59c8fc8fe3fb09c043e4b71cd1b15b70efd0532fa40e78275eea3e1739955099

Analysis

max time kernel
149s
max time network
119s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 11:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
Size 3.1MB
Sample260420-nvanfads7t
SHA256 59c8fc8fe3fb09c043e4b71cd1b15b70efd0532fa40e78275eea3e1739955099
MD5 4c5487a430bc7692fc618bd52b50513c
SHA1 dc9e1c0a38afbd38e4866d88b847e8595738a9dc
SHA512 f7a22ce04eba8d592cb75c1fc2dacbb71ad54b052bbbca49be75f467da6abd325217edb78e86816dba13f74cec40a98415df6e2573866b385db4f1df95659d4c
SSDEEP 49152:+vhH3gHamfrsDOAKt9xkECt90jY8PdXQRLf1OYfEP2c:YH3m6i9HLP9AD1OOE+c
TLSH
T166E5BE02B6CA50F2EF571630147B773BCB36BA454B349BC79354DE5C4A326C0A93A26E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4952	alg.exe
1160	DiagnosticsHub.StandardCollector.Service.exe
2972	fxssvc.exe
3348	elevation_service.exe
4844	elevation_service.exe
3084	maintenanceservice.exe
3320	msdtc.exe
1220	OSE.EXE
3280	PerceptionSimulationService.exe
4784	perfhost.exe
356	locator.exe
1016	SensorDataService.exe
1076	snmptrap.exe
3684	spectrum.exe
4472	ssh-agent.exe
1400	TieringEngineService.exe
4128	AgentService.exe
572	vds.exe
1908	vssvc.exe
2112	wbengine.exe
4876	WmiApSrv.exe
584	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\2b8e256d14bf40d2.bin	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_167687\java.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_167687\javaws.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_167687\javaw.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000095fe5be3bad0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADT	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000659710e2bad0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002aad8be3bad0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d15adae3bad0dc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000b0a64e2bad0dc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a62725e3bad0dc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
Token: SeTcbPrivilege	4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
Token: SeAuditPrivilege	2972	fxssvc.exe
Token: SeRestorePrivilege	1400	TieringEngineService.exe
Token: SeManageVolumePrivilege	1400	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4128	AgentService.exe
Token: SeBackupPrivilege	1908	vssvc.exe
Token: SeRestorePrivilege	1908	vssvc.exe
Token: SeAuditPrivilege	1908	vssvc.exe
Token: SeBackupPrivilege	2112	wbengine.exe
Token: SeRestorePrivilege	2112	wbengine.exe
Token: SeSecurityPrivilege	2112	wbengine.exe
Token: 33	584	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	584	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	584	SearchIndexer.exe
Token: SeDebugPrivilege	4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
Token: SeDebugPrivilege	4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
Token: SeDebugPrivilege	4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
Token: SeDebugPrivilege	4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
Token: SeDebugPrivilege	4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
4608	2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 584 wrote to memory of 2648	584	SearchIndexer.exe	105
PID 584 wrote to memory of 3256	584	SearchIndexer.exe	106
PID 584 wrote to memory of 4504	584	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-20_4c5487a430bc7692fc618bd52b50513c_coinminer_elex_emotet_icedid.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4608

