 860KB
SHA256 a47af15b6353154dd739318fceabf074218d61cb4f4dbebd18c3511e8a2271f9
MD5 9b0e43fc13cce99a3f8af37a901b672c
SHA1 0fb3f140b646b5f56ba790678a46026ea2333bfb
SHA512 30a622832537e91a4e0fe12618c661d0b077815cee0deda5c0911c5bf93d879fb46f922270650982e9685444a6bc00c82fe792a0efab050f9002f6e3dcdac522
SSDEEP 24576:BZMRzFVS55KINWE4aH7YBr69CyjQJUrBbbZtB:BZMRzfINzjSr6xbt
TLSH
T1BC150195B29018F8ED67823EC9264916E2B27C1A17B0C71F13E436961F733A24D2FF95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 598KB
SHA256 c69f68ef5fa52d91670746dc6fb99f9064861748a4710d11833ba534882cfbc1
MD5 5cb480696ee50db81da3c6f560268251
SHA1 0e62e9ee2d91281146907321192ad3fba7a67896
SHA512 4bf1739729678dc9c9a028796b87823b470ab036d381abdc813f31cc5cb8c87c2f4139aa7301560151fc0623b46520e1a0398ebd798f371e18efa849f80f1048
SSDEEP 12288:BKKINj6EzzgaGwn7YhPQOaP66lPCyjQPJT7l+rBbbb8GTtxZGAS:BKKINWE4aH7YBr69CyjQJUrBbbZtB
TLSH
T15AD423C6B8616559F3087735812706AB725A795BB3D787822BCB30C52EB3483CB9BCD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 598KB
SHA256 c75a8d6d8df1cd087e9ffe5ab9780c69a347f06a7950505c52595d95e4363293
MD5 cada295ef8cc5caf322dd07a0a256365
SHA1 e925195fc2399ee6da7137a8aa2c20c5dd038c07
SHA512 ba79a639c3eb2cd81bf8144cbfb094233d2373b3e2e9c16fb9581ee3faf0e307985ddd0c80a086845b56c4b71e4dafe0fcdfd970e7d9bd40b2cc1cfea2f27ad6
SSDEEP 12288:LvKINj6EzzgaGwn7YhPQOaP66lPCyjQPJT7l+rBbbb8GTtxZGAS:LvKINWE4aH7YBr69CyjQJUrBbbZtB
TLSH
T13AD423C6B8616559F3087735862706AB724A7957B3D787822BCA30C52EF3443CB9BCD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 736KB
SHA256 03dd49868bbd960eb4b44329d2edb4c3fbccc12ddce70110b489a68e03aba97e
MD5 d362dce5b4241c708e1231ab47b1490a
SHA1 daf68905e61622a8f57ab35d0a0fbdbfb551b84c
SHA512 53c6a14d1ecbfa6e1d9972550d8a6adebd1a94e0352b978e473f980078e29c439b05e3365953fdb7137310c4255e132d7693e8044dfb91a3d9538b3e75c79e05
SSDEEP 12288:d7P4FLYrLKINj6EzzgaGwn7YhPQOaP66lPCyjQPJT7l+rBbbb8GTtxZGAS:94C3KINWE4aH7YBr69CyjQJUrBbbZtB
TLSH
T131F4124776A130F9E1269338C8620A56F376783257618B9F179412B62F73292CE7FF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 598KB
SHA256 d45a543f029d6123608c174bf8e4f2025555de61b7b24daf1ff7e870c058ce90
MD5 a309b583fe6f7926e8856af2c9cf0f44
SHA1 c67a2615764d5f64e8ed678ea5dabba1ac239896
SHA512 b327eaad54bc08362a4995bfbde448748c4193e346c94ac9d037bd60548cf7cb853e8e3861bb1147346eb9cf465324af3c907b6861c0d700a9f5c0b4aacc19f2
SSDEEP 12288:ZVqKINj6EzzgaGwn7YhPQOaP66lPCyjQPJT7l+rBbbb8GTtxZGAS:ZQKINWE4aH7YBr69CyjQJUrBbbZtB
TLSH
T1FCD423C6B8616559F308773585270AAB764A7967B3D787822BCB30C52EB3083CB97CD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 598KB
