8f4b21494b125f5a1cf4ae3bb708be0ac148fc3b0a27bef465c4a749ff525da1

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_992199b80c63f660592ac9b49767f614_elex_mafia.exe
Size 877KB
Sample260818-vt2tvsad77
SHA256 8f4b21494b125f5a1cf4ae3bb708be0ac148fc3b0a27bef465c4a749ff525da1
MD5 992199b80c63f660592ac9b49767f614
SHA1 e5572318995f195d699ba2af38daf8da5237c2bf
SHA512 0e849d2a001df3247bc05f06d9ae2dff496eb99b4178367a132628b4ba662d94c39fcb1bbb8d7ad926ed36fc3c17f10a3140028f07137851b8b8adfeac080373
SSDEEP 24576:1v/Hb/xc781DpcnHj31xArLmO808UEEqaVUH:R/HbKYsHD1xArLG0Lqb
TLSH
T12015F02077E49031F1771A718A3697214DBFBC755871848EA3E87A1D2E32BD1CA78B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
1164	alg.exe
3176	GameInputSvc.exe
5108	GameInputSvc.exe
1440	elevation_service.exe
4832	elevation_service.exe
5460	maintenanceservice.exe
3280	msdtc.exe
2948	OSE.EXE
1428	PerceptionSimulationService.exe
5104	perfhost.exe
3788	ReFsDedupSvc.exe
4916	locator.exe
1820	SensorDataService.exe
5696	snmptrap.exe
5904	ssh-agent.exe
4720	TieringEngineService.exe
2924	AgentService.exe
5648	vds.exe
1540	vssvc.exe
4888	wbengine.exe
3716	WmiApSrv.exe
5328	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe

Drops file in System32 directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-18_992199b80c63f660592ac9b49767f614_elex_mafia.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-18_992199b80c63f660592ac9b49767f614_elex_mafia.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-18_992199b80c63f660592ac9b49767f614_elex_mafia.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-18_992199b80c63f660592ac9b49767f614_elex_mafia.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-18_992199b80c63f660592ac9b49767f614_elex_mafia.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-18_992199b80c63f660592ac9b49767f614_elex_mafia.exe
File opened for modification	C:\Windows\system32\msiexec.exe	alg.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-18_992199b80c63f660592ac9b49767f614_elex_mafia.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-18_992199b80c63f660592ac9b49767f614_elex_mafia.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-18_992199b80c63f660592ac9b49767f614_elex_mafia.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-18_992199b80c63f660592ac9b49767f614_elex_mafia.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-18_992199b80c63f660592ac9b49767f614_elex_mafia.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-18_992199b80c63f660592ac9b49767f614_elex_mafia.exe
File opened for modification	C:\Windows\system32\AgentService.exe	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-18_992199b80c63f660592ac9b49767f614_elex_mafia.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-18_992199b80c63f660592ac9b49767f614_elex_mafia.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	alg.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-18_992199b80c63f660592ac9b49767f614_elex_mafia.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-18_992199b80c63f660592ac9b49767f614_elex_mafia.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-18_992199b80c63f660592ac9b49767f614_elex_mafia.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-18_992199b80c63f660592ac9b49767f614_elex_mafia.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\af6e8a5e62f061e.bin	alg.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-18_992199b80c63f660592ac9b49767f614_elex_mafia.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-18_992199b80c63f660592ac9b49767f614_elex_mafia.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-18_992199b80c63f660592ac9b49767f614_elex_mafia.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-18_992199b80c63f660592ac9b49767f614_elex_mafia.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_128796\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-18_992199b80c63f660592ac9b49767f614_elex_mafia.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-18_992199b80c63f660592ac9b49767f614_elex_mafia.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-18_992199b80c63f660592ac9b49767f614_elex_mafia.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	alg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_992199b80c63f660592ac9b49767f614_elex_mafia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c7bac199352fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b7b1ee98352fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eacea89a352fdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5108	GameInputSvc.exe
5108	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3632	2026-08-18_992199b80c63f660592ac9b49767f614_elex_mafia.exe
Token: SeTcbPrivilege	3176	GameInputSvc.exe
Token: SeBackupPrivilege	3788	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3788	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3788	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3788	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3788	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3788	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3788	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3788	ReFsDedupSvc.exe
Token: SeBackupPrivilege	3788	ReFsDedupSvc.exe
Token: SeRestorePrivilege	3788	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4720	TieringEngineService.exe
Token: SeManageVolumePrivilege	4720	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	2924	AgentService.exe
Token: SeBackupPrivilege	1540	vssvc.exe
Token: SeRestorePrivilege	1540	vssvc.exe
Token: SeAuditPrivilege	1540	vssvc.exe
Token: SeBackupPrivilege	4888	wbengine.exe
Token: SeRestorePrivilege	4888	wbengine.exe
Token: SeSecurityPrivilege	4888	wbengine.exe
Token: 33	5328	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5328	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5328	SearchIndexer.exe
Token: SeDebugPrivilege	1164	alg.exe
Token: SeDebugPrivilege	1164	alg.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 5108	3176	GameInputSvc.exe	90
PID 5328 wrote to memory of 4036	5328	SearchIndexer.exe	111
PID 5328 wrote to memory of 4464	5328	SearchIndexer.exe	113
PID 5328 wrote to memory of 4824	5328	SearchIndexer.exe	114
PID 5328 wrote to memory of 1964	5328	SearchIndexer.exe	115
PID 5328 wrote to memory of 4880	5328	SearchIndexer.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-18_992199b80c63f660592ac9b49767f614_elex_mafia.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_992199b80c63f660592ac9b49767f614_elex_mafia.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3632