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4952

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1160

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4984

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2972

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3348

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4844

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3084

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3320

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1220

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3280

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4784

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:356

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1016

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1076

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:2344

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4472

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1400

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4128

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:572

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1908

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2112

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4876

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:584
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2648
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 948 2056 2824 932 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3256
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 948 2828 2840 932 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 5696176e5b548e733a387c38a818b82f1d78b14f60b97599cb565c9945ae1e8f
MD5 a1ff6d000dd30e38ffdb7c6ca3cd7346
SHA1 ccce0c03de0d05ee6bcee615c2a1e631ddd7b412
SHA512 e107d441ef05a76d62733d082875ccd2d81b123ae5c7f40427de6f796cf82993d2ee2a75490adeb204f8668801a1fec4caed75fd6fba42c93a032f69b6ea9122
SSDEEP 49152:ib+632BuPkFKRrdE6oh7stBhuXjfS4LWxn0PdXQRLf1OYfEP2c:E3q6gjB9P9AD1OOE+c
TLSH
T13BD58D03F29900E9E06AD178D7469132EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 0d67adcc4d17b0d3360cc47f4eb9229683b1a5ef6e58fe32df7126da8cd73bcd
MD5 c2585e0461914374bd2a5ee6ce61a7c4
SHA1 6db98e76e882c9493b8f698676b1a78c7a8a2bca
SHA512 a884948b6aa58cea8063f04255be2d28afdb5c23bede4ab1e63a01bcc70b8e9d2126f468340788fa83c7b6f6bd37102af28be85d3fe3cb4258893071925568f7
SSDEEP 24576:ZXY4Z3czAUF1YG2FGJKRJBrb1OYsrmogibP2wB:H3cnPdXQRLf1OYfEP2c
TLSH
T194050229B3D108F9ECA7813DC9A28511D673B85543A0E79B03B4DA791F237C85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 1928adb6c6191bf604defd1dfd998b6e69b1104767e9ae54e4a517559bb6ec5e
MD5 c79066ab2773fef53c2275c445c63738
SHA1 ea81f24fcee5d186536e5f5b358f6995b0b03f3d
SHA512 2292cb190ee753363fdbab5b2b6d58d41ff2b0a5178e750af62689fe3270a6e6cbddcb60e027c29cb0f967160991fe61da643ac3f02574eb11cc419d7d0bbce8
SSDEEP 24576:UwusOWvF1YG2FGJKRJBrb1OYsrmogibP2w:UwfOuPdXQRLf1OYfEP2
TLSH
T16705F14673E51CF9E9A7813986978632E7F3B8122660DB1F0760C75F1F27251AE39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 fbe53a20c5cb03456db3753c7775b1f32d2290d26e4fd7dff9e73c294693eada
MD5 1cd49682674108da15e7fd3b1d039aab
