70ce126a0bc1f80eb9379fc1965265a60db0842ad1f5f386455ab0b569f80c7f

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 07:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_6c95c387a4c3b8a00b640e8601f765ae_bkransomware_elex_icedid_maze.exe
Size 2.3MB
Sample260905-jnexcscf64
SHA256 70ce126a0bc1f80eb9379fc1965265a60db0842ad1f5f386455ab0b569f80c7f
MD5 6c95c387a4c3b8a00b640e8601f765ae
SHA1 928c9609760e438b2313a0cf0eab160dc6406ca4
SHA512 c94cea918aca8146fd1a1cb000772f79137b7069a92df0810e814d5ca12572f8d89a969198f0cf4f38bc004ba30c1bd2a18f7b93e7431e4008cab6f53a63f1a1
SSDEEP 49152:WDD0FZs/Yl7dYUMQ+fCi6pnO8IFeIC8uxV1XL4o1ZLSjZPTem:eD0FZs/U73MQ+fCi69eeF8uxV1X/LS1T
TLSH
T130B5BF33F594907AC93313314E9D736C76A9BB710F36428722E55F2D2EB05C36A296A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
5680	alg.exe
4212	GameInputSvc.exe
4336	GameInputSvc.exe
2904	elevation_service.exe
4912	elevation_service.exe
7128	maintenanceservice.exe
2276	msdtc.exe
1148	OSE.EXE
6500	PerceptionSimulationService.exe
4196	perfhost.exe
2064	ReFsDedupSvc.exe
3264	locator.exe
4504	SensorDataService.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-09-04_6c95c387a4c3b8a00b640e8601f765ae_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-09-04_6c95c387a4c3b8a00b640e8601f765ae_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-09-04_6c95c387a4c3b8a00b640e8601f765ae_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-04_6c95c387a4c3b8a00b640e8601f765ae_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-04_6c95c387a4c3b8a00b640e8601f765ae_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-09-04_6c95c387a4c3b8a00b640e8601f765ae_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-09-04_6c95c387a4c3b8a00b640e8601f765ae_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-09-04_6c95c387a4c3b8a00b640e8601f765ae_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e427394a957eebe4.bin	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-09-04_6c95c387a4c3b8a00b640e8601f765ae_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	GameInputSvc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	GameInputSvc.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-09-04_6c95c387a4c3b8a00b640e8601f765ae_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-09-04_6c95c387a4c3b8a00b640e8601f765ae_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	GameInputSvc.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-09-04_6c95c387a4c3b8a00b640e8601f765ae_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	GameInputSvc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-09-04_6c95c387a4c3b8a00b640e8601f765ae_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	GameInputSvc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_6c95c387a4c3b8a00b640e8601f765ae_bkransomware_elex_icedid_maze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4336	GameInputSvc.exe
4336	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2160	2026-09-04_6c95c387a4c3b8a00b640e8601f765ae_bkransomware_elex_icedid_maze.exe
Token: SeTcbPrivilege	4212	GameInputSvc.exe
Token: SeBackupPrivilege	2064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2064	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2064	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2064	ReFsDedupSvc.exe
Token: SeDebugPrivilege	5680	alg.exe
Token: SeDebugPrivilege	5680	alg.exe
Token: SeDebugPrivilege	4212	GameInputSvc.exe
Token: SeDebugPrivilege	4212	GameInputSvc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2160	2026-09-04_6c95c387a4c3b8a00b640e8601f765ae_bkransomware_elex_icedid_maze.exe
2160	2026-09-04_6c95c387a4c3b8a00b640e8601f765ae_bkransomware_elex_icedid_maze.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2160	2026-09-04_6c95c387a4c3b8a00b640e8601f765ae_bkransomware_elex_icedid_maze.exe
2160	2026-09-04_6c95c387a4c3b8a00b640e8601f765ae_bkransomware_elex_icedid_maze.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2160	2026-09-04_6c95c387a4c3b8a00b640e8601f765ae_bkransomware_elex_icedid_maze.exe
2160	2026-09-04_6c95c387a4c3b8a00b640e8601f765ae_bkransomware_elex_icedid_maze.exe
2160	2026-09-04_6c95c387a4c3b8a00b640e8601f765ae_bkransomware_elex_icedid_maze.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 4336	4212	GameInputSvc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-09-04_6c95c387a4c3b8a00b640e8601f765ae_bkransomware_elex_icedid_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_6c95c387a4c3b8a00b640e8601f765ae_bkransomware_elex_icedid_maze.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2160

