1ae32d63212fe94952346a977c7a52d3b8af56c39e7235eda363843be21f5972

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
Size 2.3MB
Sample261102-e54jtsey8s
SHA256 1ae32d63212fe94952346a977c7a52d3b8af56c39e7235eda363843be21f5972
MD5 ea93558134a5b648bafbd34602db8b26
SHA1 61a2e214fcc49a12472aefc2cae7839ed51c0c3a
SHA512 b5411ebcbde9dffdcb567d0834f8a12adfca98213c75e9ed36d003b0ffad32566152ed0645ced2654e507f85aafcb4b14a1bd575fe985e67c70a933cb458c98e
SSDEEP 49152:oDD0FZs/Yl7dYUMQ+fCi6p6O8IFeII8uxV1XL4ThOlciSexvI:sD0FZs/U73MQ+fCi6AeeT8uxV1X48rSk
TLSH
T1A8B5BF33F590907AC93313315E9D636C76A9BB710F36428722E55F2D2EB05C36A396A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
1884	elevation_service.exe
4912	elevation_service.exe
1088	maintenanceservice.exe
4364	OSE.EXE
1580	PerceptionSimulationService.exe
3020	perfhost.exe
1548	ReFsDedupSvc.exe
5200	SensorDataService.exe
3396	ssh-agent.exe
5332	AgentService.exe
4948	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe

Drops file in System32 directory 56 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\b599d75fc17a6531.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_104140\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Defender\NisSrv.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a94b8e37836add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000090b9b374836add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000225e0136836add01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000020f12436836add01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a1851e37836add01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1884	elevation_service.exe
1884	elevation_service.exe
1884	elevation_service.exe
1884	elevation_service.exe
1884	elevation_service.exe
1884	elevation_service.exe
1884	elevation_service.exe
4912	elevation_service.exe
4912	elevation_service.exe
4912	elevation_service.exe
4912	elevation_service.exe
4912	elevation_service.exe
4912	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3344	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
Token: SeBackupPrivilege	1548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1548	ReFsDedupSvc.exe
Token: SeBackupPrivilege	1548	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1548	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	5332	AgentService.exe
Token: 33	4948	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4948	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4948	SearchIndexer.exe
Token: SeDebugPrivilege	1884	elevation_service.exe
Token: SeDebugPrivilege	4912	elevation_service.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3344	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
3344	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3344	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
3344	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3344	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
3344	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
3344	2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 5236	4948	SearchIndexer.exe	100
PID 4948 wrote to memory of 1264	4948	SearchIndexer.exe	101
PID 4948 wrote to memory of 4196	4948	SearchIndexer.exe	102
PID 4948 wrote to memory of 5752	4948	SearchIndexer.exe	103
PID 4948 wrote to memory of 1620	4948	SearchIndexer.exe	105
PID 4948 wrote to memory of 2528	4948	SearchIndexer.exe	106
PID 4948 wrote to memory of 4476	4948	SearchIndexer.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_ea93558134a5b648bafbd34602db8b26_bkransomware_elex_icedid_maze.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3344

