Overview

overview

7

Static

static

3

2026-08-09...os.exe

windows10-2004-x64

7

2026-08-09...os.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 18:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_e6085be66460847f3c429401669863f1_coinminer_elex_mafia_remcos.exe
  • Size 5.2MB
  • Sample260809-wp8x2sbl9x
  • SHA256 4c22abd2ac69d43f50719dc98cef97d5cb7c4da6d13fbce7b7ca1f467ea6153b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryransomwarespywarestealer

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 27 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 38 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 39 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_e6085be66460847f3c429401669863f1_coinminer_elex_mafia_remcos.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_e6085be66460847f3c429401669863f1_coinminer_elex_mafia_remcos.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:4732
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:1984
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5104
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:3468
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:2084
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1532
    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4144
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:4016
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:2408
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:4048
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:2412
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:316
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:1576
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:1880
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:3992
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:1052
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:520
    • C:\Windows\system32\TieringEngineService.exe
      C:\Windows\system32\TieringEngineService.exe
      1⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:2664
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:4864
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1032
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:804
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2924
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:836
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:1104
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4916
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:4532
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
          2⤵
          • Modifies data under HKEY_USERS
          PID:3512

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
            • Size 2.7MB
            • SHA256 a29504e9ecc313fa75d74747c0cb97bbac0ee51afcda6955d3f9b96137995bcf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 1.5MB
            • SHA256 9fc60fbced5d1be1e9a1ce48f9045808d031caab94e52f99520c96ae36911aa6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 1.8MB
            • SHA256 04522c7ed5b1947b8bbe4bc35426e6c25bc2ff630eff71a2e462ac8bdb7d1ddf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 7c8afaff25f47abdad096faf2d66054b2d9baaeb2525e480ea13fe9056dd93af
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 62291412a33fa8520217554a20a2011b67c49f639705ddc287bcf818dd7944f8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 1.2MB
            • SHA256 fb4107b4d74f72089fdc31ef35931d92447dc55ab7d5e4801b855b54a61474f0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 1.5MB
            • SHA256 ebd8e7385630265388cd5f3902b91bfce057c3d287c48b449de6e4a05053473b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 5bb49dde3c6c39eb0cca1ed7498cee823fe59353d78bb29b8a46d39a0cd27ecf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 1.5MB
            • SHA256 46033edc14b0fd86a186909a1efba0bd28984cd2586e27abcab05c9b43a2c302
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
            • Size 2.8MB
            • SHA256 ce9cb9703e8f5143f94b4b5030c0dee8bd96c37298e2fbea3ae9133d2a958a61
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 fb0c933f39544cd0485838f2218e373e452c9b392300f87338c1a732849c6fbc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntelCommon.dll
            • Path C:\Users\Admin\AppData\Local\Temp\IIF4B2D.tmp\ar-SA\IntelCommon.dll
            • Size 14KB
            • SHA256 d0db89c31a6f31e8579cc988dbc46269dc593673a0b3f5b13cc536bb58478f70
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntelCommon.dll
            • Path C:\Users\Admin\AppData\Local\Temp\IIF4B2D.tmp\cs-CZ\IntelCommon.dll
            • Size 16KB
            • SHA256 deb94557bd091d6bd78d791e9b7efe58f93afbc5c5ba7003409148fc32a07346
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntelCommon.dll
            • Path C:\Users\Admin\AppData\Local\Temp\IIF4B2D.tmp\da-DK\IntelCommon.dll
            • Size 16KB