SHA1 2f4609fa9499cf7abf6e82d24a9f21e3b92991b3
SHA512 ed6a5298d5143edfe3c735a58acbe2793eadbc1d614740a76b253ff9c76467c85b86599f35ac6bbc256dee795f1297325ff8a869dabe10bd14d4285b82a821f4
SSDEEP 49152:xB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl1PdXQRLf1OYfEP2c:nu6JmTxd2d1P9AD1OOE+c
TLSH
T1B4D59D13F1DA01E8D06ED478974A9233EA62BC490B34B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 dcd2a0fbc91fd0ff6a50855a4a6ff5fc99361055321ef54c5508d840dc2e30b4
MD5 05206e6fda2b33707e84cebe6c7cbcec
SHA1 6188e44f496234a2553529b2116d220c741a6146
SHA512 60727f05efbf3fb838da8c689d61b874123c8560789eda11b82ab985e09a405cd40dd6e6b98daab9cdf41f34e4a71f80984ba141a0a608b723c72352e75c114f
SSDEEP 12288:1tRuQZRjYG2BzKFBQYdDUXHGsVJQQrbbJOlizwr3Wo5aibfH2wB:1XF1YG2FGJKRJBrb1OYsrmogibP2wB
TLSH
T16AD42393E3DA68C9F4E9813612ED4720428FF57926B0A54B2B11EB6C045D9C6EF30F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 14357f4a115e5c52167b0b0c77c8a9a3384a03256bcf0a5eaa334c726fa16e33
MD5 2ee945a0b207a8532335a73b861fb1b4
SHA1 34073d07206a44d087edde3fe661362317421ed5
SHA512 0f692ae1feb4f7986c903b965453b4b653a6bc9380e4bc72bf2e22ae25e82872a635fbe35cce68f3a3a04cf741472d63995a41c4164aea1370b9b4f85066e0af
SSDEEP 49152:OgZwQCyiHiQEaTPnMYPdXQRLf1OYfEP2c:N9xOPjP9AD1OOE+c
TLSH
T1ED85B01E63DC46A5E0BAD278CDA74407E6B27816573197CF0290C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 700KB
SHA256 961aa9c77bb7090eb258394310ef84330577cb0abcfdbbc33fe2c833669100bc
MD5 60200ed0b12485bd996bb5a2eda126f6
SHA1 be56dba3cb2bccb6ce691fc4ddf0d624158124bb
SHA512 65f0d2ff95f102a8d93da8ff9e2c0ad4c68a1b0fd7b97100acbae6c2e9b9e512e7a2512a934cd93128fbc0275594f0b36f895d062c8c2a1a9ece29b129e87cad
SSDEEP 12288:tDxA1U7KWRuQZRjYG2BzKFBQYdDUXHGsVJQQrbbJOlizwr3Wo5aibfH2wB:tDxA1UGcF1YG2FGJKRJBrb1OYsrmogil
TLSH
T197E4126EA6ED24E4F1B5913A06D54205C372B82A2370A7DF1691C37E0F2BED59D30F82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 82c86699e113465240e344fe0a9f78f814695e9f6675bb1200bc5ab6af44fb05
MD5 327963d952f760ddef167add0897619e
SHA1 b505978299163dbbcd11e61633f9afe72b7466a0
SHA512 cdbda70198495f2e3b5011b3f131e694fd9d3b72bf8bbc62cce1764049853e33773935fa2541e4ecb3a2f9d0fab2636bc3918f7a596dfa7b9c1527d5a2a85ab4
SSDEEP 24576:WrsmP0yHaqrVqHra44KDzM+rn6F1YG2FGJKRJBrb1OYsrmogibP2wB:WrRP0yHfVqzlA+rn6PdXQRLf1OYfEP2c
TLSH
T1EC55AF2EF2B910F9D4AAD136454507B5AB71B42D1F209AC70170C638AF0AEE89F35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 620KB
SHA256 b77f045b83af381113b665254c20a01ff13877cc1288139dc1c621a5eb7fc301
MD5 992a1dbb47bd598d159025cc7fe5bbc6
SHA1 ac473e0af173c385fc98cca0dfea7456bb03ce0c
SHA512 81b17bc8259636fe2e0f5ac24829f4d3f9f7c6be512ece5ae9aa35011946704c0b935e90835c10dc89d86cc9a82ec03203141e95c3c88440d2d941b4bdaa0c38
SSDEEP 12288:zOIRuQZRjYG2BzKFBQYdDUXHGsVJQQrbbJOlizwr3Wo5aibfH2wB:zOWF1YG2FGJKRJBrb1OYsrmogibP2wB
TLSH
T115D423C6E2D764D9F5D8813613DC0B1542CBF52920F02A5B2B62EB6D058D98BEF30B97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 962KB
SHA256 a8c93aba2e993cf2a5bc8560f171781381d02a5ce016e1d3a45e070c5a228c78
MD5 6cf4d77d894386ce91e2284b678d3695
SHA1 a4d04ddf460842bd22bfab8e0757e7511694385d
SHA512 3e35f1c356e3f5eabba72a95f34476fe03770a733529b4653d1162add3124912b836ebf1ab082574f1271a82a01fe2f98f1cf1f41b12fd4d24b93c85d034966b