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5680

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4336

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2904

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4912

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:7128

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2276

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1148

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:6500

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4196

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2064

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:3264

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 cdad2bf8eea3b7390e0cfce6cba49aa671748ce5fa16a0b43c7f4749fd40398f
MD5 e439941fdb2ea6a1918530544e9d4386
SHA1 39078e3b71ddfa80af96044ef9289816f72a96ab
SHA512 8b4b41588a9584be237fdf39a5abac1c3f17ba7c79be434376b327a6ff53bf82953df841080a56d27e1a1762c534e9cebb391560517872f2cc18083a502c9ec5
SSDEEP 49152:liS632BuPkFKRrdE6oh7stBhuXjfS4LWxny1ZLSjZPTem:G3q6gjB/LS1T
TLSH
T164D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 8149dd25f65ec806c80ec998a0c6af75323549104fd78cc8406d50ff3903f2d1
MD5 dfe028447d21d22b2fea63d98b693979
SHA1 797344c9f5003146701f6877d74ac06ef9df41c7
SHA512 ae5367db2f2597695ddc09a82a39b2bb2aac75266a7cb808b3e77dbb17b4ff7aa693390c3057befa663d33a858d180d8216180feff27912138abac52365e57f6
SSDEEP 12288:g1XLsskd8xifJqq2czAOz1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:2XYXEzczAmX11Z6DgSURgpEWLPTem
TLSH
T1AE050128A7E508F9ED63813DC8A1C505E673B88147A0E79B03F49A265F237D45E3EF91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 165190f1f863ea72d8ac6bd0891672abc22f3206325d09275c0d012839e6ac80
MD5 13a87096a9bb446f52fb58fe63520ee7
SHA1 014392c3fb90c62d2f62022c65ace1b4e3dd32dd
SHA512 d197b526157c48ef928699884c4f7694758af9838a42f0f5e36910404221cab98fc59a2c7dbb25fb7eb29b725e870c4eb7bed01de79fbf414f2da7cf73ee1487
SSDEEP 24576:003e3dj0hmx1rM/X11Z6DgSURgpEWLPTem:09dj0Afe1ZLSjZPTem
TLSH
T1A8359E15F5788335D073C0B9C5D2A68AE97230825B308ACB4296D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 60c4dc5fb0fd48b3997aa3f8267903fee4a216f68ce319119dd7f52d7a79ab98
MD5 4160ee6046ddf69e70b8202b511c3dfa
SHA1 56ddf137b5fc0193c2ee8af639f9314b57f917fa
SHA512 82648fc00d0197f04c16255e81d2efaffb005d737192afb0b7dc97b0fa9034ee097943349d72b57bd17fbdcb4959dabd4860bc4c7060c4e7673bbec86bc62d42
SSDEEP 24576:Ca7/ezSC6vUyD/aqgrvW96q8wyuPX11Z6DgSURgpEWLPTem:l/ezSC6vUzPv4Hjyc1ZLSjZPTem
TLSH
T181756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 38ff2610538d02531ddd90230e3fb3399b2778f7542e7085f6a209944d521eb8
MD5 c2c4e8530f154cfdf956fc14a44c1650
SHA1 597449e7588e7e874ca486cd0be9cddc214048b9
SHA512 c3c4279f27bd9161bd09e90611588abe199da64c4ab5a461f89c8effa84e51fe559e41976adcc07493316ac5b97e4addeed0102ab4897d871345757a1c2dea76
SSDEEP 24576:2abbP1wPUv/l+hsX11Z6DgSURgpEWLPTem:2alwPUXl+81ZLSjZPTem
TLSH
T106559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 b827861940809e8c588ba6ca75108d91dba5d4a4226fe024183cad9812e4e9bf
MD5 ea6cca3985cedaf9663455a9423d0d0a
SHA1 573dbb4d176578ef1e6efee2ccfb4dd885d9e48d
SHA512 dbd4870b613c809ca507396878dfb59d20bd7cf8cc27a9c605cbfcba54c5d8138a2a656e42cd01b401e2573fa9e8874b3c998b6b4a74df2d81df53ea9324a54f
SSDEEP 12288:Q2Fz1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:Q2fX11Z6DgSURgpEWLPTem
TLSH
T11CD423048C7F144DE7D20C33A55CF949B5B269C28ADA0B932770768AEE7FB41DB88C95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 c47c64aeeb517f61262187dd687db3388d0621f27a0d87e8ea03f9f4555f689b
MD5 e7fd6407d0a263bcea81249880a49459
SHA1 79d92ee893ee9c230a80ea0cbb73ed99a754a2eb
SHA512 9f5b490566271dba46018e4ae1148e3aedd3ba414594de80e6a1a29d91ed8bdbd38a4b997d171fb85d34461a44d6edd2a8cc8b9ac25e9dbf05231c14cc3f46b1
SSDEEP 12288:/eBNUbTVO86ULz1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:/JIUtX11Z6DgSURgpEWLPTem
TLSH
T13215CF3BEE28FCD2C27A8D795A91C600E77274714B6293CBD174820EDE236E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 d4397330eee37cbe91fe324dcc89359a31e051766c65e58e1c7605b36914992c
MD5 e4a7b13195b640a850eecfa942cacee6
SHA1 ff9f1abbcd5755ae3e4b374c4e7cb28ec2fd77bc
SHA512 f8cea9778b1f8304951491bba76cb9174935cae02e0ba395a1d0f89ec2d4804051966b56ea8f1d3105c1760915dbbac2a8924fb22b942017b947028f244ee5c5
SSDEEP 49152:DQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJN9DN5J8NRV3THd:DQvGAdlCEL8c/NRNw5CpLS1T
TLSH
T152367D656BF880F5E1A7E138897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 14d311d0761db3954e96c6e8ebb9890cdda7a798224b14b23a3a30fea92621a7
MD5 6a1f516297ebbc30ff0a48ee0fa0864d
SHA1 029dc8e802221da1561c87eac40e4e351e5047a9
SHA512 2f2e9c2d38d55748fcad98565d33a441a9b0a1cc1f6a2de34b85bbf9ce0db895441e74dba5a1b8e0079a417e4db0143564389ea307a7810331665c19a793800a
SSDEEP 12288:jkwSfxL/2Dc3bDLLmt0LDQewsAjtz1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYC5:wmewsAj3X11Z6DgSURgpEWLPTem
TLSH
T17815E030FE75E036C3BB0DB21B25D706547D79604BA21AC3E3B89A8E59342D22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 f42679b158b3803a32dbae4160a1152edd8daed759065283dbee02af72756442
