ca4f6d092c85a3a5e418b327cb34f97e1334f492b707be9072443dce55198c91

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 04:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_fc474c5fcce7181f4d0df27ee9cb6ef8_bkransomware_elex_hawkeye_maze_remcos.exe
Size 1.0MB
Sample260708-elca8sat7s
SHA256 ca4f6d092c85a3a5e418b327cb34f97e1334f492b707be9072443dce55198c91
MD5 fc474c5fcce7181f4d0df27ee9cb6ef8
SHA1 021d50c3b4cdd99c6840416feae21bb359ce46fa
SHA512 a32e4fc49c9e7f9ebe0422766be881c0f7cc6b8145388c5c8e5dcc9e7ac21e19f7caa4a55fafab007c18f857bd11efdeccb1dcac8bc58b1dde0e5867028d0841
SSDEEP 24576:c49H6s7lHNYAWqrGSmQJU3s3TvQlDPkB4O3NNYL0:c4p6s7lHNYAJmQhkD03NGw
TLSH
T15E35C002B7F99034F2F32B31AFB452655A7ABC62AD35C60F23D4191D19B0980EA75B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 22 IoCs

pid	Process
5336	alg.exe
2936	elevation_service.exe
1972	elevation_service.exe
2004	maintenanceservice.exe
1280	OSE.EXE
4696	GameInputSvc.exe
3508	GameInputSvc.exe
5932	msdtc.exe
4468	PerceptionSimulationService.exe
2464	perfhost.exe
3676	ReFsDedupSvc.exe
2272	locator.exe
2064	SensorDataService.exe
3700	snmptrap.exe
2620	ssh-agent.exe
3364	TieringEngineService.exe
3908	AgentService.exe
4600	vds.exe
5524	vssvc.exe
3232	wbengine.exe
3308	WmiApSrv.exe
3356	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\d064fbdb53e17fad.bin	alg.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-08_fc474c5fcce7181f4d0df27ee9cb6ef8_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-08_fc474c5fcce7181f4d0df27ee9cb6ef8_bkransomware_elex_hawkeye_maze_remcos.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_fc474c5fcce7181f4d0df27ee9cb6ef8_bkransomware_elex_hawkeye_maze_remcos.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3437697693-2283162250-3003737219-1000\{D233150E-1065-46DC-870B-C31A71CC554F}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3437697693-2283162250-3003737219-1000\{5BA546BB-C4A5-446C-976C-B45CF747F8FA}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3437697693-2283162250-3003737219-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5520	explorer.exe
5520	explorer.exe
3508	GameInputSvc.exe
3508	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1212	2026-07-08_fc474c5fcce7181f4d0df27ee9cb6ef8_bkransomware_elex_hawkeye_maze_remcos.exe
Token: SeShutdownPrivilege	5520	explorer.exe
Token: SeCreatePagefilePrivilege	5520	explorer.exe
Token: SeShutdownPrivilege	5520	explorer.exe
Token: SeCreatePagefilePrivilege	5520	explorer.exe
Token: SeShutdownPrivilege	5520	explorer.exe
Token: SeCreatePagefilePrivilege	5520	explorer.exe
Token: SeShutdownPrivilege	5520	explorer.exe
Token: SeCreatePagefilePrivilege	5520	explorer.exe
Token: SeShutdownPrivilege	5520	explorer.exe
Token: SeCreatePagefilePrivilege	5520	explorer.exe
Token: SeShutdownPrivilege	5520	explorer.exe
Token: SeCreatePagefilePrivilege	5520	explorer.exe
Token: SeShutdownPrivilege	5520	explorer.exe
Token: SeCreatePagefilePrivilege	5520	explorer.exe
Token: SeShutdownPrivilege	5520	explorer.exe
Token: SeCreatePagefilePrivilege	5520	explorer.exe
Token: SeShutdownPrivilege	5520	explorer.exe
Token: SeCreatePagefilePrivilege	5520	explorer.exe
Token: SeShutdownPrivilege	5520	explorer.exe
Token: SeCreatePagefilePrivilege	5520	explorer.exe
Token: SeShutdownPrivilege	5520	explorer.exe
Token: SeCreatePagefilePrivilege	5520	explorer.exe
Token: SeShutdownPrivilege	5520	explorer.exe
Token: SeCreatePagefilePrivilege	5520	explorer.exe
Token: SeShutdownPrivilege	5520	explorer.exe
Token: SeCreatePagefilePrivilege	5520	explorer.exe
Token: SeShutdownPrivilege	5520	explorer.exe
Token: SeCreatePagefilePrivilege	5520	explorer.exe
Token: SeShutdownPrivilege	5520	explorer.exe
Token: SeCreatePagefilePrivilege	5520	explorer.exe
Token: SeShutdownPrivilege	5520	explorer.exe
Token: SeCreatePagefilePrivilege	5520	explorer.exe
Token: SeShutdownPrivilege	5520	explorer.exe
Token: SeCreatePagefilePrivilege	5520	explorer.exe
Token: SeShutdownPrivilege	5520	explorer.exe
Token: SeCreatePagefilePrivilege	5520	explorer.exe
Token: SeShutdownPrivilege	5520	explorer.exe
Token: SeCreatePagefilePrivilege	5520	explorer.exe
Token: SeShutdownPrivilege	5520	explorer.exe
Token: SeCreatePagefilePrivilege	5520	explorer.exe
Token: SeDebugPrivilege	5336	alg.exe
Token: SeDebugPrivilege	5336	alg.exe
Token: SeTakeOwnershipPrivilege	2936	elevation_service.exe
Token: SeTcbPrivilege	4696	GameInputSvc.exe
Token: SeBackupPrivilege	3676	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3676	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3676	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3676	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3676	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3676	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3676	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3676	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3676	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3676	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3364	TieringEngineService.exe
Token: SeManageVolumePrivilege	3364	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	3908	AgentService.exe
Token: SeBackupPrivilege	5524	vssvc.exe
Token: SeRestorePrivilege	5524	vssvc.exe
Token: SeAuditPrivilege	5524	vssvc.exe
Token: SeBackupPrivilege	3232	wbengine.exe
Token: SeRestorePrivilege	3232	wbengine.exe
Token: SeSecurityPrivilege	3232	wbengine.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
5432	sihost.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe
5520	explorer.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1212	2026-07-08_fc474c5fcce7181f4d0df27ee9cb6ef8_bkransomware_elex_hawkeye_maze_remcos.exe
1212	2026-07-08_fc474c5fcce7181f4d0df27ee9cb6ef8_bkransomware_elex_hawkeye_maze_remcos.exe
1212	2026-07-08_fc474c5fcce7181f4d0df27ee9cb6ef8_bkransomware_elex_hawkeye_maze_remcos.exe
5116	StartMenuExperienceHost.exe
2288	SearchHost.exe
5520	explorer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5432 wrote to memory of 5520	5432	sihost.exe	98
PID 4696 wrote to memory of 3508	4696	GameInputSvc.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-08_fc474c5fcce7181f4d0df27ee9cb6ef8_bkransomware_elex_hawkeye_maze_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_fc474c5fcce7181f4d0df27ee9cb6ef8_bkransomware_elex_hawkeye_maze_remcos.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1212

