67e22723b0e1c0c2081960c773e12a2afaa607b919ac7b07b436636473730bfe

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 02:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe
Size 873KB
Sample260720-cytpyacw5p
SHA256 67e22723b0e1c0c2081960c773e12a2afaa607b919ac7b07b436636473730bfe
MD5 de03b32f37a23f8391ba86103598fbff
SHA1 8dfcb3e5200f467597a1ed28d441472f57ece8c0
SHA512 e72943679cad86b4156f9f970e54680a12edf5bc3d0221c22105443acce6164c68702cbe0cb8847808c6faa2503dda6c90f65f5b771853e24ca8ab5a166fd69f
SSDEEP 24576:Fv/Hb/xc7jT7Jckdwi6i9bNrqq4E41WFpW3oRos:B/HbKL7Jckdwi3N7+WTW3
TLSH
T1D515F12073E48032E1B35A319A3AD7718DBFBC765872D44E63D47A181E32BC0D679B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
5560	alg.exe
5076	GameInputSvc.exe
1404	GameInputSvc.exe
3840	elevation_service.exe
252	elevation_service.exe
800	maintenanceservice.exe
4924	msdtc.exe
3340	OSE.EXE
2536	PerceptionSimulationService.exe
4208	perfhost.exe
2608	ReFsDedupSvc.exe
5944	locator.exe
832	SensorDataService.exe
1072	snmptrap.exe
4964	ssh-agent.exe
1504	TieringEngineService.exe
4856	AgentService.exe
6048	vds.exe
5676	vssvc.exe
3120	wbengine.exe
2008	WmiApSrv.exe
4968	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4ca63b1424febf98.bin	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_117953\java.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005bd2d9b8ef17dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000db8e86b6ef17dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cb6e31b9ef17dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000257e69b9ef17dd01	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1404	GameInputSvc.exe
1404	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4192	2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe
Token: SeTcbPrivilege	5076	GameInputSvc.exe
Token: SeBackupPrivilege	2608	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2608	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2608	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2608	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2608	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2608	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2608	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2608	ReFsDedupSvc.exe
Token: SeBackupPrivilege	2608	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2608	ReFsDedupSvc.exe
Token: SeRestorePrivilege	1504	TieringEngineService.exe
Token: SeManageVolumePrivilege	1504	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4856	AgentService.exe
Token: SeBackupPrivilege	5676	vssvc.exe
Token: SeRestorePrivilege	5676	vssvc.exe
Token: SeAuditPrivilege	5676	vssvc.exe
Token: SeBackupPrivilege	3120	wbengine.exe
Token: SeRestorePrivilege	3120	wbengine.exe
Token: SeSecurityPrivilege	3120	wbengine.exe
Token: 33	4968	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	4968	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	4968	SearchIndexer.exe
Token: SeDebugPrivilege	5560	alg.exe
Token: SeDebugPrivilege	5560	alg.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 1404	5076	GameInputSvc.exe	91
PID 4968 wrote to memory of 1152	4968	SearchIndexer.exe	113
PID 4968 wrote to memory of 6104	4968	SearchIndexer.exe	114
PID 4968 wrote to memory of 5056	4968	SearchIndexer.exe	115
PID 4968 wrote to memory of 716	4968	SearchIndexer.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_de03b32f37a23f8391ba86103598fbff_elex_mafia.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4192