            • SHA256 100a77ce27129a8ab8de37eef14751cdc460bd390d6d647575694d0e130becf5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntelCommon.dll
            • Path C:\Users\Admin\AppData\Local\Temp\IIF4B2D.tmp\de-DE\IntelCommon.dll
            • Size 17KB
            • SHA256 c844ddc55e22df5d410e08c2e3d7cadbe05080d899a9091883fc120b714971e2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntelCommon.dll
            • Path C:\Users\Admin\AppData\Local\Temp\IIF4B2D.tmp\el-GR\IntelCommon.dll
            • Size 18KB
            • SHA256 8b531564af5548b8aae3ad6715f2c9fddd348a388f04ae2797cac085beae2d6e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntelCommon.dll
            • Path C:\Users\Admin\AppData\Local\Temp\IIF4B2D.tmp\en-US\IntelCommon.dll
            • Size 16KB
            • SHA256 a644cf1ac35d45db5dcc7903e7bdbf52d4e8c699e957fd00434d0a44cecf18f3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntelCommon.dll
            • Path C:\Users\Admin\AppData\Local\Temp\IIF4B2D.tmp\es-ES\IntelCommon.dll
            • Size 17KB
            • SHA256 6608618569df2cdb40380e768fc6c837cd46d45ebcceafadad86c4dcf2da9181
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntelCommon.dll
            • Path C:\Users\Admin\AppData\Local\Temp\IIF4B2D.tmp\fi-FI\IntelCommon.dll
            • Size 16KB
            • SHA256 42de99c1f274ba5306067e4d7feed66015eb13d9ec1f306ee4a118a3283f9487
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntelCommon.dll
            • Path C:\Users\Admin\AppData\Local\Temp\IIF4B2D.tmp\fr-FR\IntelCommon.dll
            • Size 18KB
            • SHA256 1edd1c3e3d985a4d6b34d027fcd4da222b84c8485d38ca41fbabb2d666f19dbe
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntelCommon.dll
            • Path C:\Users\Admin\AppData\Local\Temp\IIF4B2D.tmp\he-IL\IntelCommon.dll
            • Size 14KB
            • SHA256 4525a9aa73ce85d70f279016bc0b85de1fd97367d8bd1d432651efa68889b04b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntelCommon.dll
            • Path C:\Users\Admin\AppData\Local\Temp\IIF4B2D.tmp\hu-HU\IntelCommon.dll
            • Size 16KB
            • SHA256 61e14ba9957e9fdb8358a55a031fe109e464852d4b8471b1c2787cc07bad1697
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntelCommon.dll
            • Path C:\Users\Admin\AppData\Local\Temp\IIF4B2D.tmp\it-IT\IntelCommon.dll
            • Size 17KB
            • SHA256 44454a486c705ef91d4dde9ff1233fbed9062c919625f849199c9279a6c31491
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntelCommon.dll
            • Path C:\Users\Admin\AppData\Local\Temp\IIF4B2D.tmp\ja-JP\IntelCommon.dll
            • Size 12KB
            • SHA256 4b194030b5fa925422c8213e3015286ad6d176c77d5c342fd0dbc7884dd3a617
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntelCommon.dll
            • Path C:\Users\Admin\AppData\Local\Temp\IIF4B2D.tmp\ko-KR\IntelCommon.dll
            • Size 11KB
            • SHA256 7c1f389aad184cea33f451488d9ecce5992e8ec6fcbc1a22a259b32bd4b61e50
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntelCommon.dll
            • Path C:\Users\Admin\AppData\Local\Temp\IIF4B2D.tmp\nb-NO\IntelCommon.dll
            • Size 16KB
            • SHA256 b79b9bde4a2ec52f222008cb7f860d903a7d1d6ed329b5cfa11de4a485a373ee
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntelCommon.dll
            • Path C:\Users\Admin\AppData\Local\Temp\IIF4B2D.tmp\nl-NL\IntelCommon.dll
            • Size 17KB
            • SHA256 fedf4f4bcd6aab2a877f791b73e529db5f2c05d6b9b3bd26ffdf692d79f091a2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntelCommon.dll
            • Path C:\Users\Admin\AppData\Local\Temp\IIF4B2D.tmp\pl-PL\IntelCommon.dll
            • Size 16KB
            • SHA256 4de30dae532bb9b9f32b96b7edcd12c8ab436d17d0105fc5023f5a1ead36195d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntelCommon.dll
            • Path C:\Users\Admin\AppData\Local\Temp\IIF4B2D.tmp\pt-BR\IntelCommon.dll
            • Size 17KB
            • SHA256 1bcf4ec144f963cad0c2df6b2ebb36d6d5c16a08ec14c3a000f838ec3b036d29
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntelCommon.dll
            • Path C:\Users\Admin\AppData\Local\Temp\IIF4B2D.tmp\pt-PT\IntelCommon.dll
            • Size 17KB
            • SHA256 25cd9be0399f4393bd0434ddbe23b21e4264caf14814b9ffb94c5cdc7d828db9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntelCommon.dll
            • Path C:\Users\Admin\AppData\Local\Temp\IIF4B2D.tmp\ru-RU\IntelCommon.dll
            • Size 16KB
            • SHA256 5895ca4159ee04c0af5bf5c3fba4bd5b35afa37f60a17c19baff26e75e3e6033
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntelCommon.dll
            • Path C:\Users\Admin\AppData\Local\Temp\IIF4B2D.tmp\sk-SK\IntelCommon.dll
            • Size 16KB
            • SHA256 686149d5acff54df46da37e205debd9041a038bc344bbf27b0a8d5271f2a8db9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntelCommon.dll
            • Path C:\Users\Admin\AppData\Local\Temp\IIF4B2D.tmp\sl-SI\IntelCommon.dll