SHA256 9b9479953fab94f6d81ae4280953d49a4816974c0d7d162cb662c7bd18efe011
MD5 4863504fcd168a651f44b788f5529880
SHA1 ea81992a091ace2bc6368cbf85e0b6dd5d8c8558
SHA512 e64ab0abd271174e7efb0710a3d7c280e9474303ed89223ed427d601949975f47ea5c8c43220ce2aad426680d9d39f7d0457d268a0ab16956f230c896f42f751
SSDEEP 12288:xKNKINj6EzzgaGwn7YhPQOaP66lPCyjQPJT7l+rBbbb8GTtxZGAS:xCKINWE4aH7YBr69CyjQJUrBbbZtB
TLSH
T17ED423C6B8617559F2087735852706AB768A796BB3D7878227CB30C52EB3083CB97CD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 736KB
SHA256 cc8ad5c7bb730341676a6fecb42c2ab492541cf2341c82d686e46b5f79bd674a
MD5 155cc979885fbe1a081e4e83acae0636
SHA1 a0fba70a188bb445ecd189c042df2c8dc506bdda
SHA512 29cdf3814935c10c84a23f2306c3418acfccede20b5de109674a6e2ea22497ee36b6e8c7e7e50b1ebdb3de14868a8a610680dd910410efbc71717feebfaa1ed3
SSDEEP 12288:c7P4FLY+QKINj6EzzgaGwn7YhPQOaP66lPCyjQPJT7l+rBbbb8GTtxZGAS:g4CbKINWE4aH7YBr69CyjQJUrBbbZtB
TLSH
T16BF4124776A130F9E1269234C8620A56F372783257A58B9F179412B62F73292CE7FF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 860KB
SHA256 6c2e09683304b5db9e72b8d2be2cd9580a1bf88e725e4c02add5d23c1d830242
MD5 0353fab78b0275b47d992e23e13336fd
SHA1 bccf1a9ceaa3cad4b93ff457431262ffd2a9cc52
SHA512 a09f28344102400fdd97b295200b86d1593889e8ef3c560ef8143c8b4b8110ec331f6244396fd0ed5c941a4fb7602e03e419a79183c99a1f4d58eb1cf5e5d7c0
SSDEEP 24576:cTmaLl3z0z6JKINWE4aH7YBr69CyjQJUrBbbZtB:cTlLljrNzjSr6xbt
TLSH
T1F6150195B25018F8ED67923EC9264916E2B27C1A07B0C71F03E8369A1F733924D2FF95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 e9f183b08313871e9105b81626b4efcfd5462522040f9c4f4db9919bb4297b96
MD5 2576a7c8004384105676e224e6a4d8da
SHA1 4637dc4627c011bf3227a8226957b74b69d38c6d
SHA512 675a6675f793f9d60dcb9a56bcadf0f5f3880f4c0058aedc4dd2f86b1f69b9dfe9a9e8f7ebb2d6f35ab20b4348166b4699ada77b16c5189050c54253b4498815
SSDEEP 24576:y3adgCH4y7GZoKINWE4aH7YBr69CyjQJUrBbbZtB:UadgCH4y6iNzjSr6xbt
TLSH
T13235CF90F3E410E8F1B79A35C9764512DAB67C5A1B71CE8F03A8255A1F336D18E39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 598KB
SHA256 b43b4bfd9e40b2a4505d34d50cc16c577cfbd31b57b0345c37ba1789ed2b0415
MD5 5170dc8e30dd3ab4788196aea83b552b
SHA1 5a6aa1b476f502010bbaf35ef5ebbc4973778770
SHA512 67852d9c8dce1c9d0d1fa4072624cf8d1cdcbe70461aa66d15206c7ffa649bbb7c32ea600b96332431a3dc6803864811f12f509d438aa2567670ae62769053e7
SSDEEP 12288:z3BKINj6EzzgaGwn7YhPQOaP66lPCyjQPJT7l+rBbbb8GTtxZGAS:zxKINWE4aH7YBr69CyjQJUrBbbZtB
TLSH
T1E4D423C2B8617559F2087735812706AB725B796BB3D787922BCA30C52EB3483CB97CD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 598KB