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1164

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:5108

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1440

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4832

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5460

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3280

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2948

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1428

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5104

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3788

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:4916

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:1820

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:5696

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5904

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4720

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2924

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:5648

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1540

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4888

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3716

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5328
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4036
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1738198120-2966725515-3980530802-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4464
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2868 2864 936 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4824
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2844 2900 936 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1964
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:4880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 95403c59cd20737e2c11792a952117b3132955880fd0326239f42b6e5c440474
MD5 2548480dfc10efbe006b38d126c9966e
SHA1 3ca7b381ccde4ec6d0778cfe317ada5497007645
SHA512 95a0fa66b0bb6ece646df5da63c575b7b4b6baa6ddfa65c88fd7eaa5bdfd47d9d976a848818ae5e8cb795fcd739bb6d5bc1bfedcd6deeae32cfd2ad63e64ab86
SSDEEP 49152:fiD632BuPkFKRrdE6oh7stBhuXjfS4LWxngsHD1xArLG0Lqb:n3q6gjBn65yG
TLSH
T17AD59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 849KB
SHA256 9c8a82783496d4e33980322f2332c78f88213f65265fab468a151f4c86d5783e
MD5 b7c6ce74e3cf93d1515794a10ffdbc6a
SHA1 9ef367ea9f93ff5532e03fc261d480ec80c7e053
SHA512 fa9a7bfa0a65aef32baff52f4e2a25805d890e939b15ea10c53883f0e18f31ff69ea8040ee7640919efb1a00e4f0b2702ae5a043ae15b9ced891f21fe369a4b1
SSDEEP 24576:vXY2DcczAx1DpcnHj31xArLmO808UEEqaVUH:xcc0sHD1xArLG0Lqb
TLSH
T13405022877D409F9ED67817DCCA28501EA73B85547B4E79B03F48A252F233981E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 0e7c7356224d3627860615d5a407e617eaa962881f0ee9936fbde30c76b997e7
MD5 dacdde626abd3f2dc982b54a07dd5464
SHA1 7f30a94a89679b2832bcf1dc3727919d3302cff3
SHA512 6d588b0571027c8f3acae24356ed0709d26be6f145b0d051e1e56cdc55baf8c37aa9c0ba83a603d82d0d3007486d89a2ca6d880829cda4ed7dadf8359e548046
SSDEEP 24576:D0me6j/0uCxOrMn1DpcnHj31xArLmO808UEEqaVUH:DPj/01oysHD1xArLG0Lqb
TLSH
T193459E26F6748731D073C0B9C5D2A68AE972308657308ACB5296C77C3F677E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 24924d81212fcc70d192001ae7d28438ca737209881d8094a5387990f175a403
MD5 b927ce8df83e68b0660a13027f259da4
SHA1 f98b87a2d56a47f7a9d0f0993423533b7f16f71c
SHA512 f5acd1799b213a2751b7a22c6e34b0c485499795300958940e3a8a06a5036e23d759d3682688c403c47b93671a53f31aa70aea1617b9c3705b5dfcf84686f756
SSDEEP 24576:bxM/ezSC6vUyD/aqgrvW/6q8wyuh1DpcnHj31xArLmO808UEEqaVUH:+/ezSC6vUzPvuHjyKsHD1xArLG0Lqb
TLSH
T12E756C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 a6e2dbe3521c3c74fe2a5bccac32f9106a44a908de2484725332bb1206c7b5e5
MD5 48e8f30c44fbc3f617c47f5cda2124ab
SHA1 dba2e0131b019db8cf5b058c84e5101a659833f0