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5336

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1972

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2004

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1280

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5432
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5520

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2288

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5116

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3508

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5932

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4468

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2464

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3676

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:2272

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2064

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:3700

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2620

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3364

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3908

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4600

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5524

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3232

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3308

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
PID:3356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 e401ceba0996877d81fc83bd50471d8789e385d3d1744d17b35868335be4564f
MD5 0ae8ca5e2e2c671b74ed13fcc54688d2
SHA1 cc202c0190784acce65dcb24dbb9f5a6c4d92a3a
SHA512 812dc944bcd15474d4594a9b71f1974daccd2d45614a2d7d371b7fbd59df8cd2788efe7cf55d333400994811e42da91612fae2215ea0fdba3dd30196550d8040
SSDEEP 49152:ab+6b2BuPkFKRrdE6oh7stBhuXjfS4LWxnxNYAJmQhkD03NGw:Mbq6gjBeJm0kDkNr
TLSH
T1AED59D03F2D900E9E06AD178D7469133EAA2BC890B34B6DF0790B6552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 c4d2d1816e762f3bf3906bf7e41743b61910be9474f3d3b674311dcac947850f
MD5 c3d6319a3b309e1e7b67108659ada51b
SHA1 3767e6b987143af4ed0bfc1a743596fd40f052a1
SHA512 0b286d655c97c72ca6ee34aa184542b63be2bc56a9004ff90fd73c0af41e89527d82871035b455dc9fc68ac66f5dea92e21cb613ff74befe290e4bbd496a0151
SSDEEP 24576:sXY8xOczAgNYAWqrGSmQJU3s3TvQlDPkB4O3NNYL0:4OcjNYAJmQhkD03NGw
TLSH
T1A605011977E008F9ED6B917CCCA18612EB72BC4507A4E75B03B48A755F232D85E3EB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 8c472902f8c2b3e679e2f370f2ebcbb6c162b004e6d1a21bc0d69c7f6fe916ac
MD5 a97aba4d43dcad3f0b1fd286a090ecd2
SHA1 6b52e59e39705d55c9cfe99b8d876f73379fe931
SHA512 35802017a3e4f5abc143f06b2e61ec6aed625639f13b811469c07cc79b3ac9fd532c5dc7299b605337efb89f7ea698b4737f8ee2f8ff3a95e38d10d948a9a170
SSDEEP 24576:F03eHlL0h6xYrMDNYAWqrGSmQJU3s3TvQlDPkB4O3NNYL0:FFlL0kywNYAJmQhkD03NGw
TLSH
T1C645AE16F6748331D073C0B9C5D2A69AEE7130861B308ACB4296D77C7F67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 784b5c34ea3f691c1fc270c9e8ead34f6f8036d67f9f8dfb9dfc04e1cf55b7a7
MD5 032526e4c40abef7ed1df3b9529156c5
SHA1 5c62f258431cb9cc36617bbf9940ce76697f7cf9
SHA512 c463a853e1caa5469efba4df75ae29f013eb73cc52687be1a8187b16c5322d2799392e8b68977df1015caa58c31bcdec211202f02b8b79a9b3e74b66c44e29bb
SSDEEP 24576:1a2/ezSC6vUyD/aqgrvW/6q8wyuyNYAWqrGSmQJU3s3TvQlDPkB4O3NNYL0:l/ezSC6vUzPvuHjyHNYAJmQhkD03NGw
TLSH
T192756C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 d3a0f8120fac70ccd1cfa7d29f7c491bde644a6df09e381bc7d3338c437a8526
MD5 ee925cf40154385083b6fea0b0efc3f3
SHA1 0ddf92362d9afabfc61f105573d5fffba408f924
SHA512 7082062dcd3baa6e6b89cdca5d923a01e5fd9b8ab3d611c1be14c20eb7612bde06c656a9bdb0bc89ea0a07114567e069f58265dd5b9882d250e29c1beb432c39
SSDEEP 24576:YAb8PrGZPv/l+p3NYAWqrGSmQJU3s3TvQlDPkB4O3NNYL0:YA0GZPXl+xNYAJmQhkD03NGw
TLSH
T165559E66F5B48331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3F676D6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 6686005301dc547902d8134117163e2008ebe22e7e8fef7c94206981cfa43889
MD5 6d4b39a2031befcab162636d23efb95b
SHA1 72661bdeb67a3849772ce22ee4bce643db4507cc
SHA512 5fc8c5c54f6c62f1bac3d665524131f981d098005027c866aee4b24510622ad06a95f35e3ab60d103f8b0eb478d087c901d261ec9978564edcdba39260cb7962
SSDEEP 12288:AEgzabNHJmAWqrXWSh69QJULxVbw3TX/16qG7FJSekBVOCeo3Nvk4xm3L0:AlGNYAWqrGSmQJU3s3TvQlDPkB4O3NNN
TLSH