SHA256 3c7abfe263f9ca7657b1261c314f32cd7daf07a7be3d2f15706b95255aa1512a
MD5 e72c76f361197cdc5f98a61c2954eb5b
SHA1 bfeb24636e3b0529985fd8daaa45d68f98ccb7b6
SHA512 b74b7c55feac1f40e8440f6c33ff389c319b049fcf5819e363c683fc21ebb716cc403c8aa5e42159893a0e154103c2e012d715d40d249814c010b848af78de57
SSDEEP 12288:nQgKINj6EzzgaGwn7YhPQOaP66lPCyjQPJT7l+rBbbb8GTtxZGAS:n1KINWE4aH7YBr69CyjQJUrBbbZtB
TLSH
T1D6D423C2B8616569F2087735812706AB764A7967B3E7879227CB30C52EB3483CB97CD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 598KB
SHA256 137c3ab3952e7f92fda5758576bd83f3ba8b7c6e06fb486c1a53991b38a123e6
MD5 f9c126d1b654ab11cb2682b7d50d597d
SHA1 0833a45c3670af9efb935071a47ae80c2d345e5e
SHA512 53725f42321deb0a6f9d3b2bf4432a9c0be9475e4c1bb10dceaaa0616f51b24684e20d5cecf519c6d4a521f9cca02af6bc47173ddf9156f795ce961d9d8a4a0f
SSDEEP 12288:IbbhKINj6EzzgaGwn7YhPQOaP66lPCyjQPJT7l+rBbbb8GTtxZGAS:IZKINWE4aH7YBr69CyjQJUrBbbZtB
TLSH
T18BD423C2B8656559F2087735812706AB768A795BB3D787822BCB30C52EF3483CB97CD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 598KB
SHA256 da53a66e8ed54d79273e66ba4b5ace384a629691ae6d46f76dde11dff6ebd939
MD5 210fb156990e2130bb162650e808a30e
SHA1 383fcd6a78dce8174f7b0f7f94970307f28ba7a3
SHA512 89301e2418d402c67eaddbd634d9dc362f2ef3d88600432b7350a5d1ba3a0eca22686d6e615d9a091e29d5ced44c3f5bbd9d3f0e2572f7fab3ff2c1f675b6272
SSDEEP 12288:Hf88KINj6EzzgaGwn7YhPQOaP66lPCyjQPJT7l+rBbbb8GTtxZGAS:HhKINWE4aH7YBr69CyjQJUrBbbZtB
TLSH
T151D423C6B8616559F208773581270AAB764A7957B3D787822BCB31C52EF3083CB97CD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 598KB
SHA256 8f7aa31341b2fee97efec6933d8b13a3661b11fdd717e73a7bc7f99ba3c72868
MD5 91c8f3b1ced4f21e5047eeaa510d1aab
SHA1 36aa059df91baa9f3e714aaba72036194759425e
SHA512 0851faaf4fbcd39c639422400fd4f55a55077e708b17f57dff74d57f22c9e82a2a335fc3dbf2a8dfec82610bb9fffa7515accd2114bc4cd5dff6d8d1ed52d74a
SSDEEP 12288:hLJKINj6EzzgaGwn7YhPQOaP66lPCyjQPJT7l+rBbbb8GTtxZGAS:hdKINWE4aH7YBr69CyjQJUrBbbZtB
TLSH
T1D8D423C2B8617559F2087735852706AB768B7967B2D787822BCB30C52EB3083CB97CD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 598KB
SHA256 d49efd67530dc399bcfe428297d60a11d1546ff5a3f3a5a4e459060726aeb57a
MD5 5f3eaee1fb4dca1e907ffee5d71585e5
SHA1 49f86ca8809ad6cf5ecba90f8633439bac0d96e5
SHA512 b4525aa07ada7cc2017399d4eed2ec3af8b65c29be6e3ca5744efdddf2b9cea2dd12affd58c2897b6cd9d1c80265d7bc6fe48aba9a4007c58387e5a255f98795
SSDEEP 12288:aFoKINj6EzzgaGwn7YhPQOaP66lPCyjQPJT7l+rBbbb8GTtxZGAS:auKINWE4aH7YBr69CyjQJUrBbbZtB
TLSH
T101D423C6B8617559F2087735812706AB768A7967B2D787922BCB30C52EF3083CB97C94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 598KB