            • Size 16KB
            • SHA256 8d3b63196c735bab0117d7465f65ad17e47a719a79cba945d6283edd02c2dfef
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntelCommon.dll
            • Path C:\Users\Admin\AppData\Local\Temp\IIF4B2D.tmp\sv-SE\IntelCommon.dll
            • Size 15KB
            • SHA256 b30c222193ea94918858ed74091b5abd39c1a98a4dad53bccad4ae44d083ec3c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntelCommon.dll
            • Path C:\Users\Admin\AppData\Local\Temp\IIF4B2D.tmp\th-TH\IntelCommon.dll
            • Size 15KB
            • SHA256 69922d80cc4ba3e978da317e63fd2fde5eacd19cee0c1dad1ae3353f286d4a4b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntelCommon.dll
            • Path C:\Users\Admin\AppData\Local\Temp\IIF4B2D.tmp\tr-TR\IntelCommon.dll
            • Size 16KB
            • SHA256 0349fc3c102fab0613194479f0badeb6eedc617af5bdf82471f32d90fafe2183
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntelCommon.dll
            • Path C:\Users\Admin\AppData\Local\Temp\IIF4B2D.tmp\zh-CN\IntelCommon.dll
            • Size 10KB
            • SHA256 f562b02692e8b2de189f67779902edb2c2b30c75c1bc84f71c44257f842a1fe3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntelCommon.dll
            • Path C:\Users\Admin\AppData\Local\Temp\IIF4B2D.tmp\zh-TW\IntelCommon.dll
            • Size 10KB
            • SHA256 28050dc6ca7b6aea973692e61b7ef790ad656910acc7fddef4038dbd15eaf6a8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            IntelME.log
            • Path C:\Users\Admin\Intel\Logs\IntelME.log
            • Size 3KB
            • SHA256 690b2154da95801757e9f04e262da88e6d85cc5a189998e9bea13dde757af9ab
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            IntelME.log
            • Path C:\Users\Admin\Intel\Logs\IntelME.log
            • Size 10KB
            • SHA256 126219de26acaee03b9545e4ed1cff38a45dbf29942b8064fe927303c91e2e92
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 1.2MB
            • SHA256 958fc25c8a81c33629e1a146db32eb79d8f2d5dc5b949492ae09e3d93562788f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 d8d40601d7dd39610774ead46d55e3a2736d7ed8bbfd33de05738a757a711b92
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 1.3MB
            • SHA256 ceb0ab6cddc24568d73223fe9c6403e893d20601abcb3721f86bac1106dd2429
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 d229d4a4ec43c8e3cbb4caa25b95ebaf080d16818ef338c29539b870d3648233
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 1.2MB
            • SHA256 4a3d2d64f6b4e1e602df76470392b2ccb28c2185941287d7341552ecae2fc0ce
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 1.6MB
            • SHA256 f44c0e9a4ff5cff39273bdc6d4fdcf3d5322bc336fa716d092f76e3417b09c09
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 1.3MB
            • SHA256 e030a12fb40b3eb4f0f18e7f589f854ca9c5ec7466486963aaed3ca50a419038
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 db98bf580e058e179d6867d0c566696a7da2293ae9a6a918c67a104dca9a4086
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 b0cf88f3686d62e5fb3bf40760472c6f2c5582beb164412523f8290bff8439e8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 7fbf6f7d97733fb212f1350d652d059f1df95d4362ff294ff13ab6f0b8e67e78
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 1.5MB
            • SHA256 dec28a379309d1b528e750ae76940225deca8dce4d6d9c522f471ec71c258ef3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 c40eae83e4592bb500666ee51bbcffe87917f8a1171eb57d7eab8da4fee3d4ad
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 1.3MB
            • SHA256 8d2ce7fbae3fd21bf6a4b79a9c93d8ee2523dfd832ede93269b05e25d8e01e14
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 1.4MB
            • SHA256 4a2cce42574d61f5fe3161c60ce63b0dca3c5390861bd3512993431d81877e4b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 1.2MB
            • SHA256 32484b1e691f5932a447bcb758eadf21f66970f873312a81184d2415993cc9f7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 4bc4cd865d2bd574cb24cb1d1e6c3669a7d3299403939f1a54f40f76e256b1bc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 1.4MB
            • SHA256 de70f3ecb5d501aac31d37f37d69e2c8d21275f9efe13fa6414010d17b3517c1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 77f8ab66e6f531b36d15e6b363a3af81cedc4da1b86eddac570944d245345f71
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 44cd09e471fb1d228a2a2d0b85636d85c2e23139e9faf28aa929b014c2f09aee
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 1.5MB
            • SHA256 43008b1a042481d5cd928e76698649f23e88969823296a4c2d41e5d20af366fb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            msiexec.exe
            • Path C:\Windows\system32\msiexec.exe
            • Size 1.3MB
            • SHA256 9a8b2d2f3a54a425789e7dc153dab501ecb710168eb93f7de0e6a0fcf8ee1c83
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/316-469-0x0000000000400000-0x0000000000542000-memory.dmp
            Download