T1DCD4230E7A910081E7EEF57088DC0797EF74BD4636DC633318369AF9A3694D395B128A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 3f80bacfcc97155bdd6efa72f46e23f33e110986ea78a2c347449b76a1b9dc14
MD5 9668c1b07d706ec90b34abbc5ef9c4f0
SHA1 88bd1bea580a5e7c8f4e8959d4bdb99aaef1bbec
SHA512 3119aa7adc93547ae76fc5f67b0d42395f9b64728f3ae3ef36ce6ad0d5c3954c8f73828e9800707e7fb5acd2ca34f5f667bde40e3805f1e3997505adacbb0e8f
SSDEEP 24576:gCIUPNYAWqrGSmQJU3s3TvQlDPkB4O3NNYL0:gCIUPNYAJmQhkD03NGw
TLSH
T1E415DF2BEE28FCD2C27E9DB85A918740E77278304B61A3CBD135824EDE235E15E76C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 1.6MB
SHA256 3c6496a407c7b9912519fb5e3287162a63330c29d9fde539eff48292513830ce
MD5 ba230340ad09b5c792a60fceddceaf03
SHA1 6916b7d5bd9871406965aad2a9cadfada07835b6
SHA512 0acf1065440dde46a00566cec8c06f2f4eae1cf8fd5a023c03a13ef7c36f1e6a0dc81a02f0c6a514706d03810da972db8d8820632e3fb42aacca2f6804ce1f47
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTI:jQvGAdlCEL8h
TLSH
T19C756C9657B840F9E56BE098CA6AD973F7F138060130778B4BA1CB273F77A60592D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 428296a444a1a4d3f80cc87d349b91cd5be4d41c07fceabf618e029bf24975f9
MD5 069170615078f50888cde778494273de
SHA1 2b90cd5237a172eca96ab86791539e3fc238f827
SHA512 00c2bd68018163c34448f257e232fcd616a668877574c4af87bbb511d078c2f5224664b638f964eeb69420628caf72f123efe75de4113c179a6c0eb3dcb6f83f
SSDEEP 24576:QmewsAj1ENYAWqrGSmQJU3s3TvQlDPkB4O3NNYL0:zlj1ENYAJmQhkD03NGw
TLSH
T1C415E031FE74D032C7BF1DB21B65C716587CB9200BA12AC3E3A88E9D5A741D22376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 1.3MB
SHA256 30b6d61edc61aecd5b565544248c30c1a4fc45580dbfd07f80587f28aecb1538
MD5 4b570ee8428b88ecf247f56f30b43942
SHA1 03fec671420c116855c0122235e59e55eda13130
SHA512 5d60a2a2fb04f4be909f7dd543a471a9b6dfbbb812bb567c02f1a823509958aab2a122f6d93f7b7d4d98eb63cb0b8db63ae76133d39432b331ca6f13232e3271
SSDEEP 24576:SYVsdaFd5FWsAfqeeTOyCkaXESPWXZWBB7bu+e:SYVCPaBGkaXESCMBB7bu+e
TLSH
T1DB555C465B6802F9C577E198C79A8537F7F0740509346B9B8BB2C75B2F3BA609A3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.0MB
SHA256 9ce420cb2642f4cecb4c7dbdef21f13f8e862ba1b834ac56a95420f4aee7bd5c
MD5 8fc335a312b09d52b43556668c063f00
SHA1 104584934a7a6dda27d8075bddb48a0a5d0026ed
SHA512 2212b11e7db47be60770cedbe67fc7d40b7c0cc29fd0c75a5731f050945917b3f9ba2173e67723aa66f4a95e5cfe4ccaca9ba97bc1b8dce27857b9ece276c778
SSDEEP 24576:NzbRquA/m2z+L5WqJGrJCYRFiV+XenmE3Pnzc3r:NzbRquA/m2yL5zMRFiV+XenmE3/zg
TLSH
T155A55C1976B8C1E4D1F6C67896A2CA47F37178054B30ABFF4265461E2D33BE58A3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 fd09c20795fa4a7ab69b69a3677666d41d5c4c25743de75de06ee56f7ca75579
MD5 77cd72ed68952d3d23532f673316ee73
SHA1 66904b06a7ec1c52aeb4bfff8f4eb5d73e62a3da
SHA512 86e6d86d197fcc14fb9d12ae3a5729cf24a9e10249f143e8a1821d68b50add1798231f1093005a9e8639e564d323fed940472eeccaef93ff340a67fa0114f206
SSDEEP 24576:RAhGLvlFoiwtA5l7S53tNYAWqrGSmQJU3s3TvQlDPkB4O3NNYL0:RAMRFoiq59NYAJmQhkD03NGw
TLSH
T14F459D81E7F945D4F5B3AA7899B58171EA76BCA61E31D21F2160C11F1E33E809D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 ab87f454959b92c1be4824cc2d0ac80d6c35b9b8924377e69f8880579f48c8ed
MD5 239ce3f40bce23b8360ebd0081e6364b
SHA1 efe5720aaee04181e6c692e2b99a6d9e8b2c2b2f
SHA512 d81e83c0881be3a010c48ee92ca7fa574fbc92daa3a304eaa04002815081be5c570f9320c328165de99bc2d5a371a50a72d5149c06d2cb08c51bedd8222f98ec
SSDEEP 24576:uwuuOWhNYAWqrGSmQJU3s3TvQlDPkB4O3NNYL0:uwVO4NYAJmQhkD03NGw
TLSH
T15505F14A36E40CF9E9A79138C5878236F7B2BC023A65D71F1770C66B6F37261AD29710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 679KB
SHA256 3f3716430442e04f725a95b4dac5e3f89718721966b9d2e92ea9148821026377
MD5 f727815447d97d050e25d55d96403c9a
SHA1 06672d64990fc6471d98b2ad8888f62e547a0e55
SHA512 9845c55830aaf25614dad7a8c7bd8f5be2819ae93c19b1ce9c8141205841b8687c364d47b93d8c65ab3e0346715017914774206f6362fab4696cb206983dbf7a
SSDEEP 12288:9Y/1IFILabNHJmAWqrXWSh69QJULxVbw3TX/16qG7FJSekBVOCeo3Nvk4xm3L0:a/uKONYAWqrGSmQJU3s3TvQlDPkB4O39
TLSH
T101E4124E33E020F5E1ABA278C8E80746EB71785237B953DF153546BA6F278C25E35722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 768KB
SHA256 81ec3669305932564591971532858cbb51e9ac939a1b01c83350b49d8b4e131c
MD5 785f02ff117d949bd8903d22e99bc0f5
SHA1 18260b48d1ad6d262d28ce30e41e340930f5f36c
