remcos | 31fe600d3786c37b42ce407d2d9512a6542243ef7c6f55bc76f16d91889f88c7

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 04:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
Size 1.6MB
Sample260820-eyrlpazbjg
SHA256 31fe600d3786c37b42ce407d2d9512a6542243ef7c6f55bc76f16d91889f88c7
MD5 b968e2a4603fbfe632e62630720a713d
SHA1 32fd2dba3c72e79db0840ca2ace1e73e21295159
SHA512 82e979cf40ca838b61939ae9a8ab6c7893f54156833eb3fedb0167c651f96770113cd4b76ef6dd6df9b34dc88e36a3b5413dd7de87bafc4467bd324ad3eafb78
SSDEEP 12288:INTm5FFykgJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHA:IQbYkQdCN/j2GLl3iFSE33b9J
TLSH
T1EE751217FE57D1B3E41643B207947B22AF78ECB266298803C781D6C2EAB8D99D471533
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

qh88best.com discovery remcos rat spyware stealer

Malware Config

Extracted

Family

remcos

Version

2.2.0 Light

Botnet

qh88best.com

qh88best.com:2404

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
3
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-ONAWZB
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 11 IoCs

pid	Process
4496	elevation_service.exe
4380	elevation_service.exe
4800	maintenanceservice.exe
1136	OSE.EXE
1072	PerceptionSimulationService.exe
5696	perfhost.exe
5504	ReFsDedupSvc.exe
3028	SensorDataService.exe
1128	ssh-agent.exe
2736	AgentService.exe
3024	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\390495e7c618523d.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\dotnet.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116593\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000000ff0da65b30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000372ad1635b30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007bc9f9635b30dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
4496	elevation_service.exe
4496	elevation_service.exe
4496	elevation_service.exe
4496	elevation_service.exe
4496	elevation_service.exe
4496	elevation_service.exe
4496	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
Token: SeBackupPrivilege	5504	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5504	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5504	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5504	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5504	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5504	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5504	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5504	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5504	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5504	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	2736	AgentService.exe
Token: 33	3024	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3024	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3024	SearchIndexer.exe
Token: SeDebugPrivilege	1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
Token: SeDebugPrivilege	1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
Token: SeDebugPrivilege	1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
Token: SeDebugPrivilege	1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
Token: SeDebugPrivilege	4496	elevation_service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1196	2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 1148	3024	SearchIndexer.exe	101
PID 3024 wrote to memory of 3644	3024	SearchIndexer.exe	102
PID 3024 wrote to memory of 1576	3024	SearchIndexer.exe	103
PID 3024 wrote to memory of 5296	3024	SearchIndexer.exe	104
PID 3024 wrote to memory of 3300	3024	SearchIndexer.exe	106
PID 3024 wrote to memory of 1360	3024	SearchIndexer.exe	107
PID 3024 wrote to memory of 1224	3024	SearchIndexer.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_b968e2a4603fbfe632e62630720a713d_elex_remcos_remocs_wannacry.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1196

