Overview

overview

10

Static

static

5

4aa2ea3cc5...85.exe

windows7-x64

10

4aa2ea3cc5...85.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/10/2024, 11:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4aa2ea3cc55b48f3f6e54c75d383592a6fd4fa449908adbc019c3fb676dd5285.exe
  • Size 2.9MB
  • Sample241009-n4k6jaybme
  • SHA256 4aa2ea3cc55b48f3f6e54c75d383592a6fd4fa449908adbc019c3fb676dd5285
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
remcosremotehostcollectiondiscoveryratspywarestealer

Malware Config

Extracted

Family

  • remcos

Botnet

  • RemoteHost

C2

  • 204.10.160.212:6622

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-98KSNN

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Drops startup file 1 IoCs
  • Executes dropped EXE 23 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 31 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 41 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\4aa2ea3cc55b48f3f6e54c75d383592a6fd4fa449908adbc019c3fb676dd5285.exe
    "C:\Users\Admin\AppData\Local\Temp\4aa2ea3cc55b48f3f6e54c75d383592a6fd4fa449908adbc019c3fb676dd5285.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2744
    • C:\Users\Admin\AppData\Local\directory\name.exe
      "C:\Users\Admin\AppData\Local\Temp\4aa2ea3cc55b48f3f6e54c75d383592a6fd4fa449908adbc019c3fb676dd5285.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:5008
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\4aa2ea3cc55b48f3f6e54c75d383592a6fd4fa449908adbc019c3fb676dd5285.exe"
        3⤵
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3868
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\Admin\AppData\Local\Temp\gzvsmeyfjdzyxnx"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2816
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\Admin\AppData\Local\Temp\quacnpizflrdzulbom"
          4⤵
            PID:4528
          • C:\Windows\SysWOW64\svchost.exe
            C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\Admin\AppData\Local\Temp\quacnpizflrdzulbom"
            4⤵
            • Accesses Microsoft Outlook accounts
            • System Location Discovery: System Language Discovery
            PID:3528
          • C:\Windows\SysWOW64\svchost.exe
            C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\Admin\AppData\Local\Temp\twovnhtattjijihfgwiuz"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1136
    • C:\Windows\System32\alg.exe
      C:\Windows\System32\alg.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:1660
    • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
      C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
      1⤵
      • Executes dropped EXE
      PID:4656
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
      1⤵
        PID:2620
      • C:\Windows\system32\fxssvc.exe
        C:\Windows\system32\fxssvc.exe
        1⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:3976
      • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
        1⤵
        • Executes dropped EXE
        PID:3292
      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
        1⤵
        • Executes dropped EXE
        PID:4908
      • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
        1⤵
        • Executes dropped EXE
        PID:1140
      • C:\Windows\System32\msdtc.exe
        C:\Windows\System32\msdtc.exe
        1⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        PID:4728
      • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
        "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
        1⤵
        • Executes dropped EXE
        PID:4036
      • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
        C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
        1⤵
        • Executes dropped EXE
        PID:876
      • C:\Windows\SysWow64\perfhost.exe
        C:\Windows\SysWow64\perfhost.exe
        1⤵
        • Executes dropped EXE
        PID:5040
      • C:\Windows\system32\locator.exe
        C:\Windows\system32\locator.exe
        1⤵
        • Executes dropped EXE
        PID:2112
      • C:\Windows\System32\SensorDataService.exe
        C:\Windows\System32\SensorDataService.exe
        1⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:5032
      • C:\Windows\System32\snmptrap.exe
        C:\Windows\System32\snmptrap.exe
        1⤵
        • Executes dropped EXE
        PID:4744
      • C:\Windows\system32\spectrum.exe
        C:\Windows\system32\spectrum.exe
        1⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:4536
      • C:\Windows\System32\OpenSSH\ssh-agent.exe
        C:\Windows\System32\OpenSSH\ssh-agent.exe
        1⤵
        • Executes dropped EXE
        PID:1228
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
        1⤵
          PID:3368
        • C:\Windows\system32\TieringEngineService.exe
          C:\Windows\system32\TieringEngineService.exe
          1⤵
          • Executes dropped EXE
          • Checks processor information in registry
          • Suspicious use of AdjustPrivilegeToken
          PID:3980
        • C:\Windows\system32\AgentService.exe
          C:\Windows\system32\AgentService.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1216
        • C:\Windows\System32\vds.exe
          C:\Windows\System32\vds.exe
          1⤵
          • Executes dropped EXE
          PID:1324
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2752
        • C:\Windows\system32\wbengine.exe
          "C:\Windows\system32\wbengine.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4384
        • C:\Windows\system32\wbem\WmiApSrv.exe
          C:\Windows\system32\wbem\WmiApSrv.exe
          1⤵
          • Executes dropped EXE
          PID:1328
        • C:\Windows\system32\SearchIndexer.exe
          C:\Windows\system32\SearchIndexer.exe /Embedding
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2080
          • C:\Windows\system32\SearchProtocolHost.exe
            "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
            2⤵
            • Modifies data under HKEY_USERS
            PID:4416
          • C:\Windows\system32\SearchFilterHost.exe
            "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
            2⤵
            • Modifies data under HKEY_USERS
            PID:3264