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4912

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1088

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4364

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1580

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3020

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1548

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5200

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3396

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5332

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5236
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1264
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4196
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5752
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1620
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3024 3036 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2528
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3048 3052 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:4476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 a5668a90a26e51f0f4e88353ccf8c67f3d0f7ffa26ca9464d18c13937e1ca702
MD5 b8d6908d201b36a48735d4d577ddb0e0
SHA1 b9f95989f39438c7deb08bf0e9448492e6f58307
SHA512 595d321e52e014923948e306542eef6e4ce32077550c4d86b591fb84383866c46ab33b22b0c7797870804c8b690d7c3ae58416b1f53416d1d1b81c9ccecb6816
SSDEEP 49152:db+632BuPkFKRrdE6ohvstBhuXjfS4LWxnyhOlciSexvI:j3q6sjBr8rSex
TLSH
T1B0D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6552E7BEE49B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 3d889dd69aadb9e76d458df59b377d67f240c661fd799b6ed32cf8cd93724c2d
MD5 bb67f5a8988e9e57e04237e413a29736
SHA1 8a049ad83958d2e8efd4537ca92e8a96599b577c
SHA512 e8dab621ac427912d0400c9976df232f0f527cf1dded82d98a96e1501c263a0aa858c9a515de00455ca2639caa477621da4cf31c6186d5cf7cdbf52374049ec4
SSDEEP 12288:i1XLsswWkxy2lRq2czAXXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:oXYfDtczAHfhOB95Dr47iJ0nQZo2vI3
TLSH
T1D285012877D408F9ED67827CCDA28502DA337C9547A0E78B03A096795F336D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 214a5387267e9cabb429a7531b0ef12c211c197bc4c256f43c685f0696d488a5
MD5 fde0dc20b67c69e81ba87897a72adbe7
SHA1 745d66eb4f62508abb642a7214ff0e3d7a05096f
SHA512 f6d9d2735f81cf5d911aef5241c6d1d26b627758775a987077f129a346fa67e5a5eaf721a4e1c34a57710f9e22de283c77f8da75f92ce222dda9cc8af591dae9
SSDEEP 24576:N0Le5ji0hmxxrM+fhOB95Dr47iJ0nQZo2vI3:NPji0AjJhOlciSexvI
TLSH
T1BBA5AE15F6788731D073C0B9C5D2A68AED72308657308ACB4286D77C7F67AE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 03391d6554c34d1de21fb6e22a0873547336c9a69c5fce80514c6c65ee41600b
MD5 9970cec6cd80e7eff1a414d092c6508f
SHA1 662e15c10d1d5f04ca50002f0aacfc7f7e741c04
SHA512 d5e536f0563ebe81f0f47755f62e33ef2f63998ef087079127f59276347dcb5adf1da4212899ab5f4032f6197d9f73d2ce613a46482a2ef2f3a3c58d6810acc1
SSDEEP 24576:0a7/ezSC6vUyD/aqgrvWn6q8wyuYfhOB95Dr47iJ0nQZo2vI3:j/ezSC6vUzPveHjythOlciSexvI
TLSH
T197755C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2c031ef3e8aab95226e252e8e869373743ec677ec200d45240251490fd30cbaf
MD5 edab227289b681134c414cb9b602b1bf
SHA1 fedeacf79dbdd688d586ee65943e717674aa8b95
SHA512 bd91896926182b6ae2056ec1b2c21bfecc41015c54a3fb87e48a536ab3d34dd73225f46dc87bf999c21fce7a7be9e3d02a35a0bba375c7cc7eeee5b7ed2d7a89
SSDEEP 24576:OVbqPb88hv/l+YzfhOB95Dr47iJ0nQZo2vI3:OVO88hXl+AhOlciSexvI
TLSH
T1CB559E65F5B48331D073C0BAC5D3AA9AEE3234425B318ACB1246D76C3E676D6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 cadfdc9ea3d606b965dbb812bdcbe8e95b61b5e8d8f1fca44aac61e1cd1a4ad6
MD5 2b070c1782d09e56151eb38a20ed7687
SHA1 597b465b29fdcacc998e339591213ee386dab980
SHA512 da3f41f976429a7c1affdaebaebc6799974385146c48d6d5661c5e789bdb0f97d7729df5075d4915037d1f4a2654d0315ef114674aece60e8fd8ff8113523546
SSDEEP 12288:2LkXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:2LKfhOB95Dr47iJ0nQZo2vI3
TLSH
T1227523889FCC6DA6F3B7C7B97F9B8B03C8693DA494C11E539D00B26DE435455C2AA027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 2de3361f5a1a6ba8a3de5581fc116ae5539c13b3f2ebc50daf7526f0a0d0d3ee
MD5 95c592d7031f5bf3ebef2b20c68e578f
SHA1 40533db59e9016d18ec7062f0c7caf812a4e6c48
SHA512 7d57238286ad0ec875be156ea3b36dc6bf9f7e76dc5e89e32cdf64900b45feeed54b830503b276079215068f7a5c7ceec881a56c5c415ddb6a503c5f3ec52def
SSDEEP 12288:heBNUbTVO86UjXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:hJIUbfhOB95Dr47iJ0nQZo2vI3
TLSH
T15185CF6BEE28FCE2C27A8DB85B918700D77278704B5193CBD164C20EDE235E55E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 dca6716dea273fadff5b052aed65e735ee1ad50f3d7c60c055b2cda2be11e217
MD5 70ccdb4ea652cf637b9727feffeb796a
SHA1 46f6ba9751dbf2e8352989dc3128683b8be5b41c
SHA512 30bf29a6258c581045be22b7db0808040e034d577aa7181d0989b4ea7dd1c9ef7668f5da4d9c7b7f137712379434d8576aff85a1b80a4757438a9ccd0958a6d0
SSDEEP 49152:SQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3THl:SQvGAdlCEL8c/DRNw5CI8rSex
TLSH
T132266C656BF880F5E0A7E178897AC672F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 168e70da774dd4eb9f97d72ea5dfc9aea70cebb43de9f0ffa27a95e7d04f8214
MD5 b1e5f3c53572028406fdc5e34d2856b6
SHA1 33cb6fde7ca0ae92e43bf0f765512b102007800a
SHA512 2cfc0afb8cd84c781433adb0a59df3fbff4660e8cbaca81aa10b9381adf75fa3a1af757cb84346ef7a3a3ff0dcdd232f4f960dcdcfd03101f73bc8b7e3531768
SSDEEP 12288:fAwSfxL/2Dc3RDLLmt0LDQewsAjdXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9k:o0ewsAjlfhOB95Dr47iJ0nQZo2vI3