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5560

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1404

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:3840

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:252

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:800

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4924

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3340

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2536

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4208

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2608

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:5944

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:832

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:1072

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4964

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1504

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4856

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:6048

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5676

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3120

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:2008

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3611646547-550105268-947503007-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1152
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:6104
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2724 2704 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5056
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2612 1892 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 743432f10bfc1e72332ac5d9d994a6145d6544a20a0647daa46f6e1e910d8089
MD5 cb9fc810dd22ba0642d08d21a54f5ea7
SHA1 043018394dded38b61061a8ebdef6956b1443ba4
SHA512 ae75995423443c12cf46b1a22b53214daff48b30c9c178fabbb944adf64de9feaba2bf729f46b51fcec9da389116ca3c01f99e446b89e47bcf28e528132cbb03
SSDEEP 49152:bb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnY7Jckdwi3N7+WTW3:p3q6gjBlPdwi3Q
TLSH
T1E4D59D03F2D900E9E06AD178D7469132EAA2BC890B34B6DF0790B7552E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 fb8bedc884f1f4eb3b339c4c4c97f24d134654dc0586e639600e18da6463607a
MD5 e29f8dacd3c694ba5831b034aa113a1b
SHA1 cbab57e9a6554faf33525cf310b6bccfb19d6060
SHA512 9d6e8dd63e4f222f8e9dc88abd2eac6a4f4a7abf8fe513cb3cad41001232687c46da0525b302b83875150992e6c80d0cdf6dee00610274f87bf3026829490c25
SSDEEP 24576:7XYkeOczAVoT7Jckdwi6i9bNrqq4E41WFpW3oRos:OOc17Jckdwi3N7+WTW3
TLSH
T1C3050128A3E409F9ED67C239C9B2C515EA7278514760FB8B03E496651F233C46E3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 4d7797686fd795a126a472f960703ad97fae034ca60e97292815b950ad387c25
MD5 da73836ccdfa82242e6e2ee1996ff5d1
SHA1 ed3ab3b758ba515fcb9db97a8040ac8673a36714
SHA512 c18920698909a69b7b1c083fce9e08b9143498bfd04d1ace188b6cb4851b5e0decf4290c99ca23845f1690ea310a66d6e3107f5b82191d8471ec56245e45d474
SSDEEP 24576:l0Ne3jY0donOrMXWLEkgXWHiYKbfZB1v3adCMW:lHjY0WOLcfT1S1
TLSH
T159359E16F6748335D073C0B9C5D2A68AED7130865B308ACB4296D77C3E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0135d72a29b344499edb735f1dbd5bb1299c301afcb43b0f4baa96569bc6d070
MD5 eaf8ffb0bdac3a2105c70a7672adef6f
SHA1 241a1fc76bf2776ec54940c5c5767d1fda30e94a
SHA512 2469fb0e8f20a0fd2b575a8df1972de73e658ee5e93ad6ef66ef2c392a74cde0f353a7cfb483b2128c741cd70b9070d5b3038ac1a005240db04851ed263b5fa8
SSDEEP 24576:NIycezSC6v/yD/aqgrvW/6q8wyuFWLEkgXWHiYKbfZB1v3adCMW:3cezSC6v/zPvuHjyrcfT1S1
TLSH
T150756C15F5788323D0B2D0BAC5D6AA9AFE7230465B3089CB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 f2e333af1109b738cd2072d94a791be2ba71f8fa174c97ac4c61fe1683fdc63e
MD5 ea0db1c4c97a51dd66255aba37fbb658
SHA1 a0daf3f6992d707823a3b8a5d55f362ba1078945
SHA512 a74c7acbff4184b8891f99c3bd625bda91e51cb69b706283c585111146025de7119f849ee620d15d218eb1228926c94ae5b23f70cf239713c07d4653eb711a92