MD5 0cf5bbd5939523139d145578f8b153e5
SHA1 8d16b365f29fa0b9b68519a67918dc2eedd5d8f7
SHA512 9144e3fde3f27e5c55620ae537854593cc3596f55daea44cca3b2270aff7b18c309da96de8c42169a3a35ad189f045a5b4cfc8d38982a1139ca767aee4449b42
SSDEEP 196608:FUEtQeTbvf2zlO12sJTv6Ja1cpVLyX1ldPlbuJHXS1T:FUEtQevvqc2W1cpV2X132KT
TLSH
T1B5474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 fb0768f23b9e428a795f7b4e60d08ddf9bc1c6857f5d3f3faff051ef3b7b5731
MD5 5bfbb809c6f8478cc3eb324247e54289
SHA1 f0c693e0c08eb308aeeb090513ee4c659fc28cb9
SHA512 f993e876427ea516f4dcb38b280af30d0739877895e984f6537227bc5a20f9697b08cb388f4fe68468b2763638b42235fd14d943276f44fae19358071c632fc9
SSDEEP 49152:iTbRquA/m2yL5zMfFiV+XenmE3/z21ZLSjZPTem:coq1Vjnm7LS1T
TLSH
T17DD58D0976B881E4D1F6C77886A2C647F37178154B35ABEF4265460E2E33BE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 99c5efb0163fcf0347f516a81d67d3daea3db6d648061cf96e5d42b41ec4ed63
MD5 89755d1fd69eedc660f8172c86c1e3c6
SHA1 f72cdb5cb4bd12f8446f4fc3342e25293a56aa33
SHA512 bcc57f61aaedbd0a06c7dc96fd7eb43e9b7572e26da89591a4e335ca5edad2381e52e437f51a7e5eb28dc314836fcc916cdaf21e60e1f40120d0b293be8a137b
SSDEEP 24576:BAhGLvyFoiwtA5l7S53oX11Z6DgSURgpEWLPTem:BAMWFoiq5y1ZLSjZPTem
TLSH
T1DA459D80EBF955D4F5B3AA7899B69171EA76BCA65E31C20F2160D10F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 427aa4cbdd8c5082cd0a2e0562375099f5b0706528dbcf07b1f55311ca01ea2d
MD5 50fadba91750dc1533e40ffa5e2f2d31
SHA1 61db8b43b9922d4cdd4473f236296ffe7ee47041
SHA512 3fe1bc7ded47237e10e6574264bb5d71f920367b2b9cf653de9157b2bdf03a16e44abe32d653ae4db77fdf81a4667d515c696956459454e8fec8efb2da1b5f72
SSDEEP 12288:vmw5HEjsChNnBFgl0WDm+C/z1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGm:Owu+OWsX11Z6DgSURgpEWLPTem
TLSH
T1D805F10566A90CF9EAA34539C557D136F7F2B8422A25CB1F1370C65B6F37321AE2DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 675KB
SHA256 bba975dcc5e498dcc9b560b9f0fdd6ca665dae89b6f7ea1e37f4681485ba5365
MD5 80429f40506b0dcde082e16079bcc3a1
SHA1 dba4c9ffd807d162224350c0a5b1e5a3fd67332b
SHA512 37afe753861c4ce796c7ac4c4b6c5058c189a6765e761deca855f6a60c9a3c05289185b9cb8a451bc69017d3c6971597c47fd0dbd6caa2aac176641add2fa4c6
SSDEEP 12288:3GW1ILvz1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:2WuFX11Z6DgSURgpEWLPTem
TLSH
T1BCE4120926F920FDE293453AC8E8A609E3B27492577603CF1770529A6F37FC15E38B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 b47c586ab6a85cacbb3f5d3e60b8b90313e3c5da8768aade98aef1949ffa102b
MD5 e46f3849c55f2a6b05c74c5d5b566703
SHA1 724650b929d678ccfb78e780668b381785f66fa3
SHA512 a279ba46a7cf8f4eba02cf7ffd3455e5fb4b0cb2173f1fe8dea30c6a2d1e32f37518f6be56eca36abf202425e400451ca4ae67d56b392b636589204c4fcffd56
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23UH:CQRQyi36YOcP8Lvw2gAf+PN3yLS1T
TLSH
T13B667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 f52962ee467d1dcdb4d3928305ffbcf30fed9231af74d4b43cebafa0600105fd
MD5 320b70c7aad8abc0c111ca21f4ddcd13
SHA1 bf42c843ba3a8ca997a195f4c5e1a6e370d856be
SHA512 25afd67124ac499fc3d46e548e57ffbd446be5c2c9f3ae36b70bb9f4254f6e4caa7de87861e75406cc7c7f67315121ab58092b37228529202bfa80e20395c63c
SSDEEP 49152:Tj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U7:CQRQyi36YOcP8Lvw2gAf+PN3eLS1T
TLSH
T1C2667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e616776f43b7106cd86792cdf2bf98889701f628ab2dedddac09887a5f4a3fde
MD5 13c536e68b43509f57da9a6cdb2545ee
SHA1 ca3b7b1015aee7f08497e673b6fc8f2b661be861
SHA512 0eb536ec20a9965a6638cf5bc06ba99b8a8d09904678d79e39a744a90a0f2c4fd52f7a011bd044eafc927e36caccc22746a6e51ed897bf507ac396f2c77e7d52
SSDEEP 24576:Wwvrbf6SRQ+rn/fDboqxN1nnh6/7DaHGTNHu7PNU3/5W/ohL0uX11Z6DgSURgpEO:n68Qg55nhMeWu7PNU3/D1ZLSjZPTem
TLSH
T1FEB55A33B2F60099C44DE1769F4A972196E27C718FE1E3DB851172061FB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 29d03ef7354cd47ce92413d746b4a9bcfd6f4e534e625c2ee76be7f825f1d744
MD5 ad9de0da41ab5ef09b99dc391a7c3b21
SHA1 ad15c45787855f06e2f417a6268491d27b73b23e
SHA512 4de6aaaf38f1b0d672be238547dbfe2e02e89918b5310177de4ee09f3ca8585fe2102215f62ca7caca195efe8ba8e425a12897d98e6372c40da4737e58233317
SSDEEP 49152:Z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99x:Iy5112gYy5azzVv569nLKnhZhLS1T
TLSH
T100167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 52c1c19669255d41cfc19cced277cbf3987fb893c106353b3ecb03eac4b59cd1
MD5 8de8e5ce235acd5a8e9ae6da6bb56631
SHA1 e159ea16e43a4dcd78f4626af875696cf7930649
SHA512 bfd406fec378ba905b2719bc70832f5ec577939f972b5ca6ffe013392349482518d6116dbbc218c66913ec0f335774737281aa9fda2b883830dd636e28142217
SSDEEP 49152:9F+taZ3usBWOBr4tEGp0bqx0z+n217aau1glG1ZLSjZPTem:zu6JmTxd2d8LS1T
TLSH
T1BFD59D13F1DA01E8D05AD478974A9233FA62BC490B35B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 a65e9c8251e982b7bff8627ff7e833f36d170e65eda61a715d50c1d58405399c
MD5 c770e588cc3d5a974eb284f873d0ed9a
SHA1 ec0614638fb23242b626d628f762cb8e6754581e
SHA512 04b8a6935fb41458f68452409c87ec79419217faf669ae63e51063d1a91eff7eb14e1dc02ea295f96bd47f83c5780fd378b6060c82aa8cefc2f8bc8209c8eef6