TLSH
T13F95E030FEB4E436C3BB0DB61B36C706587D7D604B911AC3E3A89A9D99301D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1e06b40592beb71090481181b04554979d0fd8271b0a6574c58fc97bef5ec28b
MD5 84edf58dc91271c8e4b990a027b8735b
SHA1 a89f9feb16deb1170c7c9c863b29377235e0a2a8
SHA512 fae20a0bdc09c4a1fe193859647abf2c8012cdfd8370530c8d2502d40ad2d55e41504c897ed68f568871a13f692a40e92e639de3425f143c2d741605d020f866
SSDEEP 196608:8UEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH+ek:8UEtQevvqc2W1cpV2tI32bk
TLSH
T1BD474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 f182effd09d158429ba07328597fd3e1d862d8ece5745f28ad43477c77213880
MD5 2263f403d7458f8482bdec1de591898e
SHA1 ec7c9bc948d8f5c0176a1fb1e9d9f1bd4610cdff
SHA512 38a21aa2f1161a4456f2252a77fc78253112d85705a4005d716554241c8d0bd2ecc5546d8383da6ac107b9d30945c1e5752cd16d8508ebca2e0869e331405c65
SSDEEP 49152:kCbRquA/m2yL5zLfFiV+XenmE3/z5hOlciSexvI:toq2VjnmM8rSex
TLSH
T138D58E0976B8C2E4D1F6C77886A2C647F37178154B319BEF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 5149549997bece26b900d72f7162ff7f45994d09efeb79b7948db6ea7093d806
MD5 a1e3f5cec8c1583ae7c2d576d1d36597
SHA1 8bffca1def7ce2b7f3c2e26edfe1a8c39a0a08a4
SHA512 6c661b2d91362db9687e3d686f950fe132cf4a86fbd27464e2a5e1559ed2a34fa1986d129533ad27363a1e272164fd4430f29a0b67bd33f4da76a0a8a9f773e8
SSDEEP 24576:VAhGL3IFoiwtA5l7S53sfhOB95Dr47iJ0nQZo2vI3:VAMUFoiq5chOlciSexvI
TLSH
T17C359D80EBF955D4F5B3AAB899B68171EA76BCA95E31C20F2150D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 7fcd68c80eb40217be6d00ddabcf5eadd4785273d67996f066a687cdec14ea11
MD5 921394c6b1892fc6277ae1484ea3acad
SHA1 e5604e91ffe179ebd84215b1c7872e8e2336dfe7
SHA512 1c4a1155548e9b7a0f82930f86b027138be6d633978a8bcfd322f74b33f78202e172eff8426c072bdd74b2441d0a73e643b984fe8a5cc5386ded0f780ffd1115
SSDEEP 12288:fmw5HEjsChNVBFgl0WDm+CCXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvi:ewu4OWpfhOB95Dr47iJ0nQZo2vI3
TLSH
T1AC85F14577E81CF9E6B782388A97C532E7B27C112A21CB1F1760C65B6F33261AD2D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 7649694adac8afeadfb90ca93c41dff305ac14fc09dead5ac03d6b2b72268cc1
MD5 db03d4444bfc8891dc75df8d319385d9
SHA1 1988ecef38951444a7ee8a98682e14ec564edfa1
SHA512 18df6ec855a6d9ad1796448105808bb87e96519ae944d695d1da25a0c28228c2cdbb311aa8cd2c39438300d74960b150d360153c581f9143d117c871406430b0
SSDEEP 12288:JeZ1IytXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:sZumfhOB95Dr47iJ0nQZo2vI3
TLSH
T17975128927D825F6E2B3827C9EE64A02C7763CA5637143CF5A10826D6F339D54E39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 6a6d2e47963d5caf2f2d9ce47d6b9586c5c9f1577730d612b068132d4c21c6bb
MD5 7ac49bda62676d726385a5754b561419
SHA1 9f7386b9b9ab7d7d4b64ad600d460bcf342d88cd
SHA512 e0dc0bd2e3868975339080830021ef3e3a163f4e7b33ac3814204dd7fa5a0c35ba4b8e503c537de96b62efcd6ee19c08943cd664a6028e123878d3251dba965c
SSDEEP 49152:qj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UB:pQRQyi36YOcPbLvw2gAf+PN3X8rSex
TLSH
T1BF667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 920630f5d15cbb52b1493c2edb5b630883aa28d293babe314de736ea7dffa559
MD5 37fe78350e208c3f13c5a786f2a7ef5c
SHA1 5f11b678abf8a9934da7d849476f7999a02b2b47
SHA512 9671f2a763300f13c9474337745e6753472b6bdb01ff2b469ef5d62d10357ac24bfdbb26d8f203af564aec9196d16075c31cf93e64d4320a789838ac85cf3b0f
SSDEEP 49152:zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UB:iQRQyi36YOcPbLvw2gAf+PN3X8rSex
TLSH
T1F9667C03F3A501E8E05ED974CF3956229B757C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 a71bb155ba67413207c18c0f1f475cf0845e5b387a80cc052418ade2c05c5e79
MD5 f1677b14f76242505dc33439e6c1ecc2
SHA1 e1e291c26bac1179fd1186f033e7f61200f416db
SHA512 a0660a8293a083fdf001183e73ff2450757c2e8a9c79f7c511351747195d627db0d8289a1a56207aed6bd8e6d1b139a71d4fc2ec760912f7a03e9fc889a4d78e
SSDEEP 24576:xwvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL0WfhOB95Dr47iJ03:d68Qg55nhceWu7PNU3/JhOlciSexvI
TLSH
T172B55A33B2F600A9C45DE1769F4A872196D17C758FE0E3DB8501721A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 1fcef328a47f9ca29553bfb5b8dec66842bcc42d1cc2b79f62b7df7ac632704a
MD5 e214a441f83383a69014966a44530906
SHA1 a91d44f68f84988f4939c376ee6165c3b7c1c7f9
SHA512 77c13953944b150bd8064caf2b56f3ed06c73af2500e54362809924a9f28f1a722aa809ecdc07d24c605dacc1dd84f01925a286a496a7932f74e1bcad8b592c7
SSDEEP 49152:43aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99L:1y5112gYy5azzVvt69nLKnhZm8rSex
TLSH
T1BA167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 04c5d5afd6015189b65e6180989b8d9452c41e30e74fee1b04e9d5c77557df54
MD5 cb06c1d4896deb978a9831525b2e9e93
SHA1 6ae282356a5a0c9cfd4582b91fd43e6fc7c7372a
SHA512 02460129135fce07dfcb86404a3c1be6d38835a5883eaa234be7c9f6ff2b19dd27470a6898b4610c64c398a808b3c52f207ae71a1a9a2d369c1a33152ec1f242
SSDEEP 49152:FB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glvhOlciSexvI:ru6Jmdxd2dv8rSex
TLSH
T1ECD5AD13F1DA01E8D06ED478974A9233E962BC490B34B6DF0A9073562E77EE4AB3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 0b0b8df6ac7ae294e1702c5e225bc42dac67bc775208f75af174c31ea8339cf6
MD5 e90733bc60ff8fa69c7a958faea6fc51
SHA1 857ea60ec202b006dc908fcfa45e3435d17dfcab
SHA512 03b82f2d10fd12735e359474802a2aa6723435f3d656e91cdf92a3f8afe9f35fd5118e9b176ec247eb9511c148dcc424bb7cab16e881fb81b9ccc0d78f6a674c
SSDEEP 49152:w1hpsNoJpF1A63U44CwH7R4xThOlciSexvI:wmifPWRM8rSex
TLSH