SSDEEP 24576:7AbDPbx80Hpl+dUWLEkgXWHiYKbfZB1v3adCMW:7ALx80Jl+7cfT1S1
TLSH
T1C0559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB0246D76C3E67BD6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 10f056b7ef8043a9dbcccd2bddc8f495909b2090456607d60d5007cea453c078
MD5 475803ca9618638eb1a27dfe04830d91
SHA1 224e83012ec5c2cc433d8f5a91b0c9618c112d19
SHA512 5c113eea2a976694bfbc29a2c79c4dbed28b77ad47db4e00a2c6467b292c7370828dcf070e30a498f1a65a164b46a1b8bdbbfb36c6b6b94c0063492c75d4c4d8
SSDEEP 12288:QwWWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:QwWWLEkgXWHiYKbfZB1v3adCMW
TLSH
T12BD423237654265DEBD1E4795233C8973B7838D48B00B96E877264972AB4A0BEEC70C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 09d6ac84282beef302508e93c0eda860c8f243aaf4419a60c0d6834399ebf26d
MD5 5f854a110b056c0fe01084c8be6b1a61
SHA1 62ea24f32ddda8d9a5cdd6b09bfb4ec1d13d265f
SHA512 ed26566c6bc80897dbb4b8f6e3478f91182b93c93ef3f170bc664c9c04a361683a542ed300a76c64b32aa319f7ca2f783e1a6f852a0d98845a9e5d5a905b8e19
SSDEEP 12288:8eBNUbTVO86Ub0PUByzVc145o69xT/E+CQE7caOUnDyEtH1SEfRTn:8JIUb8Vc1eoYTxtsD91Swn
TLSH
T15015D03BEE28FCD2C67E59B856A18600E7B274304B61A3CBD175834EDE235E05E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 7c7f2c6679715db38cb5241e0f39f0ad4cd319f48cbced9c302d344590a1c1df
MD5 974039e14fb582b4079b9f954ab31633
SHA1 6c1e8ccfbce142fdb267b1df0f8ffbf89aa27bbb
SHA512 593695bc38923359f6efaf279718206f484e5afe009b21f60694eb627f7aa52d79071101ec99ee1720a360e5274581c14b3499705047229c90eda6dfce502c9b
SSDEEP 49152:XQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5JyNRV3THy:XQvGAdlCEL8c/bRNW5CF0O
TLSH
T185367D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 b30f05617083bc2a9f1bc59b65ce4338fc8fc26ff1149617f99e6f52e41404b8
MD5 3dca6fb0e7394e4e27ba39f753691a51
SHA1 fdbf940316206f7e2b45dce98a5b29c18ec88183
SHA512 f766ecaf97cb0fc025138620556c078ea289f1e0ae166149be19841d4bb956e4818ffe5d27dfa2326c35f080d4f04bfdb883d4f671101067eaf874f169e8e34b
SSDEEP 12288:BfwSfxL/2Dc3bDLLmt0LDQewsAjfPUByzVc145o69xT/E+CQE7caOUnDyEtH1SEh:BmewsAjpVc1eoYTxtsD91Swn
TLSH
T10B15E031FA74E432D77F0DB61B32C716546D7A204B611AC3E3E88E9E59302D22776E1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 175810c72233efa8a0eb65d3bad7f8bcd04add69539a7c7089b9e7c7165ff2f2
MD5 399831fb66f3d80cfb9488606ed9c3e5
SHA1 12557d8e58c9eb723d0c6038884ff0d07ca86b7d
SHA512 d12b880014f71cb7aa03c466030d995fc60d1b0e4c61475ed6fa2b86e53ca5588d494aa5f003cdda268acc34e4174a495eceb9642dbd2b1b6fd6366fe3e36190
SSDEEP 49152:e69RquA/m2yL5zMfFiV+XenmE3/zm0xt+3:loq1Vjnmz0O
TLSH
T116D58D0976B8C1E4D1F6C37896A2C647F37178154B34A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 ed6d5cc45e8af1d5ef572a73b8fbde2b7c886785003fd53e643756090f9e7f3f
MD5 3c3b533523d2cf2d33d729ac03bb296d
SHA1 4045ad4a8c31b922d83b61c4ffa5b91a2d894e70
SHA512 1a03986387626b7cc4552e89d20bc223d36f48df8bfd0d1fb646bc09df30934ae67a77977f871b9337df9482757b5df35691633d462ff16f8ac4d1d2174d57f4
SSDEEP 24576:Owu+OWXT7Jckdwi6i9bNrqq4E41WFpW3oRos:OwlOk7Jckdwi3N7+WTW3
TLSH
T1F305F14972A40CF9E9679239C65BC135F7F2BC022A25DB1F0760C65A5F27351BE2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 ffb272f5388fa7a8de4594b88c78f03b14be150f23ace66fc1ed897e0e2e5307
MD5 3b436438d5b636148636905c4562b991
SHA1 1519ea1ec0f42f77e7b93ad90264b6296ef97b80
SHA512 1fa565f5361f70037ce531f85dbc50d18c9b546650ccb2a6da6fb9d047db93e06d70db20b2aeb8ea28657ce7bd900e5b869b5c859537ed8cd56b3a91012b5040
SSDEEP 49152:CB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl/7Jckdwi3N7+WTW3:wu6JmTxd2d1Pdwi3Q
TLSH
T118D59D13F1DA01E8D06ED478974A9233FA62BC490B35B6EF0A9073552A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.0MB
SHA256 30b92df58c29b2a5adcc512faa6662a86e701868fafcd7fbd84f52689ed29a1d
MD5 459208e50e53b5fe6ee46a692367d217
SHA1 5cd2c8935f3269da7027d286f989feeb382ef737