SSDEEP 24576:6HLBUTHF1YG2FGJKRJBrb1OYsrmogibP2wB:6HLBUDPdXQRLf1OYfEP2c
TLSH
T14C250155F79500F9E86BC13C89A68A16D2B2B45D0364E7DF03A88B691F137E24F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 824KB
SHA256 bb9403b96542236cb41db71dab59aaad319737f7ed11c45bd407e5ab0adca2d0
MD5 df92ccc92248c6944cce73168cbe61dd
SHA1 043c271be21dc38c859a93bd53a9b487e06ba3f4
SHA512 98cae11ae9609ca77c233a350374a47c4a8d54b3ae03c46e0935dd6a7ef70cae0b2580e9d023af347015d2806617bac2c19653c35e31386ab0fd5d706f290874
SSDEEP 24576:ITYNHDF1YG2FGJKRJBrb1OYsrmogibP2wB:ITYtDPdXQRLf1OYfEP2c
TLSH
T12905F11FA2AD18E4E57B917D8AC28609F273B866135192CF05B0C37E0E17ED9BD39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 f96346cdae2df4614da2d182921b7f5401a619e5d6869b86e5acc63902979f73
MD5 a8d60767c6bf05400f12402e90a8e650
SHA1 be5945fe25ab3bd2c9ef243a391522a1d16149c8
SHA512 b39bf3bb6f2c6ef82b667c75fda9a6a4ab9d8c00dfb7ce48e5eeb7e947fadb036b2a4632b289aacdfeb916ba9b924b38eaa6993741bbfe730eb88e1d28be0a69
SSDEEP 24576:7rXmzjNYH84VVSNAApoEO466aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKv:7rXmzJYH84VVS6AmEFJas+cHBjSSKHPf
TLSH
T11265BF9EA2BC04E8D5BBD17DC5C24506F5B278661331CACF026182BE3F17AE56E35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 5ece7c5a11bae49b165300993a65ed166455f0a62c65a947bee17340769a0a6f
MD5 099874e9409d9c5d813a15c5871efa16
SHA1 9b2ae247e13394fd65f13b23d28431692162a8ba
SHA512 41781dbec6c21820641e5a29b5a56c93814aa27f054cb44e5878187944a0b8bd0f1cb3b6e01de465759d638fe623f9e8afec81b4934d9b2572c1f18579c3a52b
SSDEEP 24576:Fv7Xbxd9Tuycf8M/TYlSux/r2PCKF1YG2FGJKRJBrb1OYsrmogibP2wB:FDLL9TuJ0M/TYn2PBPdXQRLf1OYfEP2c
TLSH
T1A4858D5EA2EC42D8E0BBD6BD85B79146FAB2B855173081CF0251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 3aed5d85016ccbe897a5d98c5073c51f96bdb7993bea9b1e022d666fb2de89d0
MD5 a90c0d884eb97d94c11fb0653d9191a0
SHA1 707248616a8488a25b86ad6c6ff913f31862554a
SHA512 8e94be3de62b4e0b09b0ffcca603eb3b3c9a11b42341f4b61d640057e048d2bb8f158352ccb78aa16a6efd4c0697abc83dda97413ed2a34e4f18fc9e2a37e3af
SSDEEP 24576:yegJgpwJOmPOHWAK28ZguIGyPsxr5Vin10wwF1YG2FGJKRJBrb1OYsrmogibP2wB:yngOJOmPOHFwPdXQRLf1OYfEP2c
TLSH
T11A55CF3FA7BC15D5E07EC13E8A968916F6B1782603355ACF0560827E1F1BEE46E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 928KB
SHA256 560eba6d40468fc3447a5d68f5da90b5c2389d36977ed8a1723f15b6b2d79040
MD5 611ecb61484040df8184fbac5151e952
SHA1 0b49bbcd9f17cb97cec4d2728573c805c5c4b552
SHA512 63138b0dec17034811243cd7c107b1d607abe0ca5359ffa10025a41f884f766f4d1ac1a9564fa0ec073826a13280023a4303eb89b1e5f6f1baae7c2398ff6eb2
SSDEEP 24576:DqJnJiTk3R3waE4JrOQuF1YG2FGJKRJBrb1OYsrmogibP2wB:DqJnJK8R304lcPdXQRLf1OYfEP2c
TLSH
T18915E12DD2A910E8E4B7C2B4825A1756FF72347C2B2169CB19B4D5353F02FD0AA39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 eff7e23613b6d5f4edb76809e4336ee16b142d5d9dc4099a7db91dc6cc76b11d
MD5 9dc8bac080bf9de21c6e9def145eee4f
SHA1 b7ef4b930afe49e94d22ee1cdc970999ee821639
SHA512 9ec2ac47a526395de36326f9e66c4d7bcda8132e97fe5e80da266e56f668b3cbc83a117eda2e6b43f36d0e51bc2647c4ffe28dc8d237a4fe7ac95d43153d3b7b
SSDEEP 49152:V9EqCzDScAZmlvTcFg8Ph6dPdXQRLf1OYfEP2c:bwP9AD1OOE+c
TLSH