SHA512 431219b88d5d569359196999a7124e508d89591e81a5fef3c4960214af547b904e9384c79cee84f86d6dd4128f5e1589215a64f4d44b00794e6a71c0e7525290
SSDEEP 6144:I97/7SB1R7Twbiw4xt43flyDSU78JFnDelt5fhWV9xJz8Mt:Im0yIFnDelt5fhWVn
TLSH
T15EF400E9933262792C1FDCA19A7C2896452C20DF9075C3BD18FE49B642729CE7B09F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 704KB
SHA256 00b1ef611958682b1c5bb8380c9ae4cf3e062fd68a1c8f63e58b4a48184a12d9
MD5 983fc3caefbdd25adbc5835cae233d38
SHA1 9e76cc00b1cd66ceac6ed2ec40a385e7bb82e429
SHA512 2c7534ef0d2b7734a08374a36800abb55818656b6a5d021913dbf884d2a1ff33086f2cfe47c0bc32c2aef8fc73ae0122cc435cc944b3bdfe78112f1ac0be2265
SSDEEP 6144:I97/7SB1R7Twbiw4xt43flyDSU78JFnDelt5fhWV2:Im0yIFnDelt5fhWV2
TLSH
T1E2E4CBE9933262792C1FDCA19A7C28D6452C20DF9075C3BD18FE49B642729CE6B09F35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 896KB
SHA256 86fcc86990e9120989a4233c1ca4469384faabfdbef317084b7e1591b4155722
MD5 b1cee085c544ea14fd0b09e815d687f8
SHA1 27b162610ff7cd31f95a67d9e2a111927888f14f
SHA512 0b2a9d1972acc8c5fa523e319cdbfec926eedcca6bbc4e0d908382cd6ebc34be6933a30ba73a9130a7898808e08aa44b63fb1588786a658b9fde9d755bd9b3d6
SSDEEP 12288:CVJwv+Brbyf6SyXQWdFg9Brn/fDboL6lx0ktPnTX7yiLA+54C62M7DaTll7FT:+wvYqf6SRQ+rn/fDboqxN1nnh6/7DaHB
TLSH
T13F158D53F2D901E8D09EE079879A9233E972B85A0B35B6DF069087521B7BFE0673D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 832KB
SHA256 52226cc30d41442181bdb3fd42d0a71ed26d06846cd83ecf016f5da93808f535
MD5 7fa6dfd7708bc3d66aafc0d7e846af66
SHA1 b811a0e81cc6f13fb604f44dc3293277a561ef11
SHA512 85e21b629b247867dd6c22515e158f431d33942b0ee518418cebfe3268561210326cff7d0405aa980c8c240679e3521edca06a234e386b000d12432e933ef25a
SSDEEP 12288:NpAvFQv8hSzeCz3aab4JGudsp0NTdNEcUUYbdWxg:kvFQvv3aa6sp0pEnRdJ
TLSH
T171057B23F2D910D8D04DD1B9978BA632ED76B4590B21B6DF0A4187522F6BFE46B3C720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 70aae2c7a6af68d85e16acb56a8b6f5bef4e883b51b96f22b7e7c47cbf048918
MD5 e5c2295e735fa9fe7d839862b69923b3
SHA1 61f84af8e097781fe03eaa6818c0be84ca67e986
SHA512 fab4b915f7d807e45008ab61beb188436bad5d46e1150dc87214bab1186aa2ee2d0a8acac689bfdaf6c67c77fc75d01c820ff9f38a4e2f4d7fc928ae99da9780
SSDEEP 49152:wq+taZ3usBWOBr4tEGp0bqx0z+n217aau1glcNYAJmQhkD03NGw:1u6JmTxd2dSJm0kDkNr
TLSH
T1F1D59E13F1DA01E8D06ED478974A9233FA62BC490B35B6EF0A9073552A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 576KB
SHA256 ff7c420059fa2f6761142927cbad541ea70c62ad14fadf904ae518da9fc1214e
MD5 99af2b4718669fb8c07a5db784b158ee
SHA1 d7a7ab2cb9ce3d68280677eef8b75835539ceb8c
SHA512 47b0a39483747c63449db95b33e44d0ad1e7cbe8c554d548981680da2a548bef9b48aad3ad65cd1d7438ad89f36d8c1e4bccfac85d7bbbc7aee9e4a4b240cf26
SSDEEP 12288:aolEhv5jvwE1hcnegus0+t2TJyd2z615uCMGLOje:uhvCE1hps0+ogd2z615uCMVa
TLSH
T19AC48C23F1D910E8C05DD4B9975BA232E962B45A0B30B6DF0A90C7662F6BFE0673D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 556KB
SHA256 c32b5c8d513069422bde92db3f0367126e9a34374cff483c79c82896fb593d9d
MD5 0a5541f1d5c1b18cf770f0f1d9494f81
SHA1 5e27130c872d1d89fac051f86bc8c94480ec9e11
SHA512 001855ce1ee0983b059373c56fb1a523e9a59fda22aa1450860462857a9c2e8a5ff6176bbaea103f5d48c9d72a06ff6c7ba406391866496c0c7af7810cddf051
SSDEEP 6144:Q97/71r7R7TPQKmjlwBvlA1DJfItNK+fdsmaK/iJzK5Rwf8gXz6YFAwAn:QbCjiBvlAVhI7fumpWK5RwflXZFAfn
TLSH
T1C5C48C23F1D910E8D0AED4B9974BA132F9A2B4590B20B6EF0A50C6651F77EF4673DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 512KB
SHA256 01241ad4608ab265b9019ab3563620c7d11514974a6a49bda3448d7166e61da2
MD5 af9ed66829bcbeca677719afe073c7d3
SHA1 49fcfe6fc5865fe4755ebd88cbaf65837228ae6b
SHA512 05315db53ea5d53d4763f2a80e8f7ea8c2ca49b83cfb5fa41f7301d7c339c2162a6b884b82a262cfae776a682c1fd41aedfa55c8a5f03f2301b75d403a613700
SSDEEP 12288:0GCoyavyaHx/PSLSS84fQsuRn+FgyUgi1gUv:2oyavTPSLT8EARn+FgyUgdQ
TLSH
T102B49D13F1D900E8D09DD0B9978BA132ED62B85A0B35B6DF0A90C6621F7BEE4673D750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 384KB
SHA256 93325e3223ae985f02c6ad15cbb13c381f7a5eb540e57a86b1ecfa1064b237b8
MD5 b4ab3bb53665970a5447d8eee6951e49
SHA1 7bab83450182014af144361ca9069021968b6b1a
SHA512 89d33e9cbaef86c4ef2eb98a25908404997994c170026b5ec13e41254203d7a89893c03d83c91f29dc9b009db2735ba96cfb063c4d454530233a469da502b452
SSDEEP 6144:MVqN0al31NGr2EgxrqW4AWXaKO4Ob0YWMzhO39FzOh49ZWULxVbGr3TX/16TWG7Z:cqN0abNHJmAWqrXWSh69QJULxVbw3TXg
