b96ef27b09a2f7098c6cc121a206a1c9a5a28d5c49a3ec687ce18a5885a0a58e

Analysis

max time kernel
150s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/05/2026, 14:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
Size 3.1MB
Sample260525-rwpersbs6l
SHA256 b96ef27b09a2f7098c6cc121a206a1c9a5a28d5c49a3ec687ce18a5885a0a58e
MD5 d65ef5dc7782bc0394634115ce4c4ebc
SHA1 b2fd0d299f5ce5b28ef251ab74aa081400ac9e01
SHA512 81ec1c071b5948cfb7ac3e110a56ed8576fe0bf76c22d000d0cfd8e03190160e5b9ceff8515b8dc40a50bdaa529ae13ae20024d2ca7226167f76ea72b1aef3da
SSDEEP 49152:+VzH3gHamfrsDOA2t9/jECt90jYaPdXQRLf1OYfEP2c:QH3m6m94lP9AD1OOE+c
TLSH
T11EE5BE02B6CA50F2EF571630147B773BCB36BA454B349BC79354DE5C4A326C0A93A26E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4052	alg.exe
1208	DiagnosticsHub.StandardCollector.Service.exe
4764	fxssvc.exe
3500	elevation_service.exe
4932	elevation_service.exe
1676	maintenanceservice.exe
2488	msdtc.exe
4864	OSE.EXE
2828	PerceptionSimulationService.exe
3736	perfhost.exe
1596	locator.exe
1592	SensorDataService.exe
3496	snmptrap.exe
4740	spectrum.exe
1892	ssh-agent.exe
1452	TieringEngineService.exe
1728	AgentService.exe
4616	vds.exe
876	vssvc.exe
3060	wbengine.exe
3628	WmiApSrv.exe
3248	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{17A6A947-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db	spectrum.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\53b65ce1e7fc2e30.bin	alg.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	spectrum.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_161703\javaws.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000221e067553ecdc01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007b7b657553ecdc01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000094f63f7f53ecdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008c16a17553ecdc01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
Token: SeTcbPrivilege	4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
Token: SeAuditPrivilege	4764	fxssvc.exe
Token: SeRestorePrivilege	1452	TieringEngineService.exe
Token: SeManageVolumePrivilege	1452	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	1728	AgentService.exe
Token: SeBackupPrivilege	876	vssvc.exe
Token: SeRestorePrivilege	876	vssvc.exe
Token: SeAuditPrivilege	876	vssvc.exe
Token: SeBackupPrivilege	3060	wbengine.exe
Token: SeRestorePrivilege	3060	wbengine.exe
Token: SeSecurityPrivilege	3060	wbengine.exe
Token: 33	3248	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3248	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3248	SearchIndexer.exe
Token: SeDebugPrivilege	4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
Token: SeDebugPrivilege	4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
Token: SeDebugPrivilege	4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
Token: SeDebugPrivilege	4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
Token: SeDebugPrivilege	4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
4340	2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 4528	3248	SearchIndexer.exe	105
PID 3248 wrote to memory of 440	3248	SearchIndexer.exe	106
PID 3248 wrote to memory of 4048	3248	SearchIndexer.exe	107

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-25_d65ef5dc7782bc0394634115ce4c4ebc_coinminer_elex_emotet_icedid.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4340