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              elevation_service.exe
              • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
              • Size 2.1MB
              • SHA256 51adedde288f18cf8696c269deefb975efae82127bc4a4aa4588c93f23af3807
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              maintenanceservice.exe
              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
              • Size 1.3MB
              • SHA256 f6fb0a7d3710a86991d70d862f952c6d49f33db49bd21a45f8df128eba78dcba
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              7z.exe
              • Path C:\Program Files\7-Zip\7z.exe
              • Size 1.6MB
              • SHA256 a5db059608620105f193fefe7a2d3c86200bb8869667fd01cbc78f0cf9fca091
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              7zFM.exe
              • Path C:\Program Files\7-Zip\7zFM.exe
              • Size 1.5MB
              • SHA256 1e27808d760b8c0060d15f28fcf4aebdd73f938570cb22cfc7a1b657ff4031c0
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              7zG.exe
              • Path C:\Program Files\7-Zip\7zG.exe
              • Size 1.2MB
              • SHA256 c790dcda2615d77bfa903052e16dfdc478f9e9638a827dd30ec8a8635a95c034
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Uninstall.exe
              • Path C:\Program Files\7-Zip\Uninstall.exe
              • Size 1.1MB
              • SHA256 275b4bcf3ef0d85106512f30e56c494f75991ba8706e22a04a7e1f0d359a1237
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              AppVShNotify.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
              • Size 1.3MB
              • SHA256 bb18a0d71874be92f165fc6fc17fcaea529d8f8f17003f6346c3b3c6f3959d1a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              IntegratedOffice.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
              • Size 4.6MB
              • SHA256 dcd220388691809a176c0341bd2fc922e820e77525cbfb0a741218d53e53cb59
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              MavInject32.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
              • Size 1.4MB
              • SHA256 9c6f1a4ee245eb4d4342bf6e0bdbd3e5f2863963e760a8e7c2988ad0facba45a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              OfficeC2RClient.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
              • Size 24.0MB
              • SHA256 43eab6326c59f2947ba2241754d2669919dbf6751cc68e9e69b241b3c3a56091
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              appvcleaner.exe
              • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
              • Size 2.7MB
              • SHA256 ad7ad8ea7642dc00fc8c2f548ead1055c33ee3f1e110649bc5365ad05032020e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              LICLUA.EXE
              • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
              • Size 1.1MB
              • SHA256 f55c0a3da4890ac1775ecadd6043e2513ea6463fcd359fe297e093021a284b05
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              OSE.EXE
              • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
              • Size 1.3MB
              • SHA256 cdf83490e316ad1e4484ea18da4cb484c46d77d4e961829d4066a8cedc72d6be
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              VSTOInstaller.exe
              • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
              • Size 1.2MB
              • SHA256 70dbcdb745e1a32870f748d0ec508728265e7c2adba817717f8f63ea1e580e21
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              chrmstp.exe
              • Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe
              • Size 4.6MB
              • SHA256 3e24875a0a3b84e281b1864a5d247e30d7f3a9ca65987804fc9d9d45ce92bdd7
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              setup.exe
              • Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
              • Size 4.6MB
              • SHA256 a23cb5694426c076459d3a0372575cfc264ea51154cc038552cc48e735a6bd78
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              chrome_pwa_launcher.exe
              • Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe
              • Size 1.9MB
              • SHA256 3e73da710d23472a4c24e3bcc9a6802b899b8303aa0b59da4e2c724c99826d3e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              elevation_service.exe
              • Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
              • Size 2.1MB
              • SHA256 f1c3f09cfb018c26531ed49a053b887ad534a89beeb3f56e1c56edd9f09fb6f4
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              notification_helper.exe
              • Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe
              • Size 1.8MB