T159B5BE13F2D801E8D06ED17887569232EA62BC450B34B6DF0A90B7962F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 78e01e958f0f9008e82d1466a9e773540547a73630215b506f07dcbb1d7968c6
MD5 4a04cbc177fa9ab32b28e43bb54c2aa0
SHA1 b759c351fb7f8a87af9d000c03efed2694960376
SHA512 089619fd1e5db2a506526619e4c925bc2fdf94de347848d006d3fa35611646ae42b1632ca626af69471509781d1be1c19544c503cb1d3617bf04ff5d3c054f86
SSDEEP 49152:qSuZQIY0Be2KcRVtOnks6NMHqChOlciSexvI:05dKii61C8rSex
TLSH
T169C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 90ffb76a102e1ee953b78bf9025669d6cf04c2e3ee13e21db280015634f9886f
MD5 cec2fa3d82cdee661b2bfb8f5dd50dbe
SHA1 cee6ac6b9f6be4dbdf15884279cb75cf8e40cf08
SHA512 655661fd36b639b9b1f2c85d18a52d08fbb9a8ab3f7f2f7cec8758f21d10967ede7bb32f14baacc1bdafa06fe0f06817ce03b8f7c4875cd53f05c8a48e1229cd
SSDEEP 49152:rhtSn8EApI0fig3giDn0AP5w/hOlciSexvI:qX2imphQ8rSex
TLSH
T1CE95BE13F2D901E8D06ED178C7468632E962BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 1ba30fca005c8d0c86a272bab9fb649a4ed296c4ee5953c08d6f78cf240a789e
MD5 b5111fe9ba3efd54af819d9a280a5aa1
SHA1 bb020cc4671489803e484cb6716dbf2dc38b0ae1
SHA512 878a1897a7355a8dd02dc35200062d83db95a8d6cde5e39e09b4aee33cc89a2425368c98f6f3af04981db06848c76982afe331c67bd0ec133205b9e395ee2b82
SSDEEP 12288:B8XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:ByfhOB95Dr47iJ0nQZo2vI3
TLSH
T1EA7523886ECD5DA7F373C7F96F9B4B03C85D3D98A4C10A53AE00A12DF63585582AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 f3fbcbf24253db93bfd31482402a91dbfd57987ee0216d2d3044091569a82df3
MD5 d6d3ee85295be10030810bc9b1f379b2
SHA1 55201a88e7d9834940d1695105d39beaa09f6da6
SHA512 7a6c40b3463fcc95718a35f2feb092b7a5a4f331ddc02d8f8f10690c624dee1d521b779c0bc4830ba927a713139e0fc9bec6afd868d345400cce6bc5f52502af
SSDEEP 12288:1hXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:1BfhOB95Dr47iJ0nQZo2vI3
TLSH
T1C47523886ECD5DA7F373C7F96F9B4B02C85D3D98A4C10A53AE00E12DF53585582AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 a5e8c4ed7efeddc060251746bcb09398d0309aeaa5551e9c36e7e6ab2fd4ddd6
MD5 f83e3902e280b6f55805fecd39f8c096
SHA1 024f29e19d056010e492226edeb5729faed4e9b9
SHA512 e8a6558b45b32d6aaf279bfa6546b648a11a098b3eec3276800b904835bb9ecdf938ef7e29d35a715f8bd556ac4a260c9dc4278c98ee3484dda04fc2f0735dfd
SSDEEP 12288:7bXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:7jfhOB95Dr47iJ0nQZo2vI3
TLSH
T131752388AECD5DA7F373C7F96F9B4B02C85D3D98A4C10A53EE00A12DF53585582AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 f0a30cc4f653cb2461753c50844269b0bb3e3c2724162cafa7e1f436577af8ca
MD5 bcaedef02c501135635a62f8c64739cf
SHA1 acd4468ceeeff99d2d0c69c949f18c88182e9a50
SHA512 3b1a5149d2aaea3b3c1e2fffbb96f3963c1b55dddf5a39e85a32fef8fafbaa17deb0db851c9322d3b4f211c14b8b4a85bb1b785718e3e93e5e2d62652b2d0fbf
SSDEEP 12288:4V+XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:zfhOB95Dr47iJ0nQZo2vI3
TLSH
T1EB7523446FDC19D2F3B3C3F89FAB8702C4793CE4A6610B9B9E00516DAE316948679627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 b3980b03c7efd83e5186f114efc0cf925e9afe8dac374e9b6c64a37d5a3a3ff6
MD5 4761c6a3ea3aef3a207f405a4002551d
SHA1 08688776fe60a84b77ccc1016bd485aa9d36dda2
SHA512 0edb488e83bf65f188594d0dc8e8421d92695bf7bab19bae86295200b6ad1b6064a2aad9e84d79916c12ac8bc0c9a6734a8f84bc1a1bb52f70d758d99832b4c7
SSDEEP 12288:/mXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:/kfhOB95Dr47iJ0nQZo2vI3
TLSH
T132752388AECD5DA7F377C7F96F9B4B02C85D3DD8A4C10A53AD00A12CF53585582AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 092199cab702ebb8042af831e3392ac1614c017b7b3c612d381aa4bcf2d584ac
MD5 5a79e638ec8e21ebe7caefbfaa485521
SHA1 50863db6f7621d71a9c14e4de9b89c095cd16304
SHA512 8cdaf25f9e49fffe8eb2e8db088888c74ac6f49b793323a6cc42e8ff391b6495128d0c2f0f87751acc4d4c397214ac8b60e7c25e55528d9133be52a4f4feba3f
SSDEEP 12288:Z1XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:ZtfhOB95Dr47iJ0nQZo2vI3
TLSH
T16E7523886ECD5DA7F377C7F96F9B4B02C85D3D98A4C10A53AE00E12DF53585582AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 f9153f243448b25ea0484d7763f7715b79fa6ac768b63d53059f2c6a3d5eab51
MD5 ec1d092013deaab46937cf034a185817
SHA1 204090bff1427d21f82c5df9095c187ed6dda24e
SHA512 ed41be40deba7e329a2aad9b740cb30d9deeed8e1925242075cf4258178682ddde22ad3a9acb1e4505efce9b8d45ab596843c6728a4aebea1ff198ad18b097da
SSDEEP 12288:1pXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:1ZfhOB95Dr47iJ0nQZo2vI3
TLSH
T163752388AECD5DA7F373C7F96F9B8B02C85D3D98A4C10A53AE00E12DF635455826E067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 0c01816dd74606d0b6ec6216274aebddf3111a8eea3e50f19b2608e5ded72cc8
MD5 8103ab2d846c911905a6f3bf0145c299
SHA1 07386b56cf3eb223bcb6514e800b33267058cc2c
SHA512 0e8f7f82f362b272b31979b64c0e3238ccbd7a61e03f8ae261b4f16d7ad494fa26307bdf2f5c48fd1d00cbe7460aa184e8a9e31e206c8ac8ccaa7b814bdd77da
SSDEEP 12288:miZwbVzzFEoS2cPvyBXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:pZMRzFVSOhfhOB95Dr47iJ0nQZo2vI3
TLSH
T18D850294B3941CF5ED73827ECD568906D6B23C5907A0CA1F17A4322A5F333A14D3EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 12bcc4c46dd384718530da3423bce5b8c3eb6602cc2315140ead665df0b32335
MD5 0dad7b4b30d7b5bac91d18af269e5cbb
SHA1 ab52b6a9ba9c7fcd2d6c34abde821bc5b8b82e0b
SHA512 9b985e8d932601c9b208a386b49f562ae8a58e4c447b491aabda68e9eeb727445834e6028cc762529012d9c281ccab2fe3d7d0877615ef921232de318085d0cf
SSDEEP 12288:eYXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:e2fhOB95Dr47iJ0nQZo2vI3
TLSH