            memory/316-459-0x00000000007F0000-0x0000000000856000-memory.dmp
            Download

            memory/316-464-0x00000000007F0000-0x0000000000856000-memory.dmp
            Download

            memory/316-523-0x0000000000400000-0x0000000000542000-memory.dmp
            Download

            memory/520-720-0x0000000140000000-0x00000001401AD000-memory.dmp
            Download

            memory/520-494-0x0000000000C50000-0x0000000000CB0000-memory.dmp
            Download

            memory/520-500-0x0000000000C50000-0x0000000000CB0000-memory.dmp
            Download

            memory/520-504-0x0000000140000000-0x00000001401AD000-memory.dmp
            Download

            memory/804-725-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/804-516-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/836-890-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/836-524-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/1032-512-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/1032-510-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/1052-705-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/1052-490-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/1052-487-0x00000000006B0000-0x0000000000710000-memory.dmp
            Download

            memory/1104-945-0x0000000140000000-0x0000000140171000-memory.dmp
            Download

            memory/1104-528-0x0000000140000000-0x0000000140171000-memory.dmp
            Download

            memory/1532-168-0x0000000140000000-0x00000001402E9000-memory.dmp
            Download

            memory/1532-489-0x0000000140000000-0x00000001402E9000-memory.dmp
            Download

            memory/1532-169-0x0000000000510000-0x0000000000570000-memory.dmp
            Download

            memory/1532-175-0x0000000000510000-0x0000000000570000-memory.dmp
            Download

            memory/1576-472-0x0000000140000000-0x0000000140140000-memory.dmp
            Download

            memory/1576-527-0x0000000140000000-0x0000000140140000-memory.dmp
            Download

            memory/1880-531-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/1880-475-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/1880-724-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/1984-11-0x0000000140000000-0x0000000140155000-memory.dmp
            Download

            memory/1984-467-0x0000000140000000-0x0000000140155000-memory.dmp
            Download