              • SHA256 3e4b35c2eee61d10ccabbad54623fa98f92200f28487f7b40ecb7729ab189364
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              chrome_proxy.exe
              • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
              • Size 1.6MB
              • SHA256 8a593bd709d4f054e4b0f2b7948e5cf0aa422e7be46c1bb5855c6e45c748bc17
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              appletviewer.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
              • Size 1.1MB
              • SHA256 abd269ac53b643363bdcf32c849f866046a0cf22c6a2e013c6ab2c94c7285979
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              extcheck.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
              • Size 1.1MB
              • SHA256 ad0102619665981d69f716d33c67595bf2b64ba9f5db5d3687a2a52328be84e9
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              idlj.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
              • Size 1.1MB
              • SHA256 78c9e5a9c8fb60c1af82f59ed9ed615d1d598822d762b7b0ac30f43d3df5647f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              jabswitch.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
              • Size 1.1MB
              • SHA256 b06603b41dcf4aef9fe29cfa3ab6d8d192f8060e65caa54938b28b84f9a3368d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              jar.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
              • Size 1.1MB
              • SHA256 c1a32fdab7115fb708f2e89efe5c408d9bb38f4fb7ee1c22eb04a3b941fab32b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              jarsigner.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
              • Size 1.1MB
              • SHA256 c6401df3420fe0e9106f401c17731bdccd52187920c49d996f70e650c283c4dc
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              java-rmi.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
              • Size 1.1MB
              • SHA256 3663c30fbaf025e08e84e341c9635131698e10756458fc4f276d2db497878fae
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              java.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
              • Size 1.3MB
              • SHA256 1499a3417942d40019c4c9701ad1e70970537d1fbc079285f62dc3e9e7d486bf
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javac.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
              • Size 1.1MB
              • SHA256 2377f723208d1ebd5c2da59d9edc3c240bee54e596edeb26625f252dc9fbc19f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javadoc.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
              • Size 1.1MB
              • SHA256 d18aef87809f70d1c03cfb59953baadd270ff34805864ae5eec5c608b8cf73f9
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javafxpackager.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
              • Size 1.2MB
              • SHA256 a897bcd54aecdd1851fc34ab7a4b99b1ed9e4165c1f14b6684f640e9b4629d7f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              javah.exe
              • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
              • Size 1.1MB
              • SHA256 f304a3595fd05ce3045cb3e506d8e13251eb81169599abb91fb8c54e3958b084
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              wmpnetwk.exe
              • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
              • Size 1.5MB
              • SHA256 a981548808fdada738f110ae8c61b73b9d66643aede3b3a6ad3233a87cf66b27
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              dotnet.exe
              • Path C:\Program Files\dotnet\dotnet.exe
              • Size 1.2MB
              • SHA256 551e0ccd6b845eec62d66633ed280c3ba5a19d0c6699816a125a8de1aed64a5b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              gzvsmeyfjdzyxnx
              • Path C:\Users\Admin\AppData\Local\Temp\gzvsmeyfjdzyxnx
              • Size 4KB
              • SHA256 36c49c94327c8cadcad4c0d2b3a8f5162fc7bb86624923484476c5f7b960bc4c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              name.exe
              • Path C:\Users\Admin\AppData\Local\directory\name.exe
              • Size 2.9MB
              • SHA256 4aa2ea3cc55b48f3f6e54c75d383592a6fd4fa449908adbc019c3fb676dd5285
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              perfhost.exe
              • Path C:\Windows\SysWOW64\perfhost.exe
              • Size 1.1MB
              • SHA256 3bcf9fe273ef31ea25449fb172bc924cbfc3dbf0a44f99ab663796cc3a6b0672
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              AgentService.exe
              • Path C:\Windows\System32\AgentService.exe
              • Size 1.7MB
              • SHA256 bdb52933ceb9bf1f7d0287c4d7af8fdc254b855de2f2e76e76b388a18a64a403
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              DiagnosticsHub.StandardCollector.Service.exe
              • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
              • Size 1.2MB
              • SHA256 35dc3c34add106a28690ce0c9dff06066eea5d775523bcf8222f566ab54146e4
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              FXSSVC.exe
              • Path C:\Windows\System32\FXSSVC.exe
              • Size 1.2MB
              • SHA256 880b52a40a0398c652df61678d7068623e91bde3f383d1b36100d88931e4d176
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Locator.exe
              • Path C:\Windows\System32\Locator.exe
              • Size 1.1MB
              • SHA256 00b189397f8d06725eaaefc4512016a1c0141571ed9486e91ffc3bb768760838
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              ssh-agent.exe
              • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
              • Size 1.4MB
              • SHA256 a27ecaf288bebb76ea0e5c77b023b1ee055402cae8db863f120e8d1e2a5aff71
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              PerceptionSimulationService.exe
              • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
              • Size 1.2MB
              • SHA256 8e01ff87c3afc5d4416aa3c11edfeb83b9b6448cba3ee1101e2e302efb8fd2f2
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              SearchIndexer.exe
              • Path C:\Windows\System32\SearchIndexer.exe
              • Size 1.4MB
              • SHA256 9af536ab443af8cc1933c963b61c81e91a2752bf73e647a63b02753e813987d8
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              SensorDataService.exe
              • Path C:\Windows\System32\SensorDataService.exe
              • Size 1.8MB
              • SHA256 0bead2310a9f4e1725350a1dec59872558edfb02e137098a36d2bd098728cb43
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Spectrum.exe
              • Path C:\Windows\System32\Spectrum.exe
              • Size 1.4MB
              • SHA256 7223df240f9b252307b665539c2bbddcf9e5d5e3a03f73bc9342904f6330656f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              TieringEngineService.exe
              • Path C:\Windows\System32\TieringEngineService.exe
              • Size 1.4MB
              • SHA256 793954b1abe2ba63736d7798e1ee01b2ec62449f51261b62e13266fe63fb019a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              VSSVC.exe
              • Path C:\Windows\System32\VSSVC.exe
              • Size 2.0MB
              • SHA256 ad4829257a9c16d7bc0dc963ea101af82ee675a884b7eba0a5b5d9d9145c337d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              alg.exe
              • Path C:\Windows\System32\alg.exe
              • Size 1.2MB
              • SHA256 c734114a0130ca2982b015c91d962c3f132337154c6fa31a7b57f8a0ed8949b8
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msdtc.exe
              • Path C:\Windows\System32\msdtc.exe
              • Size 1.2MB
              • SHA256 98cd92c19f7d64124868b24bf9cc639303e2cccba7b1e45d11505be7a6181e3a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              snmptrap.exe
              • Path C:\Windows\System32\snmptrap.exe
              • Size 1.1MB
              • SHA256 bd444655cfc8fa28fdb02ac839a8ff6d24029574d581c05a5686ea32251bc781
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              vds.exe
              • Path C:\Windows\System32\vds.exe
              • Size 1.3MB
              • SHA256 d560f8765c42b8a657355482666cd77012eaa766280c09fc2530e72bc4a3e1bf
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              WmiApSrv.exe
              • Path C:\Windows\System32\wbem\WmiApSrv.exe
              • Size 1.3MB
              • SHA256 f236278aeb21f9085e1dc50c257e8e9b3a11f05bb9189f7526602962e5cb033b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              wbengine.exe
              • Path C:\Windows\System32\wbengine.exe
              • Size 2.1MB
              • SHA256 af0b073e4fee217ce53a0c577be438f123ac87207396b21541bafce5a2def652
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              AppVClient.exe
              • Path C:\Windows\system32\AppVClient.exe
              • Size 1.3MB
              • SHA256 40bb4e85da514b99c3b73a2f34a38e256c8187b399c9ead459a693f3d0f4624e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              SgrmBroker.exe
              • Path C:\Windows\system32\SgrmBroker.exe
              • Size 1.4MB
              • SHA256 ddc78317e6c715c1a0782cc50e54fd1b6668ce6851538e5b20f46d8e3fa2b70c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              msiexec.exe
              • Path C:\Windows\system32\msiexec.exe
              • Size 1.1MB
              • SHA256 9b2eb38c1bbd2345e94a2dbdebbdd9d289879f1302c87522467b8be0378218ce
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              memory/876-132-0x0000000140000000-0x0000000140131000-memory.dmp
              Download