SHA512 4e85621418b6d37a3daed34bc93e9d70620ecf4e001ee0acaf95144082fd59af993a75f6d9d926d5f6f600dc74508cd0c0ded657c7d59c345b1f3d4b2447be36
SSDEEP 24576:57wvtk9RX6wkyAI7WLEkgXWHiYKbfZB1v3adCMW:mMnYIqcfT1S1
TLSH
T1EF35D029EBDC04E5E1B7D13C89B3460AF6B178691B31C6CF025A52AE0E37ED45E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.6MB
SHA256 db1690efd70c5ed1ffc6b5a1bd882f6cab5a5f98146c9353fd4759e390ecb75d
MD5 a08e55f3529c0412434da4be98e147ec
SHA1 3e12789d8a802c00e921be077c047eb923355d23
SHA512 9c24bea8d89799760e1a5fd4d5a48cd11da20095f76e2ef333ee41f0308c1c8bf09154c5adf9751388764a674107f750c2adc1909557b581b0ab0d883d8c3120
SSDEEP 49152:YYGDNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0QcfT1S1:SySzP4cfT1Q
TLSH
T1E5067C56A16801D5C1B9C1B98B1BCC1BFBB134490335ABEB03E556931F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 a99428897b975ad657ee951ceb25c05f0738df6f1491dd6555c3055dbf85bd39
MD5 3a7a15dae19c220b7672bbc1bcfb700b
SHA1 b9981d18cac9d871ec64929789849f1349ec4633
SHA512 843d8679ae874eb321a706c9e56532ff56b020cf344edfd888553a511b2e3ecad638c66d539ae2c726bd8e256060566420176aaf99512944d7ca308da3c1f38d
SSDEEP 24576:627Jb1aQZRXLfOrIhnjFN8rnDHU2+fF/AY2WLEkgXWHiYKbfZB1v3adCMW:627JUQjXirIhCnDHUPfF/dcfT1S1
TLSH
T17065AE1EA3EC01E5E1BAD27885158A5AEA71742E1F31CACF1270827D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 e6490bdb3a1f27865912886cb40009d9bebc83e96ffe8b79af0907f27d6e8b2c
MD5 4a0314f30e23c6e7b54318bda8b7db2f
SHA1 59f1d0cfdf02263513a78425b050a744864997a3
SHA512 6819aeb91c956b80a3006b6f6271bbda5ebab2eacbe1ec980bfc245a1a36aff53970709e80a8bbe13351ca57b580faeec45a341feb2eb87dfa85430ddafc4470
SSDEEP 12288:BN7jT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:bjT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T103D42308835D5A5BE677D231823DD2A4F66C3F523F54FA87964462A064293807FABF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 3608d1a49076b35b8f01c1d0ed00f3a046cddfdc209aba6b288f94226e66e8b6
MD5 df943685cc536f0c4ff2ab0458a5a470
SHA1 228bdce7d5d2b0b962a30dcbbe87f1ca2858e847
SHA512 3d08ed057a82aba26f4193876db6e4d2fe599c55914fb6e75e925c375c432d24c752a529f768e92ce74d79f3e4ca4e485d0ec4e151e032388cc2e65be3ec39ae
SSDEEP 24576:Dgb6bmBIi49WNNFpg1rSvFv7bYRWLEkgXWHiYKbfZB1v3adCMW:Dgb4mBIBhGFjcfT1S1
TLSH
T1CD65AE1E22EC02F5E0F5E2B8DDAA4417D6B278160731D2DF1251426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 660KB
SHA256 2c814059e7e69a1d1877451565653d176c2133e8e6ceff3440d6ed0638590bab
MD5 3212c07c7139cecbe767fa17a15bcdd1
SHA1 8626c5d55d99bf2d610363e70d0fb2b7989dfd54
SHA512 3f8f2f7bedaefde8e813280391b643fe0cb829adbc20df38dd8b888bcf4825cb0fd65a6408ac4242d0408156c8344547e127c3a1d96d97ea59a6877f2e57f85a
SSDEEP 12288:QhGdT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:EGdT7Jckdwi6i9bNrqq4E41WFpW3oRos
TLSH
T119E4230C61AA35E9C637C231C53DE5A5F9F03A512B247AEF46D0A2709B193D0733EE28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 624KB
SHA256 282f4f50fc83891bfee499020ffc6abb2dda37d343ff0d6851cf5d897f27ad45
MD5 a6fdb6d596d14887cfcd67c8cb3a741d
SHA1 bcd16c08ba5e1bd4a750891ecac9d18c9ce66f2b
SHA512 55bc63a1f76a66ccf57bedebff40de17b05162376d8f4495165a07ed78f5ef65ae920acdde04e0d778ecfd6ed6b78f5d1050d4440ff44bc485a2b628fc338375
SSDEEP 12288:PjWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:PjWLEkgXWHiYKbfZB1v3adCMW
TLSH
T157D4232271552B9DEAD0E5BA4233C9523B7830E58B0075EF8A76505336D4FCBAEB60C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 6133680feb9dcf57341124839744ae6ef58e62a5992fc3c08399879da7251a77
MD5 16d6794dc238b726b630b14178b25ecf
SHA1 6a09c79850267c79cd1981ac8f3a44b9ade53aac
SHA512 f518a9b76aef7a8e0bbf7db9d25561ff5150544f07d804a4fe8ddb6aacda2091f086970f7fc62560f5b404ee4403b97d9fc67e2dc5ff69de71ae92a54c6434e4
SSDEEP 24576:itZ8i8FKJqH1Mzria7/mWKWLEkgXWHiYKbfZB1v3adCMW:qeFFmqVra7/NcfT1S1
TLSH
T18435F12576E102F4D4B7D1388A528663F6B2B4250364FBDF07A88A521F23BD54B7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 828KB