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4496

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4380

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4800

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1136

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:1072

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5696

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5504

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3028

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1128

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2736

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4046655672-1449839301-2197395821-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1148
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3644
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2704 2652 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1576
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2880 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5296
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3300
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2880 2908 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:1360
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2704 2652 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 1338ca3873235d11bff3f42d9bb0868d01bddc0511e57b0ef2f45c2d149fd941
MD5 c36b9995009039223383c66e6f7239d4
SHA1 bbdf6ed05822de9167ffe370d1515f388c109711
SHA512 f667b5aff9d70695fcc62496449ced646ede036dc6701a5dfcfda136d85e48e416d44b4a545e23e00588a68b7e97c8bce29624f396429f4c71c9b1fef404a2c3
SSDEEP 49152:kb+632BuPkFKRrdE6ohmstBhuXjfS4LWxncN/j2U4FH:e3q6HjBFj2jF
TLSH
T12DD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.8MB
SHA256 28de2d2309f53abb4b0ae24489b6b7a3f783c62015cafe3473476e86ee5c2922
MD5 c87ef256941f9692d7df29bd343226e7
SHA1 63641b94c91f339f7c5a1bc8ea4b73fdda2bce6c
SHA512 2a2c7cfb6b044ee57b0177edcc12d43a53d7cc2f7f8c5be602834145b5387791c12aa976555fa8d1e3c0599891d621f27a1d4ab261cf5b55334c83fef3ab7a08
SSDEEP 12288:Q1XLsswWkxy2lRq2czAsJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:GXYfDtczAEdCN/j2GLl3iFSE33b9
TLSH
T10885F128B7E409F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 c31fbec8c0b007a313289442b0cf5b1b2d52cc014fa956801b7a3d07953e17e6
MD5 973eb5cb4655dbfa9dcb7a846963f348
SHA1 c9aa61454a42645b27eecf023ce2dcf848e8085d
SHA512 4595c3fdf61be35a22af3e3af6fe2aab0e750ed4ec2d09370772f125dbf2b776d94dbb7b56426da63fcb25ffd8c4e212a7d15e729e0740e702ad9eb0bcff23d5
SSDEEP 24576:00Le5ji0hmxirMndCN/j2GLl3iFSE33b9:0Pji0AcpN/j2U4FH
TLSH
T1EBA5AE26F6748335D073C0B9C5D2A69AE97130865B308ACB4286D77C3F67BE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 204d0405a1711b04e754fc68a0fa465ebe5c0fe583cae7f2ba599d287375daf3
MD5 5613a59285cf302f4bc5fd586f83a862
SHA1 2d75717cad633d7e1cea18c2dff76ba38cdf975a
SHA512 5986829b1a6ba263d6dcf9abc0eb159519b4070ba15dc5c09499d0b5041c37013170ccd602a1e983ca569b7bc6995927abf74357f21bd6fe959e7304f9fe9786
SSDEEP 24576:Ya7/ezSC6vUyD/aqgrvWE6q8wyuNdCN/j2GLl3iFSE33b9:f/ezSC6vUzPvxHjy9N/j2U4FH
TLSH
T1E5755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246976C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2608f6941fe8eb4b3908fbfea052dc6bda742d218f014c916a2cd6c6715196b9
MD5 a1d60737d46a82b52db9c82be8111783
SHA1 b8f3a8d75485ca1ddcb308bcd08b2202b587f5bc
SHA512 f43a427240b068f967192b1b0e728f40eef1b59d599623c6aaca8cbe43efb87a8d7daa3a7c99a6c24e1541f583741cc8f484f8fb43e398ffc626c12fc2a7b00f
SSDEEP 24576:NVbqPb88hv/l+6QdCN/j2GLl3iFSE33b9:NVO88hXl+4N/j2U4FH
TLSH
T186559E65F5B48331D073C0BAC5D2AA9AEE3234415B318ACB0246D76C3E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 454b364fa4247f77b349e0262e708588470450f0f00a022cd4aecba8cad911a3
MD5 f7977e27101bef1675dff5ce89027c1c
SHA1 0046859ffdebcd64fd33707b8f0a400d1d91f077
SHA512 2060754a034729b2a664ae275807634af50d2ba9ecb4474df17bcbc81569a3104eab7ec63adec96cc6d441964cea20dfd1e626d4ba646e93827837dbf24ab213
SSDEEP 12288:SR7JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHa:SRjdCN/j2GLl3iFSE33b9/
TLSH
T177752364DAA4B665F66F837903ADDE615200FEE8E525884785917BEF117CFE8C033063
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.8MB
SHA256 28438dde55e46f8afbed624bcfa50d167b42c46a5d514966033f0ae9a572a15d
MD5 110957acd9cc36829ed79b2d58b1e621
SHA1 5c4646875d3c258d1542a1598f42bccc68e7e504
SHA512 6556cbfbe5e7b50d7bf7f1e828da195799a5bef34c9082bb9c6dde1ae48586d30d18da8c52911d532c27adf0d7e3bd0db3c2eb94a27c7ee943dd3bb0d824fce9
SSDEEP 12288:UeBNUbTVO86UoJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:UJIUIdCN/j2GLl3iFSE33b9
TLSH
T12285CF3BEE28FCE2C27E8DB85791C600D76278708B6293CBD165834E9E235E45D76C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 856d1e9518b4508c46304614bf2eb0d7d8ddf1fc915df1dd5952a7b314fb7850
MD5 bef3380d43914c5fbe8d6f3ab074dd5c
SHA1 ef9fb55da4253df4488d5962f6638511c138d337
SHA512 f9acbca9c10a0d7895f5008aef354a016ff79af1bc7c8d6ff8be6f230d0e7a3129d2d7e42cdc5bc8dbb2651e6a2a4a9477677b9a4a8068e5a0c391d4d846af07
SSDEEP 49152:gQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3THi:gQvGAdlCEL8c/yRNw5CCj2jF
TLSH
T112267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 b1c45a908f3989bb9aaed7105e092b665fd061f47c54a974ca56b4310389d85a