SSDEEP 49152:h1hpsNoJpF1A6UU44CwH7R4xc1ZLSjZPTem:hmifPbRnLS1T
TLSH
T193B5BE13F2D900E8D05DD178875A9232EA62BC460B35B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 3818aa4b5f4fd026bfbc7bf75527fa06d89a09f9229249266e252c24cbc4063d
MD5 ca80b47ed6b662b21ccdc7693561fa2a
SHA1 c9ccd5a31a588702656546407e19eaa0b4b576fe
SHA512 2bf4f60a4a67c1edc32606171ff0bef3cada336fd50037454d880b309272f763e79c0d37fab46eb675fb578bd763c79fdcb99af1e0cce095e3807bce088db424
SSDEEP 49152:MSuZQIY0Be2K6RVtOnks6NMHqQ1ZLSjZPTem:u5dKoi61uLS1T
TLSH
T133C5BE03F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 af7b9a26f0c4edd653a95c5f87a46db7e2166767bde0d166775bfab242b3cfb1
MD5 a89d193a25ed1e7d4bef92ff6d237e2c
SHA1 ff04fae00c0cf4d0b1d77df5912bf773c224a7fe
SHA512 04bf115bd51ae8e2700dc2a35292055eabbfaafe592f4ac6c834e1b7f2633da1853d6fc93af91903094baeb6d70830a790f436e7dff4ae9f34bba9a8c8cc3380
SSDEEP 49152:EXgSn8EApI0figTgiDn0AP5wJ1ZLSjZPTem:iX2iyphULS1T
TLSH
T11CA5BE13F2D900E8D05AD175C7468632EA72BC060B39AAEF0A90B7561F7BBE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 598KB
SHA256 74069df0fb774807483abfa7b91f397d259fd0d9e0d8f197ef259d047fd18a05
MD5 33e6f42c6235a64f794740030babc7a4
SHA1 5be20d374aafaeba3e2dbda2eeeba7fed80f15c3
SHA512 6132e66c4729f9ce0284d7f1131b95be92877f9e1aafb34b6f0adb81880266e7a0c362b569d377ff0de589768d81aff325596b05fcc6cb95e5d494c558a7c8c3
SSDEEP 12288:GIz1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:GYX11Z6DgSURgpEWLPTem
TLSH
T11DD423048CBF155DE3814C33D55CB649E1B565C3AAAB06E337707206BBAFB516B88CE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 598KB
SHA256 18cce8344caf0b76db7a29f97523a8e680b60273e3c33613b13d97581685cbfd
MD5 df9cc801043f32b00e06d64be150b60b
SHA1 c46b5f1f853179d197085839f938f8c3dc0bcc2f
SHA512 7e7d7ed8c8354f6aff2237a34082135d73a30d06336d3e980876b3fb7d29227ba498576d7f39701fccebed0004378a34ef1345c8ed87fff51fbf285bc772c15d
SSDEEP 12288:kCz1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:kCX11Z6DgSURgpEWLPTem
TLSH
T1F8D423048CBF145DE3814C33955CB649E5B165C3AAAB06E377707106FBAFB51AB88CE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 598KB
SHA256 ba5cbfdf79b02350ae5d01d06a488efeb3ab95a44c626e5c0c6a738b44020e9e
MD5 9dfc79542930678db8b07b5f26556b82
SHA1 e827bcfe5909280858d5e2906831e9e546d9da84
SHA512 ba27f39ffbd336d99ffa5c57bcb50b1911df0adbeb5a78768d61f2eef7eda213c3ec03285405d8e3b4824990ca262bbd83270c27fdaaa3af6bf86def2572e8da
SSDEEP 12288:Kwz1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:KwX11Z6DgSURgpEWLPTem
TLSH
T1DFD423048CBF144DE3814C33955CB649E5B565C3AAAB06E377707106FBAFB51AB88CE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 619KB
SHA256 cd7c2cec8270536b8d758f81972c0c44db30f49e401692528b29cb67a46328a8
MD5 e7bf34156919908895b826fe56703c4f
SHA1 40cbf7916acff5819fa3e110e7fa825598deae2a
SHA512 ea4a23988015a6ed28000691892f9238a79333979e087d5789e3e5ed5510535074a7f7771b2840359f890e6af46b7deb82ca58107c6daf331f03e6ab625784ca
SSDEEP 12288:clQtz1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:9X11Z6DgSURgpEWLPTem
TLSH
T10CD423045CBF00C9E6929933C559A149F2B278C2D7B707EB6730254AAF77B50AB88ED4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 598KB
SHA256 3d68f3c31d9cc277c11b0d23407449efb05cdf403025dfa33210da3c04778f03
MD5 affbed75d1a2cae416b32e34f042d445
SHA1 280c7a1f916b5d2eb7d9ee9e74a0ce3470b93325
SHA512 9821bae46f51050da6212d42ec2d05310890bd56f8bc1c036d2eb35c55ffc753f3ffc5ad9b2edb77ed521ee05aaf327ee0327400538bdb65906066dfa667dd6b
SSDEEP 12288:ZVOz1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:ZQX11Z6DgSURgpEWLPTem
TLSH
T15DD423048CBF144DE3814C33D54CB64DE5B565C7AAAB06E377B07106BBABB516B88CE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 598KB
SHA256 1cebdb55ca5538af4ab14f0aeab2941553d11815b9950fbb9083650a31c0a3c6
MD5 d457d66c2914ce1a604c6272382e2d2a
SHA1 443b5c70d1b4830eea8245578210c4afaf22cf4f
SHA512 dbfe3a81f5e426984953dc6ea098cf65a96710c43909f2e9b6a930328efdc57b12ba2161166a819a3839abb3834a37c680792b0226d000c9cb3111e1f8c409d8
SSDEEP 12288:y6Oz1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:y/X11Z6DgSURgpEWLPTem
TLSH
T138D423048CBF144DE3814C33954CB64DE5B566C7AAAB06E377707106FBABB516B88CE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 598KB
SHA256 03f162334afdda26eceb4ddafe03f01ac6b617a7bd9deaa34aa7091ee85a9922
MD5 899f3cd08a7408881583eb60237fc8d7
SHA1 8e5289dbd8abb7ef28e908f69ed083da6676bef7
SHA512 4ae8a8dee3f81709d9a0882241cb5f00367168cd99ca0ad72831372a40ff9213b400acd3315e5120bfaccc4b5715c902ffe217ec4191a46b8a960f68e7df658c
SSDEEP 12288:B9z1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:BnX11Z6DgSURgpEWLPTem
TLSH
T1D4D423048CBF144DE3814C33954CB648E1B665C3AAAB07E377707146BBAFB516B88CE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 860KB
SHA256 f074e6be47b08e31d2baeaae82e4aad380c99cbbd0946290e5bd25ce1237ce5d
MD5 9acd1bcca7041a290238eb6104db0309
SHA1 e03e11ae6332e05278d36d8428d74468700ad37e
SHA512 77958f043583b1236f2b9bb7bca7d13ec180ebfe7adbe45daa324d3f94c10a05114645ab6d953ff51835e2090dde7473ce3a1450f6d3ef6df87bad1e677bad72
SSDEEP 12288:eiZwbM6zFHoSWcPvy8z1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:BZMxzFISu0X11Z6DgSURgpEWLPTem