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4052

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:1208

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:4856

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4764

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4932

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1676

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2488

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4864

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2828

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3736

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:1596

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1592

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3496

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4740

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1228

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1892

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1452

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1728

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4616

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:876

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3060

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3628

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4528
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 952 2848 2556 932 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:440
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 952 2892 2888 932 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 0f75bd3fd0da00c380a0038e3aaffd11da5fe0858c3edc3a6270ad709e56504e
MD5 f459d9b60c38dd0ef6d1970494f351c1
SHA1 f6bb198dec55d36d03d34bdb3febc8acebd1bea0
SHA512 62ae6fc241d1721fce8a632675a5fc581cad5093f1e1359504be0fea764c1b1210c67e45e229dcba441519658636f9ee6ad001b012c037ba6265482108d64988
SSDEEP 49152:rb+632BuPkFKRrdE6oh7stBhuXjfS4LWxn8PdXQRLf1OYfEP2c:53q6gjBhP9AD1OOE+c
TLSH
T1DFD58D03F29900E9E06AD178D7469133EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 e5e0518ed352df7a23ca6d2fc7bc13a2153b6edf447422e7137229b1837fa6e9
MD5 8b2a11683fa58e099635a087263d2e15
SHA1 f73fa414760d2f474ab9b30ba4ccfa83b9bb40ca
SHA512 67fc226ec7d246c73fdf8a75152a986f89190ef6a9b9b6d5e62ccb9453ac3ab57dda55f711c783041c90fef3fee4ba76a148921a7e05d927ebf541246678ffb2
SSDEEP 24576:KXY5nOczAcF1YG2FGJKRJBrb1OYsrmogibP2wB:nOcnPdXQRLf1OYfEP2c
TLSH
T191050229B3D108F9ECA7813DC9A28511D673B85543B0E79B03A4DA791F237C85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 9b31b743f367c7e9beb850c272735089b86908dc6d44fa66b07093709639c06f
MD5 c54c49757236f7aa7b06e8d35366f3d3
SHA1 69f893ad56fa0656e87dba20c87a991a135ee02f
SHA512 6efd0e4ea1323dae2ea4e4eddcc349de6bc9df4fa2a7d031d6558cfc3e6ac6dd48e344b569055eb156b9abe6f1b694ec903d4243d64deb066328a28fe04f8bfb
SSDEEP 24576:UwusOWwF1YG2FGJKRJBrb1OYsrmogibP2w:UwfO5PdXQRLf1OYfEP2
TLSH
T19D05F14673E51CF9E9A7813986978632E7F3B8122660DB1F0760C75F1F27251AE39B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 42dc183b6e4081c1a24a8ad33eb6b634090e498589572aaf563c34f59d74dd7a
MD5 7b57da3684d0a40594e237652b3c1aea
SHA1 1631d3c76c9c8ab77de1ceeb4a90ec7cc31ef487