SHA256 467a9654a0c3021f8c2b6ad49c311690ac2aaea6428557d4fa713302759bc3d0
MD5 83f6db3d1dac514013f7ee63d05e4d36
SHA1 5b341303a8d35085f02f17582cc389bfdb958d32
SHA512 74a70d5becfb6f24f8636ab53a149ac07e358b3ebc9de26be3785e33dab063def9a7fe7d58e45d8a0d6d0e8e5693059423249bebbdf955fc232cbbc5cef8b307
SSDEEP 24576:rPUr+NQbT7Jckdwi6i9bNrqq4E41WFpW3oRos:rJQn7Jckdwi3N7+WTW3
TLSH
T19C05F11E62AC18E5E677E13D86968719F77178621712E2CF02E0817D4F27AD4BD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 26e406b289d2da14d559dbd4cb5e9c763e95467756bec1db216c458b21646f97
MD5 35d2d3b0de3ec46e4a161d29fe56eb30
SHA1 f6ca4424b664fffc96f5f9509cfe924af108a565
SHA512 cce798fd8a2effd86d071d1ddd73d45c3deb3d7aaf8a0351e28b23e9dcbdbb45c95bdb5b79f966f09cb6cd46efa9bd10405eb74618b527651a505ce9d6db71c9
SSDEEP 49152:GBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj2cfT1S1:pG05lO43bbcfT1Q
TLSH
T152D5C06E62EC11F9D1BBD17CDAC6860BEBB23415032456CF02A486A91F27FF4597E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 1f63bc8ed9ef7b0965196dbf8e77caead18a4e5b5d31d3649e0c5130bac93fa1
MD5 695ed5d6695530819fda04bc44f18382
SHA1 08dbe677b793c60c58253401f1893cb63ca85183
SHA512 21046eed63ffa4be77c802e01877fa884d22b73b391bd4a7a1268e27e4ab352c67e4b9b088c18d0bcc0a6cd652a1359a76a95f8146410d713fbc86351fb36653
SSDEEP 24576:0Da5POZ3dpbWVM50JicR2hG0lasx2+47eidnZWLEkgXWHiYKbfZB1v3adCMW:ga5POZ3wJt2pasx2+mScfT1S1
TLSH
T1A765BF5EA6FC01D5D5B9D17DC583861AF5B1342253319ACF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 01c230f8155d38f63cd261a89e6920676926f920a73c2ac5497c1b25e55b4eaa
MD5 5028ae797ac88e69bb5e8aefa52940c2
SHA1 2858d9ea0299b4bbf1198a9a5b9b17a585ba8cbe
SHA512 6c8eaa76dc3d473064f32bae4c11dd7428d1209e4b8e6dfacba35bf753578011ff7aa061bf7bb54094d16f38c55c537b3b9a1d4f376cd2c2d134b67d0c23329a
SSDEEP 24576:8NcwHdjbyQ4nLC18lb/EOjowL7FkqWLEkgXWHiYKbfZB1v3adCMW:8Nc/zEOVHFocfT1S1
TLSH
T100858C2623E901E4F5BBE1BE89779546FA71786553308ACF0291811B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 932KB
SHA256 4de3fd5bedc2cf17b2d71bb9fd164d752fbcdd4469c2e5cd0d70cc448f96dac9
MD5 cbd15b5b2c474c0fa52d49527ac6206f
SHA1 1c7017f728b6052d99af445cd617e8e18f690c95
SHA512 c190202acbdfff9db627003b33e145514a132960eae33a5796a4cac4c726742a79dd10ee4113250e8b44b3a1d824bf7b83a0ce70abab818fd1c24ea64bae92db
SSDEEP 24576:4JnJPbzB4SDWLEkgXWHiYKbfZB1v3adCMW:4JnJv6SycfT1S1
TLSH
T1F515D03DD2A810E8E4B7C2B4811A1A5AFF31346D2F1169CB19B4D4353F52FE0AA79F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 a4b62eb880409dc24d3803c6e792614b84a12d7a277181127b98e5fae3ad96a6
MD5 b66d2282d0d69fe9fbcac6870961456c
SHA1 7f1db69ecda8991e8c0764d4b527f298512cc02a
SHA512 7dadddf20980d1db99874ad523c8bd550674e1ece4fe6c4e382731ca8f45503a6ece76f77ec11f3ed03b06c4595203962184b34583e12c1ef605f6f701f04968
SSDEEP 24576:wCLHGL0MoeVtFumTijCmlKQWDk1eWLEkgXWHiYKbfZB1v3adCMW:wCLHGeeV5ijCmlDWDk1/cfT1S1
TLSH
T1D4A56B05A7EB5184F8F3CAF5CA2294169A327C549B34F7EF4A80C96A1E32FD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 776KB
SHA256 7e96bc9844fe45013f237e1bb948d527e5da5d9d82af6202800a5b42e4ff34fd
MD5 d8b4d72b74ab051b72e5cae7aff0d809
SHA1 49dbac7024b96361fcc8e41b46378b70a8de596f
SHA512 bed5a50f38394c641d0968437cefed1ca63c4d570cb4503ea3df51e8ddd11fafdf9a92eaeddf69b17feb6df4f0a1ec3ab3bbe06d1ca486f3c9df14fc7bdf661f
SSDEEP 24576:U6DINT7Jckdwi6i9bNrqq4E41WFpW3oRos:U6DI97Jckdwi3N7+WTW3
TLSH
T1ADF4010C237A11FAD167D03EC6934551E2B2B57197226ACF07D4C1B99EA3EC8BA3DE50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 760KB
SHA256 3575cb990003048f20a15dd8775e2433946a82534f264f433e25aa9e15db1d78
MD5 b444a0c358ae3dca62699d73470bb9f8
SHA1 7d8f669f3b845330f6a443712ad56b9b43c1269f
SHA512 20fa4e0a571388bc874af2f7c3299599a3f93ff92b984fdd7ed4fd8064fcfef6b3992d85aa506cacb9025e5990382adf33f14b0837a73403d2f9bc7072ba8cd5