TLSH
T119150254B3A118F8EDA3853EC9159906E2B27C560BB0C61F13B4366B5F333A11D2DFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 598KB
SHA256 b7153a4a0b1c4d9af7f83dfc37aa5596c23cea3a31e13ba883988cb904cff849
MD5 883702c0d5bf96b55ae8ad97a6fb7901
SHA1 85da7c8c2b96ae1de32296768340f1700f6cfc3e
SHA512 942ebc586e990de7594f2e535900049a639a236397002f61d263f4173ff6eb3da8ba6b2fe67dcaad6c2f47fb50e609dc3559d4959df16da39fd382d6bf505480
SSDEEP 12288:SCz1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:SCX11Z6DgSURgpEWLPTem
TLSH
T182D423048CBB144DE3810C33954CB688E5B565C7AADB06E37770710AFFABB515B88CE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 598KB
SHA256 3213475ef7baa942fdbf2ff52885b6ccabf846aaea8ba7ca6440b1c53a7a8feb
MD5 2a63932007435c533e4f12d16c0a884c
SHA1 9e22f7fdf8c914b101a16ebfe3770e48535dec2d
SHA512 65546eed6d3fa427a9dc5e011f67d05ebb4084cc3e413609343491c53666ace635c2a4199374ea5e38b6f826b17a1bd137ea238e8558a0b713b21dce2e774546
SSDEEP 12288:8Oz1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:8mX11Z6DgSURgpEWLPTem
TLSH
T182D423048CBF154DE3810C339548B649E5B565C3AA9B07E377707206FBAFB516B88CE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 736KB
SHA256 c56987a5b6d333ceb3f3f41992e51a6714e2863e01daa3c2ad102af49b5d7f87
MD5 ff3f88ba3fcc76082d5e2cdc1ed839fa
SHA1 70366c856d4b8c3dbcef68f94b20b07ebec2a900
SHA512 9dda1b2693c034335f5c25cdbb1cd9f51b8eeb92af28ea3e6cc6a70839f0a151ed81965f5f338bac2f1a3a6aa652a05148d0dce4bd1dab47435350104ea8918f
SSDEEP 12288:25PoNL0wz1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:koGwX11Z6DgSURgpEWLPTem
TLSH
T116F4120766B630FCD2628235C8556A05F3B2787247654BAF23B013776F277909E6EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 598KB
SHA256 872c557daf32a40ec0633a2c67e1d88273e11ea1c3ade36e72ff7ff7901e3744
MD5 fc1e9ed684dcc5ee6e77d346e58c940b
SHA1 795b999519f585dee634bd96f41a6b94fe1f6981
SHA512 aee3a7fc7368395037fc2470f8855d542fc3b903b06e70314f6aa56af8e9388af1c9dc8531cf197b7ac085107038b098ff82ee5181859dccb71fdbe4a8508594
SSDEEP 12288:aQz1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:aQX11Z6DgSURgpEWLPTem
TLSH
T12BD423088CBF145DE3810C33954CB689E5B565C7AA9B06E377707206FBAFB515B88CE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 598KB
SHA256 4a67aa274d7ee73fa05f8ff86cd87f539d3e6fa11876374e65931ec6ee1a6ecb
MD5 8e69e7f913f7f37f0c2a373eae8d9e08
SHA1 dca8066c2485e6f5ead01fc2b02178b4b90073a3
SHA512 86bc91ced0c4ce8836bcd3173b78b2556ac4561ee3d3c2469b022b7c3e5832ae658584a2de761448b21dbdbda9909597fdd9ce978b9d19fcbae582080959f8a2
SSDEEP 12288:mkz1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:mMX11Z6DgSURgpEWLPTem
TLSH
T12DD423088CBF145DE3810C33954CB689E5B565C7AA9B06E377707106FBABB516B88CE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 736KB
SHA256 7c21e4ca3a517c76f9aac704c6030c94a17bf20287d58fe88e9d251dbc7f6c1f
MD5 77917ff7e34db39d8c940d550b5874f1
SHA1 18dd3bfc33f6b75480a48ffbf92036fa6869d4d5
SHA512 9239d497b4d4c8c41a371ab9b9eef3d81065263232026a6452561ad79dc5d0bd53a54d321b3a9980803d28c16e987ace16c2b2e4ca832f239282a347fd7e7a57
SSDEEP 12288:b5PoNL0jz1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:NoGVX11Z6DgSURgpEWLPTem
TLSH
T1B7F4120766B630FCD2628235C8556A05F3B2787247654BAF23B013776F277909E6EFA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 860KB
SHA256 509553fff5e9bfd6979dc50a1a9287e6043400a2b0312fb8e2f0ef5127013c15
MD5 12cb2b086453f37a6515eaf05853d180
SHA1 c6f3d79f7bedd92954d363b546d0ddc51f062a22
SHA512 66678e3f92ef17104fe0ab3941def819a102745951bb3273a9f4eeba30328edd5543dfa815d50c3491947278e7240e1062cb919948c01aec4f98c010fdafdf8f
SSDEEP 12288:hCd9QxooaLxk3z0zP4PDvhqz1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGm:cToaLy3z0z26X11Z6DgSURgpEWLPTem
TLSH
T149150194B3A118F8EDA3853EC9159906D2B27C5A0BB0C61F13B4366B5F333611D2DFA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 a66a0fc168fcf3612a09e9b36b5ccd80025f89b796cc67ab58e6fbfc2b890762
MD5 9cacedfe7b439da7315792bbd4c00518
SHA1 7e106266aa7334a6ef7bcc4d97f16fd43e3734f0
SHA512 5e7caafe7ebadce0521170a512add93e6cf03a3b7580a2315b428f1b5a138eda6e9cf095ab7768350093c930b66636554df239a9bdd6ca645fafda7d46aeaaf2
SSDEEP 24576:A3Sd4CH9y7r9HX11Z6DgSURgpEWLPTem:KSd4CH9y/n1ZLSjZPTem
TLSH
T1FB35CF90F3E414E8F1B39A35C9755511DAB67C9A5B71CA8F03A4261A1F33BD18E38F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 598KB
SHA256 403ecdb8f9028aedfa37b8ce3d0ab629b0ec5807891f91de3b6cfcc8181f533b
MD5 4d0ac3d80385bd5106a84e9f9d24eb3e
SHA1 ebe12ab1e1a77f8fd5ff3d34000f9ada778eed56
SHA512 d50cf93471f2c66e07ce32ab2cd3e61a77f2733a57fda334cd36abd5f07ac60bfb20cedb0ea9c0f65852eeccba9a70df89238fe91526af3abf528a13d27b4ba8
SSDEEP 12288:47z1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:49X11Z6DgSURgpEWLPTem
TLSH
T188D423048CBF154DE7814C33954CB689E5B265C3AA9B06E377707106FFABB516B88CE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 599KB
SHA256 eaa8c608321d4093133f9a8fca0fe3d9ee8cb0a6a838a273d44247a9acd34b0a
MD5 aef1d097ab5e158a5a2731378b81f0fa
SHA1 cf66069d5724b5e2e16810d81d26bb9e1abfd556