SHA512 3e7b824e3125e8b1353cf78d925ac9d51ab7ce92f9368585b24d15fa3ab96f38a8c812da72f4260b543cbfe0067e002df8a14366e72402f7f4a50fdcbe2d92fd
SSDEEP 24576:mabJP1l/DbdmCd01DpcnHj31xArLmO808UEEqaVUH:mazl/DRmC2sHD1xArLG0Lqb
TLSH
T166559E65F5748331D073C0BAC5D2AA9AEE3234424B318ACB1246D76C3E677E6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 603KB
SHA256 a41e51c4f19e1a42bb2ed5c404c0956977243c27262d778873022a6aa19d3a89
MD5 7b65fbe49d5656effbbefb33f7d8ad68
SHA1 95d49ae72185c9aefcf1ae807be4169da1f2461e
SHA512 f8d8a38b70049964370ff0400a106b48fdd7796f6b9415608f71355f7e6b734bae9428ab2b3babadc49ef9f12078144a91a58730faaecf79ae4029a07f6421c2
SSDEEP 12288:AhUR7DpcnHj31uUArqgmWJF8oJZUPUE3P7Yq0VrVdWcKP:AhU1DpcnHj31xArLmO808UEEqaVUH
TLSH
T15FD423688F18D671F32835F209711709EAAB8E9884FC0968BD78DE593A341744B7DB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 863KB
SHA256 26f56cadcc6d953e972b064d54dc0a5fefd128c172d92d63e680c778dd0d8874
MD5 e110f0b07053046dc22be953d5721c8f
SHA1 2ee0cadd63741ff4675193ad751dfa992aa9264e
SHA512 2e519a6d60dcb31aa922789fae05bb1e40adda289c7066a18061ae87daa12f2d95a2187e4a9935bddab22702d5c0ab4a9d293fb436f5718c219507a82b837255
SSDEEP 12288:9DBNUbTVO86U2R7DpcnHj31uUArqgmWJF8oJZUPUE3P7Yq0VrVdWcKP:9iIU21DpcnHj31xArLmO808UEEqaVUH
TLSH
T1A215CF3BEE28FCE2C27A5DB95A918700E77274704B6193CBE174C20E9E235E05E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 a556b11594f2f54cace373253d517b01af4f8fde2e0fbf83fe6e18c63f736f2f
MD5 35b1cc39971bc1bd1025fc890a92da42
SHA1 c84b4726ea7357f712ba4f3f7f23bc09ebc4fd71
SHA512 6aa82193e88f4f3c13668ebbb9d890900c43f810ab60dc3674270ac9167667144f448a46152512e882ae2886f750d22a06d66287d596690d603670e8d5dc79bc
SSDEEP 49152:jQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJ99DN5J8NRV3THl:jQvGAdlCEL8c/9RNw5CJ65yG
TLSH
T171366D656BF880F5E0A7E174897AC672F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 932KB
SHA256 b1daa4242d76eb4f6351d485a5208afc05269653cd21a91d2978a70b914d888a
MD5 f47bcd9c9072b54efc9c79109e53725d
SHA1 291b9b01a9380f935af13691717aa32b86f7fa4a
SHA512 bd255b2fe829cfa2661cf0f7bb9af5e6f2aec64435fd005bcdc90b55c90cf5dd7c0e95f837d3bfc27aed5a17abb66a74b4c9e3a38ab1e1d48d87b7a0b88026b2
SSDEEP 24576:LmewsAj91DpcnHj31xArLmO808UEEqaVUH:ylj9sHD1xArLG0Lqb
TLSH
T14A15E031FE74E432D37B0DB21B26C706546DA9604BA51AC3E3B88E9D59302D22776F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 38f75f72e74748ebaecfb065c6deb704226fbf104d8bddda753fdd1a00905278
MD5 880f01e3da1cb0b10d784f19c79f3374
SHA1 55b0a3776341c6409dc7d5eb7cb54196a612e13b
SHA512 c7628a2ca8499ed8206df9315cee5ea9951b1ee5766fb4f29a3504b7af39cfa008b3a8132a424dbb826bf52395c3075ec1e972e035e52bd9922401a0dd2978fe
SSDEEP 49152:VwoRquA/m2yL5zMfFiV+XenmE3/znsHD1xArLG0Lqb:/oq1Vjnmk65yG
TLSH
T1E9D58D0976B8C2E4D1F6C77886A2C647F37178154B34A7EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 829KB
SHA256 93e0daecfeb0dd6a2b737e95dec7420e79a7c2a86d74125fcf874ab693222aa2
MD5 052ba0d1938b88e19fc6394c7bbb1bc6
SHA1 12a85e02dffef480a7b4c11172dde66c7605720c
SHA512 952708538c086e122de76ed7591dd1120d7bf7da747c3c3ae8b973acf1f7d6b8ff8b15956490406123698ce2fd887a2029e34e121547b9fadca7ea6e8c619474
SSDEEP 24576:uwuuOWU1DpcnHj31xArLmO808UEEqaVUH:uwVOzsHD1xArLG0Lqb
TLSH
T1B605F14977A80CF9E566527985978136F7F2B8012A75CB1F1770CA5B2F333216E2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 92993cdc38c6f2eb1b97e9f8186450a67bc39285ceb469956a055e9a388fdd2c
MD5 84827b487e98607621f4ce871e713ea8
SHA1 6a6d57f4b837fd2ac37685a22626a1035c759090
SHA512 32ef60065e269b089fa93204810b20a1cd6bba2daa44dbe44029957cfefcf5642e44d22d477b681bbf022406e910f27ab250cb20a4362e032b1392e128706d1b
SSDEEP 49152:5J+taZ3usBWOBr4tEGp0bqx0z+n217aau1glBsHD1xArLG0Lqb:ru6JmTxd2dB65yG
TLSH
T1DCD59D13F1DA01E8D06ED478974A9233EA62BC490B34B6DF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.1MB
SHA256 73083af88dd29d34abaf42ad1c766ea441509283b644ace1367e072b8e0a12e3