T19A752388AECD5DA7F373C7F96F9B4B02C85D3D99A4C10A53AD00A12DF53585582AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 bd58f7e6ed34b89d698f7006be7c2b98283ef7974a83380a4241afa13b5701d0
MD5 5b9831ae1466c4d531a508307b649400
SHA1 7a1a59fa900357cdc2f33bfe7197e77832158722
SHA512 69219c825726ca598a9e2ea14a453b52553d484f9ea8ce822910874a850982c670cb1f7f9c6231b71abccd5b40234ba7297dd821f4bc0f6b1583d20ebb930704
SSDEEP 12288:p0XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:pafhOB95Dr47iJ0nQZo2vI3
TLSH
T1B57523886ECD5DA7F373C7F96F9B4B02C85D3E98A4C10A53AE00E12DF63545582AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 9c61ad7779792f2fa4d74dce2d35913cd3e9ede4620b62a687deeece97746867
MD5 515b93c5bfb6e407057a0300e91697b2
SHA1 786078af3de0c2929eeb204507637d59733b5b1b
SHA512 7e39ea70968863be894b632e8dc75f9e23482125b3a07f2336f6d69378aa4eee4d5e656bd8ec221e7fcb08bd92fd7787f59a8f16079f4bf3aa9a613a17f7e5bf
SSDEEP 12288:AyPz5L8tXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:xzy1fhOB95Dr47iJ0nQZo2vI3
TLSH
T16085024777A530F9E277C2788DA30A02E7763C7547608AAF5750437A6E336909E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 68fa4b8940083822bef7d1e08d853089a60201b3a93565ce13457654e3fb2b2b
MD5 d089e23fb5ddf8a05bd5c1d364bb9f88
SHA1 7b45834bca19f74d637a80aafb80380052570793
SHA512 88f84ebe687e25c8b66146e3a859541c35d5cfc36b7279a6f89930a9e198fbc6740cae0553ad793ec2aa00e2ee1345097ede006d69d71382db4d6d145518f6d2
SSDEEP 12288:eYXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:e2fhOB95Dr47iJ0nQZo2vI3
TLSH
T1A6752388AECD5DA7F373C7F96F9B4B02C85D3D99A4C10A53ED00A12CF53585982AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 ce39d945937cc32b600ef3012e5be513949167f52736947c8baf93b6aa1c14d6
MD5 ae5842d3f4208b58d4c144a7dec828df
SHA1 25dc0a586b20e36b4e65bd96492bf9a360ab6004
SHA512 b2004b8bff62ac02be6456b537dcc792a90bc1a968ea80d650baa804cb3c531e179cd13d51c996439ae64a23f2503e9ee9718a1c0ef8ccd2337aeb69e6c2f83f
SSDEEP 12288:sYXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:s2fhOB95Dr47iJ0nQZo2vI3
TLSH
T19A752388AECD5DA7F373C7F96F9B4B02C85D3D99A4C10A53ED00A12CF53585982AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 5691d348612428bf0b00b35ba71bb09d6369bf9bf8001050653c10d0765a24c4
MD5 2421268760aaa04c282b3765b89a5ea2
SHA1 bb43a7cb0d951e44775904a2e5288335bcc0eeec
SHA512 770094ba84e734b97e24eb0efa53cfbe04ef822e196c0a8b8b44b5d244670448e421a2842fb05b265b4c229a8253601245f5063c254446158fd82621cd942b0e
SSDEEP 12288:5yPz5L8tXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:4zy1fhOB95Dr47iJ0nQZo2vI3
TLSH
T1E585024777A530F9E277C2788DA30A02E7763C7547608AAF5750437A6E336909E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 d45ea22bc2775bdd62c9897e8f791584aea6897bee094f13aa73d496b985d220
MD5 cc86507440576ca883bc286e8da626e4
SHA1 ab2c51eaa0ba30b8a762a994df92f38c0950819b
SHA512 7e99b1e643d745e289ef99ad31ba14cec4de7765bbd7a308b0df8c2894fb64b350946dc965e16b1219bf9472f5f62d52fd9651e026d72a821860197c73468e68
SSDEEP 24576:ETDaLl3z0zDTfhOB95Dr47iJ0nQZo2vI3:ETuLlj4hOlciSexvI
TLSH
T12D850294B3901CF9ED77827ECD568906C5B23C590760CA1F07A4366A5F333A14D3EB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 e1097ea7a7b0664960fc5a58dd91a43dfeef672d688af9e70a020874b4f2ebb2
MD5 6da5b58077aa5e9cb9e0106394a36c20
SHA1 d0119cf578e1f5584193fd32a1e4603c3ab0f247
SHA512 444d098a855f11fa61e4b234287b97d8e4d60856bdc0c3d6962a9176248c9d5d939678d9753b2159bdeb86364b1fe8b29eeec6c5b4307cb3538457a5e3996ef4
SSDEEP 24576:M3vd9CHKy7GZPfhOB95Dr47iJ0nQZo2vI3:2vd9CHKyaBhOlciSexvI
TLSH
T13295CF90F3E814E9F1B7CA358D764502CA767C995B61CE8F03A4661A1F33AD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 825afabc0e1ef511657c20aaa03d1a0b56db8b3fa50e8094b042d6ee31369c57
MD5 63997ae902e9e89f215abe009bf5a4a7
SHA1 9d079552cd342d19347630b23b8112ff938ed7a4
SHA512 316b8daa2079a967f843166484fc95f6aa005cf835a1ed52f18ba6448985f879dad1f6aa90b4d728e5e4cc6642efe8e9fea0a7f13ed519ad7e6f2edf737bf45b
SSDEEP 12288:r7XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:rDfhOB95Dr47iJ0nQZo2vI3
TLSH
T116752388AECD5DA7F377C7F96F9B4B02C85D3DD8A4C10A53AE00A12CF53585582AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 62e81aea384b1efd46d140d7bff9ed09dc5724bac2097cab3141f64cdf66c629
MD5 d9daa97a0d56d1d76a09221a42fe4977
SHA1 41a06cb2842786fd6545267396ed4f5d30fa0a51
SHA512 d5b7d70b9f723d1b2d463e7fd3e79ed90c3f871e9b2f6cbdd2c1eeaed8e1aaf0956b23de8c146e03a86442421b5a1d51be5e688e39c4e51d5da7f94a6287c105
SSDEEP 12288:INXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:IVfhOB95Dr47iJ0nQZo2vI3
TLSH
T1637523886EDC5DA7F377C7F96F9B8B02C85D3D98A4C10A53AE00A12DF635855826E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 e42a6b770b174401772ef6149c9b48ac88c8dd87aefdbb34239549a41d580cb0
MD5 1bd281e9d0bad7d4a001ae8307042d80
SHA1 05a15f9c390fac82db23b5acf0313fe8e6771b4c
SHA512 e9e3ed3624757a190e4d27a96cb9deb4fc7b4ba3ffc4b8dfc527c6b761071165ca8d56ac44690a766516e3ea4c13a79a6791a4651bc0c38e0ee48da84b7b2794
SSDEEP 12288:DKXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:DQfhOB95Dr47iJ0nQZo2vI3
TLSH
T1157523886EDD5DA7F373C7F96F9B4B02C85D3D99A4C10A53ED00A12CF93585982AE027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 42ef9e5090f1e62cf2671ffcee20641d4214d941fb8b898d6ed04f247c12604e
MD5 1f0bd9ca9f3a45062264006ad9957935
SHA1 f097fccd061a967c4f3b6d6307ac99c21ae8bed8
SHA512 74f707ad12e140a2ca23aeb6534dfa04deb4d618bd65f661838e70a765b0a0adfbba4c009b02b2f26ad36248836d19801683b58763ea4a546ea749c2dcd33f31
SSDEEP 12288:AYXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:A2fhOB95Dr47iJ0nQZo2vI3