T1BEA55C05F7EB5298E8B3C9F1C96694159B327C509B34F7EF0A80CA6A1E32BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 700KB
SHA256 4e686231f37d721394184b375a611050970f5ad1c35b7d2939906cafdf6db210
MD5 15fc922d7f875961a14cdbe491a6f16f
SHA1 9e1106cc282ea6055267c09bdb1365b22d5f6d0f
SHA512 ac7cec9255c24ee77fbbb414a7cbbba948c2829f36667b1b2a89c20717c7b0f7e88cd47027b8f1d9c44dd711ed060e7e01be569e12c1d24734c3e13dda61f619
SSDEEP 12288:6lYJeXmoWkMUuEJRuQZRjYG2BzKFBQYdDUXHGsVJQQrbbJOlizwr3Wo5aibfH2wB:6lYJeXmoSUuELF1YG2FGJKRJBrb1OYsB
TLSH
T168E4129EB69D30E8F16E803A56D54B04D3A2F075236127EF16E0C67D0E4AAD66F34F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 756KB
SHA256 c09e8efb1d451e91265d61f7f6a999157b69076a06f9bf97651c5891cebd6621
MD5 2f5843a105d24fb0c6f2adf69c6ee912
SHA1 4903a524c3f71c795c2bb1fb8c251fce2a5537a6
SHA512 5691f6c525e96e351d501b0e24528ebd14cf21594dded9c0f6e70efa67f3c4fbcf20c77977b9a8dd27bf427496730fadfebcfd74847f8d5d53d452ad3e3b38ef
SSDEEP 12288:kEC6kyKRuQZRjYG2BzKFBQYdDUXHGsVJQQrbbJOlizwr3Wo5aibfH2wB:kFty4F1YG2FGJKRJBrb1OYsrmogibP2c
TLSH
T146F41246A3D160D8F5F941395AE643108A6AFC301B6057DF16A0EB3E1E7ABC5AE30F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 628KB
SHA256 e8eda54f334aec6fe8d0b568a43e0dde4913939644f448ec61fc5d972d8dbb21
MD5 a05491fd23ed322ce28f3504af904373
SHA1 68a566583687f924ba3471d24d7fcfe3956347c0
SHA512 eb953f5e236f724d9e92eda901ad702a6b3bcac5bdefb024e8c28bcce363c82c46ab809ef4c82dffe5be2065a4984ace3fff01bdb6884bd8db9ef80bfb280d1b
SSDEEP 12288:IkxRuQZRjYG2BzKFBQYdDUXHGsVJQQrbbJOlizwr3Wo5aibfH2wB:HzF1YG2FGJKRJBrb1OYsrmogibP2wB
TLSH
T12BD4239AD69334DDF894807613ED1B1182CBF53920B0396F1BA1EB7D098D586AB30F97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 bb98847fc551a11226ed0d396561a3a372b07dff6e1cd42ee5002b501e9cf5ba
MD5 2f119bda60a86ebac072aa62f0f3802f
SHA1 3f78c88abda9adde2152dda8b2788bb95084becf
SHA512 975abb6c14588203de5ffdbaf67bab2a8bf76b031f9d22492062ba0554903ce78963cffba7d37419ad8e966dd2ed39c3f165469eb6135f6c2725fd0db17c7c51
SSDEEP 24576:oC+TyQIu93VAumZrHjmFUF1YG2FGJKRJBrb1OYsrmogibP2wB:o/TfIq+AFUPdXQRLf1OYfEP2c
TLSH
T1F2559D1DA7F91DCAE2B6C57588A34493E633B872137186CF2044C17D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 cc7798e13b98bfa36b048b65ab37ac05140c0f856c080dbd34460218618fc7d5
MD5 188741ac30f149258f0fce3593250fbf
SHA1 97e7ce9023d43157721a036e65697c473d25f77b
SHA512 073d55d0246d6bda4b01ec459028580272a3bf728cde3029d8c94066ccbb3aec5cb01357bd8cbeb94ebdbf4dc98a1827a401f6eb58d19fe55fdeda9e4998d03a
SSDEEP 24576:vJQikZRF1YG2FGJKRJBrb1OYsrmogibP2wB:RQikvPdXQRLf1OYfEP2c
TLSH
T1B105F10FB3AB10A5E0A7C13C89854212F6B3B475536167DF06A0C77D0B9B5EABE34B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 05f57e52b9c1ab118d3e1a2cb2d7eb8307feedd3fa16b7d08f9e71ef971f7204
MD5 69bf17c88536b44caf3854d66916a5d7
SHA1 54dcba39ab0d6231b937dc7313e0ecda6dabf0c3
SHA512 a0a9c12a5fdd7b2dc9f1789a26b327c6e32c45e82c76f6a8db4befb32daf57bf0d6ab9ffbda6fb58fc97062693c7075fd7a53340c65731287edc378e5def7761
SSDEEP 49152:cNGFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LhAPIPdXQRLf1+:upC7b4+80GTLRP9AD1OOE+c
TLSH
T157A57C3DE2F810ADD8AAC37585461665EE71382E3F2015DB01B0C578BF1AEF19A38F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/356-119-0x0000021861E80000-0x0000021861EE6000-memory.dmp