SSDEEP 12288:SG6kymT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:btymT7Jckdwi6i9bNrqq4E41WFpW3oRB
TLSH
T138F41208539821D9E6769234CA7682A4EF747C116F21A7CF46D0E33D2E3A7C0BA75F25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 632KB
SHA256 92ceb9a7ac173e1aae68ad76843c9477164ec1a3c52be19613a6484ddd508a51
MD5 8c5f0c0df407ff18886e2f1ed45ea7fc
SHA1 b5b2d7334c0b3ce90d3bc1f23e95939aab9fd69e
SHA512 237e250604bf4ceaf399c1c0043837e786f45e1faefd7c133de5b591123bc83d0b4781737d12e8b72dac50d6309e08d150dad5e622a0efb913dd2c988938d2af
SSDEEP 12288:OwBWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:9BWLEkgXWHiYKbfZB1v3adCMW
TLSH
T17DD4232A7265369CDAC0E57D4233C592777430F48F0075FF8AB294722BA4BC66EB6487
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 2e468641bbe07d9fcddded73dcf02360399cfbe12f7a47a869e52697e11b6b69
MD5 90d13a2f49565e02dcf33cb87e81161a
SHA1 a24dc5d094ad44fd59311c6af4ff0066c6d95c6a
SHA512 fd73fb412ee00c713f6dc06f0b5b8db14e2a5f37c4600fe669a81eadc45bd966ee091bbb402405fdeffcdf9525e739a658016c53d629e2c50cdd6c7f2333d196
SSDEEP 24576:fhg59oTfaidZPWLEkgXWHiYKbfZB1v3adCMW:pgYTrZecfT1S1
TLSH
T1F2559C1D73EA05CAE2B2D239D9325493D633B4315772D6DF2448C03A4DAAED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 792KB
SHA256 c8fef7fdf073850d2ca28ec98236bf2c98249e65fe2dc035f24b8f58a1a1307f
MD5 2f6cfd9b7f997233350202de3fbdac4a
SHA1 5502c5fc60a1a943dcdd543dbdb50188387fa501
SHA512 0b9c5c6f6bc8a7f95361cb09434ae4ec4cf26eb1a841872c2aabf18b1fcfc2167635cb38ceed57e4d77016da5a1070730cb2a1a56665a67d1db048297993e2c0
SSDEEP 12288:QpJcm8CNiWOyEpulgXWBqAXjqF4myKbXP2KQCY6jd1vkMadC6xzSxV:QrcmRiWLEkgXWHiYKbfZB1v3adCMW
TLSH
T12405011EB2AE00E9E1B3D13C89528546F7B33070570167DF02A1C67E1E67AEA7E39B41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 66e4a75baebd54b0122c5e3386682039e9eb50b7f9daba4816566ca56b164924
MD5 af2a02cfa1fb7d3f6be69c1005619f25
SHA1 8416dfeb0a3b4b289505ab1e33abd5e3d2ad990a
SHA512 246f80cfbff18e1a7e72166757046daa0dd76f4fdeca86f8e9068a0d74f07cabe04df3e8bec09122907a4846500dcec84fb2de75d30b6f1d3b8e6fbac3afe910
SSDEEP 49152:MDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3vcfT1S1:J3Upow8sBGcfT1Q
TLSH
T1B5A58C3DA2E810A8D9AAC379C54213A6EA71742D3F3015DB0174C478BF1BEF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 91bd576c4405feac04d201c304e11b51b5eefe01dce3017a5d0b1a3b9ae88858
MD5 19705cb77e60826cffb21bbc4e8cbe1c
SHA1 86e71fc22772440837496206a01d2b647684e03f
SHA512 825cf98b373fa71e6a6e4ef1aa19c62d442558363773475c33797145d9eebf7d67c32a0db54eb866fb96e4e2f8b0285329979d2c062122097f40377123c306a5
SSDEEP 24576:5TkNvNnaFeYhJNtmZBmVT7Jckdwi6i9bNrqq4E41WFpW3oRos:5TMwBtOm17Jckdwi3N7+WTW3
TLSH
T18F55AF6EB6B806E4D1FAC675CE238512F6727461173293CB4390C13E0E679D89E7AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 988KB
SHA256 aad5468f5a8a16d7b40ae950298a57026ba3b699e82e7214f18b2c9364501a93
MD5 bf93fb4724abf3f7ce56104c86ed844e
SHA1 d5abc778e3648aa4b54d30adc79235effc580a91
SHA512 cb313ee37376c73fea14be909cbc49413b952ed9fd7b784d4ace102f78a21b266b11e49152296b440d1a1509f875320f9ffa365d0f9915bf449924991df82001
SSDEEP 24576:UD3FHshBIYQgAZWLEkgXWHiYKbfZB1v3adCMW:UDVHeBIAAQcfT1S1
TLSH
T15B25E13EE69C04E4E57AD1BCC6638A06E77138A9032165DF02D481B61F6BEE47D3AF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 768KB
SHA256 b105b8ecc3839f7b95e2c3fea08a505e46d836c08472ed9f10f0a3768aa95b40
MD5 a683e97e56e88f1af31487c7f1fc925e
SHA1 e211b7ee11fb4064ab6b6efab5e876b57a127d74
SHA512 f49e54cc1ffb1376f3c72430541e9e04adb2ecae3c5bab48e6d37ad992b367c158d182d84bd3013fd781ee571d72f270bc20bcb6f2e2fe0dbd26b3334faffcba
SSDEEP 12288:iyW6b3IkxjbBzLT7JckYkM4PoEd+hEp9SWi6rqq2REul1WDGx2pWFJoRfdGtSb:E6UqjpLT7Jckdwi6i9bNrqq4E41WFpWc
TLSH
T194F4124D52D424EAE1769230C639C264D5B47D322775BADF22D892798B36BC0A63FF30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-56-0x0000019E3A120000-0x0000019E3A186000-memory.dmp