TLSH
T1A684234FB89641A3D269F471C9EC03AAFD7C7D4F37C662172A2A49A023158D316B16CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 320KB
SHA256 d2996b898e58c736a80d0ce9fd1d6531b808c056fe678988d1825dec9e4c17c7
MD5 c19cc823d0f98f3b4867f644b54ff18c
SHA1 bb0860cd47e168fd58985a5acdbbf1d8cc564959
SHA512 006bdfcad0291f42c81840107822417ad69c92b5b2930142a19001df6e8e76e7071893e78c2920db42b7e45e87f078d31ceb748761b4fdf78d85a7aee341d260
SSDEEP 6144:Di1al31NGr2EgxrqW4AWXaKO4Ob0YWMzhO39FzOh49ZWULxVbGr3TX/16TWQ:e1abNHJmAWqrXWSh69QJULxVbw3TX/1a
TLSH
T176642309B465D0A7D659F472D8EC03DAF97C7D8B3BCA520B2A2A4D2023258D335B16DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 256KB
SHA256 19106c7b7bf566fc79cc34b3213576ed499cbb22bd2a40e9566607ac38cffcc8
MD5 b9a08070d3c2c3e1db9aef0875ed3945
SHA1 ac1866a4f427be0afae2a0caf26604e78202b914
SHA512 303d29de027569a3056d6a26a72777d12a6b6bc33739e62666fd4504a3ee744dab7766b6dbfb075fd035bc20102103f1ec0efb0ea84d9a16816e78eba0bfc494
SSDEEP 6144:6usi8i6Eal31NGr2EgxrqW4AWXaKO4Ob0YWMzhO39FzOh49ZWUI:qlYabNHJmAWqrXWSh69QJUI
TLSH
T19144125B79E910E2E8AAF175C9F84354F2B9BC877BE2930F47000D611F326426971BE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 192KB
SHA256 547b79e4d454482ccd8d36f634a3158d4af819258392fe61bbd6624f1b649496
MD5 2f7ac84416cbefac3b91d73a35fbb07d
SHA1 c3a50f22e5892bcd66423c137f1e547ab63a3193
SHA512 4ee4f5425d129db7173644dff9c94edb973a67634d40588c77fdf9b52f36b0a03fb39cce547c694250b0201b60732806f60a5e2e04f49579a5b4bed1a88fc77f
SSDEEP 3072:1Vtc+UJIl3ZRsqVNODFLP2Vugxrk6ElqHuPQ7YZbXasRrO+l97SQOt10YWXgZ:XWFal31NGr2EgxrqW4AWXaKO4Ob0YWs
TLSH
T18014126BACD59093F69975B2D5E80790F47C7EC73FC9721F636848101B1295230B2AE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 128KB
SHA256 1e5c070d2ae08c1e87b586199a6de4ac64a9cf4bf7ab47b49ae98d4647b629c1
MD5 a345839b557330b07821f0baf5aef90c
SHA1 8d742f563b3d09c514944c39a33715782fcb0414
SHA512 8768c3b25848ced5321f2237ccaf6675b78edbb9d4592a689e0de16f4a944771941273995c580e1e0605412b8149418e304d096c8f7130418ed06446f114804d
SSDEEP 3072:p1/koJIl3ZRsqVNODFLP2Vugxrk6ElqHuPQ7YZbq:LMoal31NGr2EgxrqW4AWq
TLSH
T18BD30277A84A11A7F29499F295E94391F87C3E833FC0629F939950205B279033176EFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 64KB
SHA256 df453a5dc9b7d6088359aeba430bbecc5f4971e36546219aa53b7c04f1da94c2
MD5 fa26741d12dc852f21f225d6310670d8
SHA1 061600607c70d97b59a1ae3b0c3b4d89c5392637
SHA512 e6c23edb2f03078c7574b9a148c63cf784f215cb7759ca5c6e8cab57355b3986e35164e37f91c3897d8102095929aa95882b1b6f9a44894704343607ce310a49
SSDEEP 768:BdbF50fhNibKD0BhA8n0F0q6XLWXxGNFNpSMfcs33JzVsUrlCdjB2eO/znI6Y1tp:Bdz0friu4EF3677l3ZR9KwrJYJBH9
TLSH
T18A53E01779D704B3F25649F1A5CE43D5E8383E8B7AC2B25E275D00142F23942162BEF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 42KB
SHA256 b26b9684266b412062cb658d6003f50bcdaf0029f233f03ddae78f7af57b4c43
MD5 66030ea6d4454036d72bea3e30ae17e9
SHA1 3c307c166fd54b825e43f14c73dd0dd3bd0cb09a
SHA512 9ed96f28640dcd4f449b852f52fe2237bfab4d989cf8f00a02cb22b69a8820a2bd38e0833926f66e26844b34e9067d233647ccb65f0e428d51864a81451e2621
SSDEEP 768:oxixTg8o2lP6nGr14GleVroByGcVIFfwlelzbJoXKDzaK2WRtNZIzvBOKe:oxEnR6g14jVYBZw8v9tNZ4Or
TLSH
T1C9135D09129510BDD12FA179C5872E47F672B81A8350AADF0BB14BF71F23BA17D2E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 14KB
SHA256 af730f227be8c198994cbcc57805aa9e32e103ac2e35f2b22697a77e49049505
MD5 4ebe39532d9e74ff28f2f246e6fd949a
SHA1 ddea264e440f2468ec4190e59811572e278c2e28
SHA512 2c37ded7d25cacfee7a16d686994bcaa3b5036f255dd98726489d90aa14573953722a237b9d855c6573ab90287464fa0486ce79a021c9798fbe9a8586fbf5ed8
SSDEEP 192:1x3r2z5ejmdvxB7B9GBDbK1FS5tfeiXpefvv/f:/4cmdpaKF5iXpefvv
TLSH
T10F624B0AFEA605FAF30501B5D56717CAC8BD7D1BB78293DF676C01082F21B842616BE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 722KB
SHA256 4363bbe586080accca20d35f3c1454b6bc4fd39af78b7060e16ada6b01117a48
MD5 fe84eec359e3962c06f9f6ec428b78ab
SHA1 b93536a019e614ed66020a6e87f4bfffdfe38f90
SHA512 7e19dce059aa66f93d6e4abaeffeb0473942443da46838c2bb410c9492abbd4873c4b9cd456df8e605765246bf6113bd5edd7f246bfc3b25d94a946aff79831d
SSDEEP 12288:OWyfPLabNHJmAWqrXWSh69QJULxVbw3TX/16qG7FJSekBVOCeo3Nvk4xm3L0:QmNYAWqrGSmQJU3s3TvQlDPkB4O3NNYw
TLSH
T1B2F4010AE29401D8C0AEA175CB980B81F7337C6663E1E39B16D0F57E1F3A4915EE6B43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 763ece2e4b1f9a75a5f6fccfa563647e959c28966130c06c74dc621a27b94960