MD5 f688e59d04be1a71ec4b62513d323764
SHA1 e6b80040e4866f9a2cfc6d2310c393e4250f5a66
SHA512 fbfe838881c8229dc19d09b4c080134c3ee546c94fbbfe3a79b62e19dbb1693f5d8413bbc6c344dcd62492e4aa0a6e028dbe18f193227329eec59ce5fcd1c1de
SSDEEP 24576:+dwvtk9RX6wkyAI51DpcnHj31xArLmO808UEEqaVUH:BMnYI5sHD1xArLG0Lqb
TLSH
T1BC35D029EBDC44E1E177927C89B3460AF6B178690B71C2CF12AA436D1E33ED45E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.6MB
SHA256 97090d125c3846b0c380ba55e4dbc1213a0b0458f5c500c7a8f362520928adb8
MD5 feb499df9802debe59868c76d19b7423
SHA1 577ab8723f76d99e66f91f1d83855d8492e382b2
SHA512 cd4b1d0d1aee4d770c8c429106c5cd98ced4cc6d80e2304177cadd83fd5871350f96b35f15efc2af0f936e344d8a00277e17dc606c188191571af7eb664f2609
SSDEEP 49152:dYtpNpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0SsHD1xArLG0LQ:OySzPa65yG
TLSH
T1AE066C96A16841D5C1B9C1B98F1BCC1BFBB134490335ABEB02E546931F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.5MB
SHA256 67645f3d5fe9c88e0da56fe9009098a2f8739e3392a40fd295361aeda93cf3c9
MD5 41d75bec5a5c6f6b5fc5584e7d9472d5
SHA1 8297bb6a65436866d21348f55ad800e62dfe4c89
SHA512 3d8ef904dd72412ffd631bd23dc22a760b06496acd656c5ac07268268ce2b07243439a43460b285a5ae0ba1f17e5111d1f0106c0e6a520a67cf1ca271f58b615
SSDEEP 24576:vT7Jb1aQZRXLfOrIhnjFN8rnDHU2+fF/AYC1DpcnHj31xArLmO808UEEqaVUH:vT7JUQjXirIhCnDHUPfF/wsHD1xArLGr
TLSH
T1B665AE1DA3EC01E5E1BA927885154A5AEA71742E1B31CACF2270837D6F23ED45F35F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 610KB
SHA256 76e6742408070d633396afecdb0ccc67a45b3975fa38edaae9da3dca08e56451
MD5 af1f30e21fd88948e52d661ccd4b521a
SHA1 3020cd1b640344686efb6d1c2804b9695c9eefb3
SHA512 30e35b09e35a93a465ef38e0fc8def1e9b4411f7343fa3c2f64ca6cb20c1c7b28f453844b97346842253066c3218c4dff5d3d6efa02e9698efd26047312ad379
SSDEEP 12288:s87VR7DpcnHj31uUArqgmWJF8oJZUPUE3P7Yq0VrVdWcKP:9V1DpcnHj31xArLmO808UEEqaVUH
TLSH
T1DBD423649B5CDA31F13835F109761308B65FA69889EC41EBBD788E493A312A40F7DF63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 411fb035b4d66adf0c83b4ff3cdc1c47706368bdd24d7ab9596afad65fe0f608
MD5 c3533131816ab448b70dde7198067286
SHA1 81a73e2815828cfa68285579d71213392b0b1728
SHA512 bf8b6a66ba896af748e150420ede6268e4625703c2076e036455c4655dbe2b584cafb223ed2c14c59a858a977d2ce70e0c1205a0f94cde9cdb8bd004e5969e8e
SSDEEP 24576:Kgb6bmBIi49WNNFpg1rSvFv7bYC1DpcnHj31xArLmO808UEEqaVUH:Kgb4mBIBhGFpsHD1xArLG0Lqb
TLSH
T1FC65AE1E22EC02F5E1F9E2B8CDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 664KB
SHA256 a693ba3f36e84fc863ad0566d036e86820d4541b8f7bcdb6d611dc92a750d4b0
MD5 0a0f3302b96aee188d1b9ff823118a8d
SHA1 1ca9d3400476bf42103efbc9e8286a979f81f3cd
SHA512 4479dadc4d5e4d8ed3207f339d1a4b43a2cc91482270c37986e0fe53a2cc788b600b2062dda192a186c4d32d9c2ca762b5fcec3efe3f081d695cf34adebf22de
SSDEEP 12288:eWG4R7DpcnHj31uUArqgmWJF8oJZUPUE3P7Yq0VrVdWcKP:pG41DpcnHj31xArLmO808UEEqaVUH
TLSH
T1C7E4233C6AA9B5B0E13862B548711206F9B275A487A815FF59F4CD393F212F0273DF62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 628KB
SHA256 5590945db256ac8c070f495e8f388e88fc95d2d1549ce6c3f4ba31690a7c74f8
MD5 c9513be8ebe255e6c51499001dae6fc8
SHA1 26564ddaf2bfaaf73ad069d1419e30ed53c57c27
SHA512 0d8231e94d07398c409ead4fb123b869e91663de484aa97afd59f0900e6c9cb06b1bae8f546190b70e75fd76bbc16c0929b9a488d892c06f80226719d14cea8d
SSDEEP 12288:dtR7DpcnHj31uUArqgmWJF8oJZUPUE3P7Yq0VrVdWcKP:dt1DpcnHj31xArLmO808UEEqaVUH
TLSH
T1CBD423685A09DA71F22435F109621709B69A869887FC06E7BCBC8E4637352F40B7DF73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 ed33af4a64a0d52ac438e2caef6fefb77d200267c1cda4519c23c2450444c586
MD5 7dae374c260d054ed11387d7def5fa57
SHA1 38198614b88e42563c300ee50367a6d643fb4aaf
SHA512 127af8f1f1b570c4fd9804ff859ce8b3c5639f35c8f1f66ba5065b2fe4a4a851f38265b760eda3636421373b380bf364595f05dccdc2992f063a2607c99c166d
SSDEEP 24576:HG88u8FpJqH1Qzria7/m1vk1DpcnHj31xArLmO808UEEqaVUH:m7ZFPqVva7/yvksHD1xArLG0Lqb