SHA512 747f09406ca5e92a8dd852f45e59367ac27c2a4337ab72166bd61e01d98294ad75f0662e53aff6c1fa73c2586319e531a5094fdcdb0791d47ca1c1c88e250faf
SSDEEP 49152:ZB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glEPdXQRLf1OYfEP2c:Pu6JmTxd2dEP9AD1OOE+c
TLSH
T1D5D59D13F1DA01E8D06ED478974A9233EA62BC490B34B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 39abd0902a5a4881d8bee80fa42490ef43add148b163b04d6123c130da956b88
MD5 4045276c55876dc9c5e0769deff96af2
SHA1 02be8d3ef6278e300bf6aeec07fe9c268eadb6a5
SHA512 19a9aa1dfbc73ebe239402e18b9b627b16c71ab2f95e7a0edba412c2f3b99af241c0bff27f7c701f4b1b4d4d7615ad1375eb378a2819672bb0f8a7ab73fd545e
SSDEEP 12288:b2RuQZRjYG2BzKFBQYdDUXHGsVJQQrbbJOlizwr3Wo5aibfH2wB:b8F1YG2FGJKRJBrb1OYsrmogibP2wB
TLSH
T192D42393E7DA64C9F4E9813212ED5720418FF57922B0A58B2B21EB6C045D9C6EF30B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 2ae67f5022de446586d2e83776e4ae651d1faf554959a5d0efa9284c790f3a9f
MD5 ad6aa4b315ab60ef5e4b767ac6e8a2ad
SHA1 161cef976e31f050ee4bb442f45aab336480e60d
SHA512 c079266c6ca0d8ec56937c462a883b4921c41b633fa049c218e65829f1a530e683f40e1925b1f143f0dcb837699aafaf12c55c7243532aba2b16b5ff652be0ec
SSDEEP 49152:OXZwQCyiHiQEaTPnMMPdXQRLf1OYfEP2c:69xOPnP9AD1OOE+c
TLSH
T1E285B01E63DC46A5E0BAD278CDA74407E6B27816573197CF0290C27D1F27EE49E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 700KB
SHA256 6ee87eac4500522351fd236e46935321f6bb2f8af00db8f01535dd22fa9fa9ee
MD5 7a3de6a177e92959014e65cac4a4e450
SHA1 c61a68091bff4d17031caedeb96559c4eca5474a
SHA512 9488dc4c1d2910cb2fefc5dd755e41063b16911e8bcff5f9d8c6c1d1fe30caa90d7fd35f0ccd0cf24ad5f5f236c54040246bc207d9e68aa5cbe140deb14f1af5
SSDEEP 12288:T5xA1U7K6RuQZRjYG2BzKFBQYdDUXHGsVJQQrbbJOlizwr3Wo5aibfH2wB:T5xA1UGIF1YG2FGJKRJBrb1OYsrmogil
TLSH
T17EE4126EA2ED24E4F1B5913A46D54205C372B82A2370A7DF1691C37E0F2BED59D30F92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 eaac641a69ed33f96817103725100657199e4e894e1a439343fd3f824ebae4cf
MD5 34e262437d111d08199bc3fc576b1445
SHA1 901f3a1bf9ca6617a9e5eb5fdbc46509c600a1df
SHA512 cf83270b4e27f3ec202f63f12dc29a1a1c24583d719997bc79d6c6f3b5c20d243b4905db28eb513165002d94d969d8e47110f978950bc43cd62dac686f7783d6
SSDEEP 24576:VxsmP0yHaqrVqHra44KDzM+rntF1YG2FGJKRJBrb1OYsrmogibP2wB:VxRP0yHfVqzlA+rntPdXQRLf1OYfEP2c
TLSH
T1A355AF2EF2B910F9D4AAD136454507B5AB71B42D1F209AC70170C638AF0AEE89F35F5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 620KB
SHA256 38151d95fa27be4f939f882b8030fb6c455f20695093a38904c79c016e835db5
MD5 7bca8befe8330ba5d6969acaa278e245
SHA1 f7ca4e1cf5ef972fcb1a23d309a1770f49028cc3
SHA512 15fad9c0b88acf21bac91d80a3c6e2d4746b31bc48c6e19ae96844506f0aff64a260a67deb15f66c649df49f963881ef771622107d71e366ed83b7e8dd876923
SSDEEP 12288:EgRuQZRjYG2BzKFBQYdDUXHGsVJQQrbbJOlizwr3Wo5aibfH2wB:EOF1YG2FGJKRJBrb1OYsrmogibP2wB
TLSH
T180D423D6E2D724D9F4D8817613DD0B1441CEF52A20F06A5B2F22EB6D058D98BAF30E97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 962KB
SHA256 3be6bcb004e59995ae5597df80178fa16036c696a1e85f50b97e89403c272b28
MD5 71a22c52233f1db5da47d834900cd631
SHA1 4c2d572e21f8ed2c59c8dc4501213d8632830206
SHA512 e4a11ddc51420f04cb39fea753c581e9492602e91a120f81abe5fc011daf7387d7280bc9b37cc7b88c06d91b70a11577fee628db40263fa3352d494d3acca9a1