MD5 d10d523e58beb70e95b72e18ad14cbf0
SHA1 f1ed3feb815e53cf69378f312d0231da12133778
SHA512 ac263ae98d19ac88d26e3dc5ec41bac5e4440c61adc5905d363b960ff4d614d068b233b3d5f4025e363410e0fdaf6a9bf8198cf356261850bc554ed190a9fc32
SSDEEP 12288:VAwSfxL/2Dc34DLLmt0LDQewsAjKJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9K:2dewsAj2dCN/j2GLl3iFSE33b9K
TLSH
T14F95E031FE74E436C2BF0DB61B36C716142CBA608B6119C3E3E84E9E59346D26376A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 72a1c0d13452fb534fd4d28210f5353704ed48751602ec7563cb4447bb2b6134
MD5 5ffb3b6de1d613cf4f0b88dee1e5fe65
SHA1 c54a28e62ff2598fa78a24d571808852b6a86f44
SHA512 351232dcb0e6c725ec2e79d37f245b1474237b8f46b74a4cf6220fbddc399c0674dbfd659077dc857222fcb8fbfaa2786d1bd2c3d7af9b81349c766f5c3c8178
SSDEEP 196608:rUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHv8F:rUEtQevvqc2W1cpV2EI32v
TLSH
T187474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 1ec00f2200ad0d459c574dc3105fdc145af6e7c51090dd67c04093587f0f0441
MD5 4f4ed0f715b7582d17e7a8b0214f7fc8
SHA1 4ae79a1477c071644e107b63fe26bbf129d89406
SHA512 d304d6ad102d41de55edd22c9f4601de0baabd9d6f96ed528f6fdf69abc94324294325689b4990cf6611da1b9e00062185623653b2e7b478f3de152e809f09f6
SSDEEP 49152:kCbRquA/m2yL5zQfFiV+XenmE3/zZN/j2U4FH:toqtVjnmOj2jF
TLSH
T1C2D58D0976B8C2E4D1F6C37886A2C647F37178158B3197EF4265461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 772c01a75e0265884a8614477d6c668655537e8c01509df7da40d51407797e9c
MD5 a7d5bff7a929941e693c79bae1b5cde6
SHA1 46ab370df5b7535d51f83bf92e5f53f67a45ca4f
SHA512 52fe6953c66a5d7c77a384faa8432f6ffe5770af88f053a87c89059933f33e56f0f8450e0b07338eebd5bce21f06fecd7c594162871690288d30d3460d36eb74
SSDEEP 24576:FAhGLJIFoiwtA5l7S53hdCN/j2GLl3iFSE33b9:FAMyFoiq5mN/j2U4FH
TLSH
T1A435AD80E7F955D4F5B3AAB899B68571EA72BCA95E31C20F1150D21F0E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 344d69e1775ce587d97dfec8dfc3a19b90b921a1e59d7dc6ce76bc021413f3fd
MD5 9cc57552508e687238ea653f73932091
SHA1 35dd2fe378077f71f7f2c4e6da60c9c76565470e
SHA512 4e9032bc9d35caa10f6c9fbf8a3ee39c9d8d173e9dbcf8e42e60274263a66ad4c4d3c1bd9aab0cf5ffab5ac4112d72b6ac60a49a7c6d3a8fc35ad44b61eb9731
SSDEEP 12288:3mw5HEjsChNVBFgl0WDm+CpJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:WwuoOW6dCN/j2GLl3iFSE33b9
TLSH
T17B85F14576E41CF9E96782388697C536F7B2BC512A21CB0F0760C79B6F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.6MB
SHA256 f0933fcd3e8cea4edc4f4511f39e16dd01bc01296c9cb029d2067b402b83123b
MD5 aa5503f9f5571c6f43afb81bf00ba65a
SHA1 22880fc098d8aff6548f27e0a10b96d4d30054c3
SHA512 ec95d6b291fa302c898961dc2e10e0e8c866bb2b9fa37f21ba2c4400284eb698ad769f3ea75a3b6506b788f5886bc348ce4e6b2fb79b9b2412d176c3081667e4
SSDEEP 12288:yBZ1Iy6JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:cZufdCN/j2GLl3iFSE33b9
TLSH
T1CC75125973E471F9E1A7823C8AE59A05D321B8A5A73243CF026047EA1F36FD59D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7bdf86b07b8bbd5b819eaa59a7038629aa0aa86a19ff527b1b839fea8a2d4f26
MD5 81f6cb3875260da2daaf0619ce65a11e
SHA1 7c58820af412a4dd5b7f7e2ea3dc16dd65553c3f
SHA512 e4f668fc56c99dec12d063e1851c8333efad073ebc8c2fee56ff5a33df5d2699d9cb4485d9ab37fb81bb3e66171d6c34b183338e470e97222d8738359dceefdc
SSDEEP 49152:jj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UG:yQRQyi36YOcPQLvw2gAf+PN35j2jF
TLSH
T12E667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 07ada3a01dcfcb07977c493baddf46e9bd1856c6c18584c2290ac546a70bb026
MD5 42e17eefbad640daed82126bf02b5ce6
SHA1 a44e3c2f2db506cad2feb8b050d2b83c6fa4fc59
SHA512 d2238e59d582ac02a69040194cd005a932ec137f72536be21750b15b3959eb15d8cf666c55cb9b45e245c51fb90a85cab8e6eb02a1cfcdc06b5fc2546ef43aed
SSDEEP 49152:/j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23UG:OQRQyi36YOcPQLvw2gAf+PN35j2jF
TLSH
T1B3667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 3e01a8a97419392ce993c338673c38af9bd9ee1d1948e138ec1b3ac83ff02627
MD5 87feb014570dfbc9c546901aea082a47
SHA1 0c4ccd7bb48a9a6fed421a21edb7c5158ca23127
SHA512 b4d2d7a7567a18c11348769b92b7133ba958054b71eed189ca6b23dbcbca31eb065729a61bc7060d8efc2f81a56d23b685c2e62ee924f05887f47196fb787c8c
SSDEEP 24576:dwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0PdCN/j2GLl3iFS+:Z68Qg55nhheWu7PNU3/pN/j2U4FH
TLSH
T1AAB54933B2F200A9C44DE1769F4A872196D17C75CFE0E3DB8511725A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 81c27c88c610b0acc4ebf3922406deeed50e6775b5c3b6a864e25131f3e4dbfd
MD5 7a40301dca14a0ee614f2e59b99aafbd
SHA1 7cef511585c8f07a9fa1cb46093f2baa78e19c24
SHA512 1016fd21e836fe7116a55ea12e02992e7a8663f88ddc434adf139e8aeb6ee9d1c15f6fcbe3f6cfcf3c11922039281768d3cd2f8627412aa025b2d28e7dce7a66
SSDEEP 49152:K3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99:by5112gYy5azzVvL69nLKnhZcj2jF
TLSH
T115168B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 275121ff577f0b4b6a1c23b47bb1533473a2fda35c65970e9301b0155cebeb68
MD5 4c393c7bc9c7c64d8251d602d49a8120
SHA1 3bd8257fbfe4ee58d8e2857e4db0e6e671f00852
SHA512 6ae4c063458874c13da50a7d47fb3477532522c8fb535bd424e00dcee8a6235dcb57913c56ea4bf2c87347e71ee4a9c36565a686c5d5cc5a27e379ecbbb7b1dc
SSDEEP 49152:hB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glfN/j2U4FH:3u6JmVxd2dhj2jF