TLSH
T1B635F16567E101F1D07BE13889824667F6B2B4250364EBDF0BAC8B552F236E50B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 832KB
SHA256 cfdd2dc4a4424c3e45db3b9e341b1c89b0386736ddc76e0ddb20c293b0d2166c
MD5 0fc348f79efbf4c816a2d242dd39aebb
SHA1 0380519377cb0961b6f7f9432afa13636a6a47cc
SHA512 277e0111e9ee00ed8695fef3e6bbe62c106d8df190767ed2ff818182f5ed1a307f34cfe2cd1db6c9353e0e1ae197f840807c106cd8d868b91f5c6f3b5d21c9a5
SSDEEP 24576:jPUr+NQO1DpcnHj31xArLmO808UEEqaVUH:jJQOsHD1xArLG0Lqb
TLSH
T10605F12F66AC18F5F676A17D8982470DF772B462075192DF02E0817E1F23AE86D3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 78b42c9c5617b536504901e1c0523ecf16d9a6b6363c6fd713b3de4bc52444c8
MD5 4a955786ad091987286016281af74eb3
SHA1 0b069571f1ad535e2f3262c9c90893403b91851b
SHA512 9652cc63dea2950ab21685f50bac90e2ad5cfe01430884c5dd673f1e4811f2f8a53d2fc7c092a6cac61524797e24879063fb32a5a8bf8c0eeaee4cf3046e57b6
SSDEEP 49152:eBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjjsHD1xArLG0Lqb:hG05lO43bG65yG
TLSH
T1F2D5CF6A62EC11F9D1BBD17CCAC6460BEBB23415033556CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.5MB
SHA256 6455834685eb9031d701e7cc10055206f779d3fcf8b563a45396a824d3250a22
MD5 22e48f77c110330119981d059a0a2ea5
SHA1 85927006bf1e26c319c3be86533735d7b9be55f0
SHA512 c11c674c80c3d7450f21b4222f8cd05dffc10bae08d937124c1f01bd3af234dc1c5cacf678259b8df25c8b867899f8dde2a5c4438797d9940ef9654ff0809266
SSDEEP 24576:PUa5POZ3dpbWVM50JicR2hG0lasx2+47eidn71DpcnHj31xArLmO808UEEqaVUH:Ma5POZ3wJt2pasx2+mpsHD1xArLG0Lqb
TLSH
T15965AF5EA6FC01D5E179D17DC583460AF5B2342653319BCB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 e9b01df06f1b45e30d39e27f413ad0829d27061b8bb43c9453de4f89e0228a3d
MD5 2008a691da9e3c4cabe29fced31c17c9
SHA1 b5a019c70e3d1d4536c3f7d54c5d79acf131f592
SHA512 9ed439ff0a7436bcac141a700176429218c48d6e730b11f5b87065737302189988434430abb549ff1e4628a00baa9bb70c11b6e4d2cdcfff50362cf20567eea3
SSDEEP 24576:FNcwHdjbyQ4nLC18lb/EOjowL7Fkx1DpcnHj31xArLmO808UEEqaVUH:FNc/zEOVHF6sHD1xArLG0Lqb
TLSH
T1FD858C2623E901E4F1BBE1BE89779546FAB17865133486CF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 936KB
SHA256 3983976cafc699533c7980a14585a984d0bc1c39e96d7156b833df9994577fc3
MD5 a7229251034fe4c232977ac30f894bbf
SHA1 8a2c9048559788379e06cb3267842cb7a9ea6626
SHA512 672c1efed322cdd3687a7fa1df9e96e80fac0ad33ec676f3d346b61e6e6970480c66e4dbc863b0d826434a27754706b1e851403a5680782e3869756e70b51d04
SSDEEP 24576:oJnJPbzB4Sn1DpcnHj31xArLmO808UEEqaVUH:oJnJv6SnsHD1xArLG0Lqb
TLSH
T1AB15D03DD2A810E4E4B7C2B4811A175AFF71387D2B2569C729B4D5343F12EE0AA39F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 591c04dd15e8f50d9f24e24e9847eebda36d32b8f64d1f36a6f2350d356ab576
MD5 bf2068f174da7eef1448937224c7ad0e
SHA1 4057ee6fa7120bcf000407a816153087dfd6cbfa
SHA512 482ca893eb822a3ec18e8c58e9f416eeb02e67bf889bc1ccad5cbd0de9d22800a0141554c08a78f422f46acc5e9160c45b8e65b66212a9205ccf2ac35ac8d32b
SSDEEP 49152:WCLHGeeV5ijCmlDWDkisHD1xArLG0Lqb:dg65yG
TLSH
T1D7A56C05A7EB5184F8F3CAF5CA2294169A327C549B34F7DF4E80C96A2E32BD1D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 780KB
SHA256 3339a80c0fdf289f6c9ae15dd7d0bf84c2af548842e749572292d868bc216e54
MD5 62512234ffdc6bedc3dc79fe0638f2e6
SHA1 98a435b6382375ce3c2039630532a0d1b92ff642
SHA512 98f8664160eb6cac969955a21ac0351f1a671d15ffd1c02a8e896477c8e55b1c266a915e55637631349265b1346d27f17fca87ad0c85216918bbf81c15956aff
SSDEEP 12288:udHscFj5ZI7/R7DpcnHj31uUArqgmWJF8oJZUPUE3P7Yq0VrVdWcKP:GFDIz1DpcnHj31xArLmO808UEEqaVUH
TLSH
T16B05025C237A10F5E17B907E86930201E2B2B0B4876519DF5AE4C9792FA3ED8793CF52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 764KB
SHA256 d5ebeb541f7f0b67ac266acfac6b561a3d1edd0d1dcc174c0f589b80de4a0d62
MD5 99176532f4ea47c7d09ff31017357761
SHA1 09ce89f32697072bd4edaf4d57b47ac9a0f13e81