Download

memory/356-120-0x00007FF6C7A50000-0x00007FF6C7AFA000-memory.dmp

Download

memory/356-118-0x0000021861E80000-0x0000021861EE6000-memory.dmp

Download

memory/356-205-0x00007FF6C7A50000-0x00007FF6C7AFA000-memory.dmp

Download

memory/572-277-0x00007FF7F5E70000-0x00007FF7F612D000-memory.dmp

Download

memory/572-184-0x00007FF7F5E70000-0x00007FF7F612D000-memory.dmp

Download

memory/584-224-0x00000245F0F10000-0x00000245F0F20000-memory.dmp

Download

memory/584-257-0x00000245F9700000-0x00000245F9708000-memory.dmp

Download

memory/584-293-0x00000245FA800000-0x00000245FAFAE000-memory.dmp

Download

memory/584-282-0x00007FF6DCDC0000-0x00007FF6DD0FE000-memory.dmp

Download

memory/584-240-0x00000245F1140000-0x00000245F1150000-memory.dmp

Download

memory/584-217-0x00000245EFFD0000-0x00000245F0036000-memory.dmp

Download

memory/584-218-0x00000245EFFD0000-0x00000245F0036000-memory.dmp

Download

memory/584-223-0x00007FF6DCDC0000-0x00007FF6DD0FE000-memory.dmp

Download

memory/1016-269-0x000002AC97830000-0x000002AC97896000-memory.dmp

Download

memory/1016-126-0x000002AC97830000-0x000002AC97896000-memory.dmp

Download

memory/1016-127-0x000002AC97830000-0x000002AC97896000-memory.dmp

Download

memory/1016-214-0x00007FF6A8320000-0x00007FF6A874B000-memory.dmp

Download

memory/1016-128-0x00007FF6A8320000-0x00007FF6A874B000-memory.dmp

Download

memory/1016-271-0x00007FF6A8320000-0x00007FF6A874B000-memory.dmp

Download

memory/1076-219-0x00007FF6B3FB0000-0x00007FF6B4060000-memory.dmp

Download

memory/1076-136-0x000002B8212D0000-0x000002B821336000-memory.dmp

Download

memory/1076-135-0x000002B8212D0000-0x000002B821336000-memory.dmp

Download

memory/1076-137-0x00007FF6B3FB0000-0x00007FF6B4060000-memory.dmp

Download

memory/1160-117-0x00007FF713520000-0x00007FF713606000-memory.dmp

Download

memory/1160-29-0x00000280194A0000-0x0000028019506000-memory.dmp

Download

memory/1160-27-0x00000280194A0000-0x0000028019506000-memory.dmp

Download

memory/1160-26-0x00007FF713520000-0x00007FF713606000-memory.dmp

Download

memory/1220-88-0x000001E8A0910000-0x000001E8A09E7000-memory.dmp

Download

memory/1220-90-0x000001E8A0AC0000-0x000001E8A0B26000-memory.dmp

Download

memory/1220-89-0x000001E8A0AC0000-0x000001E8A0B26000-memory.dmp

Download

memory/1400-163-0x0000014E44B40000-0x0000014E44BA6000-memory.dmp

Download

memory/1400-165-0x0000014E44B40000-0x0000014E44BA6000-memory.dmp

Download

memory/1400-272-0x00007FF6AD4D0000-0x00007FF6AD661000-memory.dmp

Download

memory/1400-164-0x00007FF6AD4D0000-0x00007FF6AD661000-memory.dmp

Download

memory/1908-193-0x00007FF6B79B0000-0x00007FF6B7E7A000-memory.dmp