TLSH
T137D59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 68bc1127484d625d79290bb8e0573abd7da1d40b6808f95700cc42974fd08c6b
MD5 37cd5995bba1887eacde41f147173a72
SHA1 05c6f2fd5ebc8de718dfcb2f5a060064d23a1de5
SHA512 f683986ab97f3a7a0f5a356cb51b40d5859ffcf350a6fbe25e903d131cc36a8d07fa079095cd2218e087c3c877e8572fa2fe7cfd529e3a2b8baa33b59439e3cc
SSDEEP 49152:C1hpsNoJpF1A6UU44CwH7R4xTN/j2U4FH:CmifPbROj2jF
TLSH
T143B5BE13F2D901E8D06EC178875A9632EA62BC450B34A6DF0A90B7961F7BFE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 89faf2dedecd00b167f326dfb03ebea199bdc375090fb5eedda4e3ce93b30578
MD5 fe72dfcd76be8e9a747f390376cec17e
SHA1 1bca1bc93a211f2cf8ee8de6d392759c38502a1a
SHA512 87f6ff743b6acc825ac706b5e7cb87b7e1fe18655843cb07dcc5de740dde8c685962444050c4b41c5bf75ae88606affddda323cbc03c897ab534acde0fa1ab7e
SSDEEP 49152:9SuZQIY0Be2KRRVtOnks6NMHqsN/j2U4FH:T5dKTi61gj2jF
TLSH
T196C5BF13F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 7771d9ab0189fbbf416a7aed73efd9720da6c054849666055e86fdd033a0ab88
MD5 d404839ab8f682c79fff8b805c4c8d7c
SHA1 d3d99c18f28b3317007cfd6c8011e07422ff272e
SHA512 7521ce5b8ba4598c801b472ef2ea66092e4ed6b126aa119ca93edc043bff6b5fc5640b91278688ffabf55099fbbb15fc1a1fa30f1e6142569bc8d8c6aa2f5a25
SSDEEP 49152:+htSn8EApI0figngiDn0AP5wvN/j2U4FH:fX2iyph6j2jF
TLSH
T19295BE13F2D900E8D05ED178C7568632EA62BC150B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 1352bade0e5dee0477255ce9b178c13d18e760b7b1b7a8a49d1faf043fda26df
MD5 79792c0e35ae040789e70418727c622d
SHA1 f2b0309b9dbd649d12a2b7e7c0826b28a3ff4a08
SHA512 bef99455a9b095ae659e792c0b1bedd1efa15270f8dcf8575e5c867247c66638aa25d4e1570345877fc9ee87835f9788448d00a5f7badd3a4905824aebdabcd6
SSDEEP 12288:rjJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:rbdCN/j2GLl3iFSE33b9
TLSH
T11C752364E9E6B669F15BC37943A9DF515100FEE8F6264487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 1ce461a8d34a0effdd5ba7f58883a5a9ffb5d81e1e2af7c0423abc3d189b5b53
MD5 a8999671e22708fc9a742da03b2e1a43
SHA1 67296e8914a032db247fdacc7c6e7d6812fb63f7
SHA512 c7058d7f51e46c30524c461d7c7d4ee6a6b020bbeaf847689e4313a3eebd9b5c91aa6fb208fc8d7db36ac0a1509364bb96ecc01e9223bb34cd9175f930e06426
SSDEEP 12288:2uJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:2CdCN/j2GLl3iFSE33b9
TLSH
T180752364E9E6B669F15BC37943A9DF515100FEE8F6224487868156EB637CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 46c6a914bf13a7cb9e427643921be741692a9af8c3ce7997379c1522b74c9bb9
MD5 2b8d580d4ff862fa3de0f1895321f493
SHA1 dc5c244a6b35fbf30952827d7ba22499c4dc7dca
SHA512 3127c35b8a9287db8197a37d49973f9260b9b936097e734dea0051b52098c611651622213bf278ad5644006426f8959e8350fd8e0aa9983da86acd85f847e90e
SSDEEP 12288:XwJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:XAdCN/j2GLl3iFSE33b9
TLSH
T139752364E9E6B659F15BC37943A9DF519100FEE8F6224487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 600e1fe5c4ceb29c4244578d984519970fec5a24a2854fb3abc6f466a6fb71dc
MD5 6a4b895e267c20303e8ac650f34a6567
SHA1 2d192ff556d617e129c5c0ebc2c681c09af4200d
SHA512 d7cf24c4c0999ee0094b6f979bbc59169096dfe470cafc882c85e17df327717711f8238055f7e9f966fd36428c19f7de2bb0c53a0420b6f8cd5bebc679846c56
SSDEEP 12288:9VFJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:5dCN/j2GLl3iFSE33b9
TLSH
T178752360A7F561D5E46BC37C83B9DA11E220FDE8F732458F87400AEB1B75BE89432562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 52ce3b86d788c56d0aa9f96394b796abdf3e4e3220cf9fd39c865b24f10793ff
MD5 eef3cb1e1c0cee31563aeacf847deab0
SHA1 6c614f632c898112f6931bcb415941c256be7587
SHA512 4e19f2d8b0fdc8da361325e6c682022289dffd80a9fa68194d3b8346516a63954cc57b6f33c4c5f9e58cc0cc48f8b27ac66c465b19f47adc3ede4f456149f811
SSDEEP 12288:KdJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:KJdCN/j2GLl3iFSE33b9
TLSH
T1D0752364E9E6B659F15BC37943A9DF615100FEE8F6264487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 7ee65a6630fef5dd7db15503522860d421f30dbc35ad815d7bd0390983e7c081
MD5 c6c39724d321eb978798589401aab39c
SHA1 45ca2b27255703493b570596bedf27c29fc684d7
SHA512 d2c85a19d2f4390ea96032d53c1f67b7463e9979b676cb34a56fe2a3b039881687b56bf0f0aef0df4b21a6911786ec43fb6c950fea672e8a956a9d04badb8e0f
SSDEEP 12288:ISJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:IOdCN/j2GLl3iFSE33b9
TLSH
T1C0752364E9E6B669F15BC37943A9DF515100FEE8F6224487868156EB637CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 bc53c161b11c3fc31cc5af4013ced0f5830077a2878aebea66ceae0061de5401
MD5 d9a29dd355346fb40e2057b9482b64a3
SHA1 4993baec3bc0439be3301234d194f78d1b92583e
SHA512 7a81968c8b709c0baf69ed890b050c2398ce912694861b45e121788dc96e01fbd5d2aa3be64105198406c2e1c6738d5a40c64b66922110d73833fb4cee79751f
SSDEEP 12288:IGJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:IqdCN/j2GLl3iFSE33b9
TLSH
T162752364E9E6B659F15BC37943A8DF615100FEE8F6264487868156EB237CFEC90330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.8MB
SHA256 ec4aad1461bc9820d1759dfa83f85ce64705c8011aa526614d6a09845203c0c4
MD5 8fe5d2692256a0bc6488fcb9fd13c041
SHA1 976c1e9ed1d274ff90df032a51b07dec7ff23030
SHA512 3ebfbd9ac2ff5c1183d8337022308c33c1b32955ddcc26eada06b2008ca41b490ada48fb6abe550bc2d9728dcd5b536b618b83caa56f17dbef0a2a44cd87f644