SHA256 de856f3d34ed141572cdaa359b46ef6308ef33b5db5d90f071bc11d053b00261
MD5 b535af7bf9fe29048b7ecd05ce6c479e
SHA1 4ab89b7e241c88c769f09b7fa32c9a9542aacb39
SHA512 7243b42f39d7402faf9a664718cd33719586d614a88f836e55453be59ded179f4ef1f57897dc3e604a31164455797ec34d35cef816779b23af6689deb5d96473
SSDEEP 12288:R8PKINj6EzzgaGwn7YhPQOaP66lPCyjQPJT7l+rBbbb8GTtxZGAS:R+KINWE4aH7YBr69CyjQJUrBbbZtB
TLSH
T110D423C2B8616559F2087735812706AB765A7967B3DB87822BCB30C52EF3093CB97CD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 598KB
SHA256 24c5bdd280e569d92918124e1981119ebcf19c674b6e40dca049eebf07faf7df
MD5 eeb33d4d8115cf778df297dcc7013011
SHA1 193a07c7b83673a140c86af3d0e653d59d4bff42
SHA512 72132599326d873e364d3b27d840e1d9e2ff0b5ef07e522ae7c697089dd9685e17d68b579e01989d49dbb1e61fa11d19e231a507f744adc62fa59a0271bb2cd5
SSDEEP 12288:s6hMKINj6EzzgaGwn7YhPQOaP66lPCyjQPJT7l+rBbbb8GTtxZGAS:sdKINWE4aH7YBr69CyjQJUrBbbZtB
TLSH
T1F9D423C2B8617559F3087735852706AB728A7967B2D787822BCB30C52EF3093CB97C94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 598KB
SHA256 e4d4faf1822c53257d8b3113441e6414d3d25dcc613dcf20e4f0dbd4fba77d93
MD5 aa989a44edaa0c9acb34a2ce6dc2bb68
SHA1 1a48ee393ae7526fd03b63b9a408b8cba89ab5d1
SHA512 9dafb4a364e6111e5c7277338eca11c8f0a051e2c710c9f9c7d5aa0254940abe80befdba2509eb8d4094d5e3e2271bad951c441d542f9dbef452ffc48b9ca8ac
SSDEEP 12288:EeJKINj6EzzgaGwn7YhPQOaP66lPCyjQPJT7l+rBbbb8GTtxZGAS:EKKINWE4aH7YBr69CyjQJUrBbbZtB
TLSH
T1E2D423C2B8657559F2087735852706AB729A7967B3E787822BCA30C52EF3043CB97CD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 739e1aab0cb9ec722d49a37de8d61b647684cbb899728b1d5ec9abbf936ab9fa
MD5 463aeb1e7475c5776ee691d7ba586999
SHA1 704806e250fbde7e51627f555b99a52a5b2e7abd
SHA512 9bb513c85e320d8b54050f478bd1d26f1e3670f6a763ba5261dfb86a75ca790cd23514fc4bd6cc4c2e8f96029a7b0a481281acd9e97b514fa05c00d66ad2080a
SSDEEP 24576:B7wvtk9RX6wkyAIBKINWE4aH7YBr69CyjQJUrBbbZtB:SMnYITNzjSr6xbt
TLSH
T10035D029EBD844E5E177923C89B7460AF2B178591B71C3CF129A53AD0E33ED49E3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 718KB
SHA256 ef0b9751781309508b8e2f43216b0423b3ffbaeeaed12ba709627938fce551e3
MD5 84049eb419126f14bc2ec988e358ecc8
SHA1 e22e255e4d4618dc11e2b47ccdcb715b8a0650dd
SHA512 039b3d87440bb477da7e0eceff8af3ec66533b9423221fab7568f634b4005185aaafb9b8303c96f5b912ef5f7e64e6b4a3a22d66e164203b67171705335800ff
SSDEEP 12288:tJIfyKINj6EzzgaGwn7YhPQOaP66lPCyjQPJT7l+rBbbb8GTtxZGAS:iyKINWE4aH7YBr69CyjQJUrBbbZtB
TLSH