SHA512 5c153a214e92bdeadca4c8fb050be5eaecd8bc4fff873194cab707e3257b5f4a7c3c821754e3170565c912eacdc3ed00e54c62faee8aae98abfa666250b17842
SSDEEP 12288:Ikz1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:IMX11Z6DgSURgpEWLPTem
TLSH
T1FED423048CBF145DE3814C33954CB649E6B565C2ABAB07E377707106ABAFF915B88CE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 598KB
SHA256 e7d9a77de7b87053d69c510a376202fc7a27c14129e1c25328867b670ca85b58
MD5 b83c94707e85fedfa62642be9d8bbcf2
SHA1 c96f2e647b08bdd7e0ac6110859fe76968e269af
SHA512 450cb34e9249e8ce6427bb082b97ee4495ed252d931fc908e46a80b5595af026f659b1b2ed1483be9c97931502ae561c80abe96d2e41d7373856fcda4c096169
SSDEEP 12288:XXz1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:XBX11Z6DgSURgpEWLPTem
TLSH
T1BCD423048CBF144DE3814C33954CB689E5B565C7AADB06E37B707106BBABF516B88CE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 598KB
SHA256 3631b6a8b8ad159640eea5fd82aaaacd4ecbbdb8433d430241ea9ea014e658fc
MD5 f58041fa069b08ac436d4fe0f47fcd50
SHA1 98d955010e75c93340a9a204087a4b917f924e75
SHA512 68e843dcc3b5594855436ab8c7d498d6482eb28a534732f8f22c35adb9a93e5f7897d19e116914806b24f47f0df736c5a8cdbfd2a6f8acf2e69e48a337e6a033
SSDEEP 12288:cZz1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:cbX11Z6DgSURgpEWLPTem
TLSH
T1ABD423048CBF155DE3810C33954CB649E5B665C3A69B07E377707206FBABB515B88CE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 598KB
SHA256 87e531e660f6f71302e4dea11621db939bf66c479db655802799dabf87e975d8
MD5 568ffd29e40d0ad548092597d1223ef1
SHA1 b35cadec693164bf7faa65ffe587dba5ca1bc2d1
SHA512 149bb513687ded6bcb0e9831921572fe92b4e1a89f929b3957537ebaa82c82895a1fd6bc9f16804d3369b152cac0ff49525d7309076556c29472511633a44b53
SSDEEP 12288:+rz1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:+NX11Z6DgSURgpEWLPTem
TLSH
T116D423048CBF154DE3814C33954CB649F5B665C3AA9B06E377707206FBABB516B88CE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 598KB
SHA256 cca370b74571e644f160da6dc09addc68e0a936efad59a9db95c2c3689019a6d
MD5 6f97cc4b6eff900b2d1b256127507360
SHA1 159e010fa7db9a663675e55480e53df5d8fb9be7
SHA512 e17d564a63c13ef5a31bde078255534654cdbcf7c9bf621f08cfcef2fa9361b6f5425d9276b6a514f46bd15d087a3a9ee543452ee0405b2a0ebd823a5c878e2b
SSDEEP 12288:90z1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:98X11Z6DgSURgpEWLPTem
TLSH
T1DAD423048CBF044DE3814C33954CB649E5B565C3AADB07E37770720ABBABB516B88CE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 598KB
SHA256 5cb1272fdbd369910b111ddbb0159c572b3b81d4b9c9100d44432a024213e00e
MD5 29a6ff096723690433287c8f2e0d61a1
SHA1 c88fae61ceab2b6597257010cf8e77fb63b04728
SHA512 fae0cf2ef5a1cb99887eb153dbb03c52c58b9f004021bbdd5cdf8390d50277d986cd5ec427dd34ce9714a5cc901adc97ce9ab8e6dcf90338fdc8ccc9968216f0
SSDEEP 12288:8Zz1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:8bX11Z6DgSURgpEWLPTem
TLSH
T1AAD423048CBF154DE3814C33954CB689E5B265C7AADB06E377707106BBABF516B88CE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 598KB
SHA256 f8ef3149af5dae814c8843d7cdeeef531f89888dcc993e490dead54a78831759
MD5 d0fc11037a1826f542f30fa02cb6333b
SHA1 60ed8fdd54677978d441323b112976db619bd327
SHA512 788f8be6f8a9a65bbeded98f16cb014d68b1b60218d326e26b5c228ee5f622693b3d06c6b6db3f16dd12915fa5e71ab74026a0b68d9dab20898b0d1069a61191
SSDEEP 12288:Vfz1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:V5X11Z6DgSURgpEWLPTem
TLSH
T129D423048CBB144DE3814D339648B649E5B565C3AADB07E377707206FBABB525B88CE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 806d0f5685cb06549e6ed41f928e0bbca14e7c66aa8dd5af0e7709ab17f6bbfe
MD5 f1fc2314db449800b7612594fe268682
SHA1 a9139f508aa339c641c8c8b9a1c4326537461332
SHA512 91680697ab8ee691cc7aeaead8663d0d3262dfd203d772aff0aed1c0baf90f6a022a16ca26bd5068e6d40cabfeae4d66f2d9e8cf1c23d6edf244235004824331
SSDEEP 24576:2nwvtk9RX6wkyAIOX11Z6DgSURgpEWLPTem:fMnYIw1ZLSjZPTem
TLSH
T19B35DF29EBDC04E5E1B7913C99B7460AF2B178591B31C6CF12A953AE0E37ED05E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 718KB
SHA256 2717cc118d9522f307722ff39390fba46509a3861baca213770fd98aac4d67cd
MD5 6f4220b2bdeccda23345920829d0667c
SHA1 688d2cb1db4c9e19cd6055f37e3ac446ff71634b
SHA512 8d4a78884b3d10d8ff16c6f6bcaea8073caec8c267539e9f6fa39e39ae0d2ea836d3d2e0da78161039ef172072a6c295252e34fe099ceddf3fb230bbb6b0dd9f
SSDEEP 12288:Crsfkz1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:pMX11Z6DgSURgpEWLPTem
TLSH
T1AFF40109C2A902D8D1AE5536C7599A44F3737C6187E283CB23E0F53E1F7A6909ED9B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 ec42258deab3f8c16f6aac8027ea0626438030ac2a5c9c02e3e764fed0754896
MD5 ba3ba7478350b72b56e51c71423f5741
SHA1 1604d16a3ac6f718d93a9cde9a8ef4bdc036e375
SHA512 1da7a45de4751dd04e08ff1ba57062f1d4b896db2081e6fa23bd6ef0a8b272732e05801206a75cb93aee2f8ce8a7060da995fb036ca58a43c7c828affcf9bdc6
SSDEEP 12288:cf7az1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:GKX11Z6DgSURgpEWLPTem
TLSH
T106D423108CBF180DF6A11D32914CF518B27A75D28F9A06E377307246BA7BF819F98D99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 03bbfced22628c9edb5d62185de67dc01778fab1451f979b1bd43c527013229b