SSDEEP 12288:5iZwb6zzFEoS2cPvyOJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:8ZMSzFVSOidCN/j2GLl3iFSE33b9
TLSH
T11A8502A4B39018F8EC67823EC9658916D2B1BC594770C60F03E4366B5F377A15C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 f682568964b30a9bf6a6051cb5f400e78b0d0a48f46e560e404e003197bf837d
MD5 30ce7a1f1c57faae504de019c73ffb06
SHA1 d58696597a16732e7790efa835f9300e4d89c9fa
SHA512 a9a6285a86f0173bf33749722072a7cd025d8d2c693b4039a907effba284f89a3d67ae59bd982e3cc70ba740f32786e2bb3abb81c11082ac66b0b0ca62e02932
SSDEEP 12288:M/JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:MvdCN/j2GLl3iFSE33b9
TLSH
T10C752364E9E6B659F15BC37943A9DF515100FEE8F6224487868556EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 4f2cf283061e97f48dede0b7357dc16bb750879ae50d26fa8198a34108094e25
MD5 d769a79572c1ca3cd9857bed8e35bf01
SHA1 55438bf74c6cfbd07b04d7b7c72ca3cfd2e2c726
SHA512 755da02bad1e461968177b317cc620622ab9b5fc5b4fa469ce14e089290c4b325faeec10381f18d3d61118925a4efc442d5f4132e491848fc13fa84175d1351e
SSDEEP 12288:hrJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:hzdCN/j2GLl3iFSE33b9
TLSH
T193752364E9E5B669F15BC37943A8DF615100FEE8F6224487868556EB637CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.7MB
SHA256 e4cd74c99a93f9ce0b3ebaf63727d8049f96cc150b71bca18f646fcfa3cb18e5
MD5 2f470ea311ada2b15879f43e51aaf4ee
SHA1 c9c0d16301f4cc7f626a85a71b28abd888473b58
SHA512 8dfd10c076ff780b685372df768585de5a5d227679c1c612c1e5d37835cf89def77187b89f86a3df55fd9153d9e4b37ef913b7f907106c9c3a40d5090c9bcd1f
SSDEEP 12288:1yPz5L86JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:czyGdCN/j2GLl3iFSE33b9
TLSH
T173850217B3A131F9D167823889A55A11F331B87597208A9F43A007BB2F377E49D3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 c49ba81421dc4e29f3cc73cb4fa965c9cb04a152a1d167e7a6cdb3696747ff24
MD5 d44b6be413404ce86b7fde8636195938
SHA1 a8bd2153605c0fd6410cfb4e0143bbfdae8e35c3
SHA512 09b94978f4cd6f312305ed662cf0bcb9120229621ba32267314e4b960a7f45b6abaccedb5e353e6aa0cbe7fa43de13b462632e66b98fb242a1f4cced6611552f
SSDEEP 12288:X/JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:XvdCN/j2GLl3iFSE33b9
TLSH
T121752364E9E5B659F15BC37943A9DF619100FEE8F6224487868156EB637CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 a88a3088eda6992c74b5148a54127a33e13d674f203d138805b82608c81b9fd3
MD5 c1268758306b69c9939fdbb56931527d
SHA1 862f3768213c981fc3e323cd121cf71879159dfa
SHA512 37f49e42d7f0315b5d58b5971026b1ce4b9fb75ac7b07b29db17012d49d854efe7d375779b3099c80e49445e9651d3bde9167ad99510c9fd136b73f7d7115392
SSDEEP 12288:G/JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:GvdCN/j2GLl3iFSE33b9
TLSH
T173752364E9E5B669F15BC37943A9DF615100FEE8F6224487868556EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.7MB
SHA256 e85d1c5f9022f04bad265da4fedaca9a36cbe838d01a724c03c85c3c290ece67
MD5 8dfd6af32030575e999b262155d76bd3
SHA1 e5047d869d478bc99a8a0e6ffc4c536b661721d5
SHA512 4d2fe7883812a4a3f4d305b7489e2ba93d1f00322d05a4a31db7517484eda3dfce95c20c3d388788fc45d906cc371eabbf78df8bccc5646c238b9f29f3f58a2d
SSDEEP 12288:qyPz5L86JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:3zyGdCN/j2GLl3iFSE33b9
TLSH
T1CA850217B3A131F9D167823889A55A11F331B87597208A9F43A007BB2F377E49D3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.8MB
SHA256 f71d527603e48b187e514aa77f9d325316f50a802bdc6d30c507f470dae1a75c
MD5 d10c13e74bcb5d4e6979bc314e43ae9d
SHA1 fec833665d3c8fb33facbb787fa3639bb3393121
SHA512 00234000bdcc9f0e802de342313cfa41694258a048e9d72c77adf72d56f0101312549e004b79637b09e8e01580b28630bdecaa3c3d9dd95f091abfe4002b37c5
SSDEEP 12288:SCd9eWYoaLHF3z0z04PDvhAJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:zTHaLl3z0zDwdCN/j2GLl3iFSE33b9
TLSH
T1008502A4B39018F8EC67823EC9658916D2B1BC594770C64F03E4366B5F377A05C3EBA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 2.0MB
SHA256 aa69c5eaa8e39e0b2723f382cdad552e9278a5e6b8816ebae69c3cb8d2007d15
MD5 b54ff2acda05d0fca9f570d929dfd479
SHA1 0cf8fcb2518bcda325fa25b20668d5b4fb02550b
SHA512 13bc2510a51a177cd3f472effae4c836310fac05f152bef7609bb1c35b33a78bc6bab44a7a7dbccc012d699f708f288e315b4456589fe224bed7afef8a0e8e80
SSDEEP 12288:Mi4e7+RdTfgwCHKy7GLbbdIvBJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:M37d9CHKy7GZcdCN/j2GLl3iFSE33b9
TLSH
T1CA95CF90F3E414E8F0B78A3589769511DA767CA95B31CA8F03A4265A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 dee604db363d069cad76fc18efe9dd388ed7b808a53ec4a980b06b3afc567fbc
MD5 25d8af1aff73cea6e74c3da726f56f39
SHA1 c0994d30367284332c7f0154a0a4aa03d0020580
SHA512 e68a211291fb4ac9d59f68816e7fc5c2b53a5c33c51059d8dd622d91bab1ca0fa3837beccced53eb86844cc805206971647e66518a006bb1a8e2bf20470e0239
SSDEEP 12288:rQJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:rgdCN/j2GLl3iFSE33b9
TLSH
T111752364E9E6B659F15BC37943A9DF519100FEE8F6264487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 ce6f45bd7ef713a49efa077cb0530ada8cf61d99e7f7196a95cdd329c9a3bad0
MD5 c7bf48dd127a29d1822f0747028e4cad
SHA1 4b97325d6c655141b3e15e68a6b9210232a5d6e8
SHA512 d8a40eee6759944af522e5f670e772adef570250507d11964befd95092c00f236d33019474712b19cdf74af628156b4b2571cae83a84936c26730d55ae91e6d2
SSDEEP 12288:PaJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHp:PmdCN/j2GLl3iFSE33b96