            memory/2084-177-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/2084-34-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/2408-429-0x0000000140000000-0x0000000140164000-memory.dmp
            Download

            memory/2408-509-0x0000000140000000-0x0000000140164000-memory.dmp
            Download

            memory/2412-518-0x0000000140000000-0x0000000140156000-memory.dmp
            Download

            memory/2412-457-0x0000000140000000-0x0000000140156000-memory.dmp
            Download

            memory/2412-448-0x00000000004F0000-0x0000000000550000-memory.dmp
            Download

            memory/2412-454-0x00000000004F0000-0x0000000000550000-memory.dmp
            Download

            memory/2664-723-0x0000000140000000-0x000000014018D000-memory.dmp
            Download

            memory/2664-506-0x0000000140000000-0x000000014018D000-memory.dmp
            Download

            memory/2924-758-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/2924-519-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/3512-731-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-741-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-909-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-911-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-912-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-913-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-914-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-908-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-907-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-915-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-746-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-742-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-747-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-743-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-744-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-726-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-727-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-745-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-730-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-729-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-728-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-910-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-740-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-739-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-738-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-737-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-736-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-735-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-734-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-733-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-732-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-757-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-756-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-755-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-754-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-753-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-752-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-751-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-750-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-749-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3512-748-0x000002050B080000-0x000002050B090000-memory.dmp
            Download

            memory/3992-479-0x0000000140000000-0x0000000140141000-memory.dmp
            Download

            memory/3992-675-0x0000000140000000-0x0000000140141000-memory.dmp
            Download

            memory/4016-420-0x0000000000CD0000-0x0000000000D30000-memory.dmp
            Download

            memory/4016-427-0x0000000140000000-0x0000000140180000-memory.dmp
            Download

            memory/4016-425-0x0000000000CD0000-0x0000000000D30000-memory.dmp
            Download

            memory/4016-419-0x0000000140000000-0x0000000140180000-memory.dmp
            Download

            memory/4016-380-0x0000000000CD0000-0x0000000000D30000-memory.dmp
            Download

            memory/4048-433-0x00000000006E0000-0x0000000000740000-memory.dmp
            Download

            memory/4048-443-0x0000000140000000-0x000000014017A000-memory.dmp
            Download

            memory/4048-439-0x00000000006E0000-0x0000000000740000-memory.dmp
            Download

            memory/4048-515-0x0000000140000000-0x000000014017A000-memory.dmp
            Download

            memory/4144-378-0x0000000140000000-0x00000001402D4000-memory.dmp
            Download

            memory/4144-369-0x0000000000890000-0x00000000008F0000-memory.dmp
            Download

            memory/4144-375-0x0000000000890000-0x00000000008F0000-memory.dmp
            Download

            memory/4144-503-0x0000000140000000-0x00000001402D4000-memory.dmp
            Download

            memory/4732-6-0x0000000002680000-0x00000000026E6000-memory.dmp
            Download

            memory/4732-1-0x0000000002680000-0x00000000026E6000-memory.dmp
            Download

            memory/4732-0-0x0000000000400000-0x000000000092F000-memory.dmp
            Download

            memory/4732-896-0x0000000000400000-0x000000000092F000-memory.dmp
            Download

            memory/4732-442-0x0000000000400000-0x000000000092F000-memory.dmp
            Download

            memory/4916-657-0x0000000009E60000-0x0000000009E68000-memory.dmp
            Download

            memory/4916-599-0x0000000001A20000-0x0000000001A30000-memory.dmp
            Download

            memory/4916-583-0x0000000001770000-0x0000000001780000-memory.dmp
            Download

            memory/4916-532-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/4916-721-0x000000000C2B0000-0x000000000C2B8000-memory.dmp
            Download

            memory/4916-1004-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/5104-24-0x00000000006B0000-0x0000000000710000-memory.dmp
            Download

            memory/5104-23-0x0000000140000000-0x0000000140154000-memory.dmp
            Download

            memory/5104-15-0x00000000006B0000-0x0000000000710000-memory.dmp
            Download

            memory/5104-468-0x0000000140000000-0x0000000140154000-memory.dmp
            Download