Download

memory/1908-278-0x00007FF6B79B0000-0x00007FF6B7E7A000-memory.dmp

Download

memory/1908-189-0x0000024C13B30000-0x0000024C13B96000-memory.dmp

Download

memory/1908-188-0x0000024C13B30000-0x0000024C13B96000-memory.dmp

Download

memory/2112-202-0x00007FF7086F0000-0x00007FF708C1A000-memory.dmp

Download

memory/2112-198-0x000001302CAD0000-0x000001302CB36000-memory.dmp

Download

memory/2112-279-0x00007FF7086F0000-0x00007FF708C1A000-memory.dmp

Download

memory/2112-197-0x000001302CAD0000-0x000001302CB36000-memory.dmp

Download

memory/2648-286-0x000001B90EFB0000-0x000001B90F75E000-memory.dmp

Download

memory/2972-37-0x0000028971330000-0x0000028971396000-memory.dmp

Download

memory/2972-35-0x00007FF7C8E10000-0x00007FF7C909A000-memory.dmp

Download

memory/2972-43-0x0000028970570000-0x0000028970D1E000-memory.dmp

Download

memory/2972-44-0x00007FF7C8E10000-0x00007FF7C909A000-memory.dmp

Download

memory/2972-41-0x0000028971330000-0x0000028971396000-memory.dmp

Download

memory/2972-36-0x0000028971330000-0x0000028971396000-memory.dmp

Download

memory/3084-70-0x00000137B9A80000-0x00000137B9AE6000-memory.dmp

Download

memory/3084-63-0x00007FF6762B0000-0x00007FF676418000-memory.dmp

Download

memory/3084-65-0x00000137B9A80000-0x00000137B9AE6000-memory.dmp

Download

memory/3084-64-0x00000137B9A80000-0x00000137B9AE6000-memory.dmp

Download

memory/3084-73-0x00007FF6762B0000-0x00007FF676418000-memory.dmp

Download

memory/3084-72-0x00000137B8D20000-0x00000137B94CE000-memory.dmp

Download

memory/3256-295-0x0000020B140D0000-0x0000020B140E0000-memory.dmp

Download

memory/3256-296-0x0000020B140D0000-0x0000020B140E0000-memory.dmp

Download

memory/3280-99-0x000001C2DDCC0000-0x000001C2DDD26000-memory.dmp

Download

memory/3280-97-0x00007FF7ADDA0000-0x00007FF7ADEE6000-memory.dmp

Download

memory/3280-187-0x00007FF7ADDA0000-0x00007FF7ADEE6000-memory.dmp

Download

memory/3280-98-0x000001C2DDCC0000-0x000001C2DDD26000-memory.dmp

Download

memory/3320-183-0x00007FF7FB9E0000-0x00007FF7FBAF6000-memory.dmp

Download

memory/3320-76-0x00007FF7FB9E0000-0x00007FF7FBAF6000-memory.dmp

Download

memory/3320-261-0x000001D789400000-0x000001D78940C000-memory.dmp

Download

memory/3320-77-0x000001D789940000-0x000001D7899A6000-memory.dmp

Download

memory/3320-78-0x000001D789940000-0x000001D7899A6000-memory.dmp

Download

memory/3348-47-0x000002A624CF0000-0x000002A624DC7000-memory.dmp

Download

memory/3348-213-0x000002A624800000-0x000002A62485D000-memory.dmp

Download

memory/3348-48-0x000002A624EF0000-0x000002A624F56000-memory.dmp

Download

memory/3348-49-0x000002A624EF0000-0x000002A624F56000-memory.dmp