TLSH
T1CE752388AECD5DA7F373C7F96F9B4B02C85D3D99A4C10A53ED00A12CF935859826E067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 1edac70e40540ca41e0f95eaee86f85ed178087cfa464abe7d371c3ea8f954ac
MD5 983c563449073c81f94562b2dd72bbb3
SHA1 26c3f34222419197893df2107b46a4d35cff119e
SHA512 67676a089b9788d6109bca969d0ead2a9cfb7259a7d876e6ad3c589debce8d36f3c9269b0f3fe5002426f8c63a29b228006a55f993b173983f14926842982422
SSDEEP 12288:S7XIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:SDfhOB95Dr47iJ0nQZo2vI3
TLSH
T150752388AECD5DA7F373C7F96F9B4B02C85D3DD9A4C10A53AE00A12CF53585582AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 69a4dd67da34f49d7f395f5e095be00c7fad1c580571b20eb16135bb7ac578ad
MD5 1e2572c45bec92b562871983a1d6c313
SHA1 7b249214a832af5aacb2db52a5ec5d6da4e14480
SHA512 26fa112e5158aaf0ee8c449b8a82f1cdd35e592e5c5b03196741d4341f37f34b94b308fb300457fec7e2b9e55b06429d4b7153dde3a7304661880baff0c54215
SSDEEP 12288:LgXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:LufhOB95Dr47iJ0nQZo2vI3
TLSH
T17B7523886EDD5DA7F373C7F96F9B4B02C85D3D98A4C20653AE00A22DF635459826E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 badd408744b177b509002fdb2c52421832525c267d2c22c4b65606be47194696
MD5 4f53c0b5d78ae6e3e4a7e75b3a544baa
SHA1 b1f54eee0d7411643caf0e69f39039a569861731
SHA512 05868d5c273e677d3f5b1413a80acff32a84b91ef6dfa524bb3d4da7ff446d281042dbc78c557aaaa25152b1a1f75dd1100bb9107fce52b5f544f10ac683abc6
SSDEEP 12288:VmXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:VkfhOB95Dr47iJ0nQZo2vI3
TLSH
T152752388AECD5DA7F373C7F96F9B4B02C85D3DD9A4C10A53AD00A12CF93585582AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 1.5MB
SHA256 e8b7e205956915c6686aad8862782a14b49cbfb39509ef2ea26683972dd14bee
MD5 003c229efd9ff753cfe49a4fac11cd36
SHA1 34b6b6807a25dfd5c26cd5df6604a39c98996614
SHA512 9a28fd09873aebf38a19cc8c7118445e644ab1a389c11f84e137bfa200034657acb4fff956c07d8124322236ab931757a1a5469ede3e14be18f7514754a98c3d
SSDEEP 12288:tzXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:trfhOB95Dr47iJ0nQZo2vI3
TLSH
T1817523886ECD5DA7F377C7F96F9B4B02C85D3D98A4C20A53AE00A22DF635455826E027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 1.5MB
SHA256 acf032b21991c39d95b06693b78c57c70bbd9945e964f224ca1ee816c3813ae8
MD5 e767272b5a6e1395e399f58f79aa5f05
SHA1 2276344f90b34640e07397a90c2124851ade8724
SHA512 5d717b0893843850d44ca667bf52c50775769c0abca568142141f02a5abd367d612ad9a48e433b6bb007cba4b60e80287995b7429eb60c273b2f513faf793a74
SSDEEP 12288:GmXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:GkfhOB95Dr47iJ0nQZo2vI3
TLSH
T151752388AECD5DA7F373C7F96F9B4B02C85D3DD9A4C10A53AE00A12CF93545582AE067
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 6004514430ce44f74414c88cc31668a19b41109c3ccc45769e26e880a4ad09a8
MD5 f89fd393939ea3926b6b1aa1f648357a
SHA1 75a881c45b53e8076c6352d26b4ea5a526154f72
SHA512 619eb97628e3c8995388ae8aeff4da433ce8c32169771e50e2fbf965b03b98c006cd173fd9b07c53000e9354622da564bfec8ea602851ea6522efca8c5511918
SSDEEP 24576:KfwvUk9RX6wkyAIqfhOB95Dr47iJ0nQZo2vI3:aMnYIGhOlciSexvI
TLSH
T1CD95CF29EBDC08E5E1B7923C9DA7460AF6B178681B31C6CF0259536D0E33ED45E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 4ca92ab9c24627f36e1e50e6a70b627dbc8eeaf93e060894dfe792c53710b655
MD5 31ce40a1e08e617cede827edd09dfd38
SHA1 b45ed5eb858c8888a5d0b1ab9c0d9f63287bcca8
SHA512 d005ee0723377c1a2152fad57b1126edabb0535b2766b91e5e77ed4e33527aeb6c931523979f20ae30cee24aec46129214bdb982b0799d7031d1b7938b7714e3
SSDEEP 49152:bYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0fhOlciSexvI:+ySzP38rSex
TLSH
T11E067C96A1A801D5C1B9C1B98F1BCC1BFA7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 3f4d5181821a444f20bba56bad278a931dc98c99e85f206b841c5e62820e208b
MD5 1594e9d3c3ae4bfd73389e97c51c3db7
SHA1 31902038b18574bfc60ca76b4cd2c70dd3ea3dcf
SHA512 52f59f51643aec6e935252f35375d16ddf3824cc560026846ca8f5daace7ef2e9803f1985371b4dd48f4fe3278029eb35e393741fc91ffc46dbb871b45318f8e
SSDEEP 24576:U47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYxfhOB95Dr47iJ0nQZo2vI3:U47JUQjTirIhCnDHUPfF/vhOlciSexvI
TLSH
T1AF65AE1DA3EC01E5E1BAD27889154A5AEA71782D1B31CACF1270837D6F23ED49F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 ba47906f57303b554c19dea51eb8bfc72b2fcf8f428dd3fc9cdb40676bd182c5
MD5 6bcbe84c4b8f1e5892f716557e493400
SHA1 9772340b57be11ab1aae0900e66ac25f8e35fc68
SHA512 57bcab2b0327cada4cdad96ce89083d51956bc714697bc777b7fed7f57b3cb2b1ef362e8b41b20b49933604fab45e381cb84871ed93c5d1f02652303c51a0cd4
SSDEEP 12288:ibsfIXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:ZmfhOB95Dr47iJ0nQZo2vI3
TLSH
T12C750149D29802E9D1AE92B9CB564A01F3373C6493E1D3CB57C0F53E1F366909EEA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.0MB
SHA256 7d6ed2f838d6caff8e7cc35aee6f5de0b33fb642b0b1dc36d846fb6d375fc3db
MD5 f516e3f8ae6684e98410d4f08c8ceb4a
SHA1 9cc48cf3994293bd5844caed3cc9204a15f989df
SHA512 a35d9c29b3d0132bbe5422b8262553becbc84b2d74041ac24ca1a49b09a537c9e411c2e153d519654343849abd8158b3858f9f8fdb94246964de83e0ba99031f
SSDEEP 12288:mVCVU3fwldSlji1cJYrDUjRdJa59SyELoqJX:mViUPLlGcJYUjRdk9SZMI
TLSH
T1043528117666DB4FC6A940325E33D1CCAB707D01EE44AB0373C99B3FD476659BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 d6a673816553979c3cb97356b043ca1505c9dcef0adf576ccfaa05c40af86e13
MD5 c487f1deb205f86c301c42bacdfed7fe
SHA1 2a1a0a1fc51b9592358ddc5f11cdec70f8d56a98
SHA512 8eb604f7b6ae8c85bf88280b2dc0097033bbef6af44a8ff14e06e3e1fb12db5c2a6d6af998d62810bf85df23840989514103e599fc94918135eb06daf0edab8a