SHA512 abb9e5117d4ac80057712398cb1414d413499f5f751c09ec5749711dc45910891e37f1dadc99ebbf8c56827bc89fe78adba99ae13b54967337a7feb674b8a247
SSDEEP 12288:eG6kyQR7DpcnHj31uUArqgmWJF8oJZUPUE3P7Yq0VrVdWcKP:3tyQ1DpcnHj31xArLmO808UEEqaVUH
TLSH
T173F412045798A1B1F27812B48A7242449A76BC248B7453EF65F0DE3E3F327E46A35F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 636KB
SHA256 45d1530f4d3dc04af2e6ba9f74d51fe67ae2b07aa90a3ad6a136b55cfc3ff66e
MD5 774111e8e48e61749b65dbef16232520
SHA1 1399d69b57ec507d9354a79bb4398989cd115d06
SHA512 f55ae5d72c535e129913c86f0c5d131cdbbbc8345082a3276f52edbf1f161ff8fbc16c3cfa57a40aba3c4fe4a6574dde1ae520d9906c5dc5ec16f06e8f400476
SSDEEP 12288:/c53R7DpcnHj31uUArqgmWJF8oJZUPUE3P7Yq0VrVdWcKP:UR1DpcnHj31xArLmO808UEEqaVUH
TLSH
T1ACD4236C5A19A671F12436F505211705E2AAA6A847FC05FF7CF8CE353B252E40B39F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 4d49e0946eadc4ef2ab115e0b2f30125802dfca1bd76f8166f90778d500c289b
MD5 e318b8a24b27adbb6623311ad11bd150
SHA1 291262d801491d21a35e1bfd24cdfaa0b376a55b
SHA512 81e153a08091b57a0a9aa266100bf179c54787220112cdf84d4cf8aa4f6ed347d6bcec906c1e82b0c41aa6c19601c06373d76abb0c4215a19c226eae407c307b
SSDEEP 24576:Ypgn0oTfaidZw1DpcnHj31xArLmO808UEEqaVUH:0gJTrZwsHD1xArLG0Lqb
TLSH
T126559D1DA7EA05DAE2B2D275D8721483D633B4315772C6DF2448C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 796KB
SHA256 6233d0c59e3eb9730ef0dea5eb31217a0976c3eea5530c2a21512350a1278c16
MD5 5c0160f57f765c50102ee45131327e7c
SHA1 b10cba36e7f0489198f71c5f264eb99d6b5484c8
SHA512 31109f60e77f866c7bc29ba4fb1c17c1ab038aefed6cdf444291cb3e1ede896f14e062b6667890206eac5e44e8249acfd0e772045478c95675f7454572effd5f
SSDEEP 24576:RrcmRi1DpcnHj31xArLmO808UEEqaVUH:FcmRisHD1xArLG0Lqb
TLSH
T15005F15EB76E00B2E1B7917C88424205F6B3B070536117DF56A0CB7E2E276E97E38B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 33bec95939ef50eeb1bffe776ec625df308dca8042ebadd94f13c0be5c61dd68
MD5 68480ef5d4234d73fe7302796fe67753
SHA1 5cadd1a687502770649956351e90cb32507cc40b
SHA512 9af3e2a60050828ff1fec9af67ea9359b03f02acbc99024cf631fa3443d2227a4553243dcfacf5ab5ea0e0ae0e39d27f088856d57dbea0ada50576722449f020
SSDEEP 49152:ZDL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS34sHD1xArLG0Lqb:K3Upow8sBt65yG
TLSH
T1EBA58C3DA2E800A8D9AAC379C54213A6EA71742D3F3015DB0174C578BF1BEF19A39F56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a67be4706f48a14768a9e81323c2e387f7dd7b11841b6c9d85c20d855b810751
MD5 7af9b0a14558520beac38a4372a7b18a
SHA1 b6033d3e499b728061245a56658c1d15cdca3886
SHA512 2aaaec7fb155698578d8560d781faae378d2d8af931992f3b6ef4d5c74c2d95d01f1332d9f942875520efb7fd82869be00aadbac870128f0d5e65f992579145d
SSDEEP 24576:sTkNvNnaFeYhJNtmZBmC1DpcnHj31xArLmO808UEEqaVUH:sTMwBtOmCsHD1xArLG0Lqb
TLSH
T1C555AF2EBAB846E4E1FEC6B5CD238512E6727461073253CB5290C13F1E279D89E79F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 992KB
SHA256 145c10570a5722c68aa457bc8531ad3c612da30b4a7173213f9d84d1bd543b93
MD5 09a6bc1655a83e7c158a762ffec8f5d5
SHA1 375305178d6813b0e9f160b49d89b4be160722a1
SHA512 77f050b8820d1ae9acb3d83dcebb3161a2aae467323c6ce044029b081e59eb098dd9e55c60f2d6935ef97b777b5e5c6bbe221dd7e7f6f684504ed1ab1eb4e184
SSDEEP 24576:9D3FHshBIYQgA21DpcnHj31xArLmO808UEEqaVUH:9DVHeBIAA2sHD1xArLG0Lqb
TLSH
T1DD25E17DEA5C04F4E57AD1BC8A634A06E77138A9032156DB16D4C1BA2F2BEE42D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 772KB
SHA256 7bc06b0c5f8eddc7d57e4fed487e14ab57b600476f379d3f4709b84da7ea32da
MD5 23ebbb589cde994dc03523e98dbef67f
SHA1 a7c2e3b52fe81a694eccdd4d55b258a0c0dad09c
SHA512 592f81f9aae6a631b44225b58046846d700d8f98c9b3b05fa78226acd0dd8f700d69c11a338c99adbe833277fb3e7497c8300e745d409c941f93ec47a75c04da
SSDEEP 24576:46UqjpZ1DpcnHj31xArLmO808UEEqaVUH:46U8sHD1xArLG0Lqb
TLSH
T1E6F4125D569464F1F03812B08971421985B5BC7603F956EF75E8CE3E2F32AE44A3EF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1164-15-0x00007FF6C5D70000-0x00007FF6C5E93000-memory.dmp