MD5 b6a080da2665b135ff52ca9b44497852
SHA1 295dfcedc557398e039691ec95eea57af2fde2ed
SHA512 d978f1f91a0880deb156c7de778e487ceb9ba26fecbd16dd857b75623ecb304eea2105c000738643ff412e60a1f3fa47bc24a62b159f89c38696a3dee5d2affe
SSDEEP 12288:RY7jabNHJmAWqrXWSh69QJULxVbw3TX/16qG7FJSekBVOCeo3Nvk4xm3L0:62NYAWqrGSmQJU3s3TvQlDPkB4O3NNYw
TLSH
T1AAD4230A76950441F5BDF57084DC0366FF2CBD563BD8A233382646F9B3658D28EB178A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 eda3261d9156c94051a93b71ccb4b3386ed497998f5d966198cd8d0f6fb746cc
MD5 aaf848db812dba9c2548a4a1f0f9afcd
SHA1 aba9e86ae1f0e3ad737d6e5c6faaf5a046fd9c04
SHA512 c719ef70c96140e950be5305af244f3db14836bc91c3196c4adac285cbfe4f681e03786318130c1add780152a0088c9def21568935795ddfc4ee3b291ecee39c
SSDEEP 24576:cgb6bmBIi49WNNFpg1rSvFv7bYwNYAWqrGSmQJU3s3TvQlDPkB4O3NNYL0:cgb4mBIBhGFtNYAJmQhkD03NGw
TLSH
T1D265AE1E22E802F5E0FAE2B8CDAA4417D6B278161731D2DF1151427D2F3BDE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 10b3ffd644f79d83540a6e0e8daa600b2350c9269dca7c97ec00998520a106ca
MD5 1231db8d7923e6e01ae4fc0d2c6067c2
SHA1 2319822b1fc25335c1a16e15135a90f6f0750d9c
SHA512 433d0c61f7500f1c60bef470602fa716bc3c5da665aa2ac5440fc9ee63dc8df99f260e7712fb2d5e324d64f9f644f7108bf82bf9b1e04c9a9c902fcfbfe5b97a
SSDEEP 12288:bZGjabNHJmAWqrXWSh69QJULxVbw3TX/16qG7FJSekBVOCeo3Nvk4xm3L0:tG2NYAWqrGSmQJU3s3TvQlDPkB4O3NNN
TLSH
T1E3E4230E35F220C0C57EF67588A807A7FE707891379823FF0862D5B9E7694E16675E88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 309a9fc28c686dbe7e7e3bc5aa1baec473d411e8fee3e9ee641e534645aeee35
MD5 dc7238b596919c974aa73b5bb9a8f3aa
SHA1 2cdc23d4453ea7f7c21af96a252ac0493f4c0f27
SHA512 af427d534b1879011dfe5c719340feb7680b1c84a019b5e7c1c07493183ff7f47227e0fd59a1ff915b222749d9525c13fe9bd5d1e9205b6e0e88898723142ef0
SSDEEP 12288:IvabNHJmAWqrXWSh69QJULxVbw3TX/16qG7FJSekBVOCeo3Nvk4xm3L0:IaNYAWqrGSmQJU3s3TvQlDPkB4O3NNYw
TLSH
T1A1D4234E35910082E5AAF5B088CC07A6FF38BD4637DC23F3283686F5A35A4D356B16C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 22bf9d832cf5da60601b8b27117c45f1b96c79de34067aa4a5b1c3ea2af7172c
MD5 f53522f05639271b3af895fdc5b04304
SHA1 5b6312c5254fa0b60a164dd6cb76ac9133896053
SHA512 d0481fc063cef0c163a50a68ce57460b7f9de3746807d5fced34adf33e9573d50d696f4a613f887d680a3fd699a014157740578c21865e02421e9e187de41a6d
SSDEEP 24576:7xB8u8FpJqH1nLrIl7/mzNNYAWqrGSmQJU3s3TvQlDPkB4O3NNYL0:dmZFPqV4l7/iNNYAJmQhkD03NGw
TLSH
T10535015577E101F0D47BE13889864763F6B1B8251364FBEF06A88BA11F23AE14B7EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 332d5eb54c6cda03b7342f196bddf2d2359cb6deb63066d22bd4a29e5f700dfd
MD5 f2488b3d3b668b64191530268866d3b7
SHA1 7d76eabdcb0c8b8ef63a0c9aa69197ff2711b51e
SHA512 affb64042f218aa6207857dfba19dbd6135746527ffc687b77e21f2b5a58baa3a6284e97b317cc7f87ae790b0427d24fab46ee5a8369f3f8bf8746c9434f30e7
SSDEEP 24576:mPUr+NQGNYAWqrGSmQJU3s3TvQlDPkB4O3NNYL0:mJQGNYAJmQhkD03NGw
TLSH
T16705F11F32E818E5E67AF17C89854709F771B8621351A2DF02A1817E5B27DE8BD3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 428644930fdede5c95f3e231cd284b4998ff3a7fdbb37fee3db4c6a749103dbf
MD5 cab4a0ca1c1625ae8b3279dd22ac8462
SHA1 6fdb3698c5a65908a91e0862d0ca62ac786b8cb4
SHA512 9dade99ebf1ad382671083d7209694ff15ab5670a11f65fbe20b380813d1f234e838c276001d906231f18441862e3d40ffdf7fd6e98241924f2782ecc5b2038a
SSDEEP 49152:hBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjZNYAJmQhkD03NGw:CG05lO43bMJm0kDkNr
TLSH
T1C6D5CF6E62EC11F9D1BBD17CC9C64A0BEBB23815033556CB02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 505988035c3140d1719c219872572c171f3767bb0a0796766c873c8dd790aebd
MD5 f520d1cc9f75867ea7ce99e850c42f44
SHA1 8827d3e64a3aebafff6b3eb5ae4231a97baef726
SHA512 a04593b4f9cf7b51c65eb198bc3cd036f695a41306240bed24a7c4bf655bd45b2eadef447e0cfd67f53dc65e01e67bf478fea20f951cae093842a07b3371b506
SSDEEP 24576:Vra5POZ3dpbWVM50JicR2hG0lasx2+47eidnWNYAWqrGSmQJU3s3TvQlDPkB4O39:Va5POZ3wJt2pasx2+msNYAJmQhkD03Nr
TLSH
T15765BF5EA6FC00D5D5B9D17DC583461AF5B1342613329BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 fed4e0ea87c6ecd9127dd71fce1a700c70771ecf61f39a01eb150b54030c1298
MD5 52f801fc2cc0a113009b14bbf5bcfe27
SHA1 a3940ed4ef29133cbbf62bb9e805cb00e2db3f7f
SHA512 e46b1b1475b1c1b2d0d49c8d42d1ce4ff6bbc1cc28f87be33533660847a42dbbaaa5be7eed126e0dbec197bf5b4648234b498c0b3c413305afe4be1e03ddcaa0