TLSH
T1F6752364E9E5B669F15EC3B943A9DF515200FEE8F6264487868156EB137CFEC8033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 1.5MB
SHA256 c20cfe2007c799fb15cb15502f9a9890f504a0b037d58cac71424dd84ad17325
MD5 d8b8c9ca59fd81c00f602bb3bf857580
SHA1 0eb76b6c7e4bc85b470307ba359140140678d6d7
SHA512 19977429599c663e14fd6b8dc13d49978da9de9b1426f4bc2e94b6bbba3a46f5ffffdb795bf07700439e659f88fb49b448b7cbae9bde22fee1c888afd7b45a96
SSDEEP 12288:aBJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:a1dCN/j2GLl3iFSE33b9
TLSH
T169752364E9E6B659F15AC37943A9DF615100FEE8F6224487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 1.5MB
SHA256 8339fd5263b192f235e46a632da78e7606d210adc781b06327feeb204b0cc32c
MD5 a56d6e7d7eea00996ba5d848ca13c826
SHA1 a21c6cc0e6ee9b55576e8c612ea0a9f1db00062d
SHA512 81e699078968f0a6b65b2f295fe58ee6f606db6df54f8c2d5d9d0545cd01a024fcdcea2bdf72a7e70be046941eae42d9284e2ca9c0b7d464bfdcb9075a84d0e1
SSDEEP 12288:a/JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:avdCN/j2GLl3iFSE33b9
TLSH
T147752364E9E5B659F15BC37943A9DF615100FEE8F6224487868556EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 1.5MB
SHA256 aa57e02e2af7917b07421255982379e9987fceacac0f51891adf294a832d7591
MD5 e72126829dd384c9780187cc0d48bbfb
SHA1 d5377a0375358259bdc1913ae81ca00e020b3a97
SHA512 f0380f59a27fe1a11f2ab79f8696750f31f6372a9e1fa4988c64039e6e523b7077a60a9cbab06acac4292dd555b33a8a1b8089ef76abfa35e2802e64683d0bf7
SSDEEP 12288:uQJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:ugdCN/j2GLl3iFSE33b9
TLSH
T1B3752364E9E6B659F15BC37943A9DF615100FEE8F6264487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 1.5MB
SHA256 211537a8edc28e2e67cb29ded546336690a0ab7a496db37ddc479d7ae435e47b
MD5 8fa7e1f0227a0b1997c4d14dcd1a17f7
SHA1 6cc8f119148ae1f6f9012c104948b37c92cf1bf7
SHA512 d4f0271275d1352bf45f8c91a622493776b7ef9420e682689e4d35964edcabe4ab5e844404108e441bc14d9592579b2b90d12051e49cdc86cdcafc3e2155bbae
SSDEEP 12288:E3JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:EXdCN/j2GLl3iFSE33b9
TLSH
T122752364E9E6B659F15BC3B943A9DF615100FEE8F6264487868156EB237CFEC8033072
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 63af819303b346a036dc8834ffef9007c6eab67c1f61b37ad408987ae1a29750
MD5 5e3ddb4403a8768959198226c7ee426a
SHA1 538721fc4cd7a8e53e438e3082b724551a6b033c
SHA512 bdd5505e9a8092084d1c0d20513daa2b4ace7d08e5f15dbe497e51e834cd37bb9b4195387bf112416170d885a9bdfc5621a548652cefb43fad80db5a1abee26f
SSDEEP 12288:IdJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:IJdCN/j2GLl3iFSE33b9
TLSH
T1A9752364E9E6B659F15BC37943A9DF615100FEE8F6264487868156EB237CFEC80330B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 2.0MB
SHA256 cbd1aedbdeea4bf3803e82d27ed25145ae044662d081dcab9ba59d18bdec2755
MD5 c24b83b1ffe16a43a04f85f29a7d37d6
SHA1 aac68c593123f0bd7141c6c5347b14f2f1eadf2d
SHA512 50da71d675ae231555e584ab30d328d60fd3baaa66718afe0625de85374710b47092371700db0a254ee2f25bf875686b8eb01ed6d6fa6759613dd2adcf3f2563
SSDEEP 24576:5fwvok9RX6wkyAIDdCN/j2GLl3iFSE33b9:fMnYIAN/j2U4FH
TLSH
T191A5D029EBDC44E5E177923C89B7460AF2B178685B31C6CF029A53AE0E37ED45D39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 dad9debad3dee664bd521ae468fb38078157b1cce46b2fe138d897c3685ddd73
MD5 5dcfe52222fba3eca11b9a7aadb7c51b
SHA1 6d6799939b567fbd03d243395635ad7a19b78582
SHA512 848dadca223dbdacab64fcbb602f15cef0db626278522b0172ebc36cb88b3ab90a86d2489c56ffdf43906e08e94709656f747ecb522e356ee0038e979611f66c
SSDEEP 49152:EYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0PN/j2U4FH:KySzPZj2jF
TLSH
T1F4067C96A1A801D5C1B9C1B98B1BCC1BFB7134490335ABEB03E556935F6BAF09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 60f6bb2bf7a5ca61ced1594ab5859bc8a74333a61852e7450f9c6cfae8c44abc
MD5 2b1ecc1c7bbd762a14dfa307b59e8514
SHA1 e282e575fadf7c5969111becf53a20a7eb430212
SHA512 571b8dae8ab22a99f280cf843a06fb2fe1f391b4f280dadf506affefa6a15ee83a47887919727e9dd64d591ac5cd7fad7eb5782d121160bccade5e1db7b0a29b
SSDEEP 24576:V47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYydCN/j2GLl3iFSE33b9:V47JUQj1irIhCnDHUPfF/fN/j2U4FH
TLSH
T1B165AE1DA3EC01E5E1BA827885158A5AEA71782D5F31CACF1270437D6F23ED49F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 b383deba0ef26973a74fb9f7af9821126124d2c5fc51c7d4c383ef7747262038
MD5 20ff14796dd54e2dd76d437b3ffad51c
SHA1 04d084f6cadd613a66c8ffeeab6719827f3cede5
SHA512 3f8abc0a96a4fa16164b46a2133db3b0670a6d197cc104eefa63a28eb0779513cae0db2f53a1f6ab30866fb3fe95c6b30879a2adf88fe9a90a98e53ed2ccd4f6
SSDEEP 12288:RNsfPJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:WfdCN/j2GLl3iFSE33b9
TLSH
T14A850119D29412E8D06E9279C7558A41B323BCA493E1C3CB43C0F5BE1F7AAD49DFA613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 5212f4e91a8f46b3ed02c8d5f1c65c30b5bc150215f6d0bf9866065591574c78
MD5 23b94ef34b41bcb652b2b43ce7e9a4ae
SHA1 07967e0ce7bf2352bd090e223eaa7a551f6be020
SHA512 f51f20164dd9663c984f978545956b1c4c26f8eda25a61134b759c975a3e9680ddf04075b98081d3d5902512ada6498442a250fb66521ce32e564fcab21a2cdd
SSDEEP 12288:kEFzBU3fv0GProxuvTolUj08/21RMqyVOLJFi:kEF1UPv0GProxadI8/21RMqicJFi
TLSH
T1D6353950762BC75FC6A940321E33D2CCAB707D11EE459B0772C8873FD576669BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 afb0e61d51b3794e2c973e4aa336b26765b44262124d70fb2ca4fa65a43235d0