SSDEEP 12288:XAhjlhiL/f96TYTwnQTcFToYTDnQZLLXv5k1qWbc:XAhjlgjF6TYTwnQTcFToYTDnQV75rWbc
TLSH
T1B165F9406537E78FD1FB603207269B8D6774EC17B7096F26B3C5193AD82AB11A1B93C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 d4c61a22ffac9e87291f885d8baf03734da0f9dcb73186f496a10aa5e0b5fcea
MD5 f986426a2742d6de5f2a0067f260bc90
SHA1 ed004fdfbb1339245122f02b412ac1d7bb15b5d4
SHA512 ae0ca0b7df28148cb235f52762d60e319131523fa9e0c4484ccaab2c6dd07c9bdb12eb2b52cbfb2bebf0e061d79c4770defa7ed728b25f4e2c134ff85386ab2c
SSDEEP 12288:5F7QXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:HefhOB95Dr47iJ0nQZo2vI3
TLSH
T11A752344ABCC5D96F3B6C7F46E9F8702C41E3DA89B8045D3ED00A26DF5318D58ABA11B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 40a25a934364fa3a1b9003d245ecd6dde417b6e6bbef0ef5dee6c3aea7791a63
MD5 9dd1259c3a5f2788b436c672100208f2
SHA1 d02ea786cf065e2ebbe90caeed38ca69a5d868f4
SHA512 c938cf4659e36506abc5634a3a7461b1d773658a82e1c1b119821aee7a0d91a665e6fc64afded05fe12c9b59a9ce19e739ca9b03c97c3f48661e7f068636994f
SSDEEP 24576:Fgb6bmBIi49WNNFpg1rSvFv7bYYfhOB95Dr47iJ0nQZo2vI3U:Fgb4mBIBhGFlhOlciSexvI
TLSH
T10A65AE1E22EC02F5E1FAD2B89DAA4417D6B278160731D2DF1151423D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 60693b05baa0d731815f98dc8e94a2eb69d55efae4a4ad89881387a427f5b253
MD5 54483ed5b21efeb38ecd0bf2128b9dd7
SHA1 9caca83ebed60f1927c6cdd620531da66bdfa65b
SHA512 d46a4c46758e7d9712beba13ce599ba3da8bacf156d619e8b7eff802c78bfb9526d6bb9bf693651b227da715f73a0b6099136ee0a9924e99e632a54b56ac9a21
SSDEEP 24576:aG88u8FpJqH1bzria7/mhfhOB95Dr47iJ0nQZo2vI3:h7ZFPqVea7/AhOlciSexvI
TLSH
T139A5F16577E401F1D077D1388A864663F6B2B8250360EFDF0BA88B551F23AE54B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 f54b268ab91a10ee869b7c5eaef76482fe6f88402f6d0bb893efba687cb2a3e0
MD5 f5fbd1c042cd54bebd79fa9b494933f4
SHA1 6afc29f24e3cb8cd7435884ab4ac28999a90ad85
SHA512 203760fc8d9603ba923efd44db06baa8afc85757cf97d734380bbfea15f2d85146603ec9d94e371f8517a6684af4a8aa686d8efaaf3d331be147836a3771d923
SSDEEP 12288:YHvUrBFrEjwaQFXIchOB5xdYch2eZWRQrqgO7iDTTNEln67D9o7CNvIR97:YPUr+NQ9fhOB95Dr47iJ0nQZo2vI3
TLSH
T12385E11E26EC1CE5F676E17D8A868709E7717862131292CF0290817E5F37DE8AD3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 bd0c96cf6e8576e21557ae5354cfbda6121682988b8c15757176775346561d54
MD5 ab6fe18a6ce3d66867167798c505e7dd
SHA1 a0359c2d4fa1e45d5b317cd36d066c28f2ae7409
SHA512 9f7a37f9bd4d37ec7a67c2f5ec3621d8e095c8bed0cdbe5a0873bb020e8aae0a9d5b3bd361f800e1a1da969f246b0978f8b7b9ddf9307c828f3713557e32b879
SSDEEP 49152:aBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjxhOlciSexvI:FG05lO43bu8rSex
TLSH
T18BD5C06E62EC11F9D1BBC17CDAC6460BEBB23815033556CB02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 62058d336f675dd96db5c251ee13756a2b831d5edb26bd8afa2e7d10422b8bd4
MD5 ed42fdf809d8728e96a5dbc1b88a979c
SHA1 cb09b6323d9da02feec4a9b00cde91cef7c7fffe
SHA512 b8263094c8a12bc85f3d4c23b6432c6145185e05f8af44f0ae71539baacfc2ce7fbe56aaf16ba742a7756e1e1c12bbe7b0a235894f1c4032b75680c5ea274c14
SSDEEP 24576:wfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnnfhOB95Dr47iJ0nQZo2vI3:Ia5POZ3BJt2pasx2+mJhOlciSexvI
TLSH
T1F565BF5DA7FC01D5E1B9D17DC583861AE5B1342553329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 6020f47c5314cc34b942150a636ccdf04595d3789e2bd504b35154ed1050b09d
MD5 30626aaf1dbb9a8fd437b67489910c67
SHA1 9576064a650ca22e82104f29ca8a718b828bd213
SHA512 87ab6227db970804fafbb74c85ffc3d77b4f413f7ceeff0953562d618b6a51333a7a995edccf0b018f303205b7e25b6c5940a986bf8cd1830a21e7529eda46a0
SSDEEP 24576:VNcwHdjbyQ4nLC18lb/EOjowL7FkJfhOB95Dr47iJ0nQZo2vI3:VNc/zEOVHFghOlciSexvI
TLSH
T1BE857B5623E901E4F1BBE1BE89679646FA71786553308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 f3a42326425142e4253ad17eebef6dfc78b120c5638bec732cf7b69da84ef6a6
MD5 ea9cf5d31fbe234ccdb84ac4a9ed6aaf
SHA1 f7958521f03c160a9fd7a26988042fd404dd5efb
SHA512 9c3ec92579d3c029e87322d8468e682adfae960874a21f017a816bdeed83f162c0ccbb1bee7ad58f326feb199bfd1b43a50e5208334d8d223a013b612e822bfe
SSDEEP 24576:wTkNvNnaFeYhJNtmZBmrfhOB95Dr47iJ0nQZo2vI3:wTMwBtOmDhOlciSexvI
TLSH
T14D55AF6EBAF806E4D1FEC6B4CD238512E6727861073253CB5290C13E5E279D89D7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 d16999f0c90f0613267eab6f300cc193e56c07f42fc47ea0f59072ab3c075935
MD5 05cf0d87bd5caef2936f47bf721489fb
SHA1 83a2305cabb691cad05425f666a5531127da271f
SHA512 7426e0d690cdb7c6a79929d2ab527f65405c6d01fc4e74e24c765b00eccc25899b234d5ca4903a6d41f9f402242a18ff0bbcc6ca90f5c7fd3b324c7ff602c06d
SSDEEP 24576:OD3FHshBIYQgASfhOB95Dr47iJ0nQZo2vI3:ODVHeBIAA+hOlciSexvI
TLSH
T13095E17DEB9C04E4E57BC2BCDA538A06E67138A9032156CB0690C1B95F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1088-39-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1088-38-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/1088-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1088-51-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1088-53-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/1548-349-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1548-381-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1548-380-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1548-94-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1548-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/1548-88-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/1580-267-0x0000000140000000-0x00000001402AA000-memory.dmp