T140F4F14AE29411E8D16E6235C7160A52B3237C2693E2D3CB17C1F5BE1F735918EEBA43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 bcef681f232737331274404a8c18e962cc808a0e82451b9d3434a777b239a6ba
MD5 701a1130a6b0c5e216f02bd06238043c
SHA1 6897ab71c3bef3d68622a030828af4881c92d26d
SHA512 a2409b5e28d35092662dc773026a2b143e741d86e45a0671d32f1f74c91f07d90633ea03bc1e831be704c0d2dae7da131ffb20bb2d6ac9be4f925d43d97ee15f
SSDEEP 12288:cx7oKINj6EzzgaGwn7YhPQOaP66lPCyjQPJT7l+rBbbb8GTtxZGAS:QoKINWE4aH7YBr69CyjQJUrBbbZtB
TLSH
T137D423C2B9646819F2687734812B0677320BB926A7D6C7C3668631C92DB34C3CFB7D95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 21e442b82d085f86e30f6050a1de62776e104f112d7027465edb454e4238298d
MD5 810450f6bfa7e746e411aaa84e837446
SHA1 5f4e348dff0058e184166c70a72c327ba3a69fee
SHA512 1316afe68ff2df8d64f64aa0a02e0406c041a2d8c1a54af4b864bec7347780e9dedeed510561dd94ff270d7368dd83f1eca3e19eff558126bd81311ae6563a74
SSDEEP 12288:KSGEKINj6EzzgaGwn7YhPQOaP66lPCyjQPJT7l+rBbbb8GTtxZGAS:dGEKINWE4aH7YBr69CyjQJUrBbbZtB
TLSH
T111E4238A74B13098E238A339843605B775B2346163A597EF0AD2B0F55FB35D2DB7BC84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 52a4f73a30ec5cb92c441f2afe349c5b4db7f32ef55ffc30980ac689588f4f91
MD5 46cbc4cb7a9ebf1eee18ddde7ca9b544
SHA1 3721cc779c660725f1820986e9a1ed01f53c9dac
SHA512 a6f3d3b8e825981fab1ffb4c881c0eb1cd99e75cbb668fca082f63d3244138eb22f9d2a74e19b1479b1b3e78ceaf0bea1491c9283a69a49aa75e0be04fb51163
SSDEEP 12288:TOKINj6EzzgaGwn7YhPQOaP66lPCyjQPJT7l+rBbbb8GTtxZGAS:TOKINWE4aH7YBr69CyjQJUrBbbZtB
TLSH
T165D423C2B8616559F258773581270A67724A7926A3E687C326CA30C62EF34D3CBB7C90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 5580bd8a96eb134972634e5f8d5341ecd845767738dec5210997bceaddf86e2b
MD5 bc671a3b6b9716820a24fc238a88e448
SHA1 0f8852983dbf477a6a0e5c07d9fc01b40d02f25f
SHA512 443186d2bcba161a4c554f0b1a3436167ac67ed4a4cbcb05002dc24ccc0b140c75a14fc20b913b16a1b66409898ecdb5dab783200e02ffd7af8aa9adee179f2a
SSDEEP 24576:mPUr+NQyKINWE4aH7YBr69CyjQJUrBbbZtB:mJQKNzjSr6xbt
TLSH
T1E705F15F66A818E5F67AA13D8542471AF372B8621352D3CF02D1817E0F63AD9AD3FB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 1824bcc8c3caf1089478b56f45a6c76a131668ae24d439fe4e4247d69bcbb49c
MD5 80d4f89809788387f999979e104158d6
SHA1 1ed31809c12e72ed2d43462b46423c4642f4fa97
SHA512 4dfbe490ed635593b5a75fd87548cc99f51fcca7158394f020681d215a16b7cb9707d51d1b19dc750bdb0d7f2a4b940b75931efbd898fe0dc122a9ff691aca30
SSDEEP 49152:XBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjMNzjSr6xbt:IG05lO43bjN
TLSH
T17AD5C06A62EC11F9D1BBD17CDAC6460BEBB23415033556CF02A486A91F23FF49A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 b75a2c6718487fc584e06effdb8e35bdb79b5d17f914c6259d79a6c4742a4eab