SSDEEP 24576:fHLBUTb5F1YG2FGJKRJBrb1OYsrmogibP2wB:fHLBU/5PdXQRLf1OYfEP2c
TLSH
T125250155F79500F9E86BC13C89A68A16D2B2B45D0360E7DF03A88B691F537E24F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 824KB
SHA256 ba0dc2c6c20205c7b1c5c5a681367239398639aca44a33643ae4f93ad779f6ab
MD5 69f9a48ec0f8fbbab955e8f6b6b3094e
SHA1 72859a851f0bcafea311f90cf157dc77db12d0ca
SHA512 e2341725d9d29b610be0f1d37148f2b8852b06353d85ac77934e323a390add73a47f6225aea60418201331f539a041bcfd7f0b6727bad276086ce4f1c8260bc4
SSDEEP 24576:8TYNH/F1YG2FGJKRJBrb1OYsrmogibP2wB:8TYt/PdXQRLf1OYfEP2c
TLSH
T11905F11FA2AD18E4E57B917D8AC28609F273B866135192CF05B0C37E0E17ED9BD39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 e7865a5ea7fcc0ea47e8e7132c685b1bee88c4f15e528849c3778e46e0bb289c
MD5 639d602cc0f1278f8c0565dc3e0f4834
SHA1 5b51869f82684de53b0b95e5f50cc82cf85a8504
SHA512 ff5aa41fd32a2dbfcab87cd59db7cd232da58a0a2272dc48e3bdf162a24725241a7cc9b407c8edf1004484e3a8ae4f2f7b5fa72b457550ab8588c056709d310b
SSDEEP 24576:GRXsLjNYH84VVSNAApoEO466aspcrcHBjSSKHPWdQwPF3hJ8ssmOc+XLxu+x7uKP:GRXsLJYH84VVS6AmEFJas+cHBjSSKHP/
TLSH
T16965BF9EA2BC04E8D5BBD17DC5C24506F5B278661331C6CF026182BE3F17AE5AE35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 be6bee8ff4d3b2f9c414a468af21eb0d861e9d00ed08e2095f76c094aecde3b7
MD5 f8043826ca8c1bd0a8cbc44ce048ad82
SHA1 fd8cf68966f856a22ac332b03b815fe58e4dc814
SHA512 d862e5b4a68f68e98d4dacbdab9c88064f597d3640075528da4acc7342d904e84b481f0d690bad7e59f1b16f44d10a6c1e158fcfb4f4e9f0ae4357c1ce5d02bf
SSDEEP 24576:iM7Xbxd9Tuycf8M/TYlSux/r2PCBF1YG2FGJKRJBrb1OYsrmogibP2wB:i+LL9TuJ0M/TYn2PGPdXQRLf1OYfEP2c
TLSH
T1BE858D5EA2EC42D8E0BBD6BD85B79146FAB2B855173081CF0251856E1F23BF05D3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.3MB
SHA256 7077a0c1c7775c487f89a6ab5d599e0d551b573ad99dfaaa836fd5cb1436b903
MD5 d4ebafd38469e247abc69865e38879b3
SHA1 c243c196b950828da330c7528a035106adee942d
SHA512 218a61cf6b580c99e6bae75c113b617e2e6f5473e3da7811235e5538845796c002c43ab92428dab7e5f835c746594b84bc7d2a449d6b91d95a0c1893ac0120e4
SSDEEP 24576:OegJgpwJOmPOHWAK28ZguIGyPsxr5Vin10wAF1YG2FGJKRJBrb1OYsrmogibP2wB:OngOJOmPOHFAPdXQRLf1OYfEP2c
TLSH
T1F155CF3FA7BC15D5E07EC13E8A968916F6B1782603355ACF0560827E1F1BEE46E39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 928KB
SHA256 d1d7d9b6c32da49ffa9593a774a288e5e3249c595405a71572c6846aaaf7e443
MD5 93214420bf5d96e9acf3636f048c60bf
SHA1 7cc8bed8e6c472f916c7f53c988707048ba9cb64
SHA512 302c7c745da5626d20c1238d0d0dd6bce6ca9752f98e3395b42ffc92227e083576bfc67a9ac6132268783c05b27971cb103d9a1f2568a60328d9ab7efee035dd
SSDEEP 24576:+yJnJiTk3R3waE4JrOkF1YG2FGJKRJBrb1OYsrmogibP2wB:+yJnJK8R304l5PdXQRLf1OYfEP2c
TLSH
T1A615E02DD2A910E8E4B7C2B4825A1756FF72347C2B2169CB19B4D5353F02FD0AA39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 e6fbe60ad37b56a8b8c7bfe1301db73fa095cb51c3cddbd5ee351a27cb83b03d
MD5 56556414861f49ef84424b74a64f89cf
SHA1 206609a87d245555af85c8d6ce4ba81c8083d69c
SHA512 6368667080a0963c0c8ccc100f11c2f294e1f7838e21f5fde7c7c55e7cb0b1a09162a750d8fae9dffcac709427cc5b1c0cf6a9e8a8fb7059c5d3590002cf11b9
SSDEEP 49152:T9EqCzDScAZmlvTcFg8Ph6sPdXQRLf1OYfEP2c:xZP9AD1OOE+c
TLSH