MD5 bf8d1e08ceba5781ef70aa14f5afcf8a
SHA1 3c70a902d1fae7998839937c77a09ac254bc5393
SHA512 5098ac6708dc117ea1dbc4d2992a5dbe3b97b1c5be3f58161fee09060c64ccca83ca0e7b54db09a47d2ccf985679447b727cd494b9b11c23682b27f2c288d236
SSDEEP 12288:cbGQz1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:aGQX11Z6DgSURgpEWLPTem
TLSH
T168E4231C58FB309CC6728A368468A556B5B130D1975906FF06F0B136EF6BBE06B7CC98
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 d2dab4b6739f804cce5b47888bddbf9f216d3db05740031868dff1fe406e7e9b
MD5 3986dcad600d5d752c7376b55142202d
SHA1 eb46ac77f480a944ca9fb74fd42787a095be4bb0
SHA512 df9051df45137b5449d6925f4bb909e67ef77d6ebdf3c7bfbd20b2a685d88e97326e28c8d836db5b95f0969e326b4d83860ae6153469b82cbdd54e08ab598637
SSDEEP 12288:JUz1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:JcX11Z6DgSURgpEWLPTem
TLSH
T117D423048CBF144DE7910D339548B508B6B165C29BAB07E377707146ABAFBD16BB8CE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 d5f812062b7d83c4a4962871611ef77d1752d5c134b888ef9c22cae408eecc1a
MD5 3239c8cc37dfd222afa39e57577933d1
SHA1 106cf66f5227b1383d301946d8bc3ec99e11cf7a
SHA512 6039e28f9bcea02c5c9c5d751b73fbfc8c3261bfac330a11e635f5d604cb9cb89dc4bc1034c96837fd2b019a3be094bbfe5f389e04690d0a376091afd8949031
SSDEEP 12288:xHvUrBFrEjwaQVz1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:xPUr+NQPX11Z6DgSURgpEWLPTem
TLSH
T18505F12E25ED18E9E676A13D8586870DF772B462071292CF02E0817E5F67EE4BD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 e5dc2b5965471ac00bfd21dbd6b1972c3faf65a4bd45200575aa4191ee7d15c4
MD5 8cf53f6d398539fa6711a1b8664cc1f6
SHA1 f06f3fce303b7af895d858d969f6aed3e8b25afe
SHA512 0ec1226e352dc3e029867ac952bec64322269033e5db72dfb3e729ccbdd4b0f1ec0cb376f7ab6c72e4a5b7f75d593a425cb8e963f2c401d1a6e68cca0cc87422
SSDEEP 49152:zBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjt1ZLSjZPTem:cG05lO43b8LS1T
TLSH
T1E6D5C06E62EC11F9D1BBC17CDAC64A0BEBB23415033556CB02A486A91F27FF45A7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 4c79d2156671c3ece36843a5da9af11f54dda5c3914eae5746a0d6f52bb12a6c
MD5 e8d7fa68293e1e6a21b36c3f6013f8c0
SHA1 d78590178abc86bedd4ca534541f4c1575d4ce7a
SHA512 d5671f61bd2963fe42f426a4a2cd57220fa241450e2e80705ae2447bd515343f2953bd30b6cfffd830e5bfa485d203b4318ffb79951cf89bfe438b8da8d71c6d
SSDEEP 12288:LFKYGNca1w6n8ejbyQ4nLC18yx/oRvnC3e/EOTHxt0wLAxm7aCHd9W:sNcwHdjbyQ4nLC18lb/EOjowL7Fk
TLSH
T10685271623E901E4F5BBE1BE89779546FAB1786513308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 2.3MB
SHA256 8dfe5d95f6962225a327e2f55a3bf370cfc4fb9069204c07a3408f96cf76059a
MD5 536bca5f0fc8cd64e8e4b4f17d1c56a9
SHA1 a59524dbcc72683038be2ff9a155034e13b3c837
SHA512 d021466536b5c0446bab6ac1fa85184455adb10be3296efa788eb5a28a1f257dee09771b154d38a2126679f519c34b043736e9b35ecd05bc5a224082a39c15ae
SSDEEP 24576:pNcwHdjbyQ4nLC18lb/EOjowL7Fk5X11Z6DgSURgpEWLPTem:pNc/zEOVHF61ZLSjZPTem
TLSH
T140B58C1622E901E4F1B7E1BE897B9546FAB1786553348ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 98156e385683fc659ec04dfb12216de25583379b6c69429a64a1b27f1c1bd364
MD5 197b4df31ab9d8be9ad4bab6fc0e7080
SHA1 a31338a2cb13e6b43a4f9f49fa8e31142ae0a029
SHA512 49e5ffa3266a48fa0376f06b99678c8b4c04890a4720019f675035e168733b2abeb83644769e7ed6f5cfcdfcdf815682afb9934f2e68ba07f0c53a19e7ab15d1
SSDEEP 12288:/XHck6j5ZI7B7z1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:l6DIN9X11Z6DgSURgpEWLPTem
TLSH
T1DDF4011C227B10F9D167D03EC5824505E2B2B0B187661ADF17A4D57A9FA3FD8BA3CE81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 c2bd850f25e08949891e4d0f2309e11dd3553216832037939412a095a959ef1d
MD5 40ba2a9837a689b3f8ae148005685236
SHA1 1c4d807d62deb5f1d42bff36fffef993090edc76
SHA512 809ea7ee9f6cc55da3429d65b3bd54d0cd7d4fecd33043d347e9c79087d6e622c2833fba63ceddd4e62b4a379a15b7982f5c2106d85ec58912270354d7763365
SSDEEP 12288:LG6kypz1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:qtyLX11Z6DgSURgpEWLPTem
TLSH
T1E7F4220456A920C8E6B10935DA669254EA71BC509B6203DF26F0F32F7F3BBD0AE70F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 16e89cfb0a0eb704b46c5f0a3cdaa86ab5540a61885f54437148ffca94cedc94
MD5 06a0889a610c207c79063c1fc4d38ec6
SHA1 a67c3ba06b317cf2db7ba4d9130d72b255285c97
SHA512 00815a75646b184c2107c547edbe1ab459cfb26b2774d11d66b10edfbb2ff2d8c8cd046737fb11c8472a1840b07835371da850ccd60856a4f1e65edd78f21da4
SSDEEP 24576:5YTkNvNnaFeYhJNtmZBmQX11Z6DgSURgpEWLPTem:GTMwBtOmq1ZLSjZPTem
TLSH
T1C055AF2EAAB806E4D1FAC6B5CD238512FA727461073253CB5390C13F1E679D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 768KB
SHA256 16ebd8fa2ce8942115c4002abe98533bd2e8b7c934eb4b73ea08730e66eb852c
MD5 5e6b92d53d787d4b056c00e75afae1ba
SHA1 0da41aaa2eaeda347e407202330f6bb1ae8ff2d8
SHA512 6850e94f283bc6fab531c31fdfb8783197ccd2b5c7fa46607334a90ff832332bd9acff14de314ba27b29ad7072aab7ab29ecb7f6b00b643fed08c44e3b65d199
SSDEEP 12288:ry26b3IkxjbBz4z1X1N7VVF5dWDzL6wgSUR4EU/jjRIxWiUYCX4OPGAMe:x6UqjpoX11Z6DgSURgpEWLPTem
TLSH
T1D9F4120D59E924E8E1714530D569C12991B1B8B217B616EF32E4A67F8F37FC09A3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1148-86-0x0000023CD4D60000-0x0000023CD4DC6000-memory.dmp