SSDEEP 24576:PNcwHdjbyQ4nLC18lb/EOjowL7FkwNYAWqrGSmQJU3s3TvQlDPkB4O3NNYL0:PNc/zEOVHFhNYAJmQhkD03NGw
TLSH
T1CB858B1623E901E4F1BBE1BE897B9646FA717865133486CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 eeb648cd275665c300486edf2914d9ef75097472ced928107ed850a76bbcd3a2
MD5 62abdf02216d6bce4b2d0c70101a4bfc
SHA1 ab6d3d774b747c0040f51b7f40c763d86d767b14
SHA512 4bf37c8331808e63b87b65ede6ea502318f95d3c311b610da4089fb98dffbfda36243790b537046e6094f18b75f30ddbbef635fb5b6f4f6389bf90fc98cdffd4
SSDEEP 24576:TJnJPbzB4SxSNYAWqrGSmQJU3s3TvQlDPkB4O3NNYL0:TJnJv6SENYAJmQhkD03NGw
TLSH
T1F915E02DD2A810E8E4B7D2B4815A175AFF31387D2F2569C718B4D5343F12EE0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 85359df0fc0b1ed230a6ec4a56f8185970b6f23d83308bcc2454e920235fc06a
MD5 a7224d28acf9c14307d3e4dc1109397d
SHA1 84e2a7c6cab7c57aa0d842fe3fe50e13ecc78244
SHA512 b8682319552e2b3d0a17cabed08e5d1598f4ba8afbf3fa534b458df8b6f62b0d7fb838c0d12856737430097d326b60b46523066fd76fc3fdaa0ca4b08e72a65a
SSDEEP 49152:GCLHGeeV5ijCmlDWDkxNYAJmQhkD03NGw:hpJm0kDkNr
TLSH
T1EEA56B05A7EB4184E8F3CAF5CA2694169A327C549B34F7EF4E80C96A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 daedf02453b674a91845d42d8da46861f842366fa4277ef5abb116fdfa345c88
MD5 ab3d2f749e3a63c4840efc6668fc7705
SHA1 9a60a949219c35fd7a05e756b038ac54d1ec7d41
SHA512 39e704695a3f2fd0740ca5f878fae389385d12859f7f5db63be9bac0861a5b4090ec979add0a0034293295a7e77c37625eac0b555b703762a92d197fdf2122fb
SSDEEP 24576:AFDIHNYAWqrGSmQJU3s3TvQlDPkB4O3NNYL0:AFDIHNYAJmQhkD03NGw
TLSH
T13C05020D33B610F5D0BBE03DC5820642E6B1B4B1976616EF0AA4C5BD9FA3DD9B938E41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 fcf5a359bb5f0d7541a52e17a130a605163ebca92783f5d519711a2aac898380
MD5 f4b456fdd2dbb1e8fa343c5ebf8c4551
SHA1 d88b3340656eb9f7c99be355949e8a3e65d05df9
SHA512 fecdd4544002dd8c3a93c754be90dc32600a5b9bca2c6efa617aa8341bb00a669a1615970da0b235a5c84cec5ae5d143580b9115a2841f2298e2da49bd097004
SSDEEP 12288:HG6ky3vabNHJmAWqrXWSh69QJULxVbw3TX/16qG7FJSekBVOCeo3Nvk4xm3L0:mtyqNYAWqrGSmQJU3s3TvQlDPkB4O3Nr
TLSH
T1DBF4220933D410C0E6BEA674C9A543A1EF34BC103BA463FF2461E67E7B366D1A970B46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 7f7b8aa0535968ec0d0438f6beac170ba04b8d3499e9a6c96027cbfc6c7fa554
MD5 60a66b5ca64db3cded4666ba4362a85c
SHA1 c9f91c1b023f0a7e73c117cbf60bb0b4b34937d7
SHA512 fba4848a9ec96ab7ace4d08cbb37e05cde0463c7400967fc290493ef66f37bce37e8f0de9f9472d7aa4fe52f5a20d633e3a3507d65af80624bd872d89180d996
SSDEEP 12288:f91abNHJmAWqrXWSh69QJULxVbw3TX/16qG7FJSekBVOCeo3Nvk4xm3L0:VENYAWqrGSmQJU3s3TvQlDPkB4O3NNYw
TLSH
T1B9D4230D36911081E4ADF9B084DC0796EE347D663BD923F72836CAF5E36A4D346B1E85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 ada42542e47c9c2f3d39702120f01fc05cf921415b2c187e20712ad3d1143083
MD5 26998e458cab5517bb3eb2613d0d191b
SHA1 07a867bba12fac413c658fffcbd9cba7c52e6be3
SHA512 d14f4b15ef709d7ce73c1321462210adda59759d602660f41a8cd5ae91d67c88d8e0d22c8f1853a0f7b1e9daf9d9f343f724e4b3cc522609150406166fb20c3d
SSDEEP 24576:MsgoooTfaidZ0NYAWqrGSmQJU3s3TvQlDPkB4O3NNYL0:pgiTrZ0NYAJmQhkD03NGw
TLSH
T1DB559C1D77EA05CAE2B2D275D8621493DA33B4311772D6DF2448C03A4DABED8AE74F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 9976e2274e7ddc3cf57486b9f1e85d63f7d07947c5a1092f587ec01816fff5e5
MD5 d2b17aeb34b823fd42f187abc6a0fe6b
SHA1 8e2e69da6e25f6dcc0cad10f91c96bc0cc169a94
SHA512 5cc8ecedabb9cd20834c01ee9f53beb6517e8d49a200f9c6fcd58c7b67761a5a73ae24bdb0fb0217f793d3747c43aa7e99ed3caa125e834215c7b2a23ea65c19
SSDEEP 24576:UrcmRSNYAWqrGSmQJU3s3TvQlDPkB4O3NNYL0:ucmRSNYAJmQhkD03NGw
TLSH
T1F905F14EB2AA00E1E1BBD13CC8854656F7B37431275263EF01A1C7BE5A678EA7D34B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 52da3b5702bc0a395a5443dda029427aab20f17cd5b196d05f4db224fabe7f88
MD5 851e9c8aca84964bcb50626e0179eacc
SHA1 9adde3d4b0c6dafe2e775ab4653da87fe3a9d3dd
SHA512 ac0b4b4e9494db61e7c811e7bfda113bcd3a117820caa79c674d7267f181a6348b14bc614a3ebf9bdee72f59978c8f3b50158ad7fffa5c8f633ad49aadf4cbcf
SSDEEP 49152:ODL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3RNYAJmQhkD03NGw:P3Upow8sBoJm0kDkNr
TLSH
T129A58C3DA2E800A8D9AAC379C54213A6EA71782E3F3015DB0174C578BF1BDF19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1212-26-0x0000000000400000-0x00000000005FB000-memory.dmp