Download

memory/3684-146-0x000002418D6D0000-0x000002418D736000-memory.dmp

Download

memory/3684-262-0x00007FF7BF500000-0x00007FF7BF7C3000-memory.dmp

Download

memory/3684-150-0x00007FF7BF500000-0x00007FF7BF7C3000-memory.dmp

Download

memory/3684-145-0x000002418D6D0000-0x000002418D736000-memory.dmp

Download

memory/4128-179-0x000001C8F8CD0000-0x000001C8F947E000-memory.dmp

Download

memory/4128-177-0x000001C8F9A00000-0x000001C8F9A66000-memory.dmp

Download

memory/4128-173-0x00007FF6C4C10000-0x00007FF6C4FFF000-memory.dmp

Download

memory/4128-172-0x000001C8F9A00000-0x000001C8F9A66000-memory.dmp

Download

memory/4128-180-0x00007FF6C4C10000-0x00007FF6C4FFF000-memory.dmp

Download

memory/4128-171-0x000001C8F9A00000-0x000001C8F9A66000-memory.dmp

Download

memory/4472-155-0x00007FF7156D0000-0x00007FF7158BF000-memory.dmp

Download

memory/4472-157-0x0000016472680000-0x00000164726E6000-memory.dmp

Download

memory/4472-274-0x00000164721F0000-0x00000164721FC000-memory.dmp

Download

memory/4472-156-0x0000016472680000-0x00000164726E6000-memory.dmp

Download

memory/4472-266-0x00007FF7156D0000-0x00007FF7158BF000-memory.dmp

Download

memory/4608-0-0x0000000002AC0000-0x0000000002BF2000-memory.dmp

Download

memory/4608-1-0x0000000002D70000-0x0000000002DD9000-memory.dmp

Download

memory/4608-144-0x00000000011D0000-0x000000000131D000-memory.dmp

Download

memory/4608-7-0x0000000002D70000-0x0000000002DD9000-memory.dmp

Download

memory/4784-105-0x00000000008C0000-0x0000000000929000-memory.dmp

Download

memory/4784-110-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4784-196-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4784-111-0x00000000008C0000-0x0000000000929000-memory.dmp

Download

memory/4844-56-0x0000016C245B0000-0x0000016C24616000-memory.dmp

Download

memory/4844-57-0x0000016C245B0000-0x0000016C24616000-memory.dmp

Download

memory/4844-55-0x0000016C24400000-0x0000016C244D7000-memory.dmp

Download

memory/4876-206-0x0000025634DF0000-0x0000025634E56000-memory.dmp

Download

memory/4876-207-0x0000025634DF0000-0x0000025634E56000-memory.dmp

Download

memory/4876-208-0x00007FF7D2F90000-0x00007FF7D30BE000-memory.dmp

Download

memory/4876-280-0x00007FF7D2F90000-0x00007FF7D30BE000-memory.dmp

Download

memory/4952-96-0x00007FF74F1B0000-0x00007FF74F296000-memory.dmp

Download

memory/4952-16-0x000001FA5C8D0000-0x000001FA5C936000-memory.dmp

Download

memory/4952-18-0x000001FA5C8D0000-0x000001FA5C936000-memory.dmp

Download

memory/4952-17-0x000001FA5C8D0000-0x000001FA5C936000-memory.dmp

Download

memory/4952-15-0x00007FF74F1B0000-0x00007FF74F296000-memory.dmp

Download