MD5 8c20cf3ba47cc7377cb5e382a3293a32
SHA1 42a532a166f0e98519c637b9fc84e4101c02af94
SHA512 f35f0be7aca2df1355c4e828929ad6a6566727a0da6ccbdc13492dbad2332ba7d6277e0e3753b5316cd703d7014cc687786b574a3868b1764f204bb6fc453cd3
SSDEEP 6144:1Ywx6FDW/SPybBByiExQm7wu4tk+dbDdoNgZ2veNE4RPtMx6RPtMx4si0KYSXTgV:1YwCW/LbBByxxQm7wboNgZ22NEuXHZzc
TLSH
T1B265D7816136E3CFD1F76031032A5B4DA764EC17B3495F26B388053AD86AB66B0BD3D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 24621bd195509aea59853343edb6541686b41af162ff7ed8d00078c6db61fc83
MD5 11d9b487270c9da52bed3c544461cab2
SHA1 32827fbb09d44f3f4504eccd580379217a8153db
SHA512 bb1acebf9ca25fb0558663ac0cda89763628eeea6854006d38ab1557b4d63c70bc56917ee55ba13bc545f9909972e5de1f5cdc39e5ee65599600f22198dbf5b7
SSDEEP 12288:sM7HJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH+:tHdCN/j2GLl3iFSE33b9H
TLSH
T156752360D7E9AA55F47A837803ADDA316200FEF8EB1184C7C54167EB6278FD8D832563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 a13c2935c84701a419b01df50d3b9a1cd241b6782cbc5cf112e4e786956feac3
MD5 fa1b581187834492fcbd727e958ef37d
SHA1 aeb782f0ecef39b4765184ec7487c19d732f4b53
SHA512 8e7aaf9addba9019b913e874fa38e2aea48636abe93eea1bcaddcb5bc167a171ad11347217120cd68deeda15e5aa4d0d63642790897759a9ff26e4a1d33d371f
SSDEEP 24576:pgb6bmBIi49WNNFpg1rSvFv7bYNdCN/j2GLl3iFSE33b9:pgb4mBIBhGF1N/j2U4FH
TLSH
T15665AE1E22EC02F5E0FAD2B88DAA4417D6B278165731D2CF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 c53085c16c6de54f3f431b15a5b1bf86a4cc16acf50c1cfab9051264fcaafe44
MD5 82c4254c3e5ebfcf03cc5e0ef963fc35
SHA1 2664b991c2bcd5ee0fd621e9d2c3fcf4c5585269
SHA512 6b5465c2aeccbfd539da3fa362e99fdb57dd4442ef21e009a839fdfac03d2ebe84aef3627db758e72eec9462229a61f5dc00dd9274197f1df1253d4ccdf79fcb
SSDEEP 24576:5G88u8FpJqH1bzria7/midCN/j2GLl3iFSE33b9:s7ZFPqVea7/KN/j2U4FH
TLSH
T15FA5F16576E101F0D47BD1388A864663F671B8251364EBDF07A88B961F23BE44B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 67067f85105e5421d429ad30877e65d1ba48b375da7a09c5eee3b1bf22a27157
MD5 94a213f1428359f22fda3d4acd63ce87
SHA1 e2011aef6c087bc7b993f71dee028c1fb9e5759e
SHA512 16ab5d9c11ec4e36c060a1afc037a11c24eb16d2666e4179b0a46c20f07550832c779d6fda0dcb7c361ed98801078e62b188d2da081506f875e6768cde50e1b3
SSDEEP 12288:vHvUrBFrEjwaQCJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:vPUr+NQedCN/j2GLl3iFSE33b9
TLSH
T15785F22E62E918E5E67AD17D86868719F731B8615311D2CF02D0817E4F77EE8BC3AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 76dda1b8f66882a13cf1daf7eeecc54acb6ed5dd5e2aa6e0d60673c1122d019b
MD5 4c5cb1e58dddc5c7f6cd25f97351e2cb
SHA1 47a6cc0882b2183573a89f1fbb436b6e993700f5
SHA512 86e4f92de0f1c98a54b308e0d7e1b64747d81af496bad45aa7756cce623ccd1734925080510711deddbb191ff7b8f416bd7028ffa2d1c4a43c2631de3b319cdb
SSDEEP 49152:2BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjRN/j2U4FH:ZG05lO43b0j2jF
TLSH
T10DD5CF6A62EC11F9D1BBC17CDAC64A0BEBB23815033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 7d014af4ba521ea70a4fb3131c1a83c18bed1c025500b9534034851d24e0505d
MD5 ee6fee90056165de27c830be934c06f7
SHA1 4b0ccd79c61286faeb4024a274f6590e17796d6e
SHA512 e759c46a0ee2a5ced6df51b8174c3aaef1635e0264c946488c9fd850c2bd14547e0ea662959a49be1a245fad7fb17124f0b2e8a8cf46f1592b1be61861835fb0
SSDEEP 24576:vfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnkdCN/j2GLl3iFSE33b9:Xa5POZ3+Jt2pasx2+mpN/j2U4FH
TLSH
T11A65BF5DA6FC01D5D1B9D17DC5838A1AF5B1346153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 bbf81a31a7318d0d775283aabbdc2ec0e2fa11425b07de43b5da320a90b3a12a
MD5 f97a2e46d222443278d307b942651339
SHA1 551e4e4668408298e33e5a9c90569b019877a814
SHA512 0bb8302134e3b84721dac19d2df5f33eeb5e636fbc8d15c0c4aa528a9bc48451035b0b2fa4c37f0a398d9284933e9cc2257246b7ab68279b79a9c50dcbc772e1
SSDEEP 24576:nNcwHdjbyQ4nLC18lb/EOjowL7FkadCN/j2GLl3iFSE33b9:nNc/zEOVHFqN/j2U4FH
TLSH
T1E9857B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 402cb8fe5ce3df5f7200d6bbeff13c0acc27c270bad7475635f620935d9a3f53
MD5 9f12842e7649bd16443f892b5f76c930
SHA1 f20cd71efc6b167c04275728bf792fc2a546025b
SHA512 0d2e258e08dcff6d94232efe3280df6e00914ae556c2a9b05039ffe0c603bf0d8ee56fb14688aa329ddd9fa7d6085b2d33703d8a3dec3435fb08a4d507413b51
SSDEEP 24576:H8kNvNnaFeYhJNtmZBmYdCN/j2GLl3iFSE33b9:H8MwBtOmDN/j2U4FH
TLSH
T11E55AF6EBAF846E4D1FEC6B58E238512E6727461173293CB4290C13F0E679D89D36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.9MB
SHA256 bc999deb2fc430745fcec1dcc6d35580ae799b3c242fa0474e2ef4385b87169f
MD5 3fc6980ce1b2efb07295a67e441a16a4
SHA1 f8de1bd23305244e277e460719b8079539477282
SHA512 7c1c2b207f31bffc2be94367023fc303fe724ef9558fcb208fcd47947d7bbb3ea6f9fab1dd21f9ad0ee376a2d8973518924919592e9a38c0ffe3d76dfbf9642a
SSDEEP 24576:1D3FHshBIYQgA7dCN/j2GLl3iFSE33b9:1DVHeBIAAYN/j2U4FH
TLSH
T1B695E17DE69C04E4E57BC2BCC6638A06E77178A8432255CB02D481BA1F6BFE46D39F50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1072-275-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/1072-71-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/1072-72-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1072-65-0x0000000000800000-0x0000000000860000-memory.dmp