MD5 0f8b493412796baaf635f9ff83fc776e
SHA1 b39cfab82a72fa3c7d1b1311c0d0c1561f8da511
SHA512 7739d87a4481729686bfdc79ced2477a8c4a7ceacd158b9e9dcacc2ca64e8a2a13329e827f22ebb3d14ed6a05732b5cd970e3b8154f78de56d96e30d8eddbb66
SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7FkkKINWE4aH7YBr69CyjQJUrBbbZtB:VNc/zEOVHFRNzjSr6xbt
TLSH
T1D7858C5622E901E4F1BBE1BE89779546FAB1786553308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 21f07d8fb35c35b71f5dd58b9499a078f21199e3415af7b1854f7f61298b4bd4
MD5 72a7de2278b1a432d76f36535dbccd90
SHA1 a164fbe559ad5b4b3b8b2c8dddc9c94f0c005aa1
SHA512 348980de7ecd6fce56427cd5cd358771133fd51744730b3ad0e564e302a9d32df8199382ed876fed4073bdd65428a0a83cb0f78e89204adb2ac78aa6482f1c3b
SSDEEP 24576:q6DIWKINWE4aH7YBr69CyjQJUrBbbZtB:q6DI+NzjSr6xbt
TLSH
T169F4014D327620F9E16BE03DC1530512E2B2B47193625ADF07D4D1B95FA3EC9BA3AE81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 60b0240387fc4ce6868874de7876210dd6cfb3005afd118dead7060aa27dc05e
MD5 a5d38c17fd3e991f6089eb63d7c2ad2f
SHA1 e0178ba461f2d267042e9cc0737500d208c16a8b
SHA512 b9b953e879ce9a621e34b52724e867826d5a22793b7d9ab87e0cbbf42ab52371abd35d21b60c59809746e885b05d60ae0176080ddae116423d3817cae7271f29
SSDEEP 12288:TG6kyQKINj6EzzgaGwn7YhPQOaP66lPCyjQPJT7l+rBbbb8GTtxZGAS:CtyQKINWE4aH7YBr69CyjQJUrBbbZtB
TLSH
T159F4124162947094F2782338853302A6AB76BC2167A283DF15D1B2AE2F737D2DE73F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 463296761efbd62b6919ed5067893d3c5cf0994c44c66002326aefdde703e63d
MD5 dba40647f37c6556462ecf86d5229aea
SHA1 18dfdce95455527ca7baaeb99a98a94662821cf7
SHA512 cf7bc5fb8487dd0710df045ed707c895faf996aefec0058cb679255379ddd1cabd0b421443fc067afb9ef4125ffdbc4837a2befa73a7cc6f710e01273433955d
SSDEEP 24576:GTkNvNnaFeYhJNtmZBmaKINWE4aH7YBr69CyjQJUrBbbZtB:GTMwBtOmyNzjSr6xbt
TLSH
T19055AF6EBAB806E4D1FEC674CD238512F6727461173293CB5290C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 768KB
SHA256 e1a5117f6cda5528067d25c1c82f7dc0720bfdf11d014db5f59534f5c363c61c
MD5 4399311268dc348928738e9afbaa938f
SHA1 99e6bc93a48d85e8de6d2467037c36f1bc0cc14a
SHA512 117c5cdd0e5b887b3f6e0ab534088ea4c9ffe59e3013c2a5703d4793bc87f7b5c33b492e85e42e70de802ca1f34fa7c8c8193dd98842c42b0e878f6a18fe9519
SSDEEP 12288:2yS6b3IkxjbBzvKINj6EzzgaGwn7YhPQOaP66lPCyjQPJT7l+rBbbb8GTtxZGAS:A6UqjpvKINWE4aH7YBr69CyjQJUrBbbV
TLSH
T13AF4128E659064E9F1386234D52642365166BC7213F697EF36C9A1BE4F339C2CA3FE10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1236-6-0x0000000002B50000-0x0000000002BB9000-memory.dmp