Download

memory/252-57-0x0000019E3A120000-0x0000019E3A186000-memory.dmp

Download

memory/252-55-0x0000019E38F00000-0x0000019E38FC1000-memory.dmp

Download

memory/800-71-0x0000022ED6320000-0x0000022ED6386000-memory.dmp

Download

memory/800-73-0x00007FF760770000-0x00007FF7608D7000-memory.dmp

Download

memory/800-65-0x0000022ED6320000-0x0000022ED6386000-memory.dmp

Download

memory/800-64-0x00007FF760770000-0x00007FF7608D7000-memory.dmp

Download

memory/800-66-0x0000022ED6320000-0x0000022ED6386000-memory.dmp

Download

memory/832-194-0x00007FF7B33F0000-0x00007FF7B3806000-memory.dmp

Download

memory/832-212-0x0000029169490000-0x00000291694F6000-memory.dmp

Download

memory/832-138-0x0000029169490000-0x00000291694F6000-memory.dmp

Download

memory/832-214-0x00007FF7B33F0000-0x00007FF7B3806000-memory.dmp

Download

memory/832-137-0x0000029169490000-0x00000291694F6000-memory.dmp

Download

memory/832-136-0x00007FF7B33F0000-0x00007FF7B3806000-memory.dmp

Download

memory/1072-146-0x00007FF6C3710000-0x00007FF6C37C3000-memory.dmp

Download

memory/1072-201-0x00007FF6C3710000-0x00007FF6C37C3000-memory.dmp

Download

memory/1072-147-0x0000026911460000-0x00000269114C6000-memory.dmp

Download

memory/1072-148-0x0000026911460000-0x00000269114C6000-memory.dmp

Download

memory/1404-94-0x00007FF7181B0000-0x00007FF718278000-memory.dmp

Download

memory/1404-39-0x000001728CE60000-0x000001728CEC6000-memory.dmp

Download

memory/1404-40-0x000001728CE60000-0x000001728CEC6000-memory.dmp

Download

memory/1404-37-0x000001728CE60000-0x000001728CEC6000-memory.dmp

Download

memory/1404-36-0x00007FF7181B0000-0x00007FF718278000-memory.dmp

Download

memory/1504-205-0x00007FF65CC40000-0x00007FF65CDD4000-memory.dmp

Download

memory/1504-165-0x000001575EAC0000-0x000001575EB26000-memory.dmp

Download

memory/1504-166-0x00007FF65CC40000-0x00007FF65CDD4000-memory.dmp

Download

memory/1504-167-0x000001575EAC0000-0x000001575EB26000-memory.dmp

Download

memory/2008-251-0x00007FF66EAA0000-0x00007FF66EBCE000-memory.dmp

Download

memory/2008-221-0x000001BDE2810000-0x000001BDE2876000-memory.dmp

Download

memory/2008-219-0x00007FF66EAA0000-0x00007FF66EBCE000-memory.dmp

Download

memory/2008-220-0x000001BDE2810000-0x000001BDE2876000-memory.dmp

Download

memory/2536-155-0x00007FF6EA800000-0x00007FF6EA949000-memory.dmp

Download

memory/2536-100-0x00000162CCD10000-0x00000162CCD76000-memory.dmp

Download

memory/2536-97-0x00007FF6EA800000-0x00007FF6EA949000-memory.dmp

Download

memory/2536-99-0x00000162CCD10000-0x00000162CCD76000-memory.dmp

Download

memory/2608-276-0x00007FF7962E0000-0x00007FF796A23000-memory.dmp

Download

memory/2608-118-0x00007FF7962E0000-0x00007FF796A23000-memory.dmp

Download

memory/2608-120-0x000001376AC40000-0x000001376ACA6000-memory.dmp

Download

memory/2608-119-0x000001376AC40000-0x000001376ACA6000-memory.dmp

Download

memory/2608-184-0x00007FF7962E0000-0x00007FF796A23000-memory.dmp

Download

memory/2608-274-0x000001376AC40000-0x000001376ACA6000-memory.dmp

Download

memory/3120-206-0x00007FF714140000-0x00007FF714646000-memory.dmp

Download

memory/3120-207-0x000001AD33ED0000-0x000001AD33F36000-memory.dmp

Download

memory/3120-246-0x00007FF714140000-0x00007FF714646000-memory.dmp

Download

memory/3120-208-0x000001AD33ED0000-0x000001AD33F36000-memory.dmp

Download

memory/3340-88-0x0000018052AA0000-0x0000018052B61000-memory.dmp

Download

memory/3340-90-0x0000018052CC0000-0x0000018052D26000-memory.dmp

Download

memory/3340-89-0x0000018052CC0000-0x0000018052D26000-memory.dmp

Download

memory/3840-47-0x0000014E2AC40000-0x0000014E2ACA6000-memory.dmp

Download

memory/3840-46-0x0000014E2AA40000-0x0000014E2AB01000-memory.dmp

Download