T1A6A55C05F7EB5298E8B3C9F1C96694159B327C509B34F7EF0A80CA6A1E32BD1D934B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 700KB
SHA256 eed22e6d2d3b486a487cd971d2a87601e21deeb97e2039320a3303527b3ad079
MD5 a526fd56a65cb3353197099c1fb44932
SHA1 b503720c8aa07c640d515235cf1c16be34bc7930
SHA512 22db99844120d301dbb4d7d1fbb289d80513132866cac4bc104de3a95b228ed4061e478e3f39c21e92471160a238bba5009430fda23bfeff70e02a56aaf14bef
SSDEEP 12288:LlYJeXmZkknUuEyRuQZRjYG2BzKFBQYdDUXHGsVJQQrbbJOlizwr3Wo5aibfH2wB:LlYJeXmZjUuEAF1YG2FGJKRJBrb1OYsB
TLSH
T179E4129EB69D30E8E16E803A56D50B04D3A2F075236167EF16E0C67D0E4BAD66F34F81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 756KB
SHA256 f2cd5b626c917de3f2edd16a67aaaf61ce9913efaf07acb9ac4076c4161fcfe8
MD5 42c423918d576727ef020a17cce5cc2a
SHA1 9b0c8ab3aaeb7250a12ea53bd3fec7bf6ec8b366
SHA512 f52a2d4ff8684dc68b46ca019584f86c1bfc3fb53be4a9e19d7a4a736d0f94b7d9e40c1b932ca8bd55925f26417db35870025031c20f2119cbf1f91ccbd4543b
SSDEEP 12288:C9U6ky7RuQZRjYG2BzKFBQYdDUXHGsVJQQrbbJOlizwr3Wo5aibfH2wB:C6tyNF1YG2FGJKRJBrb1OYsrmogibP2c
TLSH
T134F42246A3D160D8F5F941395AA643108B6AFC301B6057DF16A0EB3E1E7ABC5AE30F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 628KB
SHA256 e3daf76a78e69feade2489d2f5174886ffa1a540f3a662b685cc4511aeba1ccf
MD5 a7c5b3f54c6564e03764c30ec13223d2
SHA1 fe061f84b645e23c1f263f5f69b2ae234fc03390
SHA512 cdee1fe41b887c16441f9e46061064ee9cbb1243eae7e83d86338f9b379ea05c406b6e696a4eefbf11119010e864b9383f65ef50f67bc263e8af59c3e119602f
SSDEEP 12288:JkARuQZRjYG2BzKFBQYdDUXHGsVJQQrbbJOlizwr3Wo5aibfH2wB:GuF1YG2FGJKRJBrb1OYsrmogibP2wB
TLSH
T139D4239AE29734DDF895807613E90B1042CFF53920B0796F1BA1EB7D098D586AB30E97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 7aba3689815e5458f9b92b0e03d3a2a7367f33bc88b285d0e573ea313e6f02f1
MD5 d2d93d114b1efe84b1993c2f750ad62d
SHA1 8c8274b5e931d85807673b792c04c1b17c183bcb
SHA512 20ffbd74c114e7d22f8b56b73ddfa9ca27e8c647040a84746e4a60b881bf04988774c8ee5a1a88b3bf6e9dbfc3e0855fe6ec0b37ac932ce50973120441334003
SSDEEP 24576:UC+TyQIu93VAumZrHjmqF1YG2FGJKRJBrb1OYsrmogibP2wB:U/TfIq+AqPdXQRLf1OYfEP2c
TLSH
T129559D1DA7F91DCAE2B6C57588A34493E633B872137186CF2044C17D499EEE8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 d5fc87b1f50502b4423a549e8edc59e0907f5b7889722c42aaf64bc9cd1cd3b5
MD5 62c9214bad1b373396bfea3ac96cf82c
SHA1 f30ea0acfeeaecd1ba8cc6688d678b8b50222676
SHA512 3822858db98795a1df9ead72d8171e52f0177accf45e68526c4900c991a7db7382eb8ee3c243c80aa586fdc61d2c93d3cd65ff59b1ebe43bf1530ff89116983b
SSDEEP 24576:F9QikZdF1YG2FGJKRJBrb1OYsrmogibP2wB:HQik3PdXQRLf1OYfEP2c
TLSH
T12205F14FB3AB10A5E0A7C13C89854211F6B3B435536267DF06A0C77D0B9B5EABE34B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 b51c9d8b6dc07036e5e8b4cfca5eeb60f7b457940a170133c5c611a3f39460e1
MD5 dd6e2f5290f8f0f5c92b05c0c00546d7
SHA1 3c9015993b9aa1528f78d6a6f83c60f95de804d8
SHA512 eee3677d82434b78c032ef8b703772aef83806a0da11dc6db780b2314464932263640e26a8127381c4c6f8a21efa5b38142fd609d7874111cc237e8ca2e9bf3a
SSDEEP 49152:M1JFwrPpGyqWo6cbT2TZ8maJO35NPHXogsS7Q78ZGAvL9vnF35LhAPsPdXQRLf1+:xpC7b4+80GTLhP9AD1OOE+c
TLSH
T138A57C3DE2F810ADD8AAC37585461665EE71782E3F2015DB01B0C578BF1AEF19A38F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StructuredQuerySchema.bin