Download

memory/1164-74-0x00007FF6C5D70000-0x00007FF6C5E93000-memory.dmp

Download

memory/1164-17-0x0000015B496A0000-0x0000015B49706000-memory.dmp

Download

memory/1164-16-0x0000015B496A0000-0x0000015B49706000-memory.dmp

Download

memory/1164-18-0x0000015B496A0000-0x0000015B49706000-memory.dmp

Download

memory/1428-95-0x00007FF7B0930000-0x00007FF7B0A7A000-memory.dmp

Download

memory/1428-98-0x0000019E807D0000-0x0000019E80836000-memory.dmp

Download

memory/1428-97-0x0000019E807D0000-0x0000019E80836000-memory.dmp

Download

memory/1428-171-0x00007FF7B0930000-0x00007FF7B0A7A000-memory.dmp

Download

memory/1440-47-0x00000227ABE90000-0x00000227ABEF6000-memory.dmp

Download

memory/1440-48-0x00000227ABE90000-0x00000227ABEF6000-memory.dmp

Download

memory/1440-46-0x00000227ABC40000-0x00000227ABDB7000-memory.dmp

Download

memory/1540-194-0x00007FF738B50000-0x00007FF739021000-memory.dmp

Download

memory/1540-245-0x00007FF738B50000-0x00007FF739021000-memory.dmp

Download

memory/1540-192-0x0000017914820000-0x0000017914886000-memory.dmp

Download

memory/1540-193-0x0000017914820000-0x0000017914886000-memory.dmp

Download

memory/1820-242-0x00007FF78CB30000-0x00007FF78CF47000-memory.dmp

Download

memory/1820-137-0x00000187F75C0000-0x00000187F7626000-memory.dmp

Download

memory/1820-208-0x00007FF78CB30000-0x00007FF78CF47000-memory.dmp

Download

memory/1820-239-0x00000187F75C0000-0x00000187F7626000-memory.dmp

Download

memory/1820-135-0x00007FF78CB30000-0x00007FF78CF47000-memory.dmp

Download

memory/1820-136-0x00000187F75C0000-0x00000187F7626000-memory.dmp

Download

memory/1964-454-0x000001C184920000-0x000001C184AA3000-memory.dmp

Download

memory/1964-364-0x000001C184920000-0x000001C184AA3000-memory.dmp

Download

memory/2924-181-0x00007FF6CBE50000-0x00007FF6CC171000-memory.dmp

Download

memory/2924-172-0x00007FF6CBE50000-0x00007FF6CC171000-memory.dmp

Download

memory/2924-178-0x000001E8EF2C0000-0x000001E8EF326000-memory.dmp

Download

memory/2924-174-0x000001E8EF2C0000-0x000001E8EF326000-memory.dmp

Download

memory/2924-173-0x000001E8EF2C0000-0x000001E8EF326000-memory.dmp

Download

memory/2948-89-0x000001CB5F510000-0x000001CB5F576000-memory.dmp

Download

memory/2948-87-0x000001CB5F230000-0x000001CB5F3A7000-memory.dmp

Download

memory/2948-88-0x000001CB5F510000-0x000001CB5F576000-memory.dmp

Download

memory/3176-30-0x0000019CBBC70000-0x0000019CBBCD6000-memory.dmp

Download

memory/3176-28-0x0000019CBBC70000-0x0000019CBBCD6000-memory.dmp

Download

memory/3176-26-0x00007FF6B3560000-0x00007FF6B3629000-memory.dmp

Download

memory/3176-27-0x0000019CBBC70000-0x0000019CBBCD6000-memory.dmp

Download

memory/3176-104-0x00007FF6B3560000-0x00007FF6B3629000-memory.dmp

Download

memory/3280-162-0x00007FF723F70000-0x00007FF72408A000-memory.dmp

Download

memory/3280-75-0x00007FF723F70000-0x00007FF72408A000-memory.dmp

Download

memory/3280-77-0x000001D77D9A0000-0x000001D77DA06000-memory.dmp

Download

memory/3280-76-0x000001D77D9A0000-0x000001D77DA06000-memory.dmp

Download

memory/3632-38-0x00000000003C0000-0x000000000066D000-memory.dmp

Download

memory/3632-0-0x00000000003C0000-0x000000000066D000-memory.dmp

Download

memory/3632-256-0x00000000003C0000-0x000000000066D000-memory.dmp

Download

memory/3632-6-0x00000000027E0000-0x0000000002849000-memory.dmp

Download

memory/3632-29-0x00000000004B4000-0x00000000004B5000-memory.dmp

Download

memory/3632-7-0x00000000027E0000-0x0000000002849000-memory.dmp

Download

memory/3632-1-0x00000000027E0000-0x0000000002849000-memory.dmp

Download

memory/3716-213-0x00007FF60ACD0000-0x00007FF60ADFF000-memory.dmp

Download

memory/3716-214-0x0000011195D60000-0x0000011195DC6000-memory.dmp

Download

memory/3716-251-0x00007FF60ACD0000-0x00007FF60ADFF000-memory.dmp

Download

memory/3716-215-0x0000011195D60000-0x0000011195DC6000-memory.dmp