Download

memory/1580-66-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1580-72-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/1580-64-0x0000000140000000-0x00000001402AA000-memory.dmp

Download

memory/1884-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1884-99-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/1884-21-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1884-20-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/1884-13-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3020-82-0x0000000000900000-0x0000000000967000-memory.dmp

Download

memory/3020-334-0x0000000000400000-0x0000000000676000-memory.dmp

Download

memory/3020-76-0x0000000000400000-0x0000000000676000-memory.dmp

Download

memory/3020-77-0x0000000000900000-0x0000000000967000-memory.dmp

Download

memory/3344-6-0x0000000002620000-0x0000000002687000-memory.dmp

Download

memory/3344-86-0x0000000000400000-0x0000000000659000-memory.dmp

Download

memory/3344-1-0x0000000002620000-0x0000000002687000-memory.dmp

Download

memory/3344-7-0x0000000002620000-0x0000000002687000-memory.dmp

Download

memory/3344-258-0x0000000000400000-0x0000000000659000-memory.dmp

Download

memory/3344-0-0x0000000000400000-0x0000000000659000-memory.dmp

Download

memory/3396-120-0x0000000000CF0000-0x0000000000D50000-memory.dmp

Download

memory/3396-367-0x0000000140000000-0x000000014031D000-memory.dmp

Download

memory/3396-113-0x0000000140000000-0x000000014031D000-memory.dmp

Download

memory/4364-60-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4364-50-0x0000000140000000-0x00000001402AE000-memory.dmp

Download

memory/4364-226-0x0000000140000000-0x00000001402AE000-memory.dmp

Download

memory/4364-54-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4912-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4912-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4912-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4912-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4912-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4948-149-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4948-143-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4948-368-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4948-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5200-366-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5200-101-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5200-363-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5200-364-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5200-100-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5200-107-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/5332-137-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5332-139-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/5332-126-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5332-132-0x0000000000CC0000-0x0000000000D20000-memory.dmp

Download

memory/5332-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download