Download

memory/1236-1-0x0000000002B50000-0x0000000002BB9000-memory.dmp

Download

memory/1236-0-0x0000000002930000-0x0000000002A45000-memory.dmp

Download

memory/1236-7-0x0000000002B50000-0x0000000002BB9000-memory.dmp

Download

memory/1340-27-0x000001FA23070000-0x000001FA230D6000-memory.dmp

Download

memory/1340-112-0x00007FF67BD20000-0x00007FF67BDE8000-memory.dmp

Download

memory/1340-26-0x00007FF67BD20000-0x00007FF67BDE8000-memory.dmp

Download

memory/1340-28-0x000001FA23070000-0x000001FA230D6000-memory.dmp

Download

memory/1340-29-0x000001FA23070000-0x000001FA230D6000-memory.dmp

Download

memory/1672-95-0x00000280C3040000-0x00000280C30A6000-memory.dmp

Download

memory/1672-96-0x00000280C3040000-0x00000280C30A6000-memory.dmp

Download

memory/1672-93-0x00007FF7F7CD0000-0x00007FF7F7E19000-memory.dmp

Download

memory/1672-156-0x00007FF7F7CD0000-0x00007FF7F7E19000-memory.dmp

Download

memory/1768-52-0x00000298641F0000-0x00000298642EB000-memory.dmp

Download

memory/1768-53-0x0000029864410000-0x0000029864476000-memory.dmp

Download

memory/1768-54-0x0000029864410000-0x0000029864476000-memory.dmp

Download

memory/2084-15-0x00007FF74F990000-0x00007FF74FAB2000-memory.dmp

Download

memory/2084-92-0x00007FF74F990000-0x00007FF74FAB2000-memory.dmp

Download

memory/2084-17-0x000002338F730000-0x000002338F796000-memory.dmp

Download

memory/2084-18-0x000002338F730000-0x000002338F796000-memory.dmp

Download

memory/2084-16-0x000002338F730000-0x000002338F796000-memory.dmp

Download

memory/2304-85-0x000001E435BA0000-0x000001E435C06000-memory.dmp

Download

memory/2304-86-0x000001E435BA0000-0x000001E435C06000-memory.dmp

Download

memory/2304-84-0x000001E435C40000-0x000001E435D3B000-memory.dmp

Download

memory/3332-163-0x00007FF6FD1D0000-0x00007FF6FD5E6000-memory.dmp

Download

memory/3332-161-0x0000028232A00000-0x0000028232A66000-memory.dmp

Download

memory/3332-141-0x0000028232A00000-0x0000028232A66000-memory.dmp

Download

memory/3332-140-0x00007FF6FD1D0000-0x00007FF6FD5E6000-memory.dmp

Download

memory/3332-142-0x0000028232A00000-0x0000028232A66000-memory.dmp

Download

memory/3332-160-0x00007FF6FD1D0000-0x00007FF6FD5E6000-memory.dmp

Download

memory/3524-126-0x0000024B146B0000-0x0000024B14716000-memory.dmp

Download

memory/3524-125-0x0000024B146B0000-0x0000024B14716000-memory.dmp

Download

memory/3524-124-0x00007FF7112F0000-0x00007FF71139D000-memory.dmp

Download

memory/3524-159-0x00007FF7112F0000-0x00007FF71139D000-memory.dmp

Download

memory/3828-72-0x00007FF680B30000-0x00007FF680C49000-memory.dmp

Download

memory/3828-73-0x00000244179B0000-0x0000024417A16000-memory.dmp

Download

memory/3828-153-0x00007FF680B30000-0x00007FF680C49000-memory.dmp

Download

memory/3828-74-0x00000244179B0000-0x0000024417A16000-memory.dmp

Download

memory/4492-67-0x0000017546400000-0x0000017546466000-memory.dmp

Download

memory/4492-62-0x0000017546400000-0x0000017546466000-memory.dmp

Download

memory/4492-61-0x0000017546400000-0x0000017546466000-memory.dmp

Download

memory/4492-60-0x00007FF793C10000-0x00007FF793D77000-memory.dmp

Download

memory/4492-69-0x00007FF793C10000-0x00007FF793D77000-memory.dmp

Download

memory/4548-44-0x0000017E0A850000-0x0000017E0A94B000-memory.dmp

Download

memory/4548-46-0x0000017E0A950000-0x0000017E0A9B6000-memory.dmp

Download

memory/4548-45-0x0000017E0A950000-0x0000017E0A9B6000-memory.dmp

Download

memory/5076-158-0x00007FF75AFA0000-0x00007FF75B6E3000-memory.dmp

Download

memory/5076-117-0x00007FF75AFA0000-0x00007FF75B6E3000-memory.dmp

Download

memory/5076-116-0x000001F57ACE0000-0x000001F57AD46000-memory.dmp

Download

memory/5076-115-0x000001F57ACE0000-0x000001F57AD46000-memory.dmp

Download

memory/5076-284-0x00007FF75AFA0000-0x00007FF75B6E3000-memory.dmp

Download

memory/5076-282-0x000001F57ACE0000-0x000001F57AD46000-memory.dmp

Download

memory/5208-123-0x00007FF67BD20000-0x00007FF67BDE8000-memory.dmp

Download

memory/5208-37-0x000001E020080000-0x000001E0200E6000-memory.dmp

Download

memory/5208-38-0x000001E020080000-0x000001E0200E6000-memory.dmp

Download

memory/5208-35-0x00007FF67BD20000-0x00007FF67BDE8000-memory.dmp

Download

memory/5208-36-0x000001E020080000-0x000001E0200E6000-memory.dmp

Download

memory/5532-157-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/5532-102-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/5532-108-0x0000000000940000-0x00000000009A9000-memory.dmp

Download

memory/5532-103-0x0000000000940000-0x00000000009A9000-memory.dmp

Download