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin
Size 414KB
SHA256 e67e330837a6b2f6d5f76815e7235a512b54b1c90f2ad62a3e9d142ae6939c8d
MD5 16b9618962f5623ca791a1366eee5708
SHA1 f0d257511952f075b2a0ec7d8e8730c3e464461a
SHA512 18e1d5a105b87fc72df94645685f5a8d3f593df2d3a9b8652b3b4a4ceaf92d3c7a67b0c08847186149dd608428cae8f1b3bc844bc7aacfc9e3219da823ca2fe2
SSDEEP 12288:vMUC7+vlk3n61mSkplXZ5RwmF9n4w/TSD:vXhl6V/i
TLSH
T124945F36BF88CB22C59A15748897C01A2E30A7C49E04CF6B73DC513CFA576685FBA359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/440-282-0x000002543FAB0000-0x000002543FAC0000-memory.dmp

Download

memory/440-279-0x000002543FAB0000-0x000002543FAC0000-memory.dmp

Download

memory/440-286-0x000002543FAB0000-0x000002543FAC0000-memory.dmp

Download

memory/440-288-0x000002543FAB0000-0x000002543FAC0000-memory.dmp

Download

memory/440-287-0x000002543FAB0000-0x000002543FAC0000-memory.dmp

Download

memory/440-285-0x000002543FAB0000-0x000002543FAC0000-memory.dmp

Download

memory/440-284-0x000002543FAB0000-0x000002543FAC0000-memory.dmp

Download

memory/440-283-0x000002543FAB0000-0x000002543FAC0000-memory.dmp

Download

memory/440-281-0x000002543FAB0000-0x000002543FAC0000-memory.dmp

Download

memory/440-280-0x000002543FAB0000-0x000002543FAC0000-memory.dmp

Download

memory/876-183-0x00000205A40E0000-0x00000205A4146000-memory.dmp

Download

memory/876-188-0x00007FF66E8E0000-0x00007FF66EDAA000-memory.dmp

Download

memory/876-184-0x00000205A40E0000-0x00000205A4146000-memory.dmp

Download

memory/876-269-0x00007FF66E8E0000-0x00007FF66EDAA000-memory.dmp

Download

memory/1208-28-0x00000256A2530000-0x00000256A2596000-memory.dmp

Download

memory/1208-114-0x00007FF641F80000-0x00007FF642066000-memory.dmp

Download

memory/1208-26-0x00007FF641F80000-0x00007FF642066000-memory.dmp

Download

memory/1208-27-0x00000256A2530000-0x00000256A2596000-memory.dmp

Download

memory/1452-161-0x0000017E715A0000-0x0000017E71606000-memory.dmp

Download

memory/1452-159-0x0000017E715A0000-0x0000017E71606000-memory.dmp

Download

memory/1452-160-0x00007FF66D6A0000-0x00007FF66D831000-memory.dmp

Download

memory/1452-260-0x00007FF66D6A0000-0x00007FF66D831000-memory.dmp

Download

memory/1592-125-0x00007FF740C10000-0x00007FF74103B000-memory.dmp

Download

memory/1592-124-0x000001736EE70000-0x000001736EED6000-memory.dmp

Download

memory/1592-265-0x00007FF740C10000-0x00007FF74103B000-memory.dmp

Download

memory/1592-263-0x000001736EE70000-0x000001736EED6000-memory.dmp

Download

memory/1592-201-0x00007FF740C10000-0x00007FF74103B000-memory.dmp

Download

memory/1592-123-0x000001736EE70000-0x000001736EED6000-memory.dmp

Download

memory/1596-192-0x00007FF6446A0000-0x00007FF64474A000-memory.dmp

Download

memory/1596-115-0x00007FF6446A0000-0x00007FF64474A000-memory.dmp

Download