              memory/876-251-0x0000000140000000-0x0000000140131000-memory.dmp
              Download

              memory/1140-91-0x0000000000C00000-0x0000000000C60000-memory.dmp
              Download

              memory/1140-100-0x0000000000C00000-0x0000000000C60000-memory.dmp
              Download

              memory/1140-90-0x0000000140000000-0x0000000140155000-memory.dmp
              Download

              memory/1140-102-0x0000000140000000-0x0000000140155000-memory.dmp
              Download

              memory/1140-97-0x0000000000C00000-0x0000000000C60000-memory.dmp
              Download

              memory/1216-233-0x0000000140000000-0x00000001401C0000-memory.dmp
              Download

              memory/1216-236-0x0000000140000000-0x00000001401C0000-memory.dmp
              Download

              memory/1228-200-0x0000000140000000-0x0000000140188000-memory.dmp
              Download

              memory/1228-459-0x0000000140000000-0x0000000140188000-memory.dmp
              Download

              memory/1324-543-0x0000000140000000-0x0000000140147000-memory.dmp
              Download

              memory/1324-240-0x0000000140000000-0x0000000140147000-memory.dmp
              Download

              memory/1328-276-0x0000000140000000-0x000000014014C000-memory.dmp
              Download

              memory/1328-633-0x0000000140000000-0x000000014014C000-memory.dmp
              Download

              memory/1660-29-0x0000000140000000-0x0000000140130000-memory.dmp
              Download

              memory/1660-30-0x0000000000700000-0x0000000000760000-memory.dmp
              Download

              memory/1660-38-0x0000000000700000-0x0000000000760000-memory.dmp
              Download

              memory/1660-143-0x0000000140000000-0x0000000140130000-memory.dmp
              Download

              memory/2080-635-0x0000000140000000-0x0000000140179000-memory.dmp
              Download

              memory/2080-289-0x0000000140000000-0x0000000140179000-memory.dmp
              Download

              memory/2112-147-0x0000000140000000-0x000000014011B000-memory.dmp
              Download

              memory/2112-275-0x0000000140000000-0x000000014011B000-memory.dmp
              Download

              memory/2744-2-0x0000000004C10000-0x0000000005410000-memory.dmp
              Download

              memory/2752-260-0x0000000140000000-0x00000001401FC000-memory.dmp
              Download

              memory/2752-548-0x0000000140000000-0x00000001401FC000-memory.dmp
              Download

              memory/3292-65-0x0000000140000000-0x0000000140234000-memory.dmp
              Download

              memory/3292-186-0x0000000140000000-0x0000000140234000-memory.dmp
              Download

              memory/3292-74-0x00000000008F0000-0x0000000000950000-memory.dmp
              Download