Download

memory/3788-119-0x0000016815DD0000-0x0000016815E36000-memory.dmp

Download

memory/3788-274-0x0000016815DD0000-0x0000016815E36000-memory.dmp

Download

memory/3788-276-0x00007FF679E70000-0x00007FF67A5B4000-memory.dmp

Download

memory/3788-117-0x0000016815DD0000-0x0000016815E36000-memory.dmp

Download

memory/3788-118-0x00007FF679E70000-0x00007FF67A5B4000-memory.dmp

Download

memory/3788-200-0x00007FF679E70000-0x00007FF67A5B4000-memory.dmp

Download

memory/4720-163-0x00007FF7B4730000-0x00007FF7B48C5000-memory.dmp

Download

memory/4720-165-0x000001EE71270000-0x000001EE712D6000-memory.dmp

Download

memory/4720-164-0x000001EE71270000-0x000001EE712D6000-memory.dmp

Download

memory/4720-223-0x00007FF7B4730000-0x00007FF7B48C5000-memory.dmp

Download

memory/4832-54-0x000002293A1A0000-0x000002293A317000-memory.dmp

Download

memory/4832-56-0x000002293A440000-0x000002293A4A6000-memory.dmp

Download

memory/4832-55-0x000002293A440000-0x000002293A4A6000-memory.dmp

Download

memory/4888-202-0x0000020D05860000-0x0000020D058C6000-memory.dmp

Download

memory/4888-201-0x00007FF68EFF0000-0x00007FF68F4F7000-memory.dmp

Download

memory/4888-204-0x0000020D05860000-0x0000020D058C6000-memory.dmp

Download

memory/4888-248-0x00007FF68EFF0000-0x00007FF68F4F7000-memory.dmp

Download

memory/4916-203-0x00007FF6DEFF0000-0x00007FF6DF09E000-memory.dmp

Download

memory/4916-128-0x0000020966190000-0x00000209661F6000-memory.dmp

Download

memory/4916-126-0x00007FF6DEFF0000-0x00007FF6DF09E000-memory.dmp

Download

memory/4916-127-0x0000020966190000-0x00000209661F6000-memory.dmp

Download

memory/5104-105-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5104-183-0x0000000000400000-0x00000000004AE000-memory.dmp

Download

memory/5104-106-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/5104-111-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/5108-40-0x0000027C8A6F0000-0x0000027C8A756000-memory.dmp

Download

memory/5108-36-0x00007FF6B3560000-0x00007FF6B3629000-memory.dmp

Download

memory/5108-37-0x0000027C8A6F0000-0x0000027C8A756000-memory.dmp

Download

memory/5108-39-0x0000027C8A6F0000-0x0000027C8A756000-memory.dmp

Download

memory/5108-125-0x00007FF6B3560000-0x00007FF6B3629000-memory.dmp

Download

memory/5328-259-0x00007FF74F940000-0x00007FF74FC7F000-memory.dmp

Download

memory/5328-225-0x00000231EBBC0000-0x00000231EBC26000-memory.dmp

Download

memory/5328-226-0x00000231EBBC0000-0x00000231EBC26000-memory.dmp

Download

memory/5328-224-0x00007FF74F940000-0x00007FF74FC7F000-memory.dmp

Download

memory/5460-69-0x000001753E280000-0x000001753E2E6000-memory.dmp

Download

memory/5460-71-0x00007FF61F090000-0x00007FF61F1F8000-memory.dmp

Download

memory/5460-64-0x000001753E280000-0x000001753E2E6000-memory.dmp

Download

memory/5460-63-0x000001753E280000-0x000001753E2E6000-memory.dmp

Download

memory/5460-62-0x00007FF61F090000-0x00007FF61F1F8000-memory.dmp

Download

memory/5648-185-0x000001A2053D0000-0x000001A205436000-memory.dmp

Download

memory/5648-184-0x00007FF74AF50000-0x00007FF74B1DB000-memory.dmp

Download

memory/5648-241-0x00007FF74AF50000-0x00007FF74B1DB000-memory.dmp

Download

memory/5648-186-0x000001A2053D0000-0x000001A205436000-memory.dmp

Download

memory/5696-145-0x0000013BE2500000-0x0000013BE2566000-memory.dmp

Download

memory/5696-146-0x0000013BE2500000-0x0000013BE2566000-memory.dmp

Download

memory/5696-144-0x00007FF6A2BA0000-0x00007FF6A2C54000-memory.dmp

Download

memory/5696-212-0x00007FF6A2BA0000-0x00007FF6A2C54000-memory.dmp

Download

memory/5904-156-0x000002AD9A7B0000-0x000002AD9A816000-memory.dmp

Download

memory/5904-155-0x000002AD9A7B0000-0x000002AD9A816000-memory.dmp

Download

memory/5904-154-0x00007FF651CE0000-0x00007FF6520C6000-memory.dmp

Download

memory/5904-220-0x00007FF651CE0000-0x00007FF6520C6000-memory.dmp

Download