Download

memory/1212-1-0x0000000000D60000-0x0000000000DC9000-memory.dmp

Download

memory/1212-7-0x0000000000D60000-0x0000000000DC9000-memory.dmp

Download

memory/1212-0-0x0000000000400000-0x00000000005FB000-memory.dmp

Download

memory/1212-6-0x0000000000D60000-0x0000000000DC9000-memory.dmp

Download

memory/1280-58-0x000001A788840000-0x000001A788933000-memory.dmp

Download

memory/1280-60-0x000001A788A10000-0x000001A788A76000-memory.dmp

Download

memory/1280-59-0x000001A788A10000-0x000001A788A76000-memory.dmp

Download

memory/1972-38-0x0000022A3EDE0000-0x0000022A3EED3000-memory.dmp

Download

memory/1972-39-0x0000022A40000000-0x0000022A40066000-memory.dmp

Download

memory/1972-40-0x0000022A40000000-0x0000022A40066000-memory.dmp

Download

memory/2004-46-0x00007FF763180000-0x00007FF7632E8000-memory.dmp

Download

memory/2004-55-0x00007FF763180000-0x00007FF7632E8000-memory.dmp

Download

memory/2004-54-0x000001DACAC80000-0x000001DACACE6000-memory.dmp

Download

memory/2004-48-0x000001DACAC80000-0x000001DACACE6000-memory.dmp

Download

memory/2004-47-0x000001DACAC80000-0x000001DACACE6000-memory.dmp

Download

memory/2064-581-0x00007FF713000000-0x00007FF713417000-memory.dmp

Download

memory/2064-494-0x00007FF713000000-0x00007FF713417000-memory.dmp

Download

memory/2064-495-0x0000015FD8270000-0x0000015FD82D6000-memory.dmp

Download

memory/2064-496-0x0000015FD8270000-0x0000015FD82D6000-memory.dmp

Download

memory/2272-486-0x0000023AF4BC0000-0x0000023AF4C26000-memory.dmp

Download

memory/2272-487-0x0000023AF4BC0000-0x0000023AF4C26000-memory.dmp

Download

memory/2272-485-0x00007FF742B00000-0x00007FF742BAE000-memory.dmp

Download

memory/2272-571-0x00007FF742B00000-0x00007FF742BAE000-memory.dmp

Download

memory/2288-110-0x0000028D03C90000-0x0000028D03CB0000-memory.dmp

Download

memory/2288-104-0x0000028D03A30000-0x0000028D03A50000-memory.dmp

Download

memory/2288-141-0x0000028D147B0000-0x0000028D147D0000-memory.dmp

Download

memory/2288-105-0x0000028D13E70000-0x0000028D13F70000-memory.dmp

Download

memory/2288-98-0x0000028D00220000-0x0000028D00320000-memory.dmp

Download

memory/2464-466-0x0000000000990000-0x00000000009F9000-memory.dmp

Download

memory/2464-471-0x0000000000990000-0x00000000009F9000-memory.dmp

Download

memory/2464-465-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/2464-560-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/2620-516-0x000001A101DE0000-0x000001A101E46000-memory.dmp

Download

memory/2620-515-0x000001A101DE0000-0x000001A101E46000-memory.dmp

Download

memory/2620-514-0x00007FF74CCF0000-0x00007FF74CF93000-memory.dmp

Download

memory/2936-30-0x000002623D030000-0x000002623D096000-memory.dmp

Download

memory/2936-32-0x000002623D030000-0x000002623D096000-memory.dmp

Download

memory/2936-29-0x000002623CE00000-0x000002623CEF3000-memory.dmp

Download

memory/2936-31-0x000002623D030000-0x000002623D096000-memory.dmp

Download

memory/3232-563-0x000001E9CB100000-0x000001E9CB166000-memory.dmp

Download

memory/3232-562-0x000001E9CB100000-0x000001E9CB166000-memory.dmp

Download

memory/3232-561-0x00007FF7CEF20000-0x00007FF7CF427000-memory.dmp

Download

memory/3308-573-0x000001D204090000-0x000001D2040F6000-memory.dmp

Download

memory/3308-574-0x000001D204090000-0x000001D2040F6000-memory.dmp

Download

memory/3308-572-0x00007FF7A0A90000-0x00007FF7A0BBF000-memory.dmp

Download

memory/3356-583-0x00007FF74CC40000-0x00007FF74CF7F000-memory.dmp

Download

memory/3356-584-0x0000013D4B500000-0x0000013D4B566000-memory.dmp

Download

memory/3356-582-0x0000013D4B500000-0x0000013D4B566000-memory.dmp

Download

memory/3364-525-0x000002850C3D0000-0x000002850C436000-memory.dmp

Download

memory/3364-524-0x000002850C3D0000-0x000002850C436000-memory.dmp

Download

memory/3364-523-0x00007FF6F3EC0000-0x00007FF6F4055000-memory.dmp

Download

memory/3508-437-0x000001E323AB0000-0x000001E323B16000-memory.dmp

Download

memory/3508-436-0x00007FF61D100000-0x00007FF61D1C9000-memory.dmp

Download

memory/3508-438-0x000001E323AB0000-0x000001E323B16000-memory.dmp

Download

memory/3508-539-0x00007FF61D100000-0x00007FF61D1C9000-memory.dmp

Download

memory/3676-477-0x00007FF727000000-0x00007FF727744000-memory.dmp

Download

memory/3676-567-0x00007FF727000000-0x00007FF727744000-memory.dmp

Download

memory/3676-479-0x0000024BDA820000-0x0000024BDA886000-memory.dmp

Download

memory/3676-478-0x0000024BDA820000-0x0000024BDA886000-memory.dmp

Download

memory/3700-506-0x000001BE39890000-0x000001BE398F6000-memory.dmp

Download

memory/3700-505-0x000001BE39890000-0x000001BE398F6000-memory.dmp

Download

memory/3700-504-0x00007FF67F0B0000-0x00007FF67F164000-memory.dmp

Download

memory/3908-538-0x00007FF648660000-0x00007FF648981000-memory.dmp

Download

memory/3908-532-0x000001D60BF00000-0x000001D60BF66000-memory.dmp

Download

memory/3908-531-0x000001D60BF00000-0x000001D60BF66000-memory.dmp

Download

memory/3908-536-0x000001D60BF00000-0x000001D60BF66000-memory.dmp

Download

memory/4468-458-0x0000028D0AA60000-0x0000028D0AAC6000-memory.dmp

Download

memory/4468-551-0x00007FF7B0060000-0x00007FF7B01AA000-memory.dmp

Download

memory/4468-456-0x00007FF7B0060000-0x00007FF7B01AA000-memory.dmp

Download

memory/4468-459-0x0000028D0AA60000-0x0000028D0AAC6000-memory.dmp

Download

memory/4600-543-0x00007FF7758D0000-0x00007FF775B5B000-memory.dmp

Download

memory/4600-545-0x0000028EFA9B0000-0x0000028EFAA16000-memory.dmp

Download

memory/4600-544-0x0000028EFA9B0000-0x0000028EFAA16000-memory.dmp

Download

memory/4696-428-0x00000255C4BC0000-0x00000255C4C26000-memory.dmp

Download

memory/4696-522-0x00007FF61D100000-0x00007FF61D1C9000-memory.dmp

Download

memory/4696-427-0x00007FF61D100000-0x00007FF61D1C9000-memory.dmp

Download

memory/4696-429-0x00000255C4BC0000-0x00000255C4C26000-memory.dmp

Download

memory/5336-17-0x000001EE38480000-0x000001EE384E6000-memory.dmp

Download

memory/5336-65-0x00007FF69C3E0000-0x00007FF69C503000-memory.dmp

Download

memory/5336-18-0x000001EE38480000-0x000001EE384E6000-memory.dmp

Download

memory/5336-16-0x000001EE38480000-0x000001EE384E6000-memory.dmp

Download

memory/5336-15-0x00007FF69C3E0000-0x00007FF69C503000-memory.dmp

Download

memory/5520-319-0x000000000EB20000-0x000000000EB2D000-memory.dmp

Download

memory/5524-553-0x000001134DA10000-0x000001134DA76000-memory.dmp

Download

memory/5524-554-0x000001134DA10000-0x000001134DA76000-memory.dmp

Download

memory/5524-552-0x00007FF7E4C10000-0x00007FF7E50E1000-memory.dmp

Download

memory/5932-444-0x00007FF762DE0000-0x00007FF762EFA000-memory.dmp

Download

memory/5932-445-0x0000020E5C8B0000-0x0000020E5C916000-memory.dmp

Download

memory/5932-446-0x0000020E5C8B0000-0x0000020E5C916000-memory.dmp

Download

memory/5932-542-0x00007FF762DE0000-0x00007FF762EFA000-memory.dmp

Download