              memory/3292-68-0x00000000008F0000-0x0000000000950000-memory.dmp
              Download

              memory/3868-12-0x0000000000400000-0x0000000000596000-memory.dmp
              Download

              memory/3868-13-0x0000000000400000-0x0000000000596000-memory.dmp
              Download

              memory/3868-14-0x0000000000400000-0x0000000000596000-memory.dmp
              Download

              memory/3868-15-0x0000000000400000-0x0000000000596000-memory.dmp
              Download

              memory/3868-16-0x0000000003240000-0x00000000032A7000-memory.dmp
              Download

              memory/3868-120-0x0000000000400000-0x0000000000596000-memory.dmp
              Download

              memory/3868-23-0x0000000003240000-0x00000000032A7000-memory.dmp
              Download

              memory/3868-24-0x0000000000400000-0x0000000000596000-memory.dmp
              Download

              memory/3868-26-0x0000000000400000-0x0000000000596000-memory.dmp
              Download

              memory/3976-54-0x0000000140000000-0x0000000140135000-memory.dmp
              Download

              memory/3976-55-0x0000000000530000-0x0000000000590000-memory.dmp
              Download

              memory/3976-61-0x0000000000530000-0x0000000000590000-memory.dmp
              Download

              memory/3976-76-0x0000000140000000-0x0000000140135000-memory.dmp
              Download

              memory/3976-66-0x0000000000530000-0x0000000000590000-memory.dmp
              Download

              memory/3980-213-0x0000000140000000-0x0000000140168000-memory.dmp
              Download

              memory/3980-480-0x0000000140000000-0x0000000140168000-memory.dmp
              Download

              memory/4036-239-0x0000000140000000-0x0000000140155000-memory.dmp
              Download

              memory/4036-121-0x0000000140000000-0x0000000140155000-memory.dmp
              Download

              memory/4384-264-0x0000000140000000-0x0000000140216000-memory.dmp
              Download

              memory/4384-632-0x0000000140000000-0x0000000140216000-memory.dmp
              Download

              memory/4536-420-0x0000000140000000-0x0000000140169000-memory.dmp
              Download

              memory/4536-187-0x0000000140000000-0x0000000140169000-memory.dmp
              Download

              memory/4656-44-0x00000000004C0000-0x0000000000520000-memory.dmp
              Download

              memory/4656-160-0x0000000140000000-0x000000014012F000-memory.dmp
              Download

              memory/4656-43-0x0000000140000000-0x000000014012F000-memory.dmp
              Download

              memory/4656-50-0x00000000004C0000-0x0000000000520000-memory.dmp
              Download

              memory/4728-224-0x0000000140000000-0x000000014013F000-memory.dmp
              Download

              memory/4728-105-0x0000000140000000-0x000000014013F000-memory.dmp
              Download

              memory/4744-370-0x0000000140000000-0x000000014011C000-memory.dmp
              Download

              memory/4744-175-0x0000000140000000-0x000000014011C000-memory.dmp
              Download

              memory/4908-199-0x0000000140000000-0x000000014022B000-memory.dmp
              Download

              memory/4908-85-0x00000000001A0000-0x0000000000200000-memory.dmp
              Download

              memory/4908-79-0x00000000001A0000-0x0000000000200000-memory.dmp
              Download

              memory/4908-87-0x0000000140000000-0x000000014022B000-memory.dmp
              Download

              memory/5008-10-0x00000000049A0000-0x00000000051A0000-memory.dmp
              Download

              memory/5032-288-0x0000000140000000-0x00000001401D7000-memory.dmp
              Download

              memory/5032-161-0x0000000140000000-0x00000001401D7000-memory.dmp
              Download

              memory/5032-631-0x0000000140000000-0x00000001401D7000-memory.dmp
              Download

              memory/5040-263-0x0000000000400000-0x000000000051D000-memory.dmp
              Download

              memory/5040-144-0x0000000000400000-0x000000000051D000-memory.dmp
              Download