Download

memory/1148-84-0x0000023CD4DE0000-0x0000023CD4F38000-memory.dmp

Download

memory/1148-85-0x0000023CD4D60000-0x0000023CD4DC6000-memory.dmp

Download

memory/2064-284-0x0000023F635B0000-0x0000023F63616000-memory.dmp

Download

memory/2064-120-0x00007FF6ABE60000-0x00007FF6AC5A3000-memory.dmp

Download

memory/2064-285-0x00007FF6ABE60000-0x00007FF6AC5A3000-memory.dmp

Download

memory/2064-115-0x0000023F635B0000-0x0000023F63616000-memory.dmp

Download

memory/2064-116-0x0000023F635B0000-0x0000023F63616000-memory.dmp

Download

memory/2064-159-0x00007FF6ABE60000-0x00007FF6AC5A3000-memory.dmp

Download

memory/2160-0-0x0000000002A40000-0x0000000002B6A000-memory.dmp

Download

memory/2160-7-0x0000000002B70000-0x0000000002BD9000-memory.dmp

Download

memory/2160-1-0x0000000002B70000-0x0000000002BD9000-memory.dmp

Download

memory/2276-154-0x00007FF706E20000-0x00007FF706F39000-memory.dmp

Download

memory/2276-74-0x00000216962D0000-0x0000021696336000-memory.dmp

Download

memory/2276-73-0x00000216962D0000-0x0000021696336000-memory.dmp

Download

memory/2276-72-0x00007FF706E20000-0x00007FF706F39000-memory.dmp

Download

memory/2904-44-0x000001F4C5F70000-0x000001F4C60C8000-memory.dmp

Download

memory/2904-46-0x000001F4C6200000-0x000001F4C6266000-memory.dmp

Download

memory/2904-45-0x000001F4C6200000-0x000001F4C6266000-memory.dmp

Download

memory/3264-126-0x00000253C0F60000-0x00000253C0FC6000-memory.dmp

Download

memory/3264-124-0x00007FF7AE0F0000-0x00007FF7AE19D000-memory.dmp

Download

memory/3264-160-0x00007FF7AE0F0000-0x00007FF7AE19D000-memory.dmp

Download

memory/3264-125-0x00000253C0F60000-0x00000253C0FC6000-memory.dmp

Download

memory/4196-108-0x00000000009C0000-0x0000000000A29000-memory.dmp

Download

memory/4196-158-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4196-103-0x00000000009C0000-0x0000000000A29000-memory.dmp

Download

memory/4196-102-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4212-29-0x00000139FE400000-0x00000139FE466000-memory.dmp

Download

memory/4212-112-0x00007FF65F360000-0x00007FF65F428000-memory.dmp

Download

memory/4212-26-0x00007FF65F360000-0x00007FF65F428000-memory.dmp

Download

memory/4212-28-0x00000139FE400000-0x00000139FE466000-memory.dmp

Download

memory/4212-27-0x00000139FE400000-0x00000139FE466000-memory.dmp

Download

memory/4336-38-0x0000014E7F5D0000-0x0000014E7F636000-memory.dmp

Download

memory/4336-123-0x00007FF65F360000-0x00007FF65F428000-memory.dmp

Download

memory/4336-37-0x0000014E7F5D0000-0x0000014E7F636000-memory.dmp

Download

memory/4336-35-0x00007FF65F360000-0x00007FF65F428000-memory.dmp

Download

memory/4336-36-0x0000014E7F5D0000-0x0000014E7F636000-memory.dmp

Download

memory/4504-143-0x0000020256070000-0x00000202560D6000-memory.dmp

Download

memory/4504-142-0x00007FF63C9B0000-0x00007FF63D1D9000-memory.dmp

Download

memory/4504-165-0x00007FF63C9B0000-0x00007FF63D1D9000-memory.dmp

Download

memory/4504-163-0x0000020256070000-0x00000202560D6000-memory.dmp

Download

memory/4504-162-0x00007FF63C9B0000-0x00007FF63D1D9000-memory.dmp

Download

memory/4504-141-0x0000020256070000-0x00000202560D6000-memory.dmp

Download

memory/4912-53-0x00000237A36F0000-0x00000237A3756000-memory.dmp

Download

memory/4912-52-0x00000237A3470000-0x00000237A35C8000-memory.dmp

Download

memory/4912-54-0x00000237A36F0000-0x00000237A3756000-memory.dmp

Download

memory/5680-16-0x0000029E0B8D0000-0x0000029E0B936000-memory.dmp

Download

memory/5680-15-0x00007FF787FC0000-0x00007FF7880E2000-memory.dmp

Download

memory/5680-92-0x00007FF787FC0000-0x00007FF7880E2000-memory.dmp

Download

memory/5680-18-0x0000029E0B8D0000-0x0000029E0B936000-memory.dmp

Download

memory/5680-17-0x0000029E0B8D0000-0x0000029E0B936000-memory.dmp

Download

memory/6500-93-0x00007FF7F1210000-0x00007FF7F1359000-memory.dmp

Download

memory/6500-157-0x00007FF7F1210000-0x00007FF7F1359000-memory.dmp

Download

memory/6500-95-0x000001ADD3960000-0x000001ADD39C6000-memory.dmp

Download

memory/6500-96-0x000001ADD3960000-0x000001ADD39C6000-memory.dmp

Download

memory/7128-60-0x00007FF67E850000-0x00007FF67E9B7000-memory.dmp

Download

memory/7128-61-0x00000238654C0000-0x0000023865526000-memory.dmp

Download

memory/7128-62-0x00000238654C0000-0x0000023865526000-memory.dmp

Download

memory/7128-67-0x00000238654C0000-0x0000023865526000-memory.dmp

Download

memory/7128-70-0x00007FF67E850000-0x00007FF67E9B7000-memory.dmp

Download