memory/3840-48-0x0000014E2AC40000-0x0000014E2ACA6000-memory.dmp

Download

memory/4192-38-0x0000000000AD0000-0x0000000000D7B000-memory.dmp

Download

memory/4192-1-0x0000000003080000-0x00000000030E9000-memory.dmp

Download

memory/4192-23-0x0000000000BC3000-0x0000000000BC4000-memory.dmp

Download

memory/4192-0-0x0000000000AD0000-0x0000000000D7B000-memory.dmp

Download

memory/4192-7-0x0000000003080000-0x00000000030E9000-memory.dmp

Download

memory/4192-257-0x0000000000AD0000-0x0000000000D7B000-memory.dmp

Download

memory/4208-107-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/4208-106-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4208-164-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/4208-112-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/4856-173-0x000002170DD80000-0x000002170DDE6000-memory.dmp

Download

memory/4856-174-0x000002170DD80000-0x000002170DDE6000-memory.dmp

Download

memory/4856-178-0x00007FF64FAB0000-0x00007FF64FDD0000-memory.dmp

Download

memory/4856-179-0x000002170DD80000-0x000002170DDE6000-memory.dmp

Download

memory/4856-181-0x00007FF64FAB0000-0x00007FF64FDD0000-memory.dmp

Download

memory/4924-78-0x000001E02BE10000-0x000001E02BE76000-memory.dmp

Download

memory/4924-76-0x00007FF7B3B30000-0x00007FF7B3C49000-memory.dmp

Download

memory/4924-77-0x000001E02BE10000-0x000001E02BE76000-memory.dmp

Download

memory/4924-135-0x00007FF7B3B30000-0x00007FF7B3C49000-memory.dmp

Download

memory/4964-202-0x00007FF6DCD40000-0x00007FF6DCFE2000-memory.dmp

Download

memory/4964-158-0x0000026524CC0000-0x0000026524D26000-memory.dmp

Download

memory/4964-157-0x0000026524CC0000-0x0000026524D26000-memory.dmp

Download

memory/4964-156-0x00007FF6DCD40000-0x00007FF6DCFE2000-memory.dmp

Download

memory/4968-231-0x00007FF689710000-0x00007FF689A4E000-memory.dmp

Download

memory/4968-228-0x000001EE4E2A0000-0x000001EE4E306000-memory.dmp

Download

memory/4968-230-0x000001EE4E2A0000-0x000001EE4E306000-memory.dmp

Download

memory/4968-252-0x00007FF689710000-0x00007FF689A4E000-memory.dmp

Download

memory/5076-63-0x00007FF7181B0000-0x00007FF718278000-memory.dmp

Download

memory/5076-27-0x00007FF7181B0000-0x00007FF718278000-memory.dmp

Download

memory/5076-28-0x000002A7EFBA0000-0x000002A7EFC06000-memory.dmp

Download

memory/5076-30-0x000002A7EFBA0000-0x000002A7EFC06000-memory.dmp

Download

memory/5076-29-0x000002A7EFBA0000-0x000002A7EFC06000-memory.dmp

Download

memory/5560-16-0x000001CA29090000-0x000001CA290F6000-memory.dmp

Download

memory/5560-52-0x00007FF6F4A20000-0x00007FF6F4B42000-memory.dmp

Download

memory/5560-15-0x00007FF6F4A20000-0x00007FF6F4B42000-memory.dmp

Download

memory/5560-17-0x000001CA29090000-0x000001CA290F6000-memory.dmp

Download

memory/5560-19-0x000001CA29090000-0x000001CA290F6000-memory.dmp

Download

memory/5676-197-0x00007FF722B70000-0x00007FF723040000-memory.dmp

Download

memory/5676-229-0x00007FF722B70000-0x00007FF723040000-memory.dmp

Download

memory/5676-195-0x0000026505810000-0x0000026505876000-memory.dmp

Download

memory/5676-196-0x0000026505810000-0x0000026505876000-memory.dmp

Download

memory/5944-187-0x00007FF6A2F60000-0x00007FF6A300D000-memory.dmp

Download

memory/5944-128-0x000001CBAA320000-0x000001CBAA386000-memory.dmp

Download

memory/5944-127-0x000001CBAA320000-0x000001CBAA386000-memory.dmp

Download

memory/5944-126-0x00007FF6A2F60000-0x00007FF6A300D000-memory.dmp

Download

memory/6048-186-0x0000021CB5530000-0x0000021CB5596000-memory.dmp

Download

memory/6048-216-0x00007FF616EC0000-0x00007FF61714A000-memory.dmp

Download

memory/6048-185-0x00007FF616EC0000-0x00007FF61714A000-memory.dmp

Download

memory/6048-188-0x0000021CB5530000-0x0000021CB5596000-memory.dmp

Download