Download

memory/1128-311-0x0000000140000000-0x0000000140327000-memory.dmp

Download

memory/1128-113-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1128-120-0x0000000000D30000-0x0000000000D90000-memory.dmp

Download

memory/1128-119-0x0000000140000000-0x0000000140327000-memory.dmp

Download

memory/1136-245-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/1136-59-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1136-53-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1136-61-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/1196-7-0x00000000026A0000-0x0000000002707000-memory.dmp

Download

memory/1196-6-0x00000000026A0000-0x0000000002707000-memory.dmp

Download

memory/1196-0-0x0000000000400000-0x000000000068D000-memory.dmp

Download

memory/1196-1-0x00000000026A0000-0x0000000002707000-memory.dmp

Download

memory/1196-86-0x0000000000400000-0x000000000068D000-memory.dmp

Download

memory/2736-124-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/2736-131-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2736-125-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2736-133-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/2736-136-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/3024-143-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3024-142-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3024-150-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3024-315-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3028-99-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3028-106-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3028-108-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3028-314-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/3028-312-0x00000000007F0000-0x0000000000850000-memory.dmp

Download

memory/3028-310-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4380-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4380-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4380-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4380-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4496-19-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4496-105-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4496-20-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4496-21-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4496-13-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/4800-44-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/4800-45-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4800-38-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/4800-51-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/4800-49-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/5504-306-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5504-328-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5504-326-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5504-94-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5504-88-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/5504-87-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5696-292-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/5696-82-0x0000000000A80000-0x0000000000AE7000-memory.dmp

Download

memory/5696-77-0x0000000000A80000-0x0000000000AE7000-memory.dmp

Download

memory/5696-76-0x0000000000400000-0x0000000000680000-memory.dmp

Download