memory/1596-116-0x00000206924F0000-0x0000020692556000-memory.dmp

Download

memory/1596-117-0x00000206924F0000-0x0000020692556000-memory.dmp

Download

memory/1676-70-0x00007FF6B42E0000-0x00007FF6B4448000-memory.dmp

Download

memory/1676-68-0x0000026FEC940000-0x0000026FEC9A6000-memory.dmp

Download

memory/1676-61-0x00007FF6B42E0000-0x00007FF6B4448000-memory.dmp

Download

memory/1676-62-0x0000026FEC940000-0x0000026FEC9A6000-memory.dmp

Download

memory/1676-63-0x0000026FEC940000-0x0000026FEC9A6000-memory.dmp

Download

memory/1728-167-0x00000230F2B50000-0x00000230F2BB6000-memory.dmp

Download

memory/1728-173-0x00000230F2B50000-0x00000230F2BB6000-memory.dmp

Download

memory/1728-175-0x00007FF6B7DB0000-0x00007FF6B819F000-memory.dmp

Download

memory/1728-169-0x00007FF6B7DB0000-0x00007FF6B819F000-memory.dmp

Download

memory/1728-168-0x00000230F2B50000-0x00000230F2BB6000-memory.dmp

Download

memory/1892-153-0x000001C801220000-0x000001C801286000-memory.dmp

Download

memory/1892-255-0x00007FF7D23D0000-0x00007FF7D25BF000-memory.dmp

Download

memory/1892-152-0x000001C801220000-0x000001C801286000-memory.dmp

Download

memory/1892-151-0x00007FF7D23D0000-0x00007FF7D25BF000-memory.dmp

Download

memory/2488-178-0x00007FF6B3290000-0x00007FF6B33A6000-memory.dmp

Download

memory/2488-73-0x00007FF6B3290000-0x00007FF6B33A6000-memory.dmp

Download

memory/2488-75-0x000001C70CD80000-0x000001C70CDE6000-memory.dmp

Download

memory/2488-74-0x000001C70CD80000-0x000001C70CDE6000-memory.dmp

Download

memory/2828-97-0x00007FF642630000-0x00007FF642776000-memory.dmp

Download

memory/2828-93-0x000001D4E0720000-0x000001D4E0786000-memory.dmp

Download

memory/2828-182-0x00007FF642630000-0x00007FF642776000-memory.dmp

Download

memory/2828-94-0x000001D4E0720000-0x000001D4E0786000-memory.dmp

Download

memory/3060-193-0x0000020B705A0000-0x0000020B70606000-memory.dmp

Download

memory/3060-194-0x0000020B705A0000-0x0000020B70606000-memory.dmp

Download

memory/3060-198-0x00007FF7FCF10000-0x00007FF7FD43A000-memory.dmp

Download

memory/3060-270-0x00007FF7FCF10000-0x00007FF7FD43A000-memory.dmp

Download

memory/3248-220-0x00000202031A0000-0x00000202031B0000-memory.dmp

Download

memory/3248-213-0x0000020202240000-0x00000202022A6000-memory.dmp

Download

memory/3248-215-0x00007FF66A780000-0x00007FF66AABE000-memory.dmp

Download

memory/3248-212-0x0000020202240000-0x00000202022A6000-memory.dmp

Download

memory/3248-236-0x00000202033D0000-0x00000202033E0000-memory.dmp

Download

memory/3248-253-0x000002020B990000-0x000002020B998000-memory.dmp

Download

memory/3248-272-0x00007FF66A780000-0x00007FF66AABE000-memory.dmp

Download

memory/3496-210-0x00007FF6A43C0000-0x00007FF6A4470000-memory.dmp

Download

memory/3496-138-0x00007FF6A43C0000-0x00007FF6A4470000-memory.dmp

Download

memory/3496-133-0x000002A531D80000-0x000002A531DE6000-memory.dmp

Download

memory/3496-134-0x000002A531D80000-0x000002A531DE6000-memory.dmp

Download

memory/3500-45-0x00000248FD730000-0x00000248FD86C000-memory.dmp

Download

memory/3500-46-0x00000248FD990000-0x00000248FD9F6000-memory.dmp

Download

memory/3500-47-0x00000248FD990000-0x00000248FD9F6000-memory.dmp

Download

memory/3628-202-0x0000027AA9130000-0x0000027AA9196000-memory.dmp

Download

memory/3628-271-0x00007FF643D80000-0x00007FF643EAE000-memory.dmp

Download

memory/3628-203-0x0000027AA9130000-0x0000027AA9196000-memory.dmp

Download

memory/3628-204-0x00007FF643D80000-0x00007FF643EAE000-memory.dmp

Download

memory/3736-102-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/3736-103-0x0000000000960000-0x00000000009C9000-memory.dmp

Download

memory/3736-108-0x0000000000960000-0x00000000009C9000-memory.dmp

Download

memory/3736-189-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/4052-18-0x00000200153C0000-0x0000020015426000-memory.dmp

Download

memory/4052-17-0x00000200153C0000-0x0000020015426000-memory.dmp

Download

memory/4052-96-0x00007FF71C430000-0x00007FF71C516000-memory.dmp

Download

memory/4052-16-0x00000200153C0000-0x0000020015426000-memory.dmp

Download

memory/4052-15-0x00007FF71C430000-0x00007FF71C516000-memory.dmp

Download

memory/4340-7-0x0000000002AE0000-0x0000000002B49000-memory.dmp

Download

memory/4340-1-0x0000000002AE0000-0x0000000002B49000-memory.dmp

Download

memory/4340-0-0x0000000002C60000-0x0000000002DA3000-memory.dmp

Download

memory/4616-179-0x00007FF607410000-0x00007FF6076CD000-memory.dmp

Download

memory/4616-266-0x00007FF607410000-0x00007FF6076CD000-memory.dmp

Download

memory/4740-142-0x00000291813F0000-0x0000029181456000-memory.dmp

Download

memory/4740-214-0x00007FF6082D0000-0x00007FF608593000-memory.dmp

Download

memory/4740-143-0x00000291813F0000-0x0000029181456000-memory.dmp

Download

memory/4740-141-0x00007FF6082D0000-0x00007FF608593000-memory.dmp

Download

memory/4764-42-0x00007FF76DC70000-0x00007FF76DEFA000-memory.dmp

Download

memory/4764-40-0x0000019DBB3A0000-0x0000019DBB406000-memory.dmp

Download

memory/4764-35-0x0000019DBB3A0000-0x0000019DBB406000-memory.dmp

Download

memory/4764-36-0x0000019DBB3A0000-0x0000019DBB406000-memory.dmp

Download

memory/4764-34-0x00007FF76DC70000-0x00007FF76DEFA000-memory.dmp

Download

memory/4864-87-0x000001BF9FE00000-0x000001BF9FE66000-memory.dmp

Download

memory/4864-86-0x000001BF9FE00000-0x000001BF9FE66000-memory.dmp

Download

memory/4864-85-0x000001BF9FB80000-0x000001BF9FCBC000-memory.dmp

Download

memory/4932-53-0x00000255B7E60000-0x00000255B7F9C000-memory.dmp

Download

memory/4932-55-0x00000255B80C0000-0x00000255B8126000-memory.dmp

Download

memory/4932-54-0x00000255B80C0000-0x00000255B8126000